Trojan.Win32.FlyStudio_1d1d67dd8f

by malwarelabrobot on May 19th, 2014 in Malware Descriptions.

Gen:Heur.PWSIME.2 (BitDefender), Trojan.Win32.Packer.Mew11SEv1.2 (ep) (VIPRE), Gen:Heur.PWSIME.2 (B) (Emsisoft), BackDoor-FAUP!1D1D67DD8F68 (McAfee), Gen:Heur.PWSIME.2 (FSecure), Win32:Trojan-gen (Avast), Cryp_MEW-11 (TrendMicro), Gen:Heur.PWSIME.2 (AdAware), GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, EmailWorm


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 1d1d67dd8f68080f2a3b8b604db2d385
SHA1: 705cbbee8b7fbf055468719d8a6646f1a33757ff
SHA256: 508b79662b07dbbc9b1f1f6de9bd53b2f256c539a2d3f67385bd8c17e18097dc
SSDeep: 12288:/vgPVR4adScIYImFdlzpICaJntI75fUfsc9:ng34vYhzp6Jn05fUft
Size: 496874 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MEW11SEv12, MEW11SEv11, UPolyXv05_v6, Mew11SEv12Eng
Company: no certificate found
Created at: 1970-01-01 03:00:00
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour Description
EmailWorm Worm can send e-mails.


Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

iexplore.exe:1668
%original file name%.exe:992

File activity

The process iexplore.exe:1668 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\wt_js[1].htm (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lock[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2[1].swf (13689 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\vshow_player_woxiu.14.04.24.a[1].swf (9283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\liver[2].js (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lpisearchd[1] (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\postmk_dc[1].png (819 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xiu_base_v.2[2].css (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_big_avatar[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\irs01.net\mt_adtracker.sxx (102 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\24h[1].png (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\girlfall_5[1].js (392 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@woxiu[1].txt (3597 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\www.56.com\flashApp\56_vshow_live.sxx (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\blank[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\rev_gift[2].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\livesearch2[1].jsp (132 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qunar[2].txt (376 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lmx2369295492_56.com_[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\z_MIN_14.64[2].js (6748 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\chat_v.7[1].js (3974 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[2].html (1162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sns_daytask_v.2[1].js (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\base_MIN_11.03[1].css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ps[1].swf (5439 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gift_v.1[1].css (797 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ico_arr_ad[1].png (247 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\broadcast_v.1[1].js (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\player_woxiu[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\holidayService[1].xml (7741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\vataplan[1].ifmRightFlightExt&ab=b&tile=14003829506057166236&city=北京 (880 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rev_icon[1].png (3856 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (145 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bg_tabsel[1].png (944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (146 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-1.5.2.min[2].js (2575 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\56Ubbface[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-1.4.4.min[2].js (1859 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\iwt-min[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\common_v.1[1].css (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qq-29210884_b_56.com_[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\timer_bg[1].gif (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\xiu_login_v.2[1].css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\shafa_v_1[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\vataplan[1].topicLinkL&ab=b&tile=14003829506057166236&city=北京 (951 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[5].html (1162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ico_arrsel[1].png (249 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lmx2369295492_b_56.com_[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\QN1CS1[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ph_flower[1].png (4087 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_activity[1].css (2338 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\peihua[1].png (11620 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b[2].html (1162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ico_la_v2_0508[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\3[1].swf (3527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cy[1].htm (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\2[1].swf (21178 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b[2].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\footer_v10[1].png (392 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (302 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bg_bd_rex[1].jpg (443 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\qq-29210884_56.com_[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\SC[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\game_v.5[2].js (271 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pv_stat[4].htm (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\20140509_zx_728x90_4485_banner[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cfmogu[1].htm (5461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_guide_v.8[1].css (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lothario_v.1[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\rev_uhd[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lowerPrice[1].jcp (714 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\rev_icon[1].png (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\8efd23b6f7157a5825ca1383a6f311ca[1].jpg (532 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\crossdomain[1].xml (476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\5b5c3b1db777d118dda54fde2ca0b435[1].jpg (3601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b[1].html (1162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\spacegif[1].gif (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\vataplan[1].topicLinkR&ab=b&tile=14003829506057166236&city=北京 (958 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\xiu_small_avatar[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sns_v.5[1].js (2073 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@irs01[1].txt (167 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico_la_ie6[1].png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\framId=flight_float_layer&chan=flight&pg=home&pos=top&site=qunar&type=floating_layer&tile=14003829506057166236&city=北京[1] (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vataplan[2].ifmRightTextlink&ab=b&tile=14003829506057166236&city=北京 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\mootools_MIN_1.4.5[2].js (1019 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\rev_uhd[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\iwt-min[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AClick[1].aspx (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sns_v.5[1].js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\seabed_treasure.11.07.29.a[1].swf (7169 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1003v1400080135920524999[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\framId=homeadSy&chan=flight&pg=home&pos=right_top&site=qunar&size=230x200&type=Tear_angle&tile=14003829506057166236&city=北京[1] (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cy[1].htm (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\btn_normal[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lpisearchd[2] (494 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.woxiu[1].xml (238 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (1075 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\no_userhead_s[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\game_v.5[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].php (1121 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (40384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1003v1389132341757446858[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Header0428[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\framId=ad_home_leftAD_bottom&chan=flight&pg=home&pos=mid&site=qunar&size=728x90&tile=14003829506057166236&city=北京[1] (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[4].html (1162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pv_stat[3].htm (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\3bbae0f3b3dc18c86886324a[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\public_v.1[1].js (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lock[2].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\livesearch2[1].jsp (132 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\e6u5-min[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\newhistory[1].html (1317 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b[4].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\wtcookie[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bg_car[1].jpg (3783 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\xiu_guide_v.8[1].css (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\56Ubbface[1].js (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\520_Entrance[1].png (4673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logo[1].png (1499 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\index[1].php (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1[2].swf (2581 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\3[1].swf (5831 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[3].html (1162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1ea2323ba908e33a81b5eae7269d6f0b[1].jpg (3401 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-1.5.2.min[1].js (3707 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\public_v.1[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\qn1cs1_disable[1].gif (97 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sns_daytask_v.2[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xiu_activity[1].css (3235 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b[1].html (1162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\framId=ad_home_rightAD_top2&chan=flight&pg=home&pos=top&site=qunar&size=230x90&tile=14003829506057166236&city=北京[1] (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\park[2].js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lowerPrice[1].jcp (1031 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b[5].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\js_flow_cookie[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\home-2014051615190002[2].css (1875 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ips[1].jcp (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_login_v.2[1].css (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\swfobject[1].js (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\airCoPromote[1].jsp (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xiu_v.12[1].css (4497 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\play_flv_v.8[1].js (5214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1003v1394650357861917005[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\hd[2].js (2025 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\main_play_v.7[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common_v.1[1].css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lock[2].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\shafa_v_1[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\counts[1] (384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lothario_v.1[1].js (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\proLiveInfo[1].php (5138 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swfobject[2].js (10 bytes)
%System%\d3d9caps.tmp (1324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b[1].html (1162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\201403181447095327ebeda78ee_1290[2].swf (1813 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\wtcookie[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@serving-sys[1].txt (214 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ico_la_v2_0508ie6[1].png (2 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (378 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\66Iba26Dsd1_IiKO6720[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vataplan[1].ifmRightTextlink&ab=b&tile=14003829506057166236&city=北京 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_v.12[1].css (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lmx2369295492_b_56.com_[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\rev_uhd[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ico_a[1].png (552 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (802 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\5711d2fac10ecb246886324a[1].png (12076 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@51[2].txt (124 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\arc[1].png (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\dy_rkxin1[1].png (4085 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_big_avatar[2].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\e0122f43fc759e56244ef1dbc5c2f955[1].jpg (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\e6u5-min[1].js (969 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\index[1].htm (2 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bg_bd[1].jpg (5016 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\js_flow_cookie[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\liver[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\proLiveInfo[1].htm (2883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\xiu_sns_v.1[1].css (952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2[1].swf (19737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jump[1].html (1427 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\newhistory[1].htm (1482 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-1.8.2_v4[1].js (3399 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@51[1].txt (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAQFMNIP.swf (4546 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\crossdomain[1].xml (120 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1003v1395300869395285901[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\hd[1].js (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\e0eaeaf8276dc5556886324a[1].gif (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\login_3[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logo_foot_v1[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\56get[1].txt (254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\spacegif[1].gif (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140430_728x90_4245_dfs_new[1].jpg (5208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pv_stat[1].htm (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\airCoPromote[1].jsp (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\201403181447095327ebeda78ee_1290[1].swf (1813 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\chat_v.7[1].js (2020 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\no_userhead_s[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\6cf4565a9b319e36561b4af95c4522df[1].gif (8457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\f1f51d8b645559506886324a[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dy_rkxin1[1].png (4130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\close[1].png (286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b[3].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\swfobject[2].js (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\LAB_0.1[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\header_v10[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\park[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\play_flv_v.8[1].js (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\signin_v.1[1].js (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@woxiu[2].txt (2926 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (205 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1003v1392141486221499555[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rev_sprite[1].png (3670 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\wtcookie[2].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lock[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\img_qnkhd[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rev_icon[2].png (3856 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (490 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\oneway_index_config-2014051615190002[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ps[1].swf (2067 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rev_sprite[2].png (2821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\shequ[1].htm (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\adServer[1].gif (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery-1.8.2_v4[1].js (2294 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\base_MIN_11.03[2].css (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\v627061383118550[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\broadcast_v.1[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\framId=ad_home_rightAD_top&chan=flight&pg=home&pos=top&site=qunar&size=230x200&tile=14003829506057166236&city=北京[1] (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\global[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b5adf698bf4292a509a926ce6c0e72ca[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1644498437263f636886324a[1].png (8409 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\promimg[1].htm (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\home_pack-2014051615190002[2].js (10565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lpisearchd[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\channel_20140504104628_44039[1].jpg (9508 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\framId=couplet_load&chan=flight&pg=home&pos=right&site=qunar&size=120x300&type=couplet&tile=14003829506057166236&city=北京[1] (59 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\oneway_index_config-2014051615190002[1].js (522 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ips[1].jcp (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h199941397100951[1].jpg (2667 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pv_stat[2].htm (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\home_pack-2014051615190002[1].js (10543 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\rev_marquee[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\98d9e829bcb252a26886324a[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xiu_base_v.2[1].css (1258 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\common[2].js (2181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\framId=ad_home_leftAD_middle&chan=flight&pg=home&pos=top&site=qunar&size=728x90&tile=14003829506057166236&city=北京[1] (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CABUI0JY.htm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\base_head_v24[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bg_sephuan[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\main_play_v.7[2].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1[1].swf (2297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f1f51d8b645559506886324a[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index[1].php (281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tb.bg[1].gif (268 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\z5n6_psmall[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pic1[1].gif (428 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\201403181447095327ebeda78ee_1290[1].swf (1821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAE34567.htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\vataplan[1].ifmRightFlightOwner&ab=b&tile=14003829506057166236&city=北京 (920 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\520_Entrance[1].png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\gift_v.1[1].css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lnt_bg1[1].png (865 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ph_flower[2].png (4087 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\z_MIN_14.64[1].js (5314 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pv_stat[3].htm (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pv_stat[1].htm (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\LAB_0.1[1].js (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\rev_gift[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[1].html (1162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\qq-zfwvflhdxq_b_56.com_[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\home-2014051615190002[1].css (1998 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[6].html (1162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\main[1].swf (5786 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (374 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\framId=flight_active_dynamic&chan=flight&pg=home&site=qunar&type=dynamic_skinned&tile=14003829506057166236&city=北京[1] (59 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\global[1].js (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\80928328[1].htm (2011 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\520_z5n6_bg[1].jpg (3782 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\mootools_MIN_1.4.5[1].js (2583 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (147 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jump[1].htm (537 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\www.woxiu[1].xml (238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\airing_sprite[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\signin_v.1[1].js (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-1.4.4.min[1].js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\Satyr_Game_icon[1].png (4437 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2013.11.261[1].gif (7842 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pv_stat[1].htm (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\80928328[1] (3054 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\3[1].swf (4517 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\postmk_wf[1].png (818 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\base_head_search[1].png (928 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (146 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\rev_h[1].png (3783 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1[1].swf (5439 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lpisearchd[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b[6].htm (2 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\a0f28380bff75d736886324a[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qunar[1].txt (670 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lock[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\wt_js[1].htm (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\gift.13.10.18.a[1].swf (3430 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\login_3[1].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\MTFlashStore[1].swf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_sns_v.1[1].css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ps[2].swf (1821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b[7].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\promimg[1] (621 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\allocateCookie[1].htm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ga.min[1].js (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\n5_ledbean[1].png (3 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#irs01.net\settings.sxx (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pv_stat[2].htm (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pv_stat[1].htm (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\u327191383286771[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\MTFlashStore[1].swf (1 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.56.com\settings.sxx (193 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bg[1].png (2822 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swfobject[1].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CZ[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\js_flow_cookie[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\girlfall_5[2].js (1998 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\vataplan[1].ifrCataAd&ab=b&tile=14003829506057166236&city=北京 (138 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b[2].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tyxbvk_b_56.com_[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\car_ivaca[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\57b557081c37a4c63ea3044817f3925a[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\timetrack[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\common[1].js (2897 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\wt_js[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\rev_uhd[1].png (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-1.5.2.min[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sns_v.5[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@51[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lpisearchd[1] (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1[1].swf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\iwt-min[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_big_avatar[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\dy_rkxin1[1].png (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\irs01.net\mt_adtracker.sxx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\girlfall_5[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@woxiu[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\e6u5-min[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\rev_gift[2].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cy[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\livesearch2[1].jsp (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qunar[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\520_Entrance[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\gift_v.1[1].css (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.woxiu[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\z_MIN_14.64[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\LAB_0.1[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jump[1].html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\base_MIN_11.03[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041720130418\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\game_v.5[1].js (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@51[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rev_icon[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lock[2].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\rev_gift[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\hd[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\home-2014051615190002[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\liver[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\56Ubbface[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\xiu_guide_v.8[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\login_3[1].js (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.56.com\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\index[1].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\mootools_MIN_1.4.5[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\xiu_login_v.2[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\adServer[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-1.4.4.min[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\airCoPromote[1].jsp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\chat_v.7[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\no_userhead_s[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AClick[1].aspx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ips[1].jcp (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sns_daytask_v.2[1].js (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#irs01.net\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\80928328[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_activity[1].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\3[1].swf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\park[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\play_flv_v.8[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\signin_v.1[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@woxiu[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qunar[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\swfobject[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lock[1].gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_big_avatar[2].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lock[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\MTFlashStore[1].swf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_sns_v.1[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rev_icon[2].png (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\main_play_v.7[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\promimg[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common_v.1[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ps[1].swf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lock[2].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\2[1].swf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lothario_v.1[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\shafa_v_1[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\rev_uhd[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lowerPrice[1].jcp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\rev_icon[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\global[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery-1.8.2_v4[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\proLiveInfo[1].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swfobject[2].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\broadcast_v.1[1].js (0 bytes)
%System%\d3d9caps.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swfobject[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041720130418 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\oneway_index_config-2014051615190002[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\public_v.1[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lock[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vataplan[1].ifmRightTextlink&ab=b&tile=14003829506057166236&city=北京 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_v.12[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\home_pack-2014051615190002[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lpisearchd[2] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xiu_base_v.2[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\common[1].js (0 bytes)

The process %original file name%.exe:992 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (167 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (321 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (205 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (165 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (205 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (492 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (321 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (11664 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (502 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].gif (43 bytes)
%System%\drivers\etc\hosts (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\AClick[2].aspx (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\AClick[1].aspx (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)

Registry activity

The process iexplore.exe:1668 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore]
"Type" = "1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051820140519]
"CacheRepair" = "0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore]
"Type" = "3"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_03"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "iexplore.exe"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6BF52A52-394A-11D3-B153-00C04F79FAA6}\iexplore]
"Count" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051820140519]
"CacheLimit" = "8192"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_27"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore]
"Type" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "iexplore.exe"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore]
"Count" = "10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051820140519]
"CachePrefix" = ":2014051820140519:"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_04"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_14"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU]
"NodeSlots" = "02 02 02 02 02 02 02 02 02 02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}]
"(Default)" = "Java Plug-in 1.3.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_18"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore]
"Time" = "DE 07 05 00 00 00 12 00 03 00 0F 00 0F 00 D0 01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2D360201-FFF5-11D1-8D03-00A0C959BC0A}\iexplore]
"Time" = "DE 07 05 00 00 00 12 00 03 00 0F 00 18 00 14 01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_17"

[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\JavaPlugin.160_18\CLSID]
"(Default)" = "{5852F5ED-8BF4-11D4-A245-0080C6F74284}"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_02"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore]
"Type" = "4"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore]
"Count" = "10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore]
"Count" = "7"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_02"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Window_Placement" = "2C 00 00 00 02 00 00 00 03 00 00 00 FF FF FF FF"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore]
"Type" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU]
"MRUListEx" = "01 00 00 00 00 00 00 00 03 00 00 00 02 00 00 00"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore]
"Count" = "11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051820140519]
"CacheOptions" = "11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_09"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore]
"Time" = "DE 07 05 00 00 00 12 00 03 00 0F 00 11 00 72 01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
"(Default)" = "Java Plug-in 1.6.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_27"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore]
"Count" = "15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\iexplore]
"Time" = "DE 07 05 00 00 00 12 00 03 00 0F 00 10 00 97 00"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore]
"Type" = "3"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6BF52A52-394A-11D3-B153-00C04F79FAA6}\iexplore]
"Type" = "1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_26"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_18"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1208111653"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_20"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014051820140519]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014051820140519\"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.0_03"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore]
"Count" = "11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_21"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_06"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_30"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.0_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2D360201-FFF5-11D1-8D03-00A0C959BC0A}\iexplore]
"Count" = "1"

[HKCU\Software\Microsoft\Internet Explorer\Toolbar]
"Locked" = "1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_10"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_08"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore]
"Time" = "DE 07 05 00 00 00 12 00 03 00 0F 00 0F 00 EF 01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_18"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_23"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_16"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.6.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_29"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.0_04"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2D360201-FFF5-11D1-8D03-00A0C959BC0A}\iexplore]
"Type" = "1"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore]
"Time" = "DE 07 05 00 00 00 12 00 03 00 0F 00 11 00 72 01"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D4 30 DB 0F 5B C9 8F D0 0E 3A 73 44 84 29 2B 98"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_20"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6BF52A52-394A-11D3-B153-00C04F79FAA6}\iexplore]
"Time" = "DE 07 05 00 00 00 12 00 03 00 0F 00 16 00 D4 03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_05"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.6.0_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_09"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_13"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_17"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_11"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_07"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_19"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_25"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links]
"Order" = "08 00 00 00 02 00 00 00 00 02 00 00 01 00 00 00"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.1_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_22"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.6.0_01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_27"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_03"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.5.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.3.1_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.1_02"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_24"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}]
"(Default)" = "Java Plug-in 1.5.0_14"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.3.1_08"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore]
"Time" = "DE 07 05 00 00 00 12 00 03 00 0F 00 20 00 D0 01"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_28"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}]
"(Default)" = "Java Plug-in 1.4.2_12"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}\InprocServer32]
"(Default)" = "%Program Files%\Java\jre6\bin\jp2iexp.dll"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_15"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.5.0_06"

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}]
"(Default)" = "Java Plug-in 1.4.2_09"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\JavaPlugin.160_18\CLSID]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013041720130418]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0028-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\JavaPlugin.160_18]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0023-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0024-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0028-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0019-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0029-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0030-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0020-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0019-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0025-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0024-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0022-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0022-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}\InprocServer32]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBA}]
[HKCU\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:992 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 66 21 D5 8A 02 34 71 CD 57 8D 4E 90 CD 83 07"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\MediaPlayer\Health\{067A4173-A5C5-45CC-9AB0-3891A476143D}]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 1248 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1 www.cfyuanji.com
127.0.0.1 www.cfyuanji.net
127.0.0.1 www.cfyuanji.cc
127.0.0.1 cfyuanji.com
127.0.0.1 cfyuanji.net
127.0.0.1 cfyuanji.cc
127.0.0.1 www.cfyalan.com
127.0.0.1 www.cfyalan.net
127.0.0.1 www.cfyalan.cc
127.0.0.1 yy.cfyalan.com
127.0.0.1 cc.cfyalan.com
127.0.0.1 cfyalan.com
127.0.0.1 cfyalan.net
127.0.0.1 cfyalan.cc
127.0.0.1 www.cftianyue.com
127.0.0.1 www.cftianyue.net
127.0.0.1 www.cftianyue.cc
127.0.0.1 cftianyue.com
127.0.0.1 cftianyue.net


Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
MEW 4096 1908736 0 0 d41d8cd98f00b204e9800998ecf8427e
 1912832 557056 496362 5.32295 b9b287d93b2fdf277914f51a86876997

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://183.60.205.125/0.htm
hxxp://115.236.16.240/AShow.aspx?AID=9842
hxxp://115.236.16.240/AShow.aspx?AID=9756
hxxp://183.60.205.125/Ä¢¹½Í¼Æ¬.gif
hxxp://z.myzwqwe12.com/AP5Min.aspx?AID=9842&Auth=1D705CD055EE5F1D53F74430175EDBD7FD71063F5A61C4C46F8D7B152648211E&referer=http://www.cfmogu.com/&utz=1400382921808 115.236.16.240
hxxp://z.myzwqwe12.com/AP5Min.aspx?AID=9842&Auth=1D705CD055EE5F1D53F74430175EDBD796364E506195CA19674CEFD23C1AB6A9&referer=http://www.cfmogu.com/&utz=1400382923323 115.236.16.240
hxxp://c.split.cnzz.com/stat.php?id=4693566&show=pic1
hxxp://z.myzwqwe12.com/pic/close.png 115.236.16.240
hxxp://z.myzwqwe12.com/pic/spacegif.gif 115.236.16.240
hxxp://z.myzwqwe12.com/AClick.aspx?AID=1805&WebID=14516&DomainID=7292&APID=9756&Auth=090A76F47330861927C2B8CF643C84CCC3139F861463EF3F6D6AD6A145C310A3&Url=&referer=http://www.cfmogu.com/ 115.236.16.240
hxxp://z.myzwqwe12.com/showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.com/CPVClick.aspx?AID=1805&PID=9756&Auth=6848383803FF6A6092490BA77624631CA1FA35D6FD9AE72FFF46957CF4C745CF&Url=http%3a%2f%2fv.6.cn%2fevent%2fpromimg%2f%3fsrc%3dpming393 115.236.16.240
hxxp://z.myzwqwe12.com/pic/logo.png 115.236.16.240
hxxp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516 61.130.108.34
hxxp://c.split.cnzz.com/core.php?web_id=4693566&show=pic1&t=z
hxxp://z10.cnzz.com/stat.htm?id=4693566&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=442332282-1400400449-&showp=1024x768&st=0&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=112104309
hxxp://z.myzwqwe12.com/AP5Min.aspx?AID=9842&Auth=1D705CD055EE5F1D53F74430175EDBD796364E506195CA19674CEFD23C1AB6A9&referer=http://www.cfmogu.com/&utz=1400382924245 115.236.16.240
hxxp://115.236.19.58/xm/2013.11.261.gif
hxxp://pic.51img1.com/v3/op/gamenew.51.com/platform/act/51wt/apic_img/swfobject.js?file_v=20140103001
hxxp://icon.cnzz.com/img/pic1.gif 42.156.162.7
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=633829471
hxxp://tg.51.com/market/game/shequ.htm?f_com=tgx2_14516 61.130.108.34
hxxp://tg.51.com/stat/pv_stat/?p_k=tst_4lr4_tgly_14516&r=0.022782987083270034 61.130.108.34
hxxp://pcookie.split.cnzz.com/app.gif?&cna=RVj/Cy0IRhYCAbhrJiY9QmtQ
hxxp://tg.51.com/stat/pv_stat/?p_k=tst_4lr4_tgly_14516&r=0.3391658119186485 61.130.108.34
hxxp://tg.51.com/stat/pv_stat/?p_k=tst_4m1e_tgx2_14516&r=0.6150320029604179 61.130.108.34
hxxp://static.verycdn.net/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=6256
hxxp://static.verycdn.net/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=4714
hxxp://static.verycdn.net/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=8506
hxxp://game.51.com/act/51wt/html/wtcookie/?r=0.40957646330132047 61.130.108.8
hxxp://game.51.com/act/51wt/html/wtcookie/?r=0.6403837481151036 61.130.108.8
hxxp://game.51.com/act/51wt/html/wtcookie/?r=0.015887030635915677 61.130.108.8
hxxp://7.ecoma.glb0.lxdns.com/jump.html?p=20111931&from=offsite&wp=1&sid=214516
hxxp://z.myzwqwe12.com/AP5Min.aspx?AID=9842&Auth=1D705CD055EE5F1D53F74430175EDBD754D01E8ABD08F3113992BEAC7A0623EE&referer=http://www.cfmogu.com/&utz=1400382924370 115.236.16.240
hxxp://z.myzwqwe12.com/AShow.aspx?AID=9756 115.236.16.240
hxxp://7.ecoma.glb0.lxdns.com/p/20111931?from=offsite&sid=214516&wp=1&cps=&r=80928328
hxxp://static.verycdn.net/img5/flashlayer/533138d44ad23/1.swf?v=3
hxxp://static.verycdn.net/img5/flashlayer/533138d44ad23/3.swf?v=3
hxxp://flight.qunar.com/?ex_track=auto_52283dc6 59.151.61.62
hxxp://7.ecoma.glb0.lxdns.com/80928328?p=20111931
hxxp://z10.cnzz.com/stat.htm?id=4693566&r=&lg=en-us&ntime=1400400449&repeatip=1&rtime=0&cnzz_eid=442332282-1400400449-&showp=1024x768&st=-17511&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=1192642880
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=1510830556
hxxp://static.verycdn.net/img5/flashlayer/533138d44ad23/2.swf?v=3
hxxp://z10.cnzz.com/stat.htm?id=4693566&r=&lg=en-us&ntime=1400400449&repeatip=2&rtime=0&cnzz_eid=442332282-1400400449-&showp=1024x768&st=-17510&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=698202374
hxxp://pcookie.split.cnzz.com/9.gif?abc=1&rnd=417627783
hxxp://qunarzz.com/flight/prd/styles/home-2014051615190002.css 59.151.16.174
hxxp://t.qunar.com/count/headerImage 211.151.112.24
hxxp://tg.51.com/tools/js_flow_cookie/?channel_alias=tgly_14516&r=0.29170465536844125 61.130.108.34
hxxp://tg.51.com/tools/wt_js/?channel_alias=tgly_14516&js_type=js_1&callback=wt_js_callback 61.130.108.34
hxxp://static.verycdn.net/img5/flashlayer/533138d44ad23/ps.swf?v=3
hxxp://tg.51.com/tools/js_flow_cookie/?channel_alias=tgly_14516&r=0.8860948699304393 61.130.108.34
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/zhuanti/huodong/Header0428.png
hxxp://simg4.qunarzz.ccgslb.com.cn/common/hf/header_v10.png
hxxp://tg.51.com/tools/wt_js/?channel_alias=tgx2_14516&js_type=js_1&callback=wt_js_callback 61.130.108.34
hxxp://tg.51.com/tools/js_flow_cookie/?channel_alias=tgx2_14516&r=0.2397324301325517 61.130.108.34
hxxp://z.myzwqwe12.com/AP5Min.aspx?AID=9842&Auth=1D705CD055EE5F1D53F74430175EDBD754D01E8ABD08F3113992BEAC7A0623EE&referer=http://www.cfmogu.com/&utz=1400382933261 115.236.16.240
hxxp://t.qunar.com/count/counts?t=1400382941105 211.151.112.24
hxxp://eoa.intra.baike.com/site/tupian/channel/adjz 119.254.117.172
hxxp://simg4.qunarzz.ccgslb.com.cn/common/hf/footer_v10.png
hxxp://1st.xdwscache.glb0.lxdns.com/script/static/xiu/v5/main_play_v.7.js?20140515
hxxp://tg.51.com/stat/pv_stat/?p_k=swf2_4lr4_tgly_14516&r=0.6105091539305322 61.130.108.34
hxxp://flight.qunar.com/twell/cookie/allocateCookie.jsp 59.151.61.62
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/flight/home/bg_bd_rex.jpg
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/flight/home/bg_bd.jpg
hxxp://tg.51.com/stat/pv_stat/?p_k=swf1_4lr4_tgly_14516&r=0.0802050050287133 61.130.108.34
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/lib/jquery/jquery-1.4.4.min.js
hxxp://myconf6room.dtwscache.glb0.lxdns.com/event/promimg/?src=pming393
hxxp://static.verycdn.net/img5/flashlayer/5360b616f2691/1.swf?v=3
hxxp://static.verycdn.net/img5/flashlayer/5360b616f2691/2.swf?v=3
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/game_v.5.js?20131104v2
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/flight/home/bg_tabsel.png
hxxp://tg.51.com/stat/pv_stat/?p_k=swf2_4lr4_tgly_14516&r=0.7722198539588714 61.130.108.34
hxxp://tg.51.com/stat/pv_stat/?p_k=swf1_4lr4_tgly_14516&r=0.14578722218447038 61.130.108.34
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/common.js?20140417
hxxp://static.verycdn.net/img5/flashlayer/5360b616f2691/3.swf?v=3
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/2011/QN1CS1.gif
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/sns_v.5.js?20131231
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/flight/flight_search/qn1cs1_disable.gif
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/sns_daytask_v.2.js?20131231
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/flight/flight_search/bg_sephuan.png
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/flight/home/ico_la_ie6.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/xiu_base_v.2.css?2012v5
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/sub/xiu_guide_v.8.css?v20140224
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/global.js?2013v6
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/base/v1/css/gift_v.1.css?20130918v1
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/public_v.1.js?20140212v1
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/sub/xiu_login_v.2.css?20131212
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/flight/home/ico_la_v2_0508ie6.png
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/flight/home/ico_la_v2_0508.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/sub/xiu_sns_v.1.css?20140415
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/base/v1/css/common_v.1.css
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/topic/xiu_activity.css?v20140429
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/css/xiu_v.12.css?20140312
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/swfobject.js
hxxp://static.verycdn.net/img5/flashlayer/5360b616f2691/ps.swf?v=3
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/play_flv_v.8.js?20140421
hxxp://myconf6room.dtwscache.glb0.lxdns.com/js/LAB_0.1.js
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/flight/flight_v1/ico_arrsel.png
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/flight/flight_search/btn_normal.png
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/chat_v.7.js?20140419
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/lothario_v.1.js?20140425
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/shafa_v_1.js?v=201311v1
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/flight/flight_search/ico_a.png
hxxp://simg4.qunarzz.ccgslb.com.cn/common/hf/arc.png
hxxp://simg4.qunarzz.ccgslb.com.cn/common/hf/24h.png
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/broadcast_v.1.js?20131107v1
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/56Ubbface.js?v=20140117
hxxp://tg.51.com/stat/pv_stat/?p_k=swf1_4m1e_tgx2_14516&r=0.0333559750407566 61.130.108.34
hxxp://tg.51.com/stat/pv_stat/?p_k=swf2_4m1e_tgx2_14516&r=0.18469849162227225 61.130.108.34
hxxp://myconf6room.dtwscache.glb0.lxdns.com/css/base_MIN_11.03.css
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/flight/flight_v1/postmk_wf.png
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/hd.js?v20140515
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/liver.js?2012v1
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/flight/flight_v1/postmk_dc.png
hxxp://myconf6room.dtwscache.glb0.lxdns.com/csjs/_/girlfall_5.js
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/park.js?201311v1
hxxp://1st.xdwscache.glb0.lxdns.com/script/page/xiu/v3/signin_v.1.js?2014v6
hxxp://qunarzz.com/js/jquery/build/jquery-1.5.2.min.js 59.151.16.174
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/03/13/02/1003v1394650357861917005.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/02/12/01/1003v1392141486221499555.jpg
hxxp://myconf6room.dtwscache.glb0.lxdns.com/js/jquery-1.8.2_v4.js
hxxp://cc00013.h.cncssr.chinacache.net/imges/live/CSSIMG/base_head_search.png
hxxp://cc00013.h.cncssr.chinacache.net/imges/live2013/logo.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/01/08/1003v1389132341757446858.jpg
hxxp://cc00013.h.cncssr.chinacache.net/3a/fb/u327191383286771.png
hxxp://cc00013.h.cncssr.chinacache.net/imges/live2013/base_head_v24.png
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/03/20/15/1003v1395300869395285901.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/2014/05/14/23/1003v1400080135920524999.jpg
hxxp://myconf6room.dtwscache.glb0.lxdns.com/js/s/iwt-min.js
hxxp://cc00013.h.cncssr.chinacache.net/imges/live/IMGSRC/logo_foot_v1.png
hxxp://myconf6room.dtwscache.glb0.lxdns.com/js/s/e6u5-min.js?101016
hxxp://cc00013.h.cncssr.chinacache.net/f2/9a/v627061383118550.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/activity/newie/n5_ledbean.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_h.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/rev_marquee.png
hxxp://myconf6room.dtwscache.glb0.lxdns.com/js/z_MIN_14.64.js
hxxp://myconf6room.dtwscache.glb0.lxdns.com/event/promimg/proLiveInfo.php
hxxp://myconf6room.dtwscache.glb0.lxdns.com/js/mootools_MIN_1.4.5.js
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/lnt_bg1.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/topic/Satyr_Game/Satyr_Game_icon.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/pic/xiu_small_avatar.jpg?t=2014051816
hxxp://irs01.net/MTFlashStore.swf 180.169.18.136
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg.png?v=0531
hxxp://myconf6room.dtwscache.glb0.lxdns.com/js/s/login_3.js
hxxp://qunarzz.com/flight/prd/scripts/oneway_index_config-2014051615190002.js 59.151.16.174
hxxp://1st.xdwscache.glb0.lxdns.com/photo/45/58/lmx2369295492_56.com_.jpg?770?t=2014051816
hxxp://1st.xdwscache.glb0.lxdns.com/photo/45/58/lmx2369295492_b_56.com_.jpg?051816
hxxp://cc00013.h.cncssr.chinacache.net/live/91/28/57b557081c37a4c63ea3044817f3925a.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/bg_car.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/99/22/e0122f43fc759e56244ef1dbc5c2f955.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/photo/33/55/qq-29210884_56.com_.jpg?338?t=2014051816
hxxp://1st.xdwscache.glb0.lxdns.com/photo/53/65/xq-sqirysbgcb_56.com_.jpg?333?t=2014051816
hxxp://qunarzz.com/flight/prd/scripts/home_pack-2014051615190002.js 59.151.16.174
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/sub/ph_flower.png?v=0910
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/sub/ph_flower.png
hxxp://08913.xdwscache.glb0.lxdns.com/flashApp/vshow_player_woxiu.14.04.24.a.swf
hxxp://08913.xdwscache.glb0.lxdns.com/flashApp/vshow/seabed_treasure.11.07.29.a.swf
hxxp://enop007.tlgslb.com/live.6.cn/e6u2/r.php?location=v.6.cn/event/promimg/?src=pming393&referer=&browser=mozilla/4.0 (compatible; msie 6.0; windows nt 5.1; sv1; .net clr 2.0.50727; .net clr 3.0.04506.648; .net clr 3.5.21022; .net4.0c)&flash=10.0&msr=1024,768&uid=0&pro=4&stamp=1400382946245
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/car_ivaca.png
hxxp://1st.xdwscache.glb0.lxdns.com/photo/13/46/p1521136036_56.com_.jpg?508?t=2014051816
hxxp://xnop012.tlgslb.com/huodong/29/27/channel_20140504104628_44039.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/admin/images/no_userhead_s.jpg
hxxp://cc00013.h.cncssr.chinacache.net/b7/aa/h199941397100951.jpg
hxxp://myconf6room.dtwscache.glb0.lxdns.com/api/liveInfoCk.php
hxxp://cc00013.h.cncssr.chinacache.net/live/39/11/b5adf698bf4292a509a926ce6c0e72ca.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/98/70/8efd23b6f7157a5825ca1383a6f311ca.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/61/34/1ea2323ba908e33a81b5eae7269d6f0b.jpg
hxxp://cc00013.h.cncssr.chinacache.net/live/55/07/6cf4565a9b319e36561b4af95c4522df.gif
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/col/peihua.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/player_woxiu.png
hxxp://08913.xdwscache.glb0.lxdns.com/flashApp/vshow/gift_shape/gift.13.10.18.a.swf
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_sprite.png?v=0930
hxxp://xnop042.tlgslb.com/crossdomain.xml
hxxp://irs01.net/irt?_iwt_UA=UA-6cn-000001&p=value1,value2&jsonp=_VUFOG 180.169.18.136
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_icon.png
hxxp://7.ecoma.glb0.lxdns.com/index.php?action=Game/Lothario&do=Init&room_user_id=lmx2369295492&t=0.16804625496624326
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/special/v1/img/topic/520days_2014/520_Entrance.png
hxxp://7.ecoma.glb0.lxdns.com/index.php?action=HdActive&do=getGoddessRank&user_id=lmx2369295492&t=0.22199426773624437
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_gift.png
hxxp://cc00013.h.cncssr.chinacache.net/live/52/51/5b5c3b1db777d118dda54fde2ca0b435.jpg
hxxp://history.qunar.com/history/newhistory.html 59.151.16.185
hxxp://history.qunar.com/lowerPrice.jcp?&callback=DomesticLowPriceHome.showLowPrice 59.151.16.185
hxxp://xiu.stat.corp.v-56.com/jump1stat?roomid=lmx2369295492&pid=20111931&sid=214516&uuid=38295037017807 180.153.21.31
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/flight/home/img_qnkhd.png
hxxp://history.qunar.com/ips.jcp?callback=QNR.ips.callback&_=1400382951167 59.151.16.185
hxxp://xnop042.tlgslb.com/56get
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/topic/Satyr_Game/timer_bg.gif
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/520_z5n6_bg.jpg
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/new_main/tb.bg.gif
hxxp://1st.xdwscache.glb0.lxdns.com/photo/53/65/xq-sqirysbgcb_b_56.com_.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/photo/33/55/qq-29210884_b_56.com_.jpg?25
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/pic/z5n6_psmall.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_sprite.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/rev_uhd.png
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/pic/xiu_big_avatar.jpg
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/bg/dy_rkxin1.png
hxxp://1st.xdwscache.glb0.lxdns.com/photo/70/19/qq-zfwvflhdxq_b_56.com_.jpg?60
hxxp://history.qunar.com/js/ga.min.js 59.151.16.185
hxxp://1st.xdwscache.glb0.lxdns.com/photo/36/37/aa429133656_b_56.com_.jpg
hxxp://history.qunar.com/lpisearchd?callback=jQuery152011194646905334254_1400382946808&from=&to=Hot&month=All&cachefrom=&cacheto=&type=ow&source=fhome&_=1400382952605 59.151.16.185
hxxp://history.qunar.com/lpisearchd?callback=jQuery152011194646905334254_1400382946809&from=&to=Hot&month=All&cachefrom=&cacheto=&type=rt&source=fhome&_=1400382952620 59.151.16.185
hxxp://1st.xdwscache.glb0.lxdns.com/photo/62/4/tyxbvk_b_56.com_.jpg?200
hxxp://1st.xdwscache.glb0.lxdns.com/photo/45/58/lmx2369295492_b_56.com_.jpg?19
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/rev/airing_sprite.gif
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=flight_float_layer 59.151.61.62
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/v1/img/activity/blank.gif
hxxp://flight.qunar.com/site/timetrack.htm?action=FH|domload|7.812&t=1400418465812 59.151.61.62
hxxp://history.qunar.com/airCoPromote.jsp?airCoList=CA,SC,CZ&num=5&callback=AirLineDeals._parseData 59.151.16.185
hxxp://1st.xdwscache.glb0.lxdns.com/style/xiu/base/v1/img/gift/game_icon/lock.gif
hxxp://history.qunar.com/f?utmwv=0.1&t=0.8484638481182711&utmsr=1024*740&utmr=-1&utmp=http://flight.qunar.com/?ex_track=auto_52283dc6&utmhn=flight.qunar.com&s=249 59.151.16.185
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=homeadSy 59.151.61.62
hxxp://a.qunar.com/vataplan?framId=topicLinkR&f=s&cur_page_num=0&rep=1&tag=99&vataposition=QNR_Zjc=_CN&vatacon=&rows=1&qtype=js&vataframe=bannerDefault&callback=QNR._AD.topicLinkR&ab=b&tile=14003829506057166236&city=北京 211.151.112.112
hxxp://a.qunar.com/vataplan?framId=topicLinkL&f=s&cur_page_num=0&rep=1&tag=99&vataposition=QNR_ZTc=_CN&vatacon=&rows=1&qtype=js&vataframe=bannerDefault&callback=QNR._AD.topicLinkL&ab=b&tile=14003829506057166236&city=北京 211.151.112.112
hxxp://flight.qunar.com/site/main.swf?20090107 59.151.61.62
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=flight_active_dynamic 59.151.61.62
hxxp://flight.qunar.com/site/timetrack.htm?action=FH|load|8.25&t=1400418466250 59.151.61.62
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/airlines/SC.gif
hxxp://a.qunar.com/vataplan?framId=ifrCataAd&f=s&cur_page_num=0&rep=1&tag=99&vataposition=QNR_YTU=_CN&vatacon=&rows=1&qtype=js&vataframe=bannerDefault&callback=QNR._AD.ifrCataAd&ab=b&tile=14003829506057166236&city=北京 211.151.112.112
hxxp://a.qunar.com/vataplan?framId=ifmRightTextlink&vataposition=QNR_OA==_CN&tag=99&rows=14&cur_page_num=0&rep=1&f=s&callback=QNR._AD.ifmRightTextlink&ab=b&tile=14003829506057166236&city=北京 211.151.112.112
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/airlines/CZ.gif
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/airlines/CA.gif
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=couplet_load 59.151.61.62
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_leftAD_middle 59.151.61.62
hxxp://a.qunar.com/js.ng/framId=flight_float_layer&chan=flight&pg=home&pos=top&site=qunar&type=floating_layer&tile=14003829506057166236&city=北京 211.151.112.112
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/flight/home/ico_arr_ad.png
hxxp://a.qunar.com/vataplan?framId=ifmRightFlightOwner&vataposition=QNR_ZTU=_CN&tag=99&rows=1&cur_page_num=0&rep=1&f=s&callback=QNR._AD.ifmRightFlightOwner&ab=b&tile=14003829506057166236&city=北京 211.151.112.112
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_leftAD_bottom 59.151.61.62
hxxp://a.qunar.com/vataplan?framId=ifmRightFlightExt&vataposition=QNR_NmE=_CN&tag=99&rows=1&cur_page_num=0&rep=1&f=s&callback=QNR._AD.ifmRightFlightExt&ab=b&tile=14003829506057166236&city=北京 211.151.112.112
hxxp://a.qunar.com/js.ng/framId=flight_active_dynamic&chan=flight&pg=home&site=qunar&type=dynamic_skinned&tile=14003829506057166236&city=北京 211.151.112.112
hxxp://a.qunar.com/js.ng/framId=homeadSy&chan=flight&pg=home&pos=right_top&site=qunar&size=230x200&type=Tear_angle&tile=14003829506057166236&city=北京 211.151.112.112
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top 59.151.61.62
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top2 59.151.61.62
hxxp://simg4.qunarzz.ccgslb.com.cn/imgs/201103/29/66Iba26Dsd1_IiKO6720.jpg
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=topicLinkR 59.151.61.62
hxxp://a.qunar.com/js.ng/framId=couplet_load&chan=flight&pg=home&pos=right&site=qunar&size=120x300&type=couplet&tile=14003829506057166236&city=北京 211.151.112.112
hxxp://a.qunar.com/js.ng/framId=ad_home_leftAD_middle&chan=flight&pg=home&pos=top&site=qunar&size=728x90&tile=14003829506057166236&city=北京 211.151.112.112
hxxp://flight.qunar.com/vataframe/b.html?_=20120830&rnd=topicLinkL 59.151.61.62
hxxp://flight.qunar.com/suggest/livesearch2.jsp?lang=zh&q=北京&sa=true&callback=top.XQS_1400382952605 59.151.61.62
hxxp://a.qunar.com/js.ng/framId=ad_home_leftAD_bottom&chan=flight&pg=home&pos=mid&site=qunar&size=728x90&tile=14003829506057166236&city=北京 211.151.112.112
hxxp://a.qunar.com/js.ng/framId=ad_home_rightAD_top&chan=flight&pg=home&pos=top&site=qunar&size=230x200&tile=14003829506057166236&city=北京 211.151.112.112
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/wns/20140430_728x90_4245_dfs_new.jpg
hxxp://a.qunar.com/js.ng/framId=ad_home_rightAD_top2&chan=flight&pg=home&pos=top&site=qunar&size=230x90&tile=14003829506057166236&city=北京 211.151.112.112
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/wns/20140415_flighthp_tbut_230x200_4211.swf?clickTag=http://qde.qunar.com/event.ng/Type=click%26FlightID=108395%26AdID=206888%26TargetID=6878%26Segments=13,28,50,132,148,373,530,534,535,536,539,540,541,542,543,544,545,546,548,549,550,551,552,553,554,555,556,558,559,560,561,562,564,565,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,586,587,610,611,1101,1102,1143,1183,1831,4054,4648,4649,4676%26Targets=5302,29,208,1504,5800,6878,6419%26Values=34,46,51,63,77,80,101,110,150,204,217,228,243,250,252,269,301,305,320,5402%26RawValues=%26Redirect=http://bsch.serving-sys.com/BurstingPipe/adServer.bs?cn=tf&c=20&mc=click&pli=9635822&PluID=0&ord=[timestamp]
hxxp://xnop012.tlgslb.com/qs/201311/14/a0f28380bff75d736886324a.jpg
hxxp://xnop012.tlgslb.com/qs/201311/14/98d9e829bcb252a26886324a.jpg
hxxp://simg4.qunarzz.ccgslb.com.cn/site/images/wns/20140509_zx_728x90_4485_banner.gif
hxxp://history.qunar.com/crossdomain.xml 59.151.16.185
hxxp://xnop012.tlgslb.com/qs/201405/13/3bbae0f3b3dc18c86886324a.jpg
hxxp://xnop012.tlgslb.com/qs/201212/25/e0eaeaf8276dc5556886324a.gif
hxxp://history.qunar.com/holidayService.jcp?count=2 59.151.16.185
hxxp://xnop012.tlgslb.com/qs/201404/25/5711d2fac10ecb246886324a.png
hxxp://xnop012.tlgslb.com/qs/201404/30/1644498437263f636886324a.png
hxxp://bs.eb-ch.akadns.net/BurstingPipe/adServer.bs?cn=tf&c=19&mc=imp&pli=9635822&PluID=0&ord=3954135100&rtu=-1
hxxp://xnop012.tlgslb.com/qs/201404/25/f1f51d8b645559506886324a.png
hxxp://xnop012.tlgslb.com/qs/201405/08/f1f51d8b645559506886324a.png
hxxp://xiu.stat.corp.v-56.com/play_conn?room_user_id=lmx2369295492&user_id=&ts=6065&try=1&cdn=dl 180.153.21.31
hxxp://xiu.stat.corp.v-56.com/play_buf?room_user_id=lmx2369295492&user_id=&try=1&cdn=dl 180.153.21.31
hxxp://s1.56img.com/script/page/xiu/v3/broadcast_v.1.js?20131107v1 113.107.56.96
hxxp://s2.56img.com/script/page/xiu/v3/56Ubbface.js?v=20140117 113.107.56.96
hxxp://s2.56img.com/script/page/xiu/v3/signin_v.1.js?2014v6 113.107.56.96
hxxp://source.qunar.com/site/images/flight/flight_search/ico_a.png 119.254.26.36
hxxp://s3.56img.com/style/xiu/v1/img/rev/rev_sprite.png?v=0930 222.84.167.30
hxxp://uface.xiu.56img.com/photo/45/58/lmx2369295492_b_56.com_.jpg?051816 113.107.56.96
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=topicLinkR 59.151.61.62
hxxp://dnlive.fastcdn.com/56get 59.39.31.49
hxxp://img1.qunarzz.com/qs/201404/30/1644498437263f636886324a.png 115.238.152.226
hxxp://s2.56img.com/script/page/xiu/v3/game_v.5.js?20131104v2 113.107.56.96
hxxp://s2.56img.com/script/page/xiu/v3/shafa_v_1.js?v=201311v1 113.107.56.96
hxxp://s1.56img.com/style/xiu/v1/img/topic/Satyr_Game/timer_bg.gif 113.107.56.96
hxxp://uface.xiu.56img.com/photo/70/19/qq-zfwvflhdxq_b_56.com_.jpg?60 113.107.56.96
hxxp://cdn.51img5.com/img5/flashlayer/533138d44ad23/3.swf?v=3 14.17.87.40
hxxp://s2.56img.com/style/xiu/v1/img/bg/520_z5n6_bg.jpg 113.107.56.96
hxxp://source.qunar.com/site/images/airlines/SC.gif 119.254.26.36
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top2 59.151.61.62
hxxp://uface.xiu.56img.com/photo/45/58/lmx2369295492_56.com_.jpg?770?t=2014051816 113.107.56.96
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_leftAD_bottom 59.151.61.62
hxxp://s1.56img.com/style/xiu/v1/img/topic/Satyr_Game/Satyr_Game_icon.png 113.107.56.96
hxxp://vi5.6rooms.com/live/2014/01/08/1003v1389132341757446858.jpg 101.28.252.36
hxxp://cdn.51img5.com/img5/flashlayer/533138d44ad23/ps.swf?v=3 14.17.87.40
hxxp://s2.56img.com/style/xiu/v1/img/bg/dy_rkxin1.png 113.107.56.96
hxxp://source.qunar.com/site/images/flight/flight_search/qn1cs1_disable.gif 119.254.26.36
hxxp://www.woxiu.com/p/20111931?from=offsite&sid=214516&wp=1&cps=&r=80928328 14.17.101.18
hxxp://s3.56img.com/style/xiu/v1/img/rev/airing_sprite.gif 222.84.167.30
hxxp://vi0.6rooms.com/f2/9a/v627061383118550.png 110.249.215.42
hxxp://ws.qunar.com/crossdomain.xml 59.151.16.186
hxxp://vi4.6rooms.com/live/55/07/6cf4565a9b319e36561b4af95c4522df.gif 60.217.241.16
hxxp://cdn.51img5.com/img5/flashlayer/5360b616f2691/ps.swf?v=3 14.17.87.40
hxxp://vj0.6rooms.com/js/LAB_0.1.js 61.146.152.57
hxxp://vi1.6rooms.com/live/2014/02/12/01/1003v1392141486221499555.jpg 122.143.24.40
hxxp://www.cfmogu.com/Ä¢¹½Í¼Æ¬.gif
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=homeadSy 59.151.61.62
hxxp://cdn.51img5.com/img5/flashlayer/533138d44ad23/1.swf?v=3 14.17.87.40
hxxp://qde.qunar.com/js.ng/framId=homeadSy&chan=flight&pg=home&pos=right_top&site=qunar&size=230x200&type=Tear_angle&tile=14003829506057166236&city=北京 211.151.112.111
hxxp://source.qunar.com/site/images/flight/home/img_qnkhd.png 119.254.26.36
hxxp://www.woxiu.com/80928328?p=20111931 14.17.101.18
hxxp://source.qunar.com/site/images/flight/home/bg_bd.jpg 119.254.26.36
hxxp://s2.56img.com/style/xiu/v1/css/sub/xiu_login_v.2.css?20131212 113.107.56.96
hxxp://bsch.serving-sys.com/BurstingPipe/adServer.bs?cn=tf&c=19&mc=imp&pli=9635822&PluID=0&ord=3954135100&rtu=-1 58.68.227.4
hxxp://s3.56img.com/style/xiu/v1/img/rev/rev_sprite.png 222.84.167.30
hxxp://www.cfmogu.com/0.htm
hxxp://pcookie.cnzz.com/app.gif?&cna=RVj/Cy0IRhYCAbhrJiY9QmtQ 42.120.219.171
hxxp://s2.56img.com/script/page/xiu/v3/play_flv_v.8.js?20140421 113.107.56.96
hxxp://vj0.6rooms.com/js/s/e6u5-min.js?101016 61.146.152.57
hxxp://vj0.6rooms.com/js/z_MIN_14.64.js 61.146.152.57
hxxp://simg4.qunarzz.com/common/hf/arc.png 119.254.26.36
hxxp://vj0.6rooms.com/js/s/iwt-min.js 61.146.152.57
hxxp://vi7.6rooms.com/live/98/70/8efd23b6f7157a5825ca1383a6f311ca.jpg 122.143.12.200
hxxp://ws.qunar.com/lpisearchd?callback=jQuery152011194646905334254_1400382946808&from=&to=Hot&month=All&cachefrom=&cacheto=&type=ow&source=fhome&_=1400382952605 59.151.16.186
hxxp://vj0.6rooms.com/js/s/login_3.js 61.146.152.57
hxxp://s2.56img.com/script/page/xiu/v3/hd.js?v20140515 113.107.56.96
hxxp://qde.qunar.com/js.ng/framId=couplet_load&chan=flight&pg=home&pos=right&site=qunar&size=120x300&type=couplet&tile=14003829506057166236&city=北京 211.151.112.111
hxxp://source.qunar.com/site/images/flight/flight_search/btn_normal.png 119.254.26.36
hxxp://www.56.com/flashApp/vshow/seabed_treasure.11.07.29.a.swf 222.216.188.94
hxxp://img1.qunarzz.com/qs/201404/25/f1f51d8b645559506886324a.png 115.238.152.226
hxxp://p.tuigoo.com/pic/close.png 115.236.16.240
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1510830556 42.120.219.171
hxxp://img1.qunarzz.com/qs/201405/13/3bbae0f3b3dc18c86886324a.jpg 115.238.152.226
hxxp://vi0.6rooms.com/live/39/11/b5adf698bf4292a509a926ce6c0e72ca.jpg 110.249.215.42
hxxp://s3.56img.com/style/xiu/v1/img/rev/rev_gift.png 222.84.167.30
hxxp://vi0.6rooms.com/live/99/22/e0122f43fc759e56244ef1dbc5c2f955.jpg 110.249.215.42
hxxp://cdn.51img3.com/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=4714 220.170.193.200
hxxp://c.myzwqwe12.com/AShow.aspx?AID=9756
hxxp://img1.qunarzz.com/qs/201405/08/f1f51d8b645559506886324a.png 115.238.152.226
hxxp://s6.cnzz.com/stat.php?id=4693566&show=pic1 1.99.192.15
hxxp://shrek.6.cn/live.6.cn/e6u2/r.php?location=v.6.cn/event/promimg/?src=pming393&referer=&browser=mozilla/4.0 (compatible; msie 6.0; windows nt 5.1; sv1; .net clr 2.0.50727; .net clr 3.0.04506.648; .net clr 3.5.21022; .net4.0c)&flash=10.0&msr=1024,768&uid=0&pro=4&stamp=1400382946245 61.160.239.94
hxxp://source.qunar.com/site/images/flight/flight_v1/postmk_wf.png 119.254.26.36
hxxp://www.qunar.com/suggest/livesearch2.jsp?lang=zh&q=北京&sa=true&callback=top.XQS_1400382952605 59.151.61.62
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top 59.151.61.62
hxxp://cdn.51img5.com/img5/flashlayer/5360b616f2691/2.swf?v=3 14.17.87.40
hxxp://bc.qunar.com/f?utmwv=0.1&t=0.8484638481182711&utmsr=1024*740&utmr=-1&utmp=http://flight.qunar.com/?ex_track=auto_52283dc6&utmhn=flight.qunar.com&s=249 59.151.16.186
hxxp://uface.xiu.56img.com/photo/13/46/p1521136036_56.com_.jpg?508?t=2014051816 113.107.56.96
hxxp://s3.56img.com/style/xiu/v1/img/activity/blank.gif 222.84.167.30
hxxp://ws.qunar.com/lowerPrice.jcp?&callback=DomesticLowPriceHome.showLowPrice 59.151.16.186
hxxp://s2.56img.com/script/page/xiu/v3/sns_daytask_v.2.js?20131231 113.107.56.96
hxxp://vi4.6rooms.com/live/52/51/5b5c3b1db777d118dda54fde2ca0b435.jpg 60.217.241.16
hxxp://source.qunar.com/site/images/flight/home/bg_bd_rex.jpg 119.254.26.36
hxxp://uface.xiu.56img.com/photo/53/65/xq-sqirysbgcb_56.com_.jpg?333?t=2014051816 113.107.56.96
hxxp://hzs9.cnzz.com/stat.htm?id=4693566&r=&lg=en-us&ntime=1400400449&repeatip=2&rtime=0&cnzz_eid=442332282-1400400449-&showp=1024x768&st=-17510&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=698202374 42.156.140.23
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=topicLinkL 59.151.61.62
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=flight_float_layer 59.151.61.62
hxxp://s1.56img.com/style/xiu/v1/img/pic/xiu_big_avatar.jpg 113.107.56.96
hxxp://s1.56img.com/style/xiu/v1/img/rev/sub/ph_flower.png 113.107.56.96
hxxp://p.tuigoo.com/showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.com/CPVClick.aspx?AID=1805&PID=9756&Auth=6848383803FF6A6092490BA77624631CA1FA35D6FD9AE72FFF46957CF4C745CF&Url=http%3a%2f%2fv.6.cn%2fevent%2fpromimg%2f%3fsrc%3dpming393 115.236.16.240
hxxp://vr0.6rooms.com/imges/live2013/base_head_v24.png 221.204.21.61
hxxp://v.6.cn/event/promimg/?src=pming393 61.146.152.57
hxxp://vr0.6.cn/imges/live/IMGSRC/logo_foot_v1.png 123.235.32.40
hxxp://source.qunar.com/site/images/flight/flight_search/bg_sephuan.png 119.254.26.36
hxxp://cdn.51img3.com/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=6256 220.170.193.200
hxxp://cdn.51img5.com/img5/flashlayer/5360b616f2691/3.swf?v=3 14.17.87.40
hxxp://s1.56img.com/style/xiu/v1/css/xiu_v.12.css?20140312 113.107.56.96
hxxp://s1.56img.com/style/xiu/special/v1/img/topic/520days_2014/520_Entrance.png 113.107.56.96
hxxp://hzs9.cnzz.com/stat.htm?id=4693566&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=442332282-1400400449-&showp=1024x768&st=0&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=112104309 42.156.140.23
hxxp://c.myzwqwe12.com/AShow.aspx?AID=9842
hxxp://js.tuigoo.com/pic/spacegif.gif 115.236.16.240
hxxp://qde.qunar.com/js.ng/framId=flight_float_layer&chan=flight&pg=home&pos=top&site=qunar&type=floating_layer&tile=14003829506057166236&city=北京 211.151.112.111
hxxp://s3.56img.com/style/xiu/v1/img/bg/bg_car.jpg 222.84.167.30
hxxp://s1.56img.com/script/page/xiu/v3/global.js?2013v6 113.107.56.96
hxxp://s3.56img.com/style/xiu/v1/css/xiu_base_v.2.css?2012v5 222.84.167.30
hxxp://s3.56img.com/style/xiu/v1/img/col/peihua.png 222.84.167.30
hxxp://img1.qunarzz.com/qs/201311/14/a0f28380bff75d736886324a.jpg 115.238.152.226
hxxp://s2.56img.com/script/page/xiu/v3/swfobject.js 113.107.56.96
hxxp://simg4.qunarzz.com/common/hf/footer_v10.png 119.254.26.36
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=flight_active_dynamic 59.151.61.62
hxxp://uface.xiu.56img.com/photo/53/65/xq-sqirysbgcb_b_56.com_.jpg 113.107.56.96
hxxp://source.qunar.com/site/images/wns/20140415_flighthp_tbut_230x200_4211.swf?clickTag=http://qde.qunar.com/event.ng/Type=click%26FlightID=108395%26AdID=206888%26TargetID=6878%26Segments=13,28,50,132,148,373,530,534,535,536,539,540,541,542,543,544,545,546,548,549,550,551,552,553,554,555,556,558,559,560,561,562,564,565,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,586,587,610,611,1101,1102,1143,1183,1831,4054,4648,4649,4676%26Targets=5302,29,208,1504,5800,6878,6419%26Values=34,46,51,63,77,80,101,110,150,204,217,228,243,250,252,269,301,305,320,5402%26RawValues=%26Redirect=http://bsch.serving-sys.com/BurstingPipe/adServer.bs?cn=tf&c=20&mc=click&pli=9635822&PluID=0&ord=[timestamp] 119.254.26.36
hxxp://simg4.qunarzz.com/common/hf/header_v10.png 119.254.26.36
hxxp://s3.56img.com/style/xiu/v1/img/rev/rev_uhd.png 222.84.167.30
hxxp://qde.qunar.com/js.ng/framId=ad_home_leftAD_bottom&chan=flight&pg=home&pos=mid&site=qunar&size=728x90&tile=14003829506057166236&city=北京 211.151.112.111
hxxp://www.56.com/flashApp/vshow_player_woxiu.14.04.24.a.swf 222.216.188.94
hxxp://cdn.51img5.com/img5/flashlayer/5360b616f2691/1.swf?v=3 14.17.87.40
hxxp://s3.56img.com/style/xiu/v1/img/rev/rev_h.png 222.84.167.30
hxxp://s1.56img.com/style/xiu/v1/img/activity/newie/n5_ledbean.png 113.107.56.96
hxxp://s3.56img.com/style/xiu/v1/img/bg/car_ivaca.png 222.84.167.30
hxxp://vj1.6rooms.com/css/base_MIN_11.03.css 61.146.152.57
hxxp://bc.qunar.com/js/ga.min.js 59.151.16.186
hxxp://qde.qunar.com/js.ng/framId=ad_home_rightAD_top2&chan=flight&pg=home&pos=top&site=qunar&size=230x90&tile=14003829506057166236&city=北京 211.151.112.111
hxxp://source.qunar.com/site/images/flight/home/ico_la_v2_0508ie6.png 119.254.26.36
hxxp://qde.qunar.com/js.ng/framId=flight_active_dynamic&chan=flight&pg=home&site=qunar&type=dynamic_skinned&tile=14003829506057166236&city=北京 211.151.112.111
hxxp://vj0.6rooms.com/js/mootools_MIN_1.4.5.js 61.146.152.57
hxxp://s3.56img.com/style/xiu/v1/img/rev/rev_icon.png 222.84.167.30
hxxp://qde.qunar.com/js.ng/framId=ad_home_rightAD_top&chan=flight&pg=home&pos=top&site=qunar&size=230x200&tile=14003829506057166236&city=北京 211.151.112.111
hxxp://www.woxiu.com/jump.html?p=20111931&from=offsite&wp=1&sid=214516 14.17.101.18
hxxp://www.woxiu.com/index.php?action=HdActive&do=getGoddessRank&user_id=lmx2369295492&t=0.22199426773624437 14.17.101.18
hxxp://s3.56img.com/style/xiu/v1/css/sub/xiu_guide_v.8.css?v20140224 222.84.167.30
hxxp://source.qunar.com/site/images/new_main/tb.bg.gif 119.254.26.36
hxxp://s3.56img.com/script/page/xiu/v3/lothario_v.1.js?20140425 222.84.167.30
hxxp://ws.qunar.com/ips.jcp?callback=QNR.ips.callback&_=1400382951167 59.151.16.186
hxxp://img1.qunarzz.com/qs/201212/25/e0eaeaf8276dc5556886324a.gif 115.238.152.226
hxxp://source.qunar.com/site/images/wns/20140430_728x90_4245_dfs_new.jpg 119.254.26.36
hxxp://irs01.com/irt?_iwt_UA=UA-6cn-000001&p=value1,value2&jsonp=_VUFOG 180.169.19.136
hxxp://p.tuigoo.com/pic/spacegif.gif 115.236.16.240
hxxp://uface.xiu.56img.com/photo/33/55/qq-29210884_b_56.com_.jpg?25 113.107.56.96
hxxp://source.qunar.com/site/images/flight/home/ico_la_v2_0508.png 119.254.26.36
hxxp://s3.56img.com/style/xiu/v1/css/sub/xiu_sns_v.1.css?20140415 222.84.167.30
hxxp://uface.xiu.56img.com/photo/33/55/qq-29210884_56.com_.jpg?338?t=2014051816 113.107.56.96
hxxp://ws.qunar.com/lpisearchd?callback=jQuery152011194646905334254_1400382946809&from=&to=Hot&month=All&cachefrom=&cacheto=&type=rt&source=fhome&_=1400382952620 59.151.16.186
hxxp://ws.qunar.com/holidayService.jcp?count=2 59.151.16.186
hxxp://source.qunar.com/site/images/flight/flight_v1/ico_arrsel.png 119.254.26.36
hxxp://qde.qunar.com/js.ng/framId=ad_home_leftAD_middle&chan=flight&pg=home&pos=top&site=qunar&size=728x90&tile=14003829506057166236&city=北京 211.151.112.111
hxxp://c.cnzz.com/core.php?web_id=4693566&show=pic1&t=z 42.120.219.6
hxxp://s1.56img.com/style/xiu/v1/img/pic/xiu_small_avatar.jpg?t=2014051816 113.107.56.96
hxxp://s1.56img.com/style/xiu/base/v1/css/common_v.1.css 113.107.56.96
hxxp://source.qunar.com/site/images/flight/flight_v1/postmk_dc.png 119.254.26.36
hxxp://ws.qunar.com/airCoPromote.jsp?airCoList=CA,SC,CZ&num=5&callback=AirLineDeals._parseData 59.151.16.186
hxxp://source.qunar.com/site/images/flight/home/bg_tabsel.png 119.254.26.36
hxxp://simg4.qunarzz.com/site/images/zhuanti/huodong/Header0428.png 119.254.26.36
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_leftAD_middle 59.151.61.62
hxxp://i2.6.cn/b7/aa/h199941397100951.jpg 116.114.22.34
hxxp://s3.56img.com/style/xiu/base/v1/img/gift/game_icon/lock.gif 222.84.167.30
hxxp://vi4.6rooms.com/live/61/34/1ea2323ba908e33a81b5eae7269d6f0b.jpg 60.217.241.16
hxxp://s2.56img.com/script/page/xiu/v3/common.js?20140417 113.107.56.96
hxxp://vi0.6rooms.com/live/2014/03/20/15/1003v1395300869395285901.jpg 110.249.215.42
hxxp://dnlive.fastcdn.com/crossdomain.xml 59.39.31.49
hxxp://s2.56img.com/script/page/xiu/lib/jquery/jquery-1.4.4.min.js 113.107.56.96
hxxp://userimg.qunar.com/imgs/201103/29/66Iba26Dsd1_IiKO6720.jpg 119.254.26.35
hxxp://vr0.6.cn/imges/live/CSSIMG/base_head_search.png 123.235.32.40
hxxp://img1.qunarzz.com/qs/201404/25/5711d2fac10ecb246886324a.png 115.238.152.226
hxxp://p1.pic.51img1.com/v3/op/gamenew.51.com/platform/act/51wt/apic_img/swfobject.js?file_v=20140103001 61.130.109.50
hxxp://www.qunar.com/twell/cookie/allocateCookie.jsp 59.151.61.62
hxxp://vi0.6rooms.com/live/2014/05/14/23/1003v1400080135920524999.jpg 110.249.215.42
hxxp://s1.56img.com/admin/images/no_userhead_s.jpg 113.107.56.96
hxxp://s3.56img.com/style/xiu/v1/img/bg.png?v=0531 222.84.167.30
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=417627783 42.120.219.171
hxxp://simg4.qunarzz.com/common/hf/24h.png 119.254.26.36
hxxp://cdn.51img3.com/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=8506 220.170.193.200
hxxp://img1.qunarzz.com/qs/201311/14/98d9e829bcb252a26886324a.jpg 115.238.152.226
hxxp://s2.56img.com/script/page/xiu/v3/park.js?201311v1 113.107.56.96
hxxp://vi2.6rooms.com/live/91/28/57b557081c37a4c63ea3044817f3925a.jpg 182.118.77.105
hxxp://v.6.cn/api/liveInfoCk.php 61.146.152.57
hxxp://s1.56img.com/style/xiu/v1/img/bg/rev_marquee.png 113.107.56.96
hxxp://vi2.6rooms.com/3a/fb/u327191383286771.png 182.118.77.105
hxxp://s1.56img.com/script/page/xiu/v3/chat_v.7.js?20140419 113.107.56.96
hxxp://hzs9.cnzz.com/stat.htm?id=4693566&r=&lg=en-us&ntime=1400400449&repeatip=1&rtime=0&cnzz_eid=442332282-1400400449-&showp=1024x768&st=-17511&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=1192642880 42.156.140.23
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=633829471 42.120.219.171
hxxp://s1.56img.com/style/xiu/v1/img/rev/sub/ph_flower.png?v=0910 113.107.56.96
hxxp://s3.56img.com/style/xiu/v1/img/lnt_bg1.png 222.84.167.30
hxxp://s2.56img.com/script/page/xiu/v3/liver.js?2012v1 113.107.56.96
hxxp://vj0.6rooms.com/js/jquery-1.8.2_v4.js 61.146.152.57
hxxp://uface.xiu.56img.com/photo/45/58/lmx2369295492_b_56.com_.jpg?19 113.107.56.96
hxxp://source.qunar.com/site/images/flight/home/ico_la_ie6.png 119.254.26.36
hxxp://s2.56img.com/script/static/xiu/v5/main_play_v.7.js?20140515 113.107.56.96
hxxp://s1.56img.com/style/xiu/base/v1/css/gift_v.1.css?20130918v1 113.107.56.96
hxxp://c1.56img.com/huodong/29/27/channel_20140504104628_44039.jpg 115.238.233.15
hxxp://uface.xiu.56img.com/photo/62/4/tyxbvk_b_56.com_.jpg?200 113.107.56.96
hxxp://cdn.51img5.com/img5/flashlayer/533138d44ad23/2.swf?v=3 14.17.87.40
hxxp://source.qunar.com/site/images/2011/QN1CS1.gif 119.254.26.36
hxxp://s3.56img.com/style/xiu/v1/img/bg/player_woxiu.png 222.84.167.30
hxxp://s3.56img.com/style/xiu/v1/css/topic/xiu_activity.css?v20140429 222.84.167.30
hxxp://s1.56img.com/style/xiu/v1/img/pic/z5n6_psmall.jpg 113.107.56.96
hxxp://source.qunar.com/site/images/wns/20140509_zx_728x90_4485_banner.gif 119.254.26.36
hxxp://s2.56img.com/script/page/xiu/v3/sns_v.5.js?20131231 113.107.56.96
hxxp://www.56.com/flashApp/vshow/gift_shape/gift.13.10.18.a.swf 222.216.188.94
hxxp://uface.xiu.56img.com/photo/36/37/aa429133656_b_56.com_.jpg 113.107.56.96
hxxp://source.qunar.com/site/images/flight/home/ico_arr_ad.png 119.254.26.36
hxxp://p.tuigoo.com/pic/logo.png 115.236.16.240
hxxp://source.qunar.com/site/images/airlines/CZ.gif 119.254.26.36
hxxp://www.woxiu.com/index.php?action=Game/Lothario&do=Init&room_user_id=lmx2369295492&t=0.16804625496624326 14.17.101.18
hxxp://s2.56img.com/script/page/xiu/v3/public_v.1.js?20140212v1 113.107.56.96
hxxp://vi1.6rooms.com/live/2014/03/13/02/1003v1394650357861917005.jpg 122.143.24.40
hxxp://vr0.6.cn/imges/live2013/logo.jpg 123.235.32.40
hxxp://v.6.cn/event/promimg/proLiveInfo.php 61.146.152.57
hxxp://source.qunar.com/site/images/airlines/CA.gif 119.254.26.36
hxxp://vj0.6rooms.com/csjs/_/girlfall_5.js 61.146.152.57
hxxp://www.qunar.com/vataframe/b.html?_=20120830&rnd=couplet_load 59.151.61.62
play.xiu.v-56.com 121.12.94.69
www.6.cn 61.146.152.57


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Outdated Windows Flash Version IE

Traffic

GET /9.gif?abc=1&rnd=1510830556 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive
Cookie: cna=RVj/Cy0IRhYCAbhrJiY9QmtQ; atpsida=0e1b1ba714bea1243904f592_1400400453


HTTP/1.1 302 Found
Server: Tengine
Date: Sun, 18 May 2014 08:07:38 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: sca=d497953f; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=0e1b1ba714bea1243904f592_1400400458; expires=Wed, 15-May-24 08:07:38 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=RVj/Cy0IRhYCAbhrJiY9QmtQ
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..



GET /img/pic1.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: icon.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine/1.3.0
Date: Sun, 18 May 2014 08:07:33 GMT
Content-Type: image/gif
Content-Length: 428
Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Expires: Mon, 19 May 2014 08:07:33 GMT
Cache-Control: max-age=86400
Accept-Ranges: bytes
GIF89a.......f..3...33.......................................!..NETSCA
PE2.0.....!..Powered by AFEI.!.......,.............I........08bX....d.
n...CS.3......_..`..H..H\8....)...S.b.UX.....(...r.L....tb]&"......#..
.o.V.a..D..o.V.a..........D..o.V.a..........D...........!.......,.....
........I........08bX....d.n...CS.3......_..`..H..H\8....).:[email protected]...
x ..........D.| .#.u.a....n~D..[....n..........D..[...n..........D....
.......;..



GET /live/98/70/8efd23b6f7157a5825ca1383a6f311ca.jpg HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi7.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 01 May 2014 18:04:51 GMT
Content-Type: image/jpeg
Content-Length: 13156
Expires: Sun, 26 Apr 2015 18:04:51 GMT
Cache-Control: max-age=31104000
ETag: "495096205"
Last-Modified: Fri, 20 Dec 2013 07:18:40 GMT
Powered-By-ChinaCache: HIT from 06047113L7
Age: 1432977
Powered-By-ChinaCache: HIT from 06043133Sq
......JFIF.....H.H.....<CREATOR: gd-jpeg v1.0 (using IJG JPEG v62),
 quality = 100....C.....................................%...#... , #&'
)*)..-0-(0%()(...C...........(...(((((((((((((((((((((((((((((((((((((
(((((((((((((...........".........................................B...
.....................!..1A.Qa."2q..#....BR....$3.br...4CDS............
.....................%......................!.1A.."Q2a.Bq............?
..#....T.....gw.z...~.S#!.....A...mj\[email protected]._Y.){...Gw`)gY
..6...K%..H.,....X....Z....../E...}q. {X.S..e......9R....j....Q..VqN.&
gt;..Ou3..w2>ORN....X.....&.....2p...V.,.LA...Z..\..A>..........
 ?.D. ..)..&...V.....V...O..Y....yV.^T^.]z..#&>o\V..*1 l(^.F...rOZ.
l._s..X.I>.}......M.eIs... %.......Q..N.*.K.......>).rrz.?...o..
..l...KJ.0X.... ..$"c.._.(..%.,..UA.. n...aXMo........P)_K............
2F3...5..q...*.TL.v...>G*7c....s.73c......1........h8.Z...;c..u!..E
#'s.......?:..bv....P.....5.9.(o...O.W.<6PX[.J.....nX...5L.....L.FH
..Z......),J.....sZ.g.........X...w.jO.o$...#'..G.8..N...NrTu.:...YZ3&
lt;.)..Q.. .$-..Pf...V.Z.*]q..........^.H.H..n.,e%.....T.c.}...~.aj.:.
.<....K..;...p..n........ C$.......... t.z..i...R.....X.H.*@.Xd..p.
..b..W.........P|.....q..._:..h.G/.k.]K...9.0s.V..]\..-.%..!H%E.G.;{..
..j..)...f8....J.F.\........'l.....j..cc.T.\...`2k:...<..w....W...3
...>u........T...H..j.....$s.r.o.Oc.....#.89....4..^......D....W..H
........z ..U@ ...J..j......Q]..qI....i..R...2.)...B..m..............g
. ... i[....~...|.Vf..zT...~i.8....[`.~....w.(....Y.a.*r......FZd|
<<< skipped >>>


GET /stat.htm?id=4693566&r=&lg=en-us&ntime=1400400449&repeatip=1&rtime=0&cnzz_eid=442332282-1400400449-&showp=1024x768&st=-17511&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=1192642880 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hzs9.cnzz.com
Connection: Keep-Alive
Cookie: cna=RVj/Cy0IRhYCAbhrJiY9QmtQ


HTTP/1.1 200 OK
Server: Tengine/1.4.1
Date: Sun, 18 May 2014 08:07:38 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Tue, 28 May 2013 02:57:17 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..



GET /live/99/22/e0122f43fc759e56244ef1dbc5c2f955.jpg HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi0.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Thu, 01 May 2014 18:11:00 GMT
Content-Type: image/jpeg
Content-Length: 7794
Expires: Sun, 26 Apr 2015 18:11:00 GMT
Cache-Control: max-age=31104000
ETag: "824209979"
Last-Modified: Thu, 31 Oct 2013 03:58:35 GMT
Powered-By-ChinaCache: HIT from 06047113L7
Age: 1432608
Powered-By-ChinaCache: HIT from 060311H3SN
......JFIF.....H.H.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 80....C.....................................%...#... , #&')*).
.-0-(0%()(...C...........(...(((((((((((((((((((((((((((((((((((((((((
(((((((((..........."........................................C........
..................!1A.."2Qaq.....BR....3b.#$r%CTc....4s...............
................ ......................!.1A"2QB............?...;E(.>
;[email protected].]d....P3UQ.%;......w9../...2IO\.,.I..
..........S..a..l.G!n.N..t...x..=........I1J.DL"..w>..cy;..8...jj..
..T....L`?.l..#.k.X.9......X...3.......^{Q.E..7..Fo...?T.S..^...{...`.
....[.......8\"YL...JQC3..l.....<....K..^Sq.....U..]W"\.r.\.r.\.r..
..AB{.(\x..t..qF..ar......0.......y(.qF.a.QD.3=i...%X..4.p>..}U.Y..
!|....1.4.#...S/K...tuD1l.CG7j.H.%..8Z..u...x.{).......4x..|..s#0l..M,
.eD.S[...H....._..{..c..~.G..h.!..V...........?.fW.;1.pb.r.... .c:....
Y.IR.~.....{n_.h.....@...{.;S.O.O2..?.0..4f..... <.......].1cG,n.i.
q.L<G...%..H.bd...=..> ..h.Q...8i{CO.z.k...5..by...1..9}..7WL9..
..\.u...r..r.rT.B.J.(@.\....(....B{.(..r0.&. .S..M.8...F.c.6...0Sa.P.A
<L..!.^9.X..E.4.....b.e..z.....k...._......MGKSMWO..;......F.h./..@
.3.c...a.z.0...........|..Z\E...^:...e1<K<.G.y.:...oV......C5..`
^.....t..].S........is.J.k.......&{n.Cw.q..y.j.&.#.x.....9..{...x....k
Ll.C2..........t?........0u..na...,n'.q<./I_.F#t.as9.P.z.j.*.'.....
...*n...........G...}St...d.6H......4.8.."..<#......5.n....!.^h.r..
(.x.... .NN.. ..\.....S..ql...w..6..y.ek.kG.........Z.m.......Yv..
<<< skipped >>>


GET /site/timetrack.htm?action=FH|load|8.25&t=1400418466250 HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: flight.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Fri, 16 May 2014 07:57:11 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Server: QWS/1.0
14........................0..



GET /app.gif?&cna=RVj/Cy0IRhYCAbhrJiY9QmtQ HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pcookie.cnzz.com
Connection: Keep-Alive
Cookie: cna=RVj/Cy0IRhYCAbhrJiY9QmtQ


HTTP/1.1 200 OK
Server: Tengine
Date: Sun, 18 May 2014 08:07:40 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=RVj/Cy0IRhYCAbhrJiY9QmtQ; expires=Wed, 15-May-24 08:07:40 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..



GET /stat.php?id=4693566&show=pic1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s6.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Date: Sun, 18 May 2014 08:07:29 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Sun, 18 May 2014 08:07:29 GMT
Expires: Sun, 18 May 2014 09:37:29 GMT
ef2..(function(){function l(){this.c="4693566";this.R="z";this.N="pic1
";this.K="";this.M="";this.o="1400400449";this.P="hzs9.cnzz.com";this.
L="";this.s="CNZZDATA" this.c;this.r="_CNZZDbridge_" this.c;this.G="_c
nzz_CV" this.c;this.u="0";this.B={};this.a={};this.la()}function g(a,b
){try{var c=[];c.push("siteid=4693566");.c.push("name=" d(a.name));c.p
ush("msg=" d(a.message));c.push("r=" d(h.referrer));c.push("page=" d(f
.location.href));c.push("agent=" d(f.navigator.userAgent));c.push("ex=
" d(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image
).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(e){}}var h=do
cument,f=window,d=encodeURIComponent,k=decodeURIComponent,p=unescape,r
=escape,m="https:"===f.location.protocol?"https:":"http:",s=m "//c.cnz
z.com/core.php";l.prototype={la:function(){try{this.U(),.this.J(),this
.ia(),this.H(),this.m(),this.ga(),this.fa(),this.ja(),this.j(),this.ea
(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),f[this.
r]=f[this.r]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:fun
ction(){try{var a=this;f._czc={push:function(){return a.C.apply(a,argu
ments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=f._czc;if
("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b  )
{var c=a[b];switch(c[0]){case "_setAccount":f._cz_account="[object Str
ing]"===.{}.toString.call(c[1])?c[1]:String(c[1]);break;case "_setAuto
Pageview":"boolean"===typeof c[1]&&(f._cz_autoPageview=c[1])}}}catch(e
){g(e,"cS failed")}},qa:function(){try{if("undefined"===typeof f._
<<< skipped >>>


GET /live/52/51/5b5c3b1db777d118dda54fde2ca0b435.jpg HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi4.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 01 May 2014 18:11:31 GMT
Content-Type: image/jpeg
Content-Length: 19936
Expires: Sun, 26 Apr 2015 18:11:31 GMT
Cache-Control: max-age=31104000
ETag: "1127295846"
Last-Modified: Thu, 31 Oct 2013 10:35:18 GMT
Powered-By-ChinaCache: HIT from 01057413L3
Age: 1432584
Powered-By-ChinaCache: HIT from 060531B33F
......JFIF.....H.H.....<CREATOR: gd-jpeg v1.0 (using IJG JPEG v62),
 quality = 100....C...................................................
.................C....................................................
........................"..........................................>
;..........................!1A..Q.."aq.2B..#R.......$3b.C.............
.......................(........................!1.."AQ2a.#..3........
....?........d].......!..|..,.k......$j... .O.Lc..nW...i..........lR..
.5IG.....j}!AY.f......../Sc..t........UU.n$.....7.E...A..\O>..y&..4
.t3V.....G-c.$}.Rl.qP.2H...&v....`}>.._.._.3..=C..y.".E$.$.#...k.Rm
.6.O.k.....Xyj.ec..x.o.../.J..z.j....qw......c...p.5.%...X .......~..z
..Rm.9y..fP...j ...jmV.B.....1pz..d.f. 4..U.".;B.....c.Y...#...lM..#.=
.......3L.#...c.i.[...X}:..=9.....K#..=.t.V.$....7P/.7^.;~.5.r.3......
.b..[........v.r....a'.~0.^.e..C..a[....(..6. ....o.(...,..!jI . .....
yX[j....m..........OKrw....^......<....X.x .7..H...r.......).U.$Rw.
...._...eh..T.#.....s.'.._#Y*i...2..#...\..Ao.9=F..v...t..TP....0.D..i
.8..:..6...s4..jbfx..!rn.z.~.\[.Ur.Q..4(.0..RlKz....xt..D.V.^.m..l....
Rq.)[5.*A.ms.M.I...'[..O...p....s9)..&..nX.....-.s....E.......-`...~..
..e..i-!..*.$...b..l..;'...F..k..c.....Kc.&....r.^..#....v._..Xj....%#
@...i...Y.y9.B.......i<..$4..,..i&_GcP|.. .E..?Al8./.$.....J...d)b.
..c.8.i &....#..........rW.f.....a.m7..p..lA.j......x.......#30.."..8.
.5..3...{ M.).....n....h..|.f.f.$...Z........g.GOI..@%.].K.Y..;.....cI
.O..ZSM.Z.W....p..>...b.x..E.........?...... 3.<tf7K,.U....?
<<< skipped >>>


GET /pic/spacegif.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p.tuigoo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/gif
Last-Modified: Tue, 06 Sep 2011 15:04:12 GMT
Accept-Ranges: bytes
ETag: "0fe5c3ca66ccc1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:20 GMT
Content-Length: 60
GIF89a.............!.......,............................S..;...
.


GET /pic/logo.png HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p.tuigoo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Wed, 31 Jul 2013 14:28:10 GMT
Accept-Ranges: bytes
ETag: "079642efa8dce1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:21 GMT
Content-Length: 3639
.PNG........IHDR..............:......pHYs...#...#.x.?v...MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>


GET /acpa/webgame/cy.html?from=tgly_14516 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:30 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|||; path=/; domain=51.com
Set-Cookie: FO_TUID=HcydFs; path=/; domain=51.com
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; path=/; domain=51.com
Set-Cookie: wtids20140518=4lr4; expires=Mon, 19-May-2014 08:07:30 GMT; path=/; domain=tg.51.com
Set-Cookie: foru=140040045031D2IWdC||game; path=/; domain=.51.com
Content-Encoding: gzip
c82.............ZK...../..@3....%.......;k'....;..`..E.(.Pl...F.....-.
%...C..y.A.<.A.\s.!. U..HqHJ.G.C..u7.......b.....{v..w.T&|.(......3
E}`........c...:...b.=.<&a.s..$0.7..*...hh...\..u.{....5.2.sV|.K=u.
..........A.X5|...#....xN&..YY.....{>.W.?..3.r........#k...57....LH
.Pn}...U.(3.>...=.O....O.......g.....>...?..O....~.._.....=Sw...
.........~...~..>|[email protected]...^/.>.......
SH......\..U...q..*7...q]?..^.{...r3"....4t.8,`.P.FO<..'...CE)...2J
 t.\kfx..*[email protected]^..-5b.V.1...g.X}(.!e2.C..j..i..'.#^V.......cgih..
G....... j......LiH..\f#...,[email protected]..../....P{f...A...{=.e..
o, ....9)..u..c..UJ.....X...&PH....0Xg.cv...0..N#..L'..............<
;.m6.t....JX.;.....tk....,,...............5.t...1.f.....Z...5By.(..L..
J}....`...d.....f..........K#....\...}ue..RW..I......9...IR..,.....i..
.....A'..1.9.:.......M#...;......H..V.Q.n..P...p(.x.B..V....l.1.....$u
h.l.........^6[(.'".3.#......Hz....u...$..ce...Z...O.......b.#..._.Ew.
?.....I.t......'..E..37u..0.$.t...q#.......V...R0(..B....#..O.z.F.t...
[email protected]..$...(..V....tD.g.....o}.#T..F.#...N..V...<4..
...^....#rpH.m...Pq.3...X..s.v.................[@V7SB.4..cD.....a.9.v.
s.]e..vZ....Zz.......C.j....rs{ B.;;.._.c.#.[J..k...7k..l.e.f#........
..n.\[email protected].../k......6o..C. IAH.%.i.hY....gG,..FT...
...J.....m%...M.....w.Q`....t:n....Ot!2..,..pI...J,.#..^.g..n..D....!.
..^...s].....C...O^......(...\....)O..P`..9..(...y....l.n#5....]......
E...h>@I,.m.P.=..z...B.......m..."nW"...'Kq......"H-..N.."7\{..
<<< skipped >>>

GET /stat/pv_stat/?p_k=tst_4lr4_tgly_14516&r=0.022782987083270034 HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4_4m1e; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:34 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
36............ )..)I......&..f5F&.5f.ff5&.5&&f&5..././&.....0..
....


GET /stat/pv_stat/?p_k=tst_4m1e_tgx2_14516&r=0.6150320029604179 HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/market/game/shequ.htm?f_com=tgx2_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4_4m1e; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:35 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
36............ )..)I.0....&..f5F..5f...5&.5&...5..H'..&.....0..
....


GET /tools/wt_js/?channel_alias=tgly_14516&js_type=js_1&callback=wt_js_callback HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4_4m1e; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game; _51usi=g7LuIL


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:39 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
31............ /..*.ON..IJL...V.(..Q.RR.......Vj.......0......


GET /tools/js_flow_cookie/?channel_alias=tgly_14516&r=0.8860948699304393 HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4_4m1e; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game; _51usi=g7LuIL


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:40 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: wt_ch_flow=tgly; expires=Mon, 19-May-2014 14:07:40 GMT; path=/; domain=51.com
Content-Encoding: gzip
14........................0......


GET /tools/js_flow_cookie/?channel_alias=tgx2_14516&r=0.2397324301325517 HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/market/game/shequ.htm?f_com=tgx2_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4_4m1e; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game; _51usi=g7LuIL; wt_ch_flow=tgly


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:40 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: wt_ch_flow=tgx2; expires=Mon, 19-May-2014 14:07:40 GMT; path=/; domain=51.com
Content-Encoding: gzip
14........................0......


GET /stat/pv_stat/?p_k=swf1_4lr4_tgly_14516&r=0.0802050050287133 HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4_4m1e; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game; _51usi=g7LuIL; wt_ch_flow=tgx2


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:42 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
37............ .O3.)I......&..f5F&.5f.ff5&.5&&f&5.....!'.....0..>....


GET /stat/pv_stat/?p_k=swf1_4lr4_tgly_14516&r=0.14578722218447038 HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4_4m1e; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game; _51usi=g7LuIL; wt_ch_flow=tgx2


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:42 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
37............ .O3.)I......&..f5F&.5f.ff5&.5&&f&5.....!'.....0..>....


GET /stat/pv_stat/?p_k=swf2_4m1e_tgx2_14516&r=0.18469849162227225 HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/market/game/shequ.htm?f_com=tgx2_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4_4m1e; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game; _51usi=g7LuIL; wt_ch_flow=tgx2


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:44 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
36............ .O3.)I.....&..f5F..5f...5&.5&...5..6v!.'.....0..



GET /irt?_iwt_UA=UA-6cn-000001&p=value1,value2&jsonp=_VUFOG HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: irs01.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:52 GMT
Content-Type: text/javascript
Content-Length: 33
Connection: close
Set-Cookie: _iwt_id=iBOptFhqeFN2Nes5R1UPAwA; expires=Thu, 31-Dec-37 23:55:55 GM; domain=.irs01.com; path=/
P3P: policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"
Cache-Control: no-cache
Pragma: no-cache
_VUFOG('iBOptFhqeFN2Nes5R1UPAwA')..



GET /photo/45/58/lmx2369295492_b_56.com_.jpg?051816 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: uface.xiu.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Wed, 04 Jun 2014 04:57:02 GMT
Date: Mon, 05 May 2014 04:57:02 GMT
Server: ngx_openresty
Content-Type: image/jpeg
Content-Length: 10123
Last-Modified: Wed, 23 Apr 2014 13:15:44 GMT
ETag: "5357bd00-278b"
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx161:8080 (Cdn Cache Server V2.0), 1.1 jydx39:1 (Cdn Cache Server V2.0)
Connection: keep-alive
......JFIF.............C..............................................
!........."$".$.......C...............................................
......................................................................
I.........................!.1A.."Qaq....2....#B...$5Rb.%CTUr..&3Ss....
................................).....................!.1.A.."Qa.2RqB.
..............?.........8..O...u......6.)V.C.T.......K.P.:. 4....B....
.4.;U.G.....O..9RZTh...I....[,rTf..J..IBO.T>U>>[email protected].)....
.H.G.SO...-....)s.6#.M&........|.....b.*Am.w..T.......:..t...Q.e4.....
6...[p..;...5..r....`[email protected].&...y....~....5.v...PT5~..r
.j&.P..k.)Ui.&.:.1CV....,D.U.H....c.TI..q..kN.M.9.d.$.CG`yU..".e.v#..m
3h.(x....j...bP'..Y=...$..2......Hi[#.~.tYV9.R...}.....ZA...^.I.{....]
....u73.;........Ii.....N....HI.<.6......[.;.iW.t:.`..I>........
...7.P...,.).h.2......].9.:{...$o....'...c..r..H'.;m.9..q#p.....k>.
2.<2..R.>.D...h..\...J......[rOR.....&.'.G..x.=....&RT!..j.k.@..
.Wz]....mB3....I..U...pM1..G...Z[n......Z,AI.Wcb....:%.....r.me.j....z
.W......g...).<862*.... .P )Q.JL..1J*.f..#1..=..g.5.k....2..7md.-..
..Ow.J...IQ.8F.].q..-.....&.X..'......Z....Jyju..F..61.j.....Yb....H.'
j..2.8..X....Q.^.-............o..$.....8..e...^)2.=6.(2..:...>..K.)
R.;..8J...ad..o..zsMip...u>FK. (.c.......<.T...y5e."[.t.Hm=j.(T 
....N.f...I.mE.&5...HC..:Lv4..()...G`....2^..m@!..7.......v.&.H.....(u
.. .1UVu.&*...(.)A)).)...MYw.|3.KDrDQt....W......cR\iD.I0D.4..4..:....
lx..c...v.d.}....$..PP.x.....}....Y;..N...l[..,........~....o.^<
<<< skipped >>>

GET /photo/53/65/xq-sqirysbgcb_56.com_.jpg?333?t=2014051816 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: uface.xiu.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Wed, 04 Jun 2014 04:57:02 GMT
Date: Mon, 05 May 2014 04:57:02 GMT
Server: ngx_openresty
Content-Type: image/jpeg
Content-Length: 10123
Last-Modified: Wed, 23 Apr 2014 13:15:44 GMT
ETag: "5357bd00-278b"
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx161:8080 (Cdn Cache Server V2.0), 1.1 jydx39:1 (Cdn Cache Server V2.0)
Connection: keep-alive
......JFIF.............C..............................................
!........."$".$.......C...............................................
......................................................................
I.........................!.1A.."Qaq....2....#B...$5Rb.%CTUr..&3Ss....
................................).....................!.1.A.."Qa.2RqB.
..............?.........8..O...u......6.)V.C.T.......K.P.:. 4....B....
.4.;U.G.....O..9RZTh...I....[,rTf..J..IBO.T>U>>[email protected].)....
.H.G.SO...-....)s.6#.M&........|.....b.*Am.w..T.......:..t...Q.e4.....
6...[p..;...5..r....`[email protected].&...y....~....5.v...PT5~..r
.j&.P..k.)Ui.&.:.1CV....,D.U.H....c.TI..q..kN.M.9.d.$.CG`yU..".e.v#..m
3h.(x....j...bP'..Y=...$..2......Hi[#.~.tYV9.R...}.....ZA...^.I.{....]
....u73.;........Ii.....N....HI.<.6......[.;.iW.t:.`..I>........
...7.P...,.).h.2......].9.:{...$o....'...c..r..H'.;m.9..q#p.....k>.
2.<2..R.>.D...h..\...J......[rOR.....&.'.G..x.=....&RT!..j.k.@..
.Wz]....mB3....I..U...pM1..G...Z[n......Z,AI.Wcb....:%.....r.me.j....z
.W......g...).<862*.... HTTP/1.1 200 OK..Expires: Wed, 04 Jun 2014 
04:57:02 GMT..Date: Mon, 05 May 2014 04:57:02 GMT..Server: ngx_openres
ty..Content-Type: image/jpeg..Content-Length: 10123..Last-Modified: We
d, 23 Apr 2014 13:15:44 GMT..ETag: "5357bd00-278b"..Cache-Control: max
-age=2592000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 zjjx161:8080 (C
dn Cache Server V2.0), 1.1 jydx39:1 (Cdn Cache Server V2.0)..Connectio
n: keep-alive........JFIF.............C...........................
<<< skipped >>>

GET /photo/53/65/xq-sqirysbgcb_b_56.com_.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: uface.xiu.56img.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Expires: Sun, 08 Jun 2014 08:40:50 GMT
Date: Fri, 09 May 2014 08:40:50 GMT
Server: ngx_openresty
Content-Type: text/html
Content-Length: 154
Location: hXXp://s1.56img.com/style/xiu/v1/img/pic/xiu_big_avatar.jpg
Cache-Control: max-age=2592000
Age: 1
X-Via: 1.1 tzwl34:80 (Cdn Cache Server V2.0), 1.1 jydx38:6 (Cdn Cache Server V2.0)
Connection: keep-alive
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>..HTTP/1.1 302 Moved Temporarily..Expi
res: Sun, 08 Jun 2014 08:40:50 GMT..Date: Fri, 09 May 2014 08:40:50 GM
T..Server: ngx_openresty..Content-Type: text/html..Content-Length: 154
..Location: hXXp://s1.56img.com/style/xiu/v1/img/pic/xiu_big_avatar.jp
g..Cache-Control: max-age=2592000..Age: 1..X-Via: 1.1 tzwl34:80 (Cdn C
ache Server V2.0), 1.1 jydx38:6 (Cdn Cache Server V2.0)..Connection: k
eep-alive..<html>..<head><title>302 Found</title&
gt;</head>..<body bgcolor="white">..<center><h1&g
t;302 Found</h1></center>..<hr><center>nginx&l
t;/center>..</body>..</html>......


GET /photo/70/19/qq-zfwvflhdxq_b_56.com_.jpg?60 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: uface.xiu.56img.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Expires: Sun, 08 Jun 2014 08:40:50 GMT
Date: Fri, 09 May 2014 08:40:50 GMT
Server: ngx_openresty
Content-Type: text/html
Content-Length: 154
Location: hXXp://s1.56img.com/style/xiu/v1/img/pic/xiu_big_avatar.jpg
Cache-Control: max-age=2592000
Age: 1
X-Via: 1.1 tzwl34:80 (Cdn Cache Server V2.0), 1.1 jydx38:6 (Cdn Cache Server V2.0)
Connection: keep-alive
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>..HTTP/1.1 302 Moved Temporarily..Expi
res: Sun, 08 Jun 2014 08:40:50 GMT..Date: Fri, 09 May 2014 08:40:50 GM
T..Server: ngx_openresty..Content-Type: text/html..Content-Length: 154
..Location: hXXp://s1.56img.com/style/xiu/v1/img/pic/xiu_big_avatar.jp
g..Cache-Control: max-age=2592000..Age: 1..X-Via: 1.1 tzwl34:80 (Cdn C
ache Server V2.0), 1.1 jydx38:6 (Cdn Cache Server V2.0)..Connection: k
eep-alive..<html>..<head><title>302 Found</title&
gt;</head>..<body bgcolor="white">..<center><h1&g
t;302 Found</h1></center>..<hr><center>nginx&l
t;/center>..</body>..</html>....=O.P..][email protected]
..s..L....2.....d...,...M......$q...S.m...r%[email protected]&...x...._
[email protected]$.*..J.n.`.,Y..y..).-n.M..f.YV...g.....).........V.......Q..
Jn]..%..0w[.@Rk.&bY.\@C.)..Q..'.rByL:.M....8.._$.@).RH..y..<.Ch..H.
...!.rL..Ej .p..^ )k)<c......`.-r`=E..P.....d.O....(..<$.FVU.x..
..s....R....k...] .Q7...Iq.......ww_..:.....m....:@.&...W..Z......)...
6..$'.......h.4.0.}...Y*........d.9IV.........B.o...T.!...H#[email protected]@.=7
.,...........q.-.!IZM.".,..:.l...".w>..! ....S.VI.....H..`>.Z.h.
....8..R. ...[..KZ..z.D......e..0.;[email protected][email protected].........
.?*%&.A...e-.\.x.iP.6.1...i0UNh...}p.....qq.]..M....r.............
<<< skipped >>>

GET /photo/62/4/tyxbvk_b_56.com_.jpg?200 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: uface.xiu.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 08 Jun 2014 08:49:25 GMT
Date: Fri, 09 May 2014 08:49:25 GMT
Server: ngx_openresty
Content-Type: image/jpeg
Content-Length: 8455
Last-Modified: Tue, 22 Apr 2014 01:12:14 GMT
ETag: "5355c1ee-2107"
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl36:8106 (Cdn Cache Server V2.0), 1.1 jydx42:8 (Cdn Cache Server V2.0)
Connection: keep-alive
......JFIF.............C..............................................
!........."$".$.......C...............................................
......................................................................
O........................!..1A.."Q.2aq..#......$5E..4BCRcru...36bt..%S
Tes......................................................!q...........
..?..........9...n`:......`:....$M.......,.z..s`A.....7.CGk.....).l...
<...."...f.%.......8Uo.WM....g..,..)....">....y..IS...iH6.....A 
P'..........."......7.AA.v....3.......7....0...`..VJ...i..N.p/..l.{...
J..@-.".....=........[[email protected]..`>#..h...x...`.m......R@...`.
....%.....:..`.2.M..m....z.C...8...(tX.Jr (..A...)[email protected]...%.....
.....!Ki[I....!.........Z.....C...J./...,..t.... .....JG0..6..l%....R.
...N....Kj^......8.PfP..i.m...4.C..YG...>.........?0..?e.}.`<...
.b......t.I. [email protected][email protected] 8..H...... .l<.F.2=..-56.9..]7....4ZK
.y)Vmk.....\'.3..r.m.......3Dem...3..2..%..........I..`KKw....... *R.&
lt;.Cj..m..JeML).Y*H$_... .,.6.&....}J...t.ag.W.<@:..)..,..4.......
B..... .`...<..8..`>...I..HTTP/1.1 200 OK..Expires: Sun, 08 Jun 
2014 08:49:25 GMT..Date: Fri, 09 May 2014 08:49:25 GMT..Server: ngx_op
enresty..Content-Type: image/jpeg..Content-Length: 8455..Last-Modified
: Tue, 22 Apr 2014 01:12:14 GMT..ETag: "5355c1ee-2107"..Cache-Control:
 max-age=2592000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 tzwl36:8106
 (Cdn Cache Server V2.0), 1.1 jydx42:8 (Cdn Cache Server V2.0)..Connec
tion: keep-alive........JFIF.............C........................
<<< skipped >>>


GET /photo/45/58/lmx2369295492_56.com_.jpg?770?t=2014051816 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: uface.xiu.56img.com
Connection: Keep-Alive



..7M.}.z3....B..Ueh.'...~k....${-.?.......Z...n.....z.<...h .Q.u...
..X......>.,..C..$...\..c*6.....3."s^..m...F.j.........y..C...._z..
o..F.Aaw....[............H......h.....VHO......p....-....\,M}(..\,.8..
._.q2a..E..%q....b{[email protected].!...... ........= T...-.v..m3K.>
;...g.\l..b..:[.....T.e.G.../..H..5......Em..d. ...%.4..w...a...a.....
.i..#.=.*.(....._...."..f>..o..eO......[k..Vy.9.#.>...SP........
..<.p...{.U...c..^...|gY..l.Pp2?...Di.P...yK........*G..HTTP/1.1 20
0 OK..Date: Mon, 12 May 2014 05:30:56 GMT..Server: ngx_openresty..Cont
ent-Type: image/jpeg..Content-Length: 1586..Last-Modified: Wed, 23 Apr
 2014 13:15:44 GMT..ETag: "5357bd00-632"..Accept-Ranges: bytes..Age: 1
..X-Via: 1.1 tzwl43:8106 (Cdn Cache Server V2.0), 1.1 jydx42:6 (Cdn Ca
che Server V2.0)..Connection: keep-alive..........JFIF.............C..
............................................!........."$".$.......C...
....................................................................&l
t;.;...........................................3......................
..!..1A.."BQaq....#.....2b................................ ...........
...........!.1."A2#............?..6.....*..D......Wc|.<\..-4.?...X.
'..X....A^}....).....b$U..AF.2tg..8R=*.{.....n..!_Em.'H.q..BB.{ ...J1.
5%.9.j..N{.c.1..FL...1.k$..u.\t.)...S......,Y......n..u....R.....s.n..
....=..y5...R..x...;.z.....s.....L.G.w......'....X...3.q..#F.fF...~.z.
..c....I.E.3..jR.......NO.aRz...SBpj.go.4Y. ....%D.=.............B.V..
. y.9..X....-.....$K{Y<..o..*! ..6....4......M.49......:.....8.
<<< skipped >>>

GET /photo/33/55/qq-29210884_56.com_.jpg?338?t=2014051816 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: uface.xiu.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 12 May 2014 05:30:56 GMT
Server: ngx_openresty
Content-Type: image/jpeg
Content-Length: 1586
Last-Modified: Wed, 23 Apr 2014 13:15:44 GMT
ETag: "5357bd00-632"
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl43:8106 (Cdn Cache Server V2.0), 1.1 jydx42:6 (Cdn Cache Server V2.0)
Connection: keep-alive
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................<.;........................................
...3........................!..1A.."BQaq....#.....2b..................
.............. ......................!.1."A2#............?..6.....*..D
......Wc|.<\..-4.?...X.'..X....A^}....).....b$U..AF.2tg..8R=*.{....
.n..!_Em.'H.q..BB.{ ...J1.5%.9.j..N{.c.1..FL...1.k$..u.\t.)...S......,
Y......n..u....R.....s.n......=..y5...R..x...;.z.....s.....L.G.w......
'....X...3.q..#F.fF...~.z...c....I.E.3..jR.......NO.aRz...SBpj.go.4Y. 
....%D.=.............B.V... y.9..X....-.....$K{Y<..o..*! ..6....4..
....M.49......:.....8..$...tO.*hz..\i....[..{...9]..v...J...=-..x.NdbO
qI..E..L..0.LN'H...`...^..C.Ccg5..rG..c.aF).. ..Z^....-..41.d.ds.`....
:....4./..|...._...*G..r...3H_..$..(..>.vb>d...Oe..K)Y.'pqk.h<
;....I=.d..j...Z4..W`......U...$.k.9....{R.Q..6K.p.. ...I.s......M....
<>..N,.G..:7*08.#.v.}...~.".Y..=.RE"....s.......J....U=.w,..I..m
.#0^.....m......hb...XV..>.X...p...9`.J..cj.V ......f~'...[..<..
(....U.$..y.j<mu(...S....Y.0.\.J.6.HTTP/1.1 200 OK..Date: Mon, 12 M
ay 2014 05:30:56 GMT..Server: ngx_openresty..Content-Type: image/jpeg.
.Content-Length: 1586..Last-Modified: Wed, 23 Apr 2014 13:15:44 GMT..E
Tag: "5357bd00-632"..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 tzwl43:8
106 (Cdn Cache Server V2.0), 1.1 jydx42:6 (Cdn Cache Server V2.0)..Con
nection: keep-alive........JFIF.............C.....................
<<< skipped >>>

GET /photo/13/46/p1521136036_56.com_.jpg?508?t=2014051816 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: uface.xiu.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 14 May 2014 14:32:26 GMT
Server: ngx_openresty
Content-Type: image/jpeg
Content-Length: 1246
Last-Modified: Wed, 07 May 2014 14:21:28 GMT
ETag: "536a4168-4de"
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl41:8104 (Cdn Cache Server V2.0), 1.1 jydx41:6 (Cdn Cache Server V2.0)
Connection: keep-alive
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................<.;........................................
2..........................!A1Q..2.."ar&3BRq#6c.......................
......... ......................!1..Q.2A............?.....">..P...i
..{.?..F<JJ..T....-...... ..O....1os.Hc.....KM.<..w....#....!.2|
....x"&.%..Z...bg.f .r...<.i=u;.*../.H2.Y.l. ,f.akaisZV~m'.t.J.A..6
.t ...;.Tu .....4...j....^.~....}...6..q..cL....8..E.c.{..r..w=.#..Ee.
.a..!..i. ..eR.<(..?.m>.}.T....)....kaM.......}...K`.~n{.]~..*..
.....Ym.$B@MZ.....*Gc.6`....$.)j.L......K.l....O.T^:....4....x.'N.d..S
....7y......S....U$90R%:D...i.C..N.6...)[email protected].
.G.J\N.$....a..,....\.....F.#......}.TQBT.......& ...FOa....P.8.......
...|..{6k..&......o...8.J..l..ob.lP...7...d.......;..... .-...W..?~.S_
.u..=n..S..G.E.....F.Q.\Z..i.4.^..w.Uy..#.q.vB..k..# .Z.6..'.OX...../.
.M..p....)[email protected].>.....6..
...^yr%j..n ..k.....,!....zM.8..q..2..PAu....<.....L...9..o.6.l....
..qF5R..Z...c&..VgY#.....|.....4HTTP/1.1 200 OK..Date: Wed, 14 May 201
4 14:32:26 GMT..Server: ngx_openresty..Content-Type: image/jpeg..Conte
nt-Length: 1246..Last-Modified: Wed, 07 May 2014 14:21:28 GMT..ETag: "
536a4168-4de"..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 tzwl41:8104 (C
dn Cache Server V2.0), 1.1 jydx41:6 (Cdn Cache Server V2.0)..Connectio
n: keep-alive........JFIF.............C...........................
<<< skipped >>>

GET /photo/33/55/qq-29210884_b_56.com_.jpg?25 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: uface.xiu.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 08 Jun 2014 09:16:07 GMT
Date: Fri, 09 May 2014 09:16:07 GMT
Server: ngx_openresty
Content-Type: image/jpeg
Content-Length: 7575
Last-Modified: Wed, 07 May 2014 14:21:28 GMT
ETag: "536a4168-1d97"
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl36:8105 (Cdn Cache Server V2.0), 1.1 jydx38:10 (Cdn Cache Server V2.0)
Connection: keep-alive
......JFIF.............C..............................................
!........."$".$.......C...............................................
......................................................................
<........................!1.AQ.."aq26t....3R.#Br..b...4d...........
.....................#.....................!1..AQaq.."2............?..
<q.....4.*.....r..4A...`......H...U....m.....M.J^.Tt..UH<a...J..
A.~....p;.).....}R..A...j o..<.. ..[B>*.. ...kh...>...Q...>
;*).6vW.....K).....OC$....0....~h..h.....^.......c.....I.'.........k..
..q.W.X......1.......f.q..r4.....$u[_...R.xd..........;...yauI...c~;;^
........ ...zl....g...H....;%.......Gf.yPHO..i..q.. .j....I......Z....
u.....gh.......q.W..:O...p:....c.r|....5....v."o`S....xh...........A.K
.Ou.O.C...sh47.b...oD.9 ..Z'.:H7...j...<.G.S.....h.B....A..h....c1.
.....0.A..I..R.K.S....... .......R.Zr.D...M1..).O..-5..}.=..<...<
;@[email protected]*.p...#d.x8...sFb.....p.0.......A;.z0.'.@....|O...z]t
Y.....(...%...>\/...........<'.....H%?.w..F.E.Ou.O.C......A...B.
....j0}.:9Yl..>.P..Zy.j...=..(.w]<[email protected].*.2..(...|
...tWd..lF...O ..{.s.p....(8...E....n..k]..dg.n.....3...........mX..D.
...n...s..Z4u[...Z........$...;...t....o* ....I.w...-..O..\.A!k..~..tk
[email protected].?....8...3Y.s.N.....J.`...$....e &'.X.E.r...'3.........
s......C.*EX........G0 ....Ii".A.m.5..........u....H:.o.-V..d..."[.G.{
t...j.m.....Vq8.$O.<E..........K...l.. ;.......p..ook6,..9...<
.U"y..n6..b.(.z......u..]... }...&......Gm.Q.=t_...1.......-M.F..n
<<< skipped >>>

GET /photo/36/37/aa429133656_b_56.com_.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: uface.xiu.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 08 Jun 2014 09:16:07 GMT
Date: Fri, 09 May 2014 09:16:07 GMT
Server: ngx_openresty
Content-Type: image/jpeg
Content-Length: 7575
Last-Modified: Wed, 07 May 2014 14:21:28 GMT
ETag: "536a4168-1d97"
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl36:8105 (Cdn Cache Server V2.0), 1.1 jydx38:10 (Cdn Cache Server V2.0)
Connection: keep-alive
......JFIF.............C..............................................
!........."$".$.......C...............................................
......................................................................
<........................!1.AQ.."aq26t....3R.#Br..b...4d...........
.....................#.....................!1..AQaq.."2............?..
<q.....4.*.....r..4A...`......H...U....m.....M.J^.Tt..UH<a...J..
A.~....p;.).....}R..A...j o..<.. ..[B>*.. ...kh...>...Q...>
;*).6vW.....K).....OC$....0....~h..h.....^.......c.....I.'.........k..
..q.W.X......1.......f.q..r4.....$u[_...R.xd..........;...yauI...c~;;^
........ ...zl....g...H....;%.......Gf.yPHO..i..q.. .j....I......Z....
u.....gh.......q.W..:O...p:....c.r|....5....v."o`S....xh...........A.K
.Ou.O.C...sh47.b...oD.9 ..Z'.:H7...j...<.G.S.....h.B....A..h....c1.
.....0.A..I..R.K.S....... .......R.Zr.D...M1..).O..-5..}.=..<...<
;@[email protected]*.p...#d.x8...sFb.....p.0.......A;.z0.'.@....|O...z]t
Y.....(...%...>\/...........<'.....H%?.w..F.E.Ou.O.C......A...B.
....j0}.:9Yl..>.P..Zy.j...=..(.w]<&&.HTTP/1.1 200 OK..Expires: S
un, 08 Jun 2014 09:16:07 GMT..Date: Fri, 09 May 2014 09:16:07 GMT..Ser
ver: ngx_openresty..Content-Type: image/jpeg..Content-Length: 7575..La
st-Modified: Wed, 07 May 2014 14:21:28 GMT..ETag: "536a4168-1d97"..Cac
he-Control: max-age=2592000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 
tzwl36:8105 (Cdn Cache Server V2.0), 1.1 jydx38:10 (Cdn Cache Server V
2.0)..Connection: keep-alive........JFIF.............C............
<<< skipped >>>

GET /photo/45/58/lmx2369295492_b_56.com_.jpg?19 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: uface.xiu.56img.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Expires: Sat, 14 Jun 2014 08:38:06 GMT
Date: Thu, 15 May 2014 08:38:06 GMT
Server: ngx_openresty
Content-Type: text/html
Content-Length: 154
Location: hXXp://s1.56img.com/style/xiu/v1/img/pic/xiu_big_avatar.jpg
Cache-Control: max-age=2592000
Age: 1
X-Via: 1.1 tzwl39:88 (Cdn Cache Server V2.0), 1.1 jydx41:0 (Cdn Cache Server V2.0)
Connection: keep-alive
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>..HTTP/1.1 302 Moved Temporarily..Expi
res: Sat, 14 Jun 2014 08:38:06 GMT..Date: Thu, 15 May 2014 08:38:06 GM
T..Server: ngx_openresty..Content-Type: text/html..Content-Length: 154
..Location: hXXp://s1.56img.com/style/xiu/v1/img/pic/xiu_big_avatar.jp
g..Cache-Control: max-age=2592000..Age: 1..X-Via: 1.1 tzwl39:88 (Cdn C
ache Server V2.0), 1.1 jydx41:0 (Cdn Cache Server V2.0)..Connection: k
eep-alive..<html>..<head><title>302 Found</title&
gt;</head>..<body bgcolor="white">..<center><h1&g
t;302 Found</h1></center>..<hr><center>nginx&l
t;/center>..</body>..</html>..HTTP/1.1 200 OK..Expires:
 Wed, 04 Jun 2014 04:57:02 GMT..Date: Mon, 05 May 2014 04:57:02 GMT..S
erver: ngx_openresty..Content-Type: image/jpeg..Content-Length: 10123.
.Last-Modified: Wed, 23 Apr 2014 13:15:44 GMT..ETag: "5357bd00-278b"..
Cache-Control: max-age=2592000..Accept-Ranges: bytes..Age: 1..X-Via: 1
.1 zjjx161:8080 (Cdn Cache Server V2.0), 1.1 jydx39:1 (Cdn Cache Serve
r V2.0)..Connection: keep-alive........JFIF.............C.............
.................................!........."$".$.......C..............
......................................................................
.................................I.........................!.1A.."
<<< skipped >>>


GET /act/51wt/html/wtcookie/?r=0.6403837481151036 HTTP/1.1
Accept: */*
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: game.51.com
Connection: Keep-Alive
Cookie: FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:36 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=81bef340b32dc309a62b5ddf5b1cf5a4; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: _51usi=8tEKiA; path=/; domain=51.com
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: poup_c=-1; expires=Mon, 19-May-2014 08:07:36 GMT; path=/; domain=game.51.com
Content-Encoding: gzip
14........................0..



GET /game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=4714 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.51img3.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Content-Type: application/x-shockwave-flash
Content-Length: 11420
Last-Modified: Tue, 18 Mar 2014 06:47:09 GMT
Accept-Ranges: bytes
Cache-Control: max-age=86400
Date: Sun, 18 May 2014 06:52:19 GMT
Age: 37782
Powered-By-VeryCDN: HIT from ctc-sa-1-1-c1111, HIT from utn-sh-1-4-c1131
Connection: keep-alive
CWS.ZU..x..\.|TE......9........A.!.....c..D9<I2o&o2#[email protected].../..
..x ........C`.]W..............I..............~...._"Il.$....Y.K.t}.f.
I..o..s/.c.p42yhiQ.P..S..b5....{....'.5yh(.h.X\.l...e.........&...*.5j
$F../.$.....YC.8..'[email protected].....@
......JJG.3..j....X....54.....Y.42..../...#.uZ<4..{`/..nM..A=..F&..
:}J.i...P.|1.].=..`.........CzlJcdq$....M.58...D.......:-R....Sf......
 ....9Z.]:.......$j.8.v"L....c..V.O..k......n3..........<t..1..%C.M
'(>...]..{M..... .2J @Q..Z..........:....I.....?..^...5.K*..jI..kS.
N.;d&eX%>Z..<.F.V.._.mhl.....h.N."RFu....fG..=f5.L.!E5.xC...U...
z">-...G0j~C,....t....wsT..h..>n....#..j.d..`,Z?#......,...R..i.
...i.j...b.z..n..v.hda$.5...3b.h.OH..`o.cz<|.n/.>...X.Q..p.Q.ieb
.~.......[.M.6..!......b..!.f..a.R.....:.qei4\.tK<..t...pM"....1S..
.-..V.`..G...t8}..^.].....xB.F8...D42......6c.......!h.......4.....M..
.....K....N.6.c."...A....."{C...:..A.........M.n....1C.Y..=hV..5....1p
.w....|..B._K`.bVcL?/N....R....'[email protected]:..p...k..eA.....n..#
...5..be.V.5..zF.:.oP..}L]L.E.c$..~......<.....G.....;?..B.huu2$;..
.E.U...F.\.?[...0W.....%...paOz..][...4.NvC4.(...t\tq\..00.N....U....p
..y..F=...JG......=..d.v.6.l.F..5.!.$......x...IT..#....V;.G.#5s.Mz.i.
..k...OD......qS.j....^A.FUS9.:K......q...}.,.`.8.P}......D..0]KhV.2.n
r.....z.&.-..#.S..cp.D:..E#..56.!.e.'K....3.X/........P8....]...l$..P.
....xf/.m..h.9YnF..r....8...e............8.t.....es.H.,...J....c.F...w
..u..5:...hd.......x...'...^{...#i./.G.;k...Zk..T'........u5..i.k.
<<< skipped >>>

GET /game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=8506 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://tg.51.com/market/game/shequ.htm?f_com=tgx2_14516
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.51img3.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Content-Type: application/x-shockwave-flash
Content-Length: 11420
Last-Modified: Tue, 18 Mar 2014 06:47:09 GMT
Accept-Ranges: bytes
Cache-Control: max-age=86400
Date: Sun, 18 May 2014 07:32:48 GMT
Age: 73402
Powered-By-VeryCDN: HIT from ctc-sa-1-1-c1111, HIT from utn-hz-1-1-c1131
Connection: keep-alive
CWS.ZU..x..\.|TE......9........A.!.....c..D9<I2o&o2#[email protected].../..
..x ........C`.]W..............I..............~...._"Il.$....Y.K.t}.f.
I..o..s/.c.p42yhiQ.P..S..b5....{....'.5yh(.h.X\.l...e.........&...*.5j
$F../.$.....YC.8..'[email protected].....@
......JJG.3..j....X....54.....Y.42..../...#.uZ<4..{`/..nM..A=..F&..
:}J.i...P.|1.].=..`.........CzlJcdq$....M.58...D.......:-R....Sf......
 ....9Z.]:.......$j.8.v"L....c..V.O..k......n3..........<t..1..%C.M
'(>...]..{M..... .2J @Q..Z..........:....I.....?..^...5.K*..jI..kS.
N.;d&eX%>Z..<.F.V.._.mhl.....h.N."RFu....fG..=f5.L.!E5.xC...U...
z">-...G0j~C,....t....wsT..h..>n....#..j.d..`,Z?#......,...R..i.
...i.j...b.z..n..v.hda$.5...3b.h.OH..`o.cz<|.n/.>...X.Q..p.Q.ieb
.~.......[.M.6..!......b..!.f..a.R.....:.qei4\.tK<..t...pM"....1S..
.-..V.`..G...t8}..^.].....xB.F8...D42......6c.......!h.......4.....M..
.....K....N.6.c."...A....."{C...:..A.........M.n....1C.Y..=hV..5....1p
.w....|..B._K`.bVcL?/N....R....'[email protected]:..p...k..eA.....n..#
...5..be.V.5..zF.:.oP..}L]L.E.c$..~......<.....G.....;?..B.huu2$;..
.E.U...F.\.?[...0W.....%...paOz..][...4.NvC4.(...t\tq\..00.N....U....p
..y..F=...JG......=..d.v.6.l.F..5.!.$......x...IT..#....V;.G.#5s.Mz.i.
..k...OD......qS.j....^A.FUS9.:K......q...}.,.`.8.P}......D..0]KhV.2.n
r.....z.&.-..#.S..cp.D:..E#..56.!.e.'K....3.X/........P8....]...l$..P.
....xf/.m..h.9YnF..r....8...e............8.t.....es.H.,...J....c.F...w
..u..5:...hd.......x...'...^{...#i./.G.;k...Zk..T'........u5..i.k.
<<< skipped >>>


GET /qs/201311/14/a0f28380bff75d736886324a.jpg HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS/1.2
Date: Fri, 11 Apr 2014 00:07:49 GMT
Content-Type: image/jpeg
Content-Length: 5374
Last-Modified: Thu, 14 Nov 2013 10:21:43 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
X-Cache: MISS from xnop014-CT-JSNT-29-239.fastcdn.com
Age: 3226048
Via: SX-119-115.fastcdn.com (DLC-3.0), CT-152-226.fastcdn.com (DLC-3.0)
Connection: keep-alive
......JFIF.....H.H......Exif..MM.*...............d...........F........
.......................................................(...........1..
.........2...........i.......................z..'....z..'.VVV.meitu.co
m.2012:12:18 09:30:38...........0221.......................d..........
.F.............................N...........V.(.....................^..
.........B.......H.......H..........Adobe_CM......Adobe.d.............
......................................................................
..............................................................F.d.."..
..............?.......................................................
...................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....
&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw..............
..........5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..d
EU6te......u..F...............Vfv........'7GWgw.................?.....
..Z. v..^._...%W.L......m......-.........................?.W.7..zU~.~.
..|..]}...T{~^......9.a...._e..E.....u..^o..(p.i.p..y{P...<WR.....C
.7k.......*.q.pU..0H.....c.?..T.gQ.....u...c....|G'3......>ib......
8..P.....Lp....zU~.~...W.7........tg5........<C.};......u.W...S....
C[fMM..d..?I..\.k...C,D.x.VO....7.*.q.pK......5..>.t.......7O.K}.XG
j......7..E.^...W.7..zU~.~..?..Zz....}.R.............>...~........ 
.^.7.H .A.....#d.y....j...RE.......c..3......8#bb.......y..?I..7..8Mef
,f......6.m...}......i..S 9...."8.\o....v.#5^.OBNA..........]..?r...:.
.^.}0\O....V..F.[............F?.......?.........?....../......l.._
<<< skipped >>>

GET /qs/201405/13/3bbae0f3b3dc18c86886324a.jpg HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS/1.2
Date: Tue, 13 May 2014 10:56:59 GMT
Content-Type: image/jpeg
Content-Length: 1475
Last-Modified: Tue, 13 May 2014 10:54:59 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
Age: 421857
Via: SX-130-250.fastcdn.com (DLC-3.0), CT-152-226.fastcdn.com (DLC-3.0)
Connection: keep-alive
......JFIF.....H.H.....0Exif..II*.......1...............VVV.meitu.com.
...C................................... $.' ",#..(7),01444.'9=82<.3
42...C...........2!.!2222222222222222222222222222222222222222222222222
2......>.>..".......................................5...........
..............!.1AQ.."#Baq...2..$%Rbr.................................
.&.......................!1.aq...."A..............?._........iy....K..
...Ulk.0.<r.3.....w....y.}.B......H<.Y..|i<.e....'.v....n..I.
.jO,i)8.?.)......#]&.s5v39.C~.pTI(..`j.:."58W.4......NQ.=2...A........
,.......4lo..?.,..!....oH....u..._j..y.*..,l..0.......P....!.e;/q..Z[.
..OC...^f......N.. ..o!....[.g..."!!>a.y...H.P.,'.X.$....R.z../..#.
.k...[ei."........};(~...z..JO...:...5s..r./.e.....KR..jq....Vu....Z..
w.........w..!.^.... ....N..sT46..'..i..YR]....t.....m..iH..i-'..=I.2.
tc..4:..G.......^df;..?J..6s.$..CC..S.......i......F....^...Qu.4..6.ep
HC....1M...eIy/..4..5.C.$l8.V.#.:}p...-V.../..)....$.YW^J.Q.X6.<.R^
....4....HI....H..........E...S.W....n.=..B.a@'.......diOz.......U.0/)
.p.}.).....i......(M.J..;.K......=......E.U..l<H.3;.}.....g8*..b3..
.g...f..D..][email protected].....^..>[email protected]&%G |E...sVK<...z../.@}/
.|OJ.B..8...,m.6=#~..L..[.\F.l.8....b=?#.....] _..Dc:.......lYM.M.C..`
4...(J..X.}......#....F...Bs...b...o.D..E.....)C..N....?.....e9!m.;HI.
..IHG@~8..0....a.P........ m.....LCn-E.. ......,r..o......Dw..........
......V.Qy<0u......?.....v".........W,....Z..v_..6k.. w3*\...V.....
..>..8~...W.@[email protected].@...:.$.s......
<<< skipped >>>

GET /qs/201404/25/5711d2fac10ecb246886324a.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS/1.2
Date: Fri, 25 Apr 2014 06:54:59 GMT
Content-Type: image/png
Content-Length: 53656
Last-Modified: Fri, 25 Apr 2014 06:53:51 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
Age: 1991577
Via: SX-70-137.fastcdn.com (DLC-3.0), CT-152-226.fastcdn.com (DLC-3.0)
Connection: keep-alive
.PNG........IHDR.............s.......IDATx...w.]Wu/.]k.s......fTl.....
l.6.6`...$/$......B........$y.......QlK6..,.V....h4...{.............~.
...s.=e..W..F..g.." .......L. D."...`B.............0...... ......|:...
..q......H....sG.`........d.$..H..j..N.&..[@...0..........{......`....
^....?"....c.o/B..O./..w?7.~6...[#" .I.....i...1......aD.."Bp..=l/K...
{'...........}.... ..#3...;/,.. ."........e@..."....A~M,...........f.%
..Db....Us.J....y2p...[.`..&.%%....W..7Dp4' 0.O%....P1 vO..........CKz
.,...=YI.......?S..D...rxw...'\..G.......". [email protected]~...0."v..r. .I#
.s....:`..^[email protected]...!...g..1D... ]*[email protected]........
..1L.nt..2.v.0.........(.0.!..2..)%..B$.>....D...b$.b<'.,.d.U<
;....%J.^....^0l..H...=....o.v.T_..M..G`:.!...f.G "R}........{........
 U.p.....z..............b$.]. w.xe..........%5...x...'..Ld..2H.3...D;.
...R.:..t.W.X.D.L.$Y...qG..v......D..*.q..D...3.c.6.9h..P...I. 4./....
..gW^..mo......j.....T3uO.........9...P..lW...L.k..r...C..6... ."'.<
;....D..).%T].=...Q.gP...&...3.1.0..X.i..I..<.5. V,S'.....g...*....
.j......8.c.3....C."...V. !b. .....h..F.<cV..%..B.T..5.!&T4J....pZ.
..6X.^.5`d.5..9.m8G....H`.....Izg..3U..E.>.....d......Y20.r........
.6....a..`.. ...#1a?...}C..Jy..HD...8.*N.$?.D`".!c.............^DzB$..
aIi.1.9.&./..0i...0mn:..h...:bV....6.y.....-5....A....H.......D..j....
6Y ......."U.hfGjd...A....L.F..b...2ZR.]. D.<...2.:g..5...d..r.o.PH
......m.!..S.V....].T... .yb....Z.A...h.2..D...j..d.^q....^..$hNAa'&1D
)5X.e..B.h.z.1.d.i.o[..q.J...u1V.sK.f..0..& ...)..ih#uyj..lE......
<<< skipped >>>

GET /qs/201404/25/f1f51d8b645559506886324a.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=topicLinkR
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS/1.2
Date: Fri, 25 Apr 2014 07:05:59 GMT
Content-Type: image/png
Content-Length: 2842
Last-Modified: Fri, 25 Apr 2014 07:05:04 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
Age: 1990917
Via: SX-70-135.fastcdn.com (DLC-3.0), CT-152-226.fastcdn.com (DLC-3.0)
Connection: keep-alive
.PNG........IHDR...............Q*...;iCCPicm..x..SwX...>..e.VB....l
.."#[email protected]....(.gA..Z.U\8.....}z............y.
....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W
. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@
..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H...
....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o"&
gt;!.........N..._....p...u.k.[..V.h..][email protected].<......%b
..0..>[email protected][email protected]..#......)..4.\,...X..P
"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ .
..........\...L....D..*.A..............a.D@.$.<.B........A.T.:.....
........18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.
]H#.-r.9.\@.... [email protected].]...k....=.....K.ut.}..c..
1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.
'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m..
..... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%
...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2.
.g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_
.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.....
..9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.
c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x
.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..
J.6.....|...M....V>VyV.V..I.\.,.m.WlP.W...:........v.m.....).).
<<< skipped >>>


GET /vataplan?framId=topicLinkR&f=s&cur_page_num=0&rep=1&tag=99&vataposition=QNR_Zjc=_CN&vatacon=&rows=1&qtype=js&vataframe=bannerDefault&callback=QNR._AD.topicLinkR&ab=b&tile=14003829506057166236&city=北京 HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: a.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: text/plain;charset=UTF-8
Connection: keep-alive
Set-Cookie: sn=1400400474_1; path=/; expires=Sun, 18-May-2014 16:37:54 GMT; HttpOnly
Content-Length: 958
Server: QWS/1.0
QNR._AD.topicLinkR({.  "response_stat": {.    "elapsed": "3669",.    "
url": "notshown",.    "stat": "success".  },.  "key_data": [.    {.   
   "description": ".............................................",.   
   "e": "ZUsmGH7FtVOS/8vZIri5mSboeEECk0xHlFTby3Fo6TFXO56HaDlZjn85W0ffl
jk5HXASA1uVVnZ7KGY8Ob2CKhkNDW0sdBVseUfYkv gFN15cBfMTNWG6SFhJ58LNZRd7CB
QaS8XM6AxNn/EIoMqwRcUgBiqACCnMlXEIXNDQ mdVNOTIkJqN9RUeDcHaeoKmCY9Z7kPF
GOsf9 jOaeR0Ghgn1M7jtKsaEtz t9NzT8KZGikShHtIkhOCZS0uyOiJUkiDyJC4NpFWWj
mAU60NUpoHS2 tQE4V0pKYAwalgb0B0YgoCF4jXX6FoiIDClVtlGE1Z62IZTG4RttuAMtj
829es2vNAHQEsFJLxct/ sezqb/ZzhOM6VLyFUcDB/ 46s0M7ndgueJAwRuliRcsqq  nL
 pU/aYA/LO9JXD22SjFNXk2xf0ia5dHZGE2ToK6MyWcVXjImHRNET4GCgCgFxdW5hcg=="
,.      "img": "hXXp://img1.qunarzz.com/qs/201404/25/f1f51d8b645559506
886324a.png",.      "show": "VVV.qunar.com",.      "title": ".........
........................",.      "cus": "",.      "s": 5068442,.      
"margin": false,.      "phone": "".    }.  ].}.)....


GET /vataplan?framId=ifrCataAd&f=s&cur_page_num=0&rep=1&tag=99&vataposition=QNR_YTU=_CN&vatacon=&rows=1&qtype=js&vataframe=bannerDefault&callback=QNR._AD.ifrCataAd&ab=b&tile=14003829506057166236&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: a.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: text/plain;charset=UTF-8
Connection: keep-alive
Set-Cookie: sn=1400400474_1; path=/; expires=Sun, 18-May-2014 16:37:54 GMT; HttpOnly
Content-Length: 138
Server: QWS/1.0
QNR._AD.ifrCataAd({.  "response_stat": {.    "elapsed": "3222",.    "u
rl": "notshown",.    "stat": "success".  },.  "key_data": {..  }.}.)font>....


GET /vataplan?framId=ifmRightFlightOwner&vataposition=QNR_ZTU=_CN&tag=99&rows=1&cur_page_num=0&rep=1&f=s&callback=QNR._AD.ifmRightFlightOwner&ab=b&tile=14003829506057166236&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: a.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:55 GMT
Content-Type: text/plain;charset=UTF-8
Connection: keep-alive
Set-Cookie: sn=1400400475_1; path=/; expires=Sun, 18-May-2014 16:37:55 GMT; HttpOnly
Content-Length: 920
Server: QWS/1.0
QNR._AD.ifmRightFlightOwner({.  "response_stat": {.    "elapsed": "246
0",.    "url": "notshown",.    "stat": "success".  },.  "key_data": [.
    {.      "description": "..................",.      "e": "1E RFyF9k
CDQ404g5yDzT4uavMeE2gzq64ugYwAlyVv6IyCQXCw ERK8ZndzrdxhC pzKERtcWWYKb4
xD9l8xzvWkQJW6GoNNZZb/Apkz2FX6wsEjDb0DwBqk6foIW6iT7KJOT3wlxOJKMXb4UsX/
4G92SPxMC7PcubA50ADpSSsJTMp tr/cr Q37u4gdjsOalwaL9fbqGebtYp/z51ue0R53a
S9WazG6ipjjk4gdPsDQlMof32xHbtmxemxViqrLsM5KpwGg9zCk8gq0MKpNU0CR3ZAcs69
wikgA8HZwGypnlhR2tlsKwZL9J98YlqWKawNquJyMusbes3lhYT qB6AvipnOQx6ZLxsx0
GlQ12FRmj8mDbPXxG1urFyH/FrrcB4cBD5QwOWMe0aE/y WtGBPz8ekIIwoPJWJ8bnnNNH
/4b32XUDO38Xuj1JUf8Gu7dl4MYILRGvo7TTP OMXI=",.      "img": "hXXp://img
1.qunarzz.com/qs/201404/25/5711d2fac10ecb246886324a.png",.      "show"
: "flight.qunar.com",.      "title": "..................",.      "cus"
: "",.      "s": 3017953,.      "margin": false,.      "phone": "".   
 }.  ].}.)..



GET /BurstingPipe/adServer.bs?cn=tf&c=19&mc=imp&pli=9635822&PluID=0&ord=3954135100&rtu=-1 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://source.qunar.com/site/images/wns/20140415_flighthp_tbut_230x200_4211.swf?clickTag=http://qde.qunar.com/event.ng/Type=clic
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: bsch.serving-sys.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Length: 42
Content-Type: image/gif
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Server: Microsoft-IIS/7.5
Set-Cookie: S_9635822=4579094392256640648
Set-Cookie: u2=4efdcd51-5109-4a3b-892a-ac541f1e17fe3Zg090; expires=Sat, 16-Aug-2014 04:07:57 GMT; domain=.serving-sys.com; path=/
Access-Control-Allow-Origin: *
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Sun, 18 May 2014 08:07:57 GMT
Connection: close
GIF89a.............!.......,[email protected].;..



GET /0.htm HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: VVV.cfmogu.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:23 GMT
Content-Length: 7
Content-Type: text/html
Content-Location: hXXp://VVV.cfmogu.com/0.htm
Last-Modified: Sat, 17 May 2014 15:58:47 GMT
Accept-Ranges: bytes
ETag: "32172be3e871cf1:d3cb"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
0518Sp1....


GET /Ä¢¹½Í¼Æ¬.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.cfmogu.com
Connection: Keep-Alive
Cookie: CNZZDATA4693566=cnzz_eid=442332282-1400400449-&ntime=1400400449&cnzz_a=0<ime=1400382930105


HTTP/1.1 404 Not Found
Date: Sun, 18 May 2014 08:07:38 GMT
Content-Length: 83
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
<html><head><title>Error</title></head>&
lt;body>........................</body></html>..
..


GET /Ä¢¹½Í¼Æ¬.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.cfmogu.com
Connection: Keep-Alive
Cookie: CNZZDATA4693566=cnzz_eid=442332282-1400400449-&ntime=1400400449&cnzz_a=1<ime=1400382930105


HTTP/1.1 404 Not Found
Date: Sun, 18 May 2014 08:07:38 GMT
Content-Length: 83
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
<html><head><title>Error</title></head>&
lt;body>........................</body></html>..



GET /core.php?web_id=4693566&show=pic1&t=z HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Date: Sun, 18 May 2014 08:07:32 GMT
Content-Type: application/javascript
Content-Length: 802
Connection: keep-alive
Last-Modified: Sun, 18 May 2014 08:07:32 GMT
Expires: Sun, 18 May 2014 08:22:32 GMT
!function(){var a,b,c,d=encodeURIComponent,e="4693566",f="pic1",g="",h
="online_v3.php",i="hzs9.cnzz.com",j="1",k="pic",l="z",m="站&
271;统计",n=window["_CNZZDbridge_" e].bobject,o="https:"==
document.location.protocol?"https:":"http:",p="0",q=o "//online.cnzz.c
om/online/" h,r=[];r.push("id=" e),r.push("h=" i),r.push("on=" d(g)),r
.push("s=" d(f)),q ="?" r.join("&"),"0"===p&&n.callRequest([o "//cnzz.
mmstat.com/9.gif?abc=1"]),j&&(""!==g?n.createScriptIcon(q,"utf-8"):(b=
"z"==l?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" e:"hXXp://quanji
ng.cnzz.com","pic"===k?(c=o "//icon.cnzz.com/img/" f ".gif",a="<a h
ref='" b "' target=_blank title='" m "'><img border=0 hspace=0 v
space=0 src='" c "'></a>"):a="<a href='" b "' target=_blan
k title='" m "'>" m "</a>",n.createIcon([a])))}();.....



GET /vataframe/b.html?_=20120830&rnd=homeadSy HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 15 May 2014 10:35:28 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /vataframe/b.html?_=20120830&rnd=ad_home_leftAD_middle HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 15 May 2014 10:35:28 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:55 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 15 May 2014 10:35:28 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /vataframe/b.html?_=20120830&rnd=topicLinkR HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:55 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 15 May 2014 10:35:28 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /suggest/livesearch2.jsp?lang=zh&q=北京&sa=true&callback=top.XQS_1400382952605 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:55 GMT
Content-Type: application/x-javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: QWS/1.0
84..top.XQS_1400382952605({"userInput":"......","c":0,"result":[{"type
":3,"country":"......","key":"......","display":"......(BJ)"}]}.);..0.
.



GET /xm/2013.11.261.gif HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://p.tuigoo.com/showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 115.236.19.58
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: 38379
Content-Type: image/gif
Last-Modified: Wed, 27 Nov 2013 01:42:51 GMT
Accept-Ranges: bytes
ETag: "98ad3afc11ebce1:79d"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:42 GMT
GIF89a...........jQ..nonN...1v.H5(...............`..................d.
...s.P...&.....k..VkHUD//%%mVEiL5s.nN..................V.......-jto.-.
......wd..y...mroKrt0"..F.\..........wRLH....$......X.....q...........
....Oc4.yi.............c.........wl....h.....e....wT...dw4..j....1...}
.....v,KO..y.YL..R......@ .2C..C....$Xe............G...GO..Yl.........
..N............. ....(0....7B..................R:?............Tj......
..\=.7.......&..<...v.iV]./......mCW..i.....P.................Se`7-
I\a.......{p...r..V.....W.}................Qu......}<g....UN....-..
............... .`{.F.!...[...ay......}...............................
..............9.......................................................
.............................................................C.....\..
!..a`..._}R..Hº!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehi
HzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="A
dobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> <
;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> &
lt;rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1
.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" x
mlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.
did:12278B547F56E311BDF0D3EE77448737" xmpMM:DocumentID="xmp.did:B9A0BE
11568111E396F2887EEF4C264B" xmpMM:InstanceID="xmp.iid:B9A0BE10568111E3
96F2887EEF4C264B" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:15278B547F56E311BD
<<< skipped >>>


GET /site/images/airlines/CZ.gif HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 1199
Accept-Ranges: bytes
Date: Sat, 17 May 2014 19:22:40 GMT
Last-Modified: Wed, 01 Jan 2014 16:35:24 GMT
Expires: Sun, 22 Jun 2014 19:22:40 GMT
Age: 45914
X-Cache: HIT from qunar_cdn_02
GIF89a................................................................
......................................................................
......................................................................
......................................................................
............................~..}~.|}.zz.yz.uu.rs.pr.pq.mo.ln.lm.kk.kl.
km.ll.kl.jl.hi.fg.ce.^`.^_.YZ.WY.WX.XZ.SU.ST.QS.MO.MN.LM.KM.KL.JK.JL.J
L.HI.FG.DE.DD.DE.BC.CE.BD.?@.<<.<=.;;.9:.78.7:.23.24./1.,,.,,
.').$%. ". #.. .......................................................
......................................................................
......................................................................
......................................................................
....................!.......,...............H...C..*\(0H..74i...H...Q 
R....=...B..#A..:. h.S .&....A../.6`i.. ...Dl.D....1.......(.....%...8
p.PX...L|R..4E..I&L....J...........J .XQ...B...9E.)...H..P....~.......
....j%C .N..DPQH..-C.d.`....yPqb!...2;..p4.A."E.4X.(..2N.0...M.....y..
'....40#D...p....i....b......%#.?.....p/....`...*@,...K.pE..a.B..Tp...
........ \... .......`..n..H(...J#..AA..$..(4..J"..'....".(.D......B..
......9..!..@L...;....


GET /site/images/flight/home/ico_arr_ad.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 05:52:33 GMT
Content-Type: image/png
Content-Length: 247
Last-Modified: Wed, 02 Apr 2014 08:00:04 GMT
Expires: Mon, 23 Jun 2014 05:52:33 GMT
Accept-Ranges: bytes
Age: 8122
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR...$...#.......X.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE....i...............9~....tRNS.............iIDATx...1.. .C.
i.......C......m..A0*x......yA...J.'o:oOG...F...A\)B3.@.!V......c.Xy..
.6.u%..7....n...G.......!3.}....IEND.B`.....


GET /site/images/wns/20140415_flighthp_tbut_230x200_4211.swf?clickTag=http://qde.qunar.com/event.ng/Type=click%26FlightID=108395%26AdID=206888%26TargetID=6878%26Segments=13,28,50,132,148,373,530,534,535,536,539,540,541,542,543,544,545,546,548,549,550,551,552,553,554,555,556,558,559,560,561,562,564,565,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,586,587,610,611,1101,1102,1143,1183,1831,4054,4648,4649,4676%26Targets=5302,29,208,1504,5800,6878,6419%26Values=34,46,51,63,77,80,101,110,150,204,217,228,243,250,252,269,301,305,320,5402%26RawValues=%26Redirect=http://bsch.serving-sys.com/BurstingPipe/adServer.bs?cn=tf&c=20&mc=click&pli=9635822&PluID=0&ord=[timestamp] HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 07:48:29 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 48067
Last-Modified: Tue, 15 Apr 2014 10:15:08 GMT
Expires: Mon, 23 Jun 2014 07:48:29 GMT
Accept-Ranges: bytes
Age: 1167
X-Cache: HIT from qunar_cdn_02
CWS.\...x...gTS].......R. U.JU......;"5..z/.. ]@@@@.....$....H......Dz
..D...3.8...........7.k...\k....{..g.. ....R<.H....)IIIe.(.....9...
...b......r.y...^:.~^.A.N..^......G..`.ao.e..q.......U\@n..........<
;l\....o.3{.@..\.?...............y.:.y.{..\.E=.=.l..........An..6v.d..
C.............;..[E..M......<v..x.xS..aG&./oE.[........)4....@..(..
.....3..)..3..Rh.3.4..5..c..C..B.Pj\.<...)........)x.w]j.....mW....
P....)..&........3...o;..o......Z..j1.....5....._.{.%...8>>..0u.
..~.e......j....).....'3....>.........t......S..y.W./.M...../.5..)r
1..P>.D.=.;..*.....:CCCCK{.,=#.=..=.....9...8.88....^.......{C..-))
)n.;..%..$.$~..............k..$......n..T.....S..<MEMs..,..@.....%.
...TT.O..`....Hu...{.......3J.%|<.{....^./>.g....ef..../ x......
..;r*.T...jh...........;8:..=..}|...^.|...:2*1.mrJ.................Dm]
=.k...............q.....~~..............o......._.u......)O..........O
S].E}.......<.ag..'|..B. .....G.Yf>.i.........c......c..5.L!$...
.G............C.......\<......<......)..P..l.a.zJ.r.Q^...y...3..
..G..f_..).N...R.M..\.Re.^..,..n#f.,..s.jU..7.l%...x^...8.2..LPZ-....=
9.h..m..39Qy..2.)....q.....g...W....,ki7>bw.U}ln1.....x]..ro.4..>
;%W......iM)....c..c?....9.j..4......_.........Am.sb.....W...o 7Z..E..
...Z.FxJ.jK.6.|t...>s..}.T>.0.p04%........."..Yq/j..~JM.#W.~&Z..
.i.J..y...~_n@......<....A.$}ug....{..2"..._*O.^_.MUO.}.e.x...^....
{&u..;.;/...ww.*i.v.&-e....U7.......I5....\.....K ..&m%...........>
.N%...b.2q..K...pE.I..2..>...05.>\N..?.g....@..............)
<<< skipped >>>


GET /common/hf/header_v10.png HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg4.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 8472
Accept-Ranges: bytes
Date: Sun, 18 May 2014 02:17:39 GMT
Last-Modified: Fri, 14 Feb 2014 06:15:04 GMT
Expires: Mon, 23 Jun 2014 02:17:39 GMT
Age: 21001
X-Cache: HIT from qunar_cdn_02
[email protected].$....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE.........YSQ...:::...................................|...j.
...................}}}...F...........nnn.....B.........NML............
............)........,.....|..sssd..D....T.........!v.................
....................#.....................f...........................
...........................................X..........................
..................vom`__........'....................tRNS.............
......................................................................
.............................................8.Kg....IDATx......HR..F.
.^.#%..D`...8.....y...S.c.o0...=.3q.M..=..S...Z/?.dQv..;c.V..U..U...(.
......_....&z........x..>..2._>.........{ .p....k_.._.........t.
...?...O?.*y._....0.y.hG..l... _......b..N...d.V^b.?..r_..............
.......A.\.q)Q"j...".\}....k..k.......}q...H..P........i..a}.|.>...
.m.9;I..{;.].O.r~.|.<....4. )....3.....S......?y.5.....n ...$..D..L
?.rqr...^.9;)..>.&.... ....y%........I............3.; ......$z{..O.
.........."....6.*@.Or.A..0.y.fK....m.(..R=..F8...>r...J.~......i..
.U2i...!.![._K.......D..A. T...S.$l....p..t .8..{b..L(..f.S..^.}.*.<
;...^......M...m.?.~?.$.a.|...".....N....#N^.Zszz.:?K4.b.v.<......C
..H...j.p.S&g.'.8.~..-...(].........[8 .yy.s..y.$.7...Y.r&.(...l&G....
b..j.....e.....`B.C.....}%.h>.....\>.:..?....|.....?C...{......Y
.....{.2...'..o...U.a...n.'y....dM~(~.|t.u~..7.r.e.s.$......"..)...O.r
.N.|sJa.?x.{..b_....2?.D.7w...QRZ<x.......s9.w.no.Z.......2....
<<< skipped >>>

GET /common/hf/arc.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg4.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 153
Accept-Ranges: bytes
Date: Sun, 18 May 2014 02:17:39 GMT
Last-Modified: Tue, 15 Apr 2014 08:15:04 GMT
Expires: Mon, 23 Jun 2014 02:17:39 GMT
Age: 21005
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR.....................gAMA......a.....sRGB.........PLTE
.....^.....: [email protected]...!IDAT..c`d``u`..`..a..............'.. ...
.....IEND.B`...



GET /app.gif?&cna=RVj/Cy0IRhYCAbhrJiY9QmtQ HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pcookie.cnzz.com
Connection: Keep-Alive
Cookie: cna=RVj/Cy0IRhYCAbhrJiY9QmtQ


HTTP/1.1 200 OK
Server: Tengine
Date: Sun, 18 May 2014 08:07:40 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=RVj/Cy0IRhYCAbhrJiY9QmtQ; expires=Wed, 15-May-24 08:07:40 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..



GET /act/51wt/html/wtcookie/?r=0.40957646330132047 HTTP/1.1
Accept: */*
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: game.51.com
Connection: Keep-Alive
Cookie: FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:36 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=5738518114d7276b02fb5a26711f1638; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: _51usi=J2QzsH; path=/; domain=51.com
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: poup_c=-1; expires=Mon, 19-May-2014 08:07:36 GMT; path=/; domain=game.51.com
Content-Encoding: gzip
14........................0......


GET /act/51wt/html/wtcookie/?r=0.015887030635915677 HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/market/game/shequ.htm?f_com=tgx2_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: game.51.com
Connection: Keep-Alive
Cookie: FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:37 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=92df9055726bd7e1e8cc1d389b32d797; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: _51usi=g7LuIL; path=/; domain=51.com
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: poup_c=-1; expires=Mon, 19-May-2014 08:07:37 GMT; path=/; domain=game.51.com
Content-Encoding: gzip
14........................0..



GET /img5/flashlayer/533138d44ad23/1.swf?v=3 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://cdn.51img3.com/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=4714
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.51img5.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Content-Type: application/x-shockwave-flash
Content-Length: 16588
Last-Modified: Tue, 25 Mar 2014 08:05:40 GMT
Accept-Ranges: bytes
Cache-Control: max-age=86400
Date: Sun, 18 May 2014 06:21:12 GMT
Age: 39936
Powered-By-VeryCDN: HIT from ctc-dg-1-1-c1111, HIT from utn-yz-1-1-c1131
Connection: keep-alive
CWS..H..x....\R..?~@1g..../1...{Rii........R..KS...2...hV^.4.o....f.m.
.NMAi.jef.ZS.........{......w.s......~.....u....<..`.!...y#. ..Xn..
....c<....C..&.x.o.6.<.~.'....:.\..................pHIK.E.rHH...
..J..N.$....%&`..#..Sy.66..=.o.?b.R.#w'FE;r..9............y|....KLf$&.
."k[a.{#Sb........ >r/...DG"......w7v. q.....o...........y.. ....At
. ....=..........D."wG.".Kg"......;....uO.....?......N.I..3.........{.
-.....7z_t./.(.eQ..9.1..."y^......Dj.:.rH.M....<....U.F..5.....Y@..
....9..:......o..H.............m.r....-.)...N..o/p.1.n.......6...l....
..e.:.....Wg7o......u....-.;....._.v..H....K....'.8..'u..L..#...F'....
MMN..h....).ZMy...*...........w......v..L..t.[Z.....?E`.1........_0...
../,,t...D.......5b].\".d...{..B.~.-T............2.k.e..,W;....t....Nk
=...v..&v...........n...C.e.Z.......V.l9....m.../\.>.43.X..........
..j......=.....\=<._6.u].a..V.......8.....H....p.......?........l.a
.,..b....c....r..W.$...?......D....g.p...t...!C..........x5i{.....g...
....WR...^[email protected].%.K4!"Yx}<$......*...........7~....=..l.......n..
..6.......>.Sk0...!...M.Z_.=P.:.!,ef...[.W.=9.S.?.1..Uj..;....n.7G)
....3..w.i>.W.^}?........W......}.U..`&.|.)E6.d/.....~d..x~.=.e....
.l.7...x....T......'._Z....]..|.v.h..h.........J....v..?.}C.x....3 ..c
.S.5Z.Q1.2~v....]...y1..2..C;..G)m.....<...Q.;."4.lK\.'UY.....m..T/
.}...t../.wi..9).t.....q.bI.....B.)........v..p.._g...j.Y9......g^L...
..<*.s...].#.B,....m.zF...y..\96.~L...1.......^).....4.x2.cM.41.)M.
.ONoRlj<.....<.LF...O........a....r.TJ}.9/....=q2...Li.I...E
<<< skipped >>>

GET /img5/flashlayer/533138d44ad23/2.swf?v=3 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://cdn.51img3.com/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=4714
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.51img5.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Content-Type: application/x-shockwave-flash
Content-Length: 144447
Last-Modified: Tue, 25 Mar 2014 08:05:40 GMT
Accept-Ranges: bytes
Cache-Control: max-age=86400
Date: Sun, 18 May 2014 04:53:04 GMT
Age: 78720
Powered-By-VeryCDN: HIT from ctc-dg-1-1-c1111, HIT from utn-yz-1-1-c1131
Connection: keep-alive
CWS.8...x...eT]K.&.qww.....l..N..q.8!@pw....!................u.w....=.
.c...|.SO.YkU.... ....W.... .......0a..AG.3~..)r7.k[0.KO.....=?.... . 
....9...... ;.;;.....n.d..d..|%L....)...d....%..74.sv.z..7.....hm...&v
F...v6,n..,l..,.x^@.....Nv.jvv..b.P.R..`....vf.`....5..*.3.9...3......
K..........G..........K.................."..U0u241t2...\/1..l...7..p;.
....).o$. .....ZvM...\{gG.?*fb.bjmjcj..~I0...61.7.s.1t.6......."dqc.[.
.[....2..J. ....UI/3SP......./4.I..................M_.........-.....TF
B........K.a.|..-....$.....1Vq6IvVN.).7.o.......&ag.. o..L._..#./6%G.9
.e..g.b.5...._ZM.A..&R.v6.T....l. SB..J..4.._~.................C._lv.;
i..R...0...?_.,......q....6...G$.`;.y'[email protected].<.K.B..c.B........R
2R..._...y. ........F.EBF...y.!".a."##..................Q..^:.h.../Vr.
../..88tr|8.B._..2..._..>:!...zn.`.C.@qCA..@b@@a@<w.._t.@.......
.......k.......FB..............e.S..~e......G..f...]U3..........cb....
.N\.$>.v..ZB..?... 7/......{./.e......]....^||.....K. a~.|.b`R.A..)
;...0.....:..A.F.q....h.J..y...K*[email protected]..................=7........G..
..r..h.S[[email protected]..<..sR
.c.._.T7..|.,....5.a...Za....B...R9y.e0..pegY.g....})...........1"h...
.U.."....a [email protected]).}*...Q.e.....A.....TsH.4.AI.}....U.T.....
<s.y..:.2...0.W.}.6...Mh}..q&..d....e..s..a......3-6......6(p.....7
[email protected]..?..N...3.........^S.7y ."7]2X.I.a...!...=..n...f...........
.n,T...............o=]U] #w'?p..;./........g.P>.<.>..O...i?g.
=....{./H.G.g..w..\..<$.3....2...l..p.... ..........i.l9.^.<
<<< skipped >>>

GET /img5/flashlayer/533138d44ad23/2.swf?v=3 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://cdn.51img3.com/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=6256
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.51img5.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Content-Type: application/x-shockwave-flash
Content-Length: 144447
Last-Modified: Tue, 25 Mar 2014 08:05:40 GMT
Accept-Ranges: bytes
Cache-Control: max-age=86400
Date: Sun, 18 May 2014 04:53:04 GMT
Age: 78722
Powered-By-VeryCDN: HIT from ctc-dg-1-1-c1111, HIT from utn-yz-1-1-c1131
Connection: keep-alive
CWS.8...x...eT]K.&.qww.....l..N..q.8!@pw....!................u.w....=.
.c...|.SO.YkU.... ....W.... .......0a..AG.3~..)r7.k[0.KO.....=?.... . 
....9...... ;.;;.....n.d..d..|%L....)...d....%..74.sv.z..7.....hm...&v
F...v6,n..,l..,.x^@.....Nv.jvv..b.P.R..`....vf.`....5..*.3.9...3......
K..........G..........K.................."..U0u241t2...\/1..l...7..p;.
....).o$. .....ZvM...\{gG.?*fb.bjmjcj..~I0...61.7.s.1t.6......."dqc.[.
.[....2..J. ....UI/3SP......./4.I..................M_.........-.....TF
B........K.a.|..-....$.....1Vq6IvVN.).7.o.......&ag.. o..L._..#./6%G.9
.e..g.b.5...._ZM.A..&R.v6.T....l. SB..J..4.._~.................C._lv.;
i..R...0...?_.,......q....6...G$.`;.y'[email protected].<.K.B..c.B........R
2R..._...y. ........F.EBF...y.!".a."##..................Q..^:.h.../Vr.
../..88tr|8.B._..2..._..>:!...zn.`.C.@qCA..@b@@a@<w.._t.@.......
.......k.......FB..............e.S..~e......G..f...]U3..........cb....
.N\.$>.v..ZB..?... 7/......{./.e......]....^||.....K. a~.|.b`R.A..)
;...0.....:..A.F.q....h.J..y...K*[email protected]..................=7........G..
..r..h.S[[email protected]..<..sR
.c.._.T7..|.,....5.a...Za....B...R9y.e0..pegY.g....})...........1"h...
.U.."....a [email protected]).}*...Q.e.....A.....TsH.4.AI.}....U.T.....
<s.y..:.2...0.W.}.6...Mh}..q&..d....e..s..a......3-6......6(p.....7
[email protected]..?..N...3.........^S.7y ."7]2X.I.a...!...=..n...f...........
.n,T...............o=]U] #w'?p..;./........g.P>.<.>..O...i?g.
=....{./H.G.g..w..\..<$.3....2...l..p.... ..........i.l9.^.<
<<< skipped >>>

GET /img5/flashlayer/5360b616f2691/1.swf?v=3 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://cdn.51img3.com/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=8506
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.51img5.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/0.7.66
Content-Type: application/x-shockwave-flash
Content-Length: 36744
Last-Modified: Wed, 30 Apr 2014 08:36:38 GMT
Accept-Ranges: bytes
Cache-Control: max-age=86400
Date: Sat, 17 May 2014 21:42:32 GMT
Age: 73862
Powered-By-VeryCDN: HIT from ctc-dg-1-1-c1111, HIT from utn-yz-1-1-c1131
Connection: keep-alive
[email protected]@@.. ......#..).C.B..4.iR"-..%D..*.B(B...B/.$?
............ore.y2k...^ k..3......d!..;.@.....@..).....79S.-.P_..@.. E
.....r..!!!"!."..wQ...........>......r......R...A.5.9..q.'....kG'0$
H............(...vr.q....:>..../......z..c.8....QR.C.S..1...8.....x
.....n&%".).....q....R..?u...U...$~_LR......s1.9.I9Ii...r....._$..j...
.....O.Rrb.r...Q....U....../)..$.............}.....b....>...~A.....
I.....8..1H...c.Og.?.EC..=...!....n... .o...!......mr__..I..........a.
]EM]....g.sq........_`.........."...rb2.b.......Z..bb.......55.....H..
[email protected].{.;..................@.}.......Z.`.?...1 .
......F..4.....?.$.&.. -v_Z.?..?......oH.......7........S......x..]Z..
aP...N~...).....8)..";o.....\}[email protected].:.........:z..L..(...8.
 [email protected]...'G2;..].......q./..!B...........I.<.VWKG..=._.g..
.6fNi.fn-i=;=i.[.B..G....U.e8.....Z..T........?@............. J......[
Z.K..?..G.A!}..]".D.FA.. .#..##u.X..IAF.......S\..x.'MK. ''#[email protected]...
@G~GL.....?.eI......~1..p...P.pR...\.....#..y..AG......_;....M.)J.H..k
...HGA.P...K.IH../V.a..._9.g.../....8...._V...#.../..H...:B.#}x$....AB
L%.z...I....4T44..?......'D..........'.x,...B... P.#u........6.....fOg
...|...ny.n...S.../.i.....#.....9I.....T=.W..G...;....no.a8..U....\..h
.{..:..;........{.p|..zb..I.....0.W..R.F...S...[5~.....5i:.}... KB.]..
|).......F.......<..7f........YN....A......T..(..M/..=..M..P.?0.E&g
t;C...s....$S.t...Qf....,9.Y.>(...&.n.C%Dl .......L..).....i0G.{.M.
.]...........|B.. ....%...n...2.....ap'...)D#G...U_U.e.y...{..s...
<<< skipped >>>

GET /img5/flashlayer/5360b616f2691/3.swf?v=3 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://cdn.51img3.com/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=8506
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.51img5.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Content-Type: application/x-shockwave-flash
Content-Length: 62159
Last-Modified: Wed, 30 Apr 2014 08:36:38 GMT
Accept-Ranges: bytes
Cache-Control: max-age=86400
Date: Sun, 18 May 2014 02:40:47 GMT
Age: 19629
Powered-By-VeryCDN: HIT from ctc-dg-1-1-c1111, HIT from utn-yz-1-1-c1131
Connection: keep-alive
CWS..'..x....\T..?~f............FRZ.n$....iDA.....NaPZ..P.. ......s..}
.....{...=0g.Y..w....k.....o......A..!9...g..................0.L.....Y
..............KHH..............fz.....N.r. c.j.b..f...A...prw.....{...
... ......v3'..[...\...H................$.."go.j....di....7..Hk...A. 7
.m..!<.|.9........#.........-...#.. ....SP...T.c...*.n...n....O....
{../...;..Xz.S..rB.s.....u..~.......c.f.......n...s....L......M.......
...q.............i...?...J.......wp.8.vu......]...-84,\..].,....CFEEX.
......BAF.A`..1.................................:...MO.d....v..f..@;..
.M.........*))--..-. .......]-\l<,..\.....l..j...(....f:......I....
?4=A3...qs.Jq.I..K..h..;rLr........p.O;.yHs|[email protected]$..=..K..O(.p...
.;..'.?...bh.8h.;".).....#.......%]lL.....$.....(......{.@!?....-.8.c.
..1...r.....t...l.....45C..X......q..M.1s.wr............[..Y.h:...8Z..
q.s.mt.;...c...R..........G...43C...:....d....,..z..h...Q._.q...\Q..dD
K......FDC........iDr........}......4..9_]=..`.y..4..c..?.'.w.GH.....c
Y"...`~O.M.T.=:...&J..Z..L.pd.;.`.J...`.....A&Ep..s.......E.p.&..g...:
b.<..2?.'.=..;....E......w..G#....1ge... ..m.y...1u9......F..S...p.
N<.5.1.p..n.=:.......h....J9=......Bwq....Jp..|..........g.5...N...
<#)..U......y......N....W......K2X..6......Q.......8d....H/s...h.4.
.n.W....[D.m6.;....:?rc....nf....om...........j...6.*....5...f.Po.....
.L..b;=i.y....`i.AX......C*g.D........Z..: r..?H..13....$f.b.."b..1...
.... .G..V....=8.=,.G.C...5. .?rD..#,...E....$.a.A..;e.]8......\.D..kt
.#.......i..K...K..b..M.4.H..raN.....j ._.....z.lR....^......."j\.
<<< skipped >>>

GET /img5/flashlayer/5360b616f2691/ps.swf?v=3 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://cdn.51img3.com/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=8506
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.51img5.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/0.7.66
Content-Type: application/x-shockwave-flash
Content-Length: 38332
Last-Modified: Wed, 30 Apr 2014 08:36:38 GMT
Accept-Ranges: bytes
Cache-Control: max-age=86400
Date: Sun, 18 May 2014 02:44:22 GMT
Age: 19415
Powered-By-VeryCDN: HIT from ctc-dg-1-1-c1111, HIT from utn-yz-1-1-c1131
Connection: keep-alive
CWS.....x....X.../:8..$8.w.\.;...A..|......Cpw.[...}p......;d..>..s
.}[email protected]... ......u........t.w.....hl.PgaNN.
....^.'WkNn!!!N..N..v8.;...j..........A...p.u..:9R?]..;.A.hh......_j.!
.f.N. ..'.NO3gNn...'=p&aiW....U...^\...Z...bC...........SKk.S.S....[R.
.r.r......$....pq..s..sqks.....s.Y......M.....U.A.,..f....s....is...y.
......x.).dik...%.......[$..c.............&.......r.qj. Nn.. 8;.?wGUUX
...5s..).............<....2.r.......<..\.2\..R......,..6.'.7..#.
..,._h.7......Z.....h..J.r.H..JIJ.rssK.H...y.x..|.<r..k.oT..V...;.R
......8..B@O....;TOa.._a...&.,.....4........[[email protected]._J.~.
 ..K._.[.om....?HN....?......G..?C..._.uvs..S.,-8A....A.(..S1,-...\...
.f.....fO.9=.!6N.`.3w...S........$...Aqj.4".4v.b.g......D...<...=.z
$..s.k.\ž9.....>=......(.....P10.......c..ccbb...a..b.SS..cb>.
x...O.. ...%.S....'%.hh...hX..O.......AH.KJ..8......q....h..x.Hx.....p
#......{ . !."...W.q..HH....X.H..H.?..(x/P._qKj......i...B...RZ....q5u
.t..9..D....2...y...[~.. $F.3..6..... Lx.....$....@@.....G........j...
...&...<$<....8$.=..........B..W.HN:1.K.|............p..._......
..9n.....~.y......yT...fl..X_($}."N[7_F.Y.....ZA.E..[.N.pv.cy"......z.
.)..my.../.I.W.......,...u1..xx.x.....IY.1......h.z.TS.S.W:.....e..Jgi
..p.....sc.e.Z...U...Q[Ul..N.7.i..z..._......"...X..j...k.1.)..^...(..
..|...'..0./..}>l.$o..$.u3....%]%.....3...7....^..H[.......N*fh."Ka
/.:..J.%......J.w/o./,OB...WT6...s7..,.....T...es.K. .....W..[........
:...:...K...ZB./.m....c.........X...6`.bD..1/...Fe..G_.8.I=k...\.!
<<< skipped >>>


GET /jump.html?p=20111931&from=offsite&wp=1&sid=214516 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.woxiu.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:37 GMT
Server: ngx_openresty
Content-Type: text/html
Last-Modified: Sun, 18 May 2014 08:07:01 GMT
Transfer-Encoding: chunked
Content-Encoding: gzip
X-Via: 1.1 fsdx18:2 (Cdn Cache Server V2.0)
Connection: keep-alive
2e29.............}i...u.g.W..A$M...e...'*z.E..%[.I.4...H.0....L..'.e..
q.$rN.b...<....,..~.5C.......K5..T.G.[..=@/.U..]..[.~...O...O<U.
..w*.x..<......j....j....*/....?[.[..b?....v..u......l...........!.
..w./.P=..(><..9...j......4y..~.;..i.Zk....q.|.|.>.......o.wG
.{;.O....;.|.. ..4....a|4...W ...?..;.ak.lT.~K.h?..x:...h..{...{.....^
.9.n....o=...]y.k_>.._.......;W...7O........?z...w............OWN..
.........x............o>|.]x......x......^G\7N..3....[....{o.......
..q......_=.......@_O....7^;..;......H.......O.....7.|.....K_=........
{...........r..G.~.....^..._.......~...I..../o........h..w|D>.....a
..v...H .......8..H.~6.G....Y...ie..i<.nG."[email protected]....
^..:..?..~%..Tn..._{/......fnj......`T.....6...[.7.:6.U.W...........6.
......1}...y..(...|....i.....x:iekp.i./n<..s....V._.....4.......:qw
w.../_..%~..p......v._........u.n.n.[.;....wk.......x8.w......g.f2...k
...... .5....o..\s7m.....u:.....].Sw]."....Z...We.....~r.....~|.ft.J..
..'k..].p.r~..........9..s...$S&.b=A|."<.\..9..[..K.y1.v....nWsf...
`4..H..=.;[email protected].^.3...L.7.{..r... C..<...n..s......
c....{,.&.[7]3... ...;B&...T.....~/a~.&....ll.........3v..5F. ..:.F.s|
k......r.c..s.....c..c5..ew...1._.u.B..U....V....>....../.F=.......
[..S..s..."..{.......N..?...I..z...>[email protected].....{.~..r..S.&
p:........_.....o}....GC...0.L.s......k. u........t..........h.{....#.
....>..ubw....n...c7..PwN............w?u..C`x....&...6'g.hx.....a..
..E..O...hK..Fo.zP....L..a..........j.2..a.......MI...#..4...R.'w.
<<< skipped >>>

GET /p/20111931?from=offsite&sid=214516&wp=1&cps=&r=80928328 HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.woxiu.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:37 GMT
Server: ngx_openresty
Content-Type: text/html
Last-Modified: Sun, 18 May 2014 08:07:01 GMT
Transfer-Encoding: chunked
Content-Encoding: gzip
X-Via: 1.1 fsdx18:2 (Cdn Cache Server V2.0)
Connection: keep-alive
HTTP/1.1 302 Moved Temporarily..Date: Sun, 18 May 2014 08:07:37 GMT..S
erver: ngx_openresty..Content-Type: text/html; charset=UTF-8..Transfer
-Encoding: chunked..P3P: CP=CAO PSA OUR..Set-Cookie: __x_wx_ww=1; expi
res=Thu, 04-Aug-2022 08:07:38 GMT; path=/; domain=.woxiu.com..Set-Cook
ie: __x_osite=offsite_56; expires=Thu, 04-Aug-2022 08:07:38 GMT; path=
/; domain=.woxiu.com..Set-Cookie: proxy=20111931; expires=Thu, 04-Aug-
2022 08:07:38 GMT; path=/; domain=.woxiu.com..Set-Cookie: __x_sid=2145
16; expires=Thu, 04-Aug-2022 08:07:38 GMT; path=/; domain=.woxiu.com..
Set-Cookie: __x_webpage=1; expires=Thu, 04-Aug-2022 08:07:38 GMT; path
=/; domain=.woxiu.com..Location: hXXp://VVV.woxiu.com/80928328?p=20111
931..X-Via: 1.1 fsdx18:2 (Cdn Cache Server V2.0)..Connection: keep-ali
ve..0..



GET /script/page/xiu/v3/game_v.5.js?20131104v2 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Wed, 13 May 2015 06:35:31 GMT
Date: Tue, 13 May 2014 06:35:31 GMT
Server: Tengine
Content-Type: application/x-javascript
Content-Length: 12739
Last-Modified: Fri, 14 Mar 2014 09:33:12 GMT
ETag: "5322ccd8-31c3"
Content-Encoding: gzip
Cache-Control: max-age=604800
Age: 1
X-Via: 1.1 tzwl34:8106 (Cdn Cache Server V2.0), 1.1 jydx38:1 (Cdn Cache Server V2.0)
Connection: keep-alive
......"S..game_v.5.js..\{..D...>E[xG.-..cfX.GM.x.\`p0.W....Z.-.Z.J.
yl{"`....c.]...]..`n...5......{f..~...*=[.y..&............eU.....~....
kKk.....1{.>X.........Wy.vt...}K....<]..E{._st.h......u]..W....&
..lvTW....~R..%W.ZvO.%.Z.X .:a.b..Fk.q...SW..!.N=;.....Y..>..)"X..:
..D"y.....d.e...?....wu...pYu"..x..<...'y}M.=/Z.6............p.....
.e.Vd....$.<S^...]=J...7.u..6K.c......U...#4.nu.n..4.Y~L..e.*....e.
.(....x=.Z..R...........%..u.~.e,.4S.<.slG.PM\...L].Z......M[[..FK.
. .m....$3......jX\snJ....&....|..pIW..Q.......p.R.yC2|.'.....*..... w
.]._*.][email protected].`...*:m. .../...p...R..,....P..Ee.Xj
O....~.......).q.RT....'E..JQ.N.Z....H1.73.a....u.GVN.....-....8...V..
../\..}i.7.m.....w.b0Ab.S.............q#jY#j##._|...o6o}<.......e..
....l\...;..\..._.v........_.0....PUp(.7...9.rrN.hax...._..........n..
UQ........sy..[..........thd7.B...2wN]V=.5...l.-.,6..mi.c.d.t.ZW......
...s.j.kn...y.*.nnJm.........$V0.y6.,.h..G..myx..|s...K....kt.>.}..
Y[.ct.6,. p".Z. .W..4..x.vx..dv.Y..hL...Qev....}...q.5K}.tL..dx.....{.
.R.o/K..J.N.QM..i..,..W...Uh...$p..%......}.'9..lH.9...R..].6U...F..;(
v.N.w.K.....<F.7$.g8..'.D.I3I..6rr.}.m......u....../.....E.U....44;
..9.{..z ...7k...F..w|U.....o/n\z9....'\-u......1..~...$.s{).L..[..9o.
.e...8).\......A#8...fy....d&.52.....5.....I.....d....tT.8....P......|
.....F.......m.._6?.........t`..{..}.9..".....W.>&.T..... .5(D.....
....z...}..L..Qz.(...........<.7|.a..T....?... ..H..A......>?F.0
.}....x*Jg..,..B..Yt..i...{z...L.....{..1w&.M......"B.9.#....4...u
<<< skipped >>>

GET /script/page/xiu/v3/sns_v.5.js?20131231 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Wed, 13 May 2015 06:35:31 GMT
Date: Tue, 13 May 2014 06:35:31 GMT
Server: Tengine
Content-Type: application/x-javascript
Content-Length: 12739
Last-Modified: Fri, 14 Mar 2014 09:33:12 GMT
ETag: "5322ccd8-31c3"
Content-Encoding: gzip
Cache-Control: max-age=604800
Age: 1
X-Via: 1.1 tzwl34:8106 (Cdn Cache Server V2.0), 1.1 jydx38:1 (Cdn Cache Server V2.0)
Connection: keep-alive
......"S..game_v.5.js..\{..D...>E[xG.-..cfX.GM.x.\`p0.W....Z.-.Z.J.
yl{"`....c.]...]..`n...5......{f..~...*=[.y..&............eU.....~....
kKk.....1{.>X.........Wy.vt...}K....<]..E{._st.h......u]..W....&
..lvTW....~R..%W.ZvO.%.Z.X .:a.b..Fk.q...SW..!.N=;.....Y..>..)"X..:
..D"y.....d.e...?....wu...pYu"..x..<...'y}M.=/Z.6............p.....
.e.Vd....$.<S^...]=J...7.u..6K.c......U...#4.nu.n..4.Y~L..e.*....e.
.(....x=.Z..R...........%..u.~.e,.4S.<.slG.PM\...L].Z......M[[..FK.
. .m....$3......jX\snJ....&....|..pIW..Q.......p.R.yC2|.'.....*..... w
.]._*.][email protected].`...*:m. .../...p...R..,....P..Ee.Xj
O....~.......).q.RT....'E..JQ.N.Z....H1.73.a....u.GVN.....-....8...V..
../\..}i.7.m.....w.b0Ab.S.............q#jY#j##._|...o6o}<.......e..
....l\...;..\..._.v........_.0....PUp(.7...9.rrN.hax...._..........n..
UQ........sy..[..........thd7.B...2wN]V=.5...l.-.,6..mi.c.d.t.ZW......
...s.j.kn...y.*.nnJm.........$V0.y6.,.h..G..myx..|s...K....kt.>.}..
Y[.ct.6,. p".Z. .W..4..x.vx..dv.Y..hL...Qev....}...q.5K}.tL..dx.....{.
.R.o/K..J.N.QM..i..HTTP/1.1 200 OK..Expires: Wed, 13 May 2015 06:35:31
 GMT..Date: Tue, 13 May 2014 06:35:31 GMT..Server: Tengine..Content-Ty
pe: application/x-javascript..Content-Length: 12739..Last-Modified: Fr
i, 14 Mar 2014 09:33:12 GMT..ETag: "5322ccd8-31c3"..Content-Encoding: 
gzip..Cache-Control: max-age=604800..Age: 1..X-Via: 1.1 tzwl34:8106 (C
dn Cache Server V2.0), 1.1 jydx38:1 (Cdn Cache Server V2.0)..Connectio
n: keep-alive........"S..game_v.5.js..\{..D...>E[xG.-..cfX.GM.x
<<< skipped >>>

GET /script/page/xiu/v3/public_v.1.js?20140212v1 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Wed, 21 May 2014 03:35:52 GMT
Date: Wed, 14 May 2014 03:35:52 GMT
Server: Tengine
Content-Type: application/x-javascript
Content-Length: 25251
Last-Modified: Wed, 16 Apr 2014 03:30:03 GMT
ETag: "534df93b-62a3"
Content-Encoding: gzip
Cache-Control: max-age=604800
Age: 1
X-Via: 1.1 zjjx160:80 (Cdn Cache Server V2.0), 1.1 jydx38:3 (Cdn Cache Server V2.0)
Connection: keep-alive
....;.MS..sns_v.5.js..<k..T... ..7.h......v.$.d..rH.sv.F..l .%.$..N
..0..M.ax...M....L.;!..c..n>..... ..e.;.!g.sH..Y..nU...w..bgzf.....
..........3...aCw kN.\~\S.JK.:Z..>.7O...ei.zH_.. ...M....W.-]X..5..
A5...V*...s.Tz..UZ}.......pR.\...r...jY...c.EB.T(...bi. ........ok...T
.B........}mn=..r.8..0..........|.....~.....k......z...[...%?.{......m
.......xx.6T..zq....o...}.q.uh......a..... ...U.C..C.....?f.TI...7T...
.*.......X..9._..8}.b.....9...=nu....me.!..45,.">....Z...8.{mV{....
[email protected]&k.;.>.Q...:]-,.[... .[}....;.k.....\..
b..O..i.....iv.........F..j.8.......b... dt...-..~.....a%yd....Y)....w
..l....q.T.2.[kU.....4m.r K..f....1.f..NU..p.u...y........Lfy..l..q3..
..6[...6MU6.=.....;.......Q2.....V.B.\...]Z...B.PzZ5.7o[..Ni...lT.:...
@.......H..C.b..1Z...p......h0.2.....N...`kK2....K.bQ....0.."R.. .C.#*
.....B.A.._O e.o^.......K..._..4..rI;f.._.SNe.=../..8y......YA..9l.g.)
..t..Ee1...'....R......]......N.4.......e.......V3B..9.`[email protected].#.[f
..d...=...6?;3x.....o.<..d..k.W....G..S.._R.%..xu........\.....(L..
\................6r=9Q.R..C .q.c.F....!...:.wm....N......O....i..m.*..
.e..R.........f.Yq.......;;.......Q......!Q..R^q]; .])J..bX..b......y0
.l.6..A".$...7..=...!......{w.6.N<[email protected].:.)....>.,.`D..!.
2....ZI....EJ.......)... .........D...c.._.1....&0dp?Q..m....y..i.0...
.P.1...].w&.I..Bf.;.kU..f.._*.gf.....1].L.-.-...Z*..*.(..N...{z.|pF.)?
._.}.W.....:p`...........WN* YbpV..O.;...v..8|M.....V.ZP....<l.{U.z
..vBNU\..&.B......p..........m.P.^[email protected]!...T...'...
<<< skipped >>>

GET /script/page/xiu/v3/swfobject.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Fri, 15 May 2015 02:06:12 GMT
Date: Thu, 15 May 2014 02:06:12 GMT
Server: Tengine
Content-Type: application/x-javascript
Content-Length: 5355
Last-Modified: Thu, 15 May 2014 02:06:03 GMT
ETag: "5374210b-14eb"
Content-Encoding: gzip
Cache-Control: max-age=31536000
Age: 1
X-Via: 1.1 tzwl36:80 (Cdn Cache Server V2.0), 1.1 jydx38:9 (Cdn Cache Server V2.0)
Connection: keep-alive
.....!tS..public_v.1.js..<[email protected][email protected]*Y.medIH
.|[email protected]...%.......O./.{..,..=3.d.*U.Gj......k.....\l..1.
^0.<kx.j....t...Ux.(.n....f.[....h.e......_..y..S........E|,.Z..3mU
...*.].).x......[.U._.......{...E...k..MSW.S.o..)}IZ..........Fo.{..;.
_kv-.........|.Wm .f...M..,...k[..e..p..my.....i..a.,WO.....lm.4,.`...
N.J.....=$...el..........0..f..)~...... $..t..n.........i..,V.._.f. ..
..[.L..&.....[b..E....t,zm{)....u....6.TV...D........%...(.......yG1I_
...<!..y...3....;"..M.j...2.....;....2g. ~~......h.Kg.s...I....~..~
..2..=.v.....m.c>...t.._e.....N.k..#...SM..$..";[email protected]...
..R.f..^gf.q.>...X..`.,x%G..9.,*......6....3.........j..%&...D...s.
.GJ...y .....9.. i.er.......a*...fQ.Y..v....6h9........}.V*---...E....
}K.F..(..[..e.X..g...L......NH1}..e..f...w..p....03........NF...j2.PB.
......V;R....ri.BI..@......]mX:.....`>...f...T.5..{!......7..o._.q.
....Q. ..C.5.[[...8.ni....mXy&.p.&m.<...3v.e.y.3.%.......m.......X.
....U........q.3.c.CP...fhB....d.j;hP.O..5..../..$.eaJ8T...fx.\.."..W(
.gY.w.u..Ep...HTTP/1.1 200 OK..Expires: Fri, 15 May 2015 02:06:12 GMT.
.Date: Thu, 15 May 2014 02:06:12 GMT..Server: Tengine..Content-Type: a
pplication/x-javascript..Content-Length: 5355..Last-Modified: Thu, 15 
May 2014 02:06:03 GMT..ETag: "5374210b-14eb"..Content-Encoding: gzip..
Cache-Control: max-age=31536000..Age: 1..X-Via: 1.1 tzwl36:80 (Cdn Cac
he Server V2.0), 1.1 jydx38:9 (Cdn Cache Server V2.0)..Connection: kee
p-alive.......!tS..public_v.1.js..<[email protected].@.
<<< skipped >>>

GET /script/page/xiu/v3/shafa_v_1.js?v=201311v1 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sat, 24 May 2014 23:38:00 GMT
Date: Sat, 17 May 2014 23:38:00 GMT
Server: Tengine
Content-Type: application/x-javascript
Content-Length: 3858
Last-Modified: Fri, 14 Mar 2014 09:33:12 GMT
ETag: "5322ccd8-f12"
Content-Encoding: gzip
Cache-Control: max-age=604800
Age: 1
X-Via: 1.1 zjjx157:8080 (Cdn Cache Server V2.0), 1.1 jydx38:2 (Cdn Cache Server V2.0)
Connection: keep-alive
......"S..swfobject.js...kw.8....D.....$}.,D...M.I.&.....a.pbl.6......
[email protected]...^.]bD.H0b.Pr3.......s..cb.
Q..SfuH.?)a...9..h}..3......8.8....}.F.A..}....3.1NX..1.F...t..n.0...:
....#...{#...qK........}#...q........3..x.........&....uv0F..)..[...'g
>.3../.mz.h.Y...o...Mx...j...`.`c....GG#.1..C........6.M}...hR[b...
-.C.Lx.h...... ...0..Q......|..%....E1.-d84#..;\k...E....;........./.Z
.y.Gt.-.i..&......ho.......`...o.)^ e....e.....>....}.9....yS...b.F
c..8.&....g1.........6...Q`.....~..............i..|>....6......E.\ 
o.._.;.`... 6.m....bS..i.O[=...h...$6P.[.(.m".2..n.r qYH..<...sK. .
O_&...~..|.U......]!"..oy..E.rT#..<.ADD....%y y.. H4.Et.C62.'i.D...
.k...V...T?MS./.X..K...d.....6c.t.f#c..fC..m..Si3n.=....`P.e..[o_....R
.IaB..Xx...HB.....'.L}.p.?=..Cq...Yhd.............4s..x...zId.&s..9...
...x$..:......0Hp.d....!.\..4=.h..`..=I.3...oF.).I.}./.c.H8..t..s.w..T
(.5.I8..Z......y.P.v.%..8Q.....0!..../c...e.3.....................n..W
O.....,.....6.Q.:..[.u...u.OU......d...v..x....N....MW.....p.%L7..c.y.
.e....b.HTTP/1.1 200 OK..Expires: Sat, 24 May 2014 23:38:00 GMT..Date:
 Sat, 17 May 2014 23:38:00 GMT..Server: Tengine..Content-Type: applica
tion/x-javascript..Content-Length: 3858..Last-Modified: Fri, 14 Mar 20
14 09:33:12 GMT..ETag: "5322ccd8-f12"..Content-Encoding: gzip..Cache-C
ontrol: max-age=604800..Age: 1..X-Via: 1.1 zjjx157:8080 (Cdn Cache Ser
ver V2.0), 1.1 jydx38:2 (Cdn Cache Server V2.0)..Connection: keep-aliv
e........"S..swfobject.js...kw.8....D.....$}.,D...M.I.&.....a.pbl.
<<< skipped >>>

GET /script/page/xiu/v3/hd.js?v20140515 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Fri, 15 May 2015 02:55:56 GMT
Date: Thu, 15 May 2014 02:55:56 GMT
Server: Tengine
Content-Type: application/x-javascript
Content-Length: 34955
Last-Modified: Thu, 15 May 2014 02:18:03 GMT
ETag: "537423db-888b"
Content-Encoding: gzip
Cache-Control: max-age=31536000
Age: 1
X-Via: 1.1 tzwl41:8106 (Cdn Cache Server V2.0), 1.1 jydx38:10 (Cdn Cache Server V2.0)
Connection: keep-alive
.....#tS..hd.js..<.w.T....p.&...;v..X....;]x....6..X..V.TI..4..e(.@
.....0....(.o.h.0._..I~._x.w.V[r.....P.Kw........LT..-..C.g.......iR$%
.\.lS.j..*Z..U.S....?.,=....B.....^ .X.r......%....4.)..........(...$i
R......:!T...7..%..".<W....(s;...7...V....\IL.M...?.q..l..._1..qR=N
.l0.K.9.Rn}vm..}6....\.......m.q.4Ps ...U. ...h..;p_....../.m..ji..6`X
k.....[[email protected]:...........$;.....K.E....Q7v..[.5
~T..t..rb.8.%l..$yN.WE.$GRE.. H.l.T..&W..d...G...hS..'..H*.&....K.o..&
lt;h]...Q..e.!.'GE..|..../..X.t.......J...:-.K.M.s.....W..D.../.._/...
......3*,..td..~.^....$..8.....D....M..(.4...Pi.u[T.. .K9$/.\.}.#.Oo0.
K..].M.>R...N,].....<K.8...5....q..p....".....#.....&...{s..%PC.
.x........GW....u.*....o.G.<...h.(a......-:.Z.....,.._\.....t..8d.f
....v*R.0...*O.j1...M..5QU.... .%..s.]v.RMv.(.j..[.....D.>....t....
O[..ZWn.9}.u... so.@,..q..kK.~."r......67ZW...C.T...C*,&,{Z..........?
...m..=..........s..nU[`o....W0..8d..Q.._.....F.....A.}]r_..f....g..xB
Ff.0<..V].<..._.UK.....J.!kv*k..4..65..dj.W7..,daZM.U ...[..7...
..\...R......&.....dW...Rq:\Mr.......C...I....r...*:...VT.\..I..O.{c\.
z..m1k.6.MrG.)..tMd.k...$S..ATe.Nr...i]....u.5....R#.l7M-..3.....im.mN
r.N.l....Q..T...L.D.t..I...]/..m..\nrr2.u[[email protected]>w.......R kMV
I.'*.F<#Vm.....0.$..,....."....j.{.3'....*..jIW....fg..>.f._..9s
.t.12....2..<...VM.G...nZ.~.N...eM....L=.....7..........q..T.*..$..
O.0....V.vE.q..e!.u...A...s...X.C.i..J...4.h../.I0e.Z..)6W...-c.......
.(b.]..>...x..Z........W(.8...>!.2.L...&...D.S#.>G...7.Na
<<< skipped >>>

GET /script/page/xiu/v3/park.js?201311v1 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive



.z...YA.?......Fw.-.0.J&..-...#e........8.b..f"G.y.9/...[.X.......%...
.`..I.wH...yhu$...../.R(.=....stMMxfZ..r....C!..x8........(......v=.."
.V.#7../..p.\.b...E.....&L......:!.*b_...T.....J.....p....].j...L.U.I'
h.....Lip$...s.....o...$E.|.H...{/.m.....~...Wta.?.....NV.....#.{Rv...
.B..>..S91.../......w...wo......n.......}..._._....R.....i...R_.F/.
.6V./,......Z}z...E.b>X?u.$.B.lJ..Ik'.....UT..........9..N.*..3.9 .
.[..T<V...r.H....D...<w.L..v..'.4..........W.v!H... BjQ.........
 y...?....p.~LH.R. ....Jb([email protected]....
.......U......^St.......6V.....OD.....;1.M..Kc.].....F.... ..<J.S..
~.].....L.^.....GU.,...>g..9w..I.....P......W..0.....8...y5..S.2G..
.$....p..NU=..}{.ZI.B... .......>.....j.;.2K"ep4L..S.....?.8....F..
.#.vP...C dT{N..B...IA..... u.......r\.c.. =..g..........|fp..........
`.X%D....G..Z........c.*....O.....cp....pP..%...r......APe.^<.c..o.
x...&...T.....^.Rf.o.w.............}.....zS..6........q. .x....'../...
|............._..H9"..*Z.y.." ..}.u.q...._w_.E.....1....L..P..K...4..O
.V..:..3.........F.9M@.......N....f..qO.........E.....bA.M.2..7......5
..B.....E.VF~.h.......&...d...5.I<[email protected];Eqd.6.&..W..]....N
S..q...O.......PX..NY.U..n.J"z........R...C.l.>..1....*.2.j...1...k
.......d....I.RId..K<Q..4.u.o..4&Hv...v._.....&.fVVH.,...&....p....
....P!....k. ..rc..>.v.......9f.SU.dJ....[Q.?....} "...%L.[\.4.H.8R
.....|.......32...I.@?N...m..o.......PD~.i..H...~s.^o.<...~..x.....
.&...w..`z.U..N.U..>..z.U.....z...YA.?......Fw.-.0.J&..-...#e..
<<< skipped >>>

GET /style/xiu/v1/img/bg/520_z5n6_bg.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 12 Aug 2014 12:51:22 GMT
Date: Wed, 14 May 2014 12:51:22 GMT
Server: Tengine
Content-Type: image/jpeg
Content-Length: 45335
Last-Modified: Wed, 07 May 2014 08:40:03 GMT
ETag: "5369f163-b117"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl42:8106 (Cdn Cache Server V2.0), 1.1 jydx42:4 (Cdn Cache Server V2.0)
Connection: keep-alive
......Exif..II*.................Ducky.......P.....ohXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:92370CDC89D5E311A
1AFF8E0D228F768" xmpMM:DocumentID="xmp.did:1D96A630D5C011E3874EF6AA225
7AF0A" xmpMM:InstanceID="xmp.iid:1D96A62FD5C011E3874EF6AA2257AF0A" xmp
:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:92370CDC89D5E311A1AFF8E0D228F768" stRef:doc
umentID="xmp.did:92370CDC89D5E311A1AFF8E0D228F768"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
....................".................................................
............................................!1.AQ.aq"2.....BR#....r.sU
..b.3S$4.........ECc...Dt...%5....&.Tdu..........................!..1A
Qaq."R........2Bbr..S.........#3..C$4..sT...c...............?......X.P
.F....[.......w..f1...W......U....([x..j../z..<..G.<E.5|f.....r.
(G.......j..9FP...M_......r..."...3Gy..<..B<E.5|f..W.y.2.x..
<<< skipped >>>


GET /lowerPrice.jcp?&callback=DomesticLowPriceHome.showLowPrice HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ws.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:52 GMT
Content-Type: application/x-javascript; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: QWS/1.0
Content-Encoding: gzip
d8f.............\Mo..../o5#.z...>.2Yd.E.Q...."......H.#...=..3....Q
....a..g.m....1N.s.V.w.2G.nU.{....73.>y..............m........./...
w...c.....w...?........Qw.7{................._T......w....../........g
.......#....fg.}......[..7...=.8..S...3.......V.8.Ap.....|......k.).es
r.]{.(.aWx(..m`.......z.\.X3..5G.....v.Z..v...q...6...ZW.{.t){^<i_.
.q.......|.Ks}.]{.5...:....4.......7....qtN..@m?..,[email protected].=oW.'.V..
8...g>.q.S.....q.^......p....p..6..N..z..g..t.uz]u.8..... Ng.._..2.
...k..I.S...gz.z.r'dO1................N.A.....}..5,...=?\n^.h7...~]".^
....... .......E..??.K..F8r1.g..B.A...8.r.8.............`,k...........
..[.|H..R.....4...q0.....6's..?&q._T.g.......)tu...<...?~{.sv..I.8O
./N.. 8.....~3.3.&. `.~..0...v..}..`.......ok..j.........8...l2..C.317
#.2.J.X...w .E..;.v&...,..d..mhi..../.N.]..D..T.."..%m.....S..rP!I.v&g
t;......k.3......E...oO.B...3.D......\{2.......?Di..... ..n..2'...D..z
.......nJ.d.... g.......V.}AcZj.m.......!V.....d=N......U...>..oZ.w
.fo..Lo.g.........Z.&_8.E............\.......d&.8@2c..].|.............
.g`O9"..o....aL{1e.1."...0-......L...2....%..!...E...........l.....N..
n.db. .}.Mt..KV..J/(D.......L.6\....a...)8.....ZT.8..%m...S.3B.}..)`n.
..b.T......_......,..&K.R......A.(...... U..$E./.p..,W..... ...w...2.Q
[email protected]..... .....L.l....SJ>.Qu..6...$.o...^..\..|.j..F.D
....Tg.e./m8d("&.../.f..xi...........!....1...-.A..d.).......$......Q.
..O.FQ.T..~D..319........p......P..0......]..bs......$\Q$.*;V....d.<
;[email protected]"......D[.,.%.g].rl...*....J._..*.P.
<<< skipped >>>

GET /lpisearchd?callback=jQuery152011194646905334254_1400382946809&from=&to=Hot&month=All&cachefrom=&cacheto=&type=rt&source=fhome&_=1400382952620 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ws.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:53 GMT
Content-Type: application/x-javascript; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: QWS/1.0
Content-Encoding: gzip
1ee..............]K.A....\..03;;....:".V2.d..".(.O...(.. C...4..3....F
.:9..t...3...=;?........".g\`...u..a...U........%.....L6...Q...k..X..d
}...l2H....J....Z5z.Sz2.,xJP.0.`...e(ba...N...Jl5J.QI.Y?.R.......[...&
lt;..$c...FV....qEn_t...9..^..r.|....f.\.......4.......~.!....D..l8.@S
.......jp.........iX.....q....|....c.r.(..;h.1Z........h..n.W;....vM.(
.N...O.d.....w...6...Mctm.~z..y...k....wO..._.B.]......-.......h...|3.
.5.#...U.;|...`...\.{..).U..>....S....WM.D.....l....TUBF.m....T25..
..(7>....E.......0......


GET /crossdomain.xml HTTP/1.1


Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ws.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:56 GMT
Content-Type: text/xml; charset=utf8
Connection: keep-alive
Content-Length: 476
Last-Modified: Fri, 09 May 2014 06:37:43 GMT
Accept-Ranges: bytes
Server: QWS/1.0
<?xml version="1.0"?>.<!DOCTYPE cross-domain-policy.  SYSTEM 
"hXXp://VVV.macromedia.com/xml/dtds/cross-domain-policy.dtd">.<c
ross-domain-policy>.  <allow-access-from domain="*.qunar.com" se
cure="false" />.  <allow-access-from domain="*.shandongair.com.c
n" secure="false" />.  <allow-access-from domain="*.baidu.com" s
ecure="false" />.  <allow-access-from domain="*.sogou.com" secur
e="false" />.  <allow-access-from domain="*.soso.com" secure="fa
lse" />.</cross-domain-policy>...



GET /site/images/zhuanti/huodong/Header0428.png HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg4.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 4946
Accept-Ranges: bytes
Date: Sun, 18 May 2014 03:32:49 GMT
Last-Modified: Mon, 28 Apr 2014 13:10:03 GMT
Expires: Mon, 23 Jun 2014 03:32:49 GMT
Age: 16491
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR.......#.....o.".....tEXtSoftware.Adobe ImageReadyq.e&
lt;...#iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC (Macintosh)" xmpMM:InstanceID="xmp.iid:F712A69CC6CF11E38034B09
DB33B4CA5" xmpMM:DocumentID="xmp.did:F712A69DC6CF11E38034B09DB33B4CA5"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6B7A8109C6CE11E38
034B09DB33B4CA5" stRef:documentID="xmp.did:6B7A810AC6CE11E38034B09DB33
B4CA5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?>/.......PLTE#........................LN.pt
........ .oqH) .z}333.pq"""~..[BF.....%V=>   ;:;........ .pqaGL...P
<@CBC...UI=..!...KLLi[]..!...mkm...."(.......79....LN...xeh.. .pq.7
:\Z[...._`.&*............s_cjS[........!..!~{|...-........,"#SRR...2,.
..... ._a..... ......3#$bbd...iMP.' trt[MP...D25........... MBE...e$'=
 ,%  <8&..... P33.6:..$N:;......>22.................... >69zu
u;. .$(L.!.pq6.0zv}B:=.^a.kp.."b8:z[]........"?90......A;*E..*'(......
2&(...VUX....."I5:................MN...B7:XVZ........"nnp.."bZ>..#.
'&kddddf........"...FFG..$///.@E..............$..... ..1~?DP,._^_?
<<< skipped >>>

GET /common/hf/footer_v10.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg4.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 8209
Accept-Ranges: bytes
Date: Sun, 18 May 2014 00:06:21 GMT
Last-Modified: Tue, 15 Apr 2014 06:55:05 GMT
Expires: Mon, 23 Jun 2014 00:06:21 GMT
Age: 28880
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR..............9Ms....gAMA......a.....sRGB.........PLTE
........6......................................D........<..........
...j.yyy-....!....v...........z. ....!...............'.....333.g."....
........s..w..p...........|.YYY.....&....."......jjj..................
......GGG..d.............MP..e..m.....$.pp.....!..4....<9.hl.N.....
...............pr.......v....t......EB....dd..%i......9..[..21.......y
y...T..........M....MM.(..............[[.....h.....c....RR....*&.....\
....k...............'.."..{[email protected]......*.5........J.
....8.}.....;$...=....u.pq..X....|..N*A...s...d..S....VZ._a.....X....^
=.................~.......?.....AG...d.l..[..i........E.R. {......?N.W
.7:.....y..=....f.x....p.............'..y|.]..(.........'..^.g6..5....
[email protected]"7?o..)GOz.w .....c.....OY`......o.....|..O....w]...kq.x^
;y[*/g.V....tRNS.".l.......l.!i...l!........IDATh....\SW......w....w.s
....4.....&F%7...L..1....d..."...K...!*..R.# .R.DPAAk..Z..Q..i;m.3m...
......@....../..{..9@~..{.s.....3V60..../..7)......?.0...:L.?.=.......
[email protected].'H..}M...._.|../^z.|..?C^:..y........ .......`...E.{
..E...H...(.I...............^@.!..6Q...&.j..=.....]~k......w.ON.....%.
.....=O...\.5d.j...!......xL... a."..)..w..fwm.w.W.......%...._.$.XSs.
.........l.x....q....o.........F..8.g9.^....}....,k.}.V............?..
.....7.[..|....;..~~!~D..._..-..q#..p.y.{..."...5k.'.Z.b....$..6...#00
...V([email protected]@.........#.j&9.y.v..H.[.....#...3r."(...3
.8..............r.?~$A.f.(h.Oi..r.....D.....s.B.u/.....]..........
<<< skipped >>>

GET /common/hf/24h.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: simg4.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 244
Accept-Ranges: bytes
Date: Sun, 18 May 2014 00:32:35 GMT
Last-Modified: Tue, 15 Apr 2014 07:10:04 GMT
Expires: Mon, 23 Jun 2014 00:32:35 GMT
Age: 27309
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR................R....gAMA......a.....sRGB........-PLTE
....f..i.......`..x..J...........*........*r..m.O...eIDAT..c``9.......
T.[.&000./`a.....T...I.P..... #. .2..e.D........(.....(.D.90p....Az...
......8%.........b........IEND.B`...



GET /js/ga.min.js HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: bc.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:52 GMT
Content-Type: application/x-javascript
Connection: keep-alive
Content-Length: 2584
Last-Modified: Tue, 12 Jun 2012 13:55:42 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Set-Cookie: QN1=wKgZEVN4alhJ4y5ZDPhTAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=qunar.com; path=/
P3P: policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"
Accept-Ranges: bytes
Server: QWS/1.0
(function(){var e=function(){this.param={};};e.prototype.cookie=functi
on(i,j,g){if(arguments.length>1&&String(j)!=="[object Object]"){g=g
||{};if(j===null||j===undefined){g.expires=-1;}if(typeof g.expires==="
number"){var l=g.expires,h=g.expires=new Date();h.setDate(h.getDate() 
l);}j=String(j);return(document.cookie=[encodeURIComponent(i),"=",g.ra
w?j:encodeURIComponent(j),g.expires?"; expires=" g.expires.toUTCString
():"",g.path?"; path=" g.path:"; path=/",g.domain?"; domain=" g.domain
:"",g.secure?"; secure":""].join(""));}g=j||{};var f,k=g.raw?function(
m){return m;}:decodeURIComponent;return(f=new RegExp("(?:^|; )" encode
URIComponent(i) "=([^;]*)").exec(document.cookie))?k(f[1]):null;};e.pr
ototype.add=function(f,g){if(g!=null){this.param[f]=g;}};e.prototype.g
etHashString=function(f){var h=window.location.hash.toString();var g=n
ew RegExp("" f "=([^&?]*)","ig");return((h.match(g))?decodeURIComponen
t((h.match(g)[0].substr(f.length 1))):"");};e.prototype.getQueryString
=function(f){var h=window.location.search.toString();var g=new RegExp(
"" f "=([^&?]*)","ig");return((h.match(g))?decodeURIComponent((h.match
(g)[0].substr(f.length 1))):"");};e.prototype.send=function(){var f=th
is.get_location();var g=new Image();g.src="hXXp://bc.qunar.com/" f "?"
 this._collect_params();};e.prototype._collect_params=function(){var g
=[];var h=this.param;for(var f in h){g.push(f "=" encodeURIComponent(h
[f]));}return g.join("&");};e.prototype.getDomain=function(f){return(f
||"").replace(/^. \.(. ?\.. )$/,"$1");};e.prototype.get_location=f
<<< skipped >>>

GET /f?utmwv=0.1&t=0.8484638481182711&utmsr=1024*740&utmr=-1&utmp=http://flight.qunar.com/?ex_track=auto_52283dc6&utmhn=flight.qunar.com&s=249 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: bc.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: image/gif
Connection: keep-alive
Content-Length: 43
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Expires: Sun, 18 May 2014 08:07:53 GMT
Cache-Control: no-cache
Server: QWS/1.0
GIF89a.............!.......,...........L..;..



GET /huodong/29/27/channel_20140504104628_44039.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS/1.2
Date: Thu, 15 May 2014 12:35:41 GMT
Content-Type: image/jpeg
Content-Length: 83080
Last-Modified: Sun, 04 May 2014 02:46:28 GMT
ETag: "5365aa04-14488"
Expires: Sun, 09 Nov 2014 08:58:19 GMT
Cache-Control: max-age=15552000
Accept-Ranges: bytes
Age: 428960
Via: SX-130-251.fastcdn.com (DLC-3.0), CT-233-15.fastcdn.com (DLC-3.0)
Connection: keep-alive
......Exif..MM.*.............................b...........j.(..........
.1.........r.2...........i....................'.......'.Adobe Photosho
p CS6 (Windows).2014:04:25 17:04:30.........................."........
...d...........................................&.(....................
.....................H.......H.........XICC_PROFILE......HLino....mntr
RGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP  ..
..............................................cprt...P...3desc.......l
wtpt........bkpt........rXYZ........gXYZ...,[email protected]..
.pdmdd........vued...L....view.......$lumi........meas.......$tech...0
....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c)
 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1..........
..sRGB IEC61966-2.1..................................................X
YZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b
.........XYZ ......$.........desc........IEC hXXp://VVV.iec.ch........
....IEC hXXp://VVV.iec.ch.............................................
.desc........IEC 61>.?!?a?.?.@#@d@[email protected])AjA.A.B0BrB.B.C:C}C.D.DGD.D.
E.EUE.E.F"FgF.F.G5G{G.H.HKH.H.I.IcI.I.J7J}J.K.KSK.K.L*LrL.M.MJM.M.N%Nn
N.O.OIO.O.P'PqP.Q.QPQ.Q.R1R|R.S.S_S.S.TBT.T.U(UuU.V.V\V.V.WDW.W.X/X}X.
Y.YiY.Z.ZVZ.Z.[E[.[.\5\.\.]']x].^.^l^._._a_.`.`W`.`.aOa.a.bIb.b.cCc.c.
[email protected]=e.e.f=f.f.g=g.g.h?h.h.iCi.i.jHj.j.kOk.k.lWl.m.m`m.n.nkn.o.oxo.
p p.p.q:q.q.rKr.s.s]s.t.tpt.u(u.u.v>v.v.wVw.x.xnx.y*y.y.zFz.{.{c{.|
!|.|.}A}.~.~b~..#.....G.....k...0.....W.........G.....r...;.....i.
<<< skipped >>>


GET /flashApp/vshow/seabed_treasure.11.07.29.a.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.56.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Wed, 11 Jun 2014 19:53:38 GMT
Date: Mon, 12 May 2014 19:53:38 GMT
Server: Tengine
Content-Type: application/x-shockwave-flash
Content-Length: 69524
Last-Modified: Fri, 29 Jul 2011 11:11:10 GMT
ETag: "4e32954e-10f94"
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx163:8104 (Cdn Cache Server V2.0), 1.1 gxnndx31:0 (Cdn Cache Server V2.0)
Connection: keep-alive
CWS.....x.|..X...7.K-Kww.tVVV...- ...4.%-.]."]....4."........k...g....
...X..f!.......d.........c/.1.....v^PW[........}.H.VN..>hv.Po.v[?[7
.oL.....................D.........c....q....!..q.w7............-X....V
....n .. ..o$.3.w.... ..../L4..A.........,...Cml......`Kyx.8ZC}......)
y=...z2.N.G.IO:...[...V..f.I.....C...j.ne.n...!........a............w.
.r.............o.f........wpx....;..2..8Q...../......gQ...E......n..P/
......lB.'.2....m.O0IyyA.1.l.6zn...0...Hrn6.PX..tuU.,..e....l.0.O...F.
p.v|[email protected].{x.....z."[X..{..Y<9...IE.....
......o.(...#(. .>I..z.......Su....E..L....G......S..d.m.......].U,
.O....X{9z...zy..\.....%.....#........}.AD....-...P`..88..H...u.....G.
...h.hk#.K..:li"i....x..]..P7.!/.#..S.Q.m}t.]m.}}.".~jR..,._7X.{x.z{?.
....<........9....%o.....#...>L...............-..n...Ym.=...5.. 
....tA.3...............:.S.Z..t..l1...c.u.U.-Bdu....)U9...X(.$.\`E....
i.*'...}"...t...P`h.."...lH..&..,i{zI........D.....dBD.!..............
.......Y.........H.....D.....!.c`ba......  ............A.`.<.....D.
!aq.....A..Z.c........f7.l.....T...,..,...,..G....c..MW&.|..P..w..k.S.
.c.......&@_#x...]F....)...q."..?_ .3.A.f.b../.4...,N....uL..~....4[..
9.2<........0@.......__.I.b.F....z.x.<.nD#..1.fn....XKkFhF.....8
...!..Y.....|.#.........K..Mn...f...A.h.D.#.r.H7..........T.L^.H.{....
e...........=.?....(jy..._tH....#.6.`..2.\...|.c.<....u./.........R
..g"f....]x..y..... .9{....L>.N....E..F.VU..f.R*}......X...[.Y.....
......k.3..Z.M...$.8g....T}..z...R...l..E.V..........;.p.)...V....
<<< skipped >>>


GET /img5/flashlayer/533138d44ad23/3.swf?v=3 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://cdn.51img3.com/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=4714
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.51img5.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/0.7.66
Content-Type: application/x-shockwave-flash
Content-Length: 40091
Last-Modified: Tue, 25 Mar 2014 08:05:40 GMT
Accept-Ranges: bytes
Cache-Control: max-age=86400
Date: Sat, 17 May 2014 22:17:11 GMT
Age: 64483
Powered-By-VeryCDN: HIT from ctc-dg-1-1-c1111, HIT from utn-yz-1-1-c1131
Connection: keep-alive
CWS.U...x...wTTO...d.....$#[email protected]..(Qh$..,((HjP$CCwMw.
.i.7;;;{v..1......~.n..uo..H../[email protected]!.......Q.stV4...>....W.~
R.u...Q............HH)((HHJKHK.aK...{..?........K.r.w.s..p.yCq.......y
y.E.#/...../n..{.$....xd.#!%.)...-....d...3..<U.q..:....Pc?....?V..
'T.LV\.*.}........U..o...iNZ._.iI..b.2b...RW.e..e.D%..%%.C..J.S..)...&
gt;..?U...Q.... .We..:...9.......*I.7........).'...?b...N.N^N...X.K...
........P....ts....x$...s.....$..S......_m..g....!.........N.......>
;N..N..@?.'l...b2...z......NzZ*...nn...:..W5..ikh.h.HIi..KjJiKK^......
.........`..8...4.....C...f.....5...T...k..r....c......V'?..N.:~0/.(..
..;.4........._E......&....*....C....J...Q............o.....U..MB.....
.". .y.k..P).D.R...A.S.{.P.D..'. .N.SB ...?8...&N..&..?......g..O#9q.N
.J."k.Um)....`..e.Q.n.{[email protected]/..F.>....|..A.Hc/..B(.0..rr..
....Jj...XC6Ou..S....a..e.....Wo..I..'...-....>?.^~Bc,..P...f<EM
>...t..\..z......'...q..lED...@...... ..z.?....a%..D.... q.t]...|..
0u...0.e....~."u.L....B.uWN.`B>%_.8[.~..R..].......kNR.Y..x...5r.."
.T......VR.1IE..l...(4EK..Nj..E....;....m..>....DPv.Oe."E1q...yW...
.R=Yqx.yd.<$<n.H.f0Z...2..b9...1.....uR..e.3...[.$.:.#..A...*...
...<'&>Q..A...........n.$A..k%.2.R.%a.K.Y....I...p..._5W.....q,.
.-G..\!...yo. ~N.....u....../?.. ].......8c...1.*$&...S^.Z.P..v...}...
_....#...<.BN.....7...^...>..\.......%.U..?u'/..eu..`T1..V..2.).
........L.......c.....p...|..f..C..Cg....O.9u.......q..V.....p-..'{s..
bE..W\.US.K.E.Tk.6.`f(.}y...y.K........Ul.....RA...x...l`kn...q.Z.
<<< skipped >>>

GET /img5/flashlayer/533138d44ad23/ps.swf?v=3 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://cdn.51img3.com/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=4714
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.51img5.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/0.7.66
Content-Type: application/x-shockwave-flash
Content-Length: 15920
Last-Modified: Tue, 25 Mar 2014 08:05:40 GMT
Accept-Ranges: bytes
Cache-Control: max-age=86400
Date: Sat, 17 May 2014 11:31:19 GMT
Age: 80620
Powered-By-VeryCDN: HIT from ctc-dg-1-1-c1111, HIT from utn-yz-1-1-c1131
Connection: keep-alive
CWS.j[..x..|.XS.....B'.....)..^[email protected] .B..........E..E...^P,(vPQ@T,.
@......y............f..5.Zkf..5;;..B..X..r.p....,......0c..].i..I)....
N=..M.64...2.21`s.............PB?='....OI.P..!.WVz.'!...N....hv..N]}.6
;9..mJ.....f.........F.tC...Y.pX.....f'.;.R4.$Fz<....e..CzF..%...O.
.HHb.L-.l....O\,W.goL72........V.&..t.)tKk:...c.cM}Y\...eL46.....Y...Z
..[.M~n...xs63!6.o5.S.fk..=......_.nr...t:7.......sRY...tv.'...5.G...z
jJ:......j. ......nV.V...&FN.n&FF.....tS 7Ww. .3K...M'.\.1.....8.....S
..6?NB\........X.]]\-...............M.f..........a ....b.s..h.R..t..Sv
..].w.._...t...s./M'...u..........n...Y.;[.........].\'..?;2V......JA.
10....;..1?"45.... f.! ..kK.Qj.f.f.u,.....3RS..b.8.a.~z<;fN.#......
......$..I...\.pjl.......V..f....&.X......m.`..Z.U.O...|}......;....Q.
...........]...>..`.....}..$D%U.E%......Jb..*.t..sC#-%eI-#SSSg..15.
.......v.t.;T..p.LRZZ[UZA[]..H]YNAQ........XYUZ........27662..Gm-L-..~
4....1s.C...A.#.c.g..4.........|.....@ ........F.'..$...%..9y...[...1.
K.wK...%..E..r.H.7$..3..9#..9....P.$...`..../Y........i....]....1:V.$:
.MM.........I.mo......7..zy.z............R}C{...S./....B.....O...6LN.}
...W........}=..}.. .g^5.^3{g...t#..d..e........._..Z....59sy.V-.cv .w
....n.s...{.v'.\p0.j.q.......o..,4.z.....q...f.T......A......'>..Xe
_....|..BM....-..|..p.oY......5....t..G.Qp.......b...M6....f...^..O.g.
...o..>}.rk....g..r2.].....F..>.x......m..H./c.>6#YW..G...]=O
.V.V../*...w......;6VW..j[..R..#.....;.R.|.Q..h.......{.c.........04 w
J~p.........<..i.|.@.~{..<&...6{.)i.......o.....}..LIx..yS..
<<< skipped >>>

GET /img5/flashlayer/533138d44ad23/1.swf?v=3 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://cdn.51img3.com/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=6256
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.51img5.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Content-Type: application/x-shockwave-flash
Content-Length: 16588
Last-Modified: Tue, 25 Mar 2014 08:05:40 GMT
Accept-Ranges: bytes
Cache-Control: max-age=86400
Date: Sun, 18 May 2014 06:21:12 GMT
Age: 39938
Powered-By-VeryCDN: HIT from ctc-dg-1-1-c1111, HIT from utn-yz-1-1-c1131
Connection: keep-alive
CWS..H..x....\R..?~@1g..../1...{Rii........R..KS...2...hV^.4.o....f.m.
.NMAi.jef.ZS.........{......w.s......~.....u....<..`.!...y#. ..Xn..
....c<....C..&.x.o.6.<.~.'....:.\..................pHIK.E.rHH...
..J..N.$....%&`..#..Sy.66..=.o.?b.R.#w'FE;r..9............y|....KLf$&.
."k[a.{#Sb........ >r/...DG"......w7v. q.....o...........y.. ....At
. ....=..........D."wG.".Kg"......;....uO.....?......N.I..3.........{.
-.....7z_t./.(.eQ..9.1..."y^......Dj.:.rH.M....<....U.F..5.....Y@..
....9..:......o..H.............m.r....-.)...N..o/p.1.n.......6...l....
..e.:.....Wg7o......u....-.;....._.v..H....K....'.8..'u..L..#...F'....
MMN..h....).ZMy...*...........w......v..L..t.[Z.....?E`.1........_0...
../,,t...D.......5b].\".d...{..B.~.-T............2.k.e..,W;....t....Nk
=...v..&v...........n...C.e.Z.......V.l9....m.../\.>.43.X..........
..j......=.....\=<._6.u].a..V.......8.....H....p.......?........l.a
.,..b....c....r..W.$...?......D....g.p...t...!C..........x5i{.....g...
....WR...^[email protected].%.K4!"Yx}<$......*...........7~....=..l.......n..
..6.......>.Sk0...!...M.Z_.=P.:.!,ef...[.W.=9.S.?.1..Uj..;....n.7G)
....3..w.i>.W.^}?........W......}.U..`&.|.)E6.d/.....~d..x~.=.e....
.l.7...x....T......'._Z....]..|.v.h..h.........J....v..?.}C.x....3 ..c
.S.5Z.Q1.2~v....]...y1..2..C;..G)m.....<...Q.;."4.lK\.'UY.....m..T/
.}...t../.wi..9).t.....q.bI.....B.)........v..p.._g...j.Y9......g^L...
..<*.s...].#.B,....m.zF...y..\96.~L...1.......^).....4.x2.cM.41.)M.
.ONoRlj<.....<.LF...O........a....r.TJ}.9/....=q2...Li.I...E
<<< skipped >>>

GET /img5/flashlayer/533138d44ad23/3.swf?v=3 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://cdn.51img3.com/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=6256
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.51img5.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/0.7.66
Content-Type: application/x-shockwave-flash
Content-Length: 40091
Last-Modified: Tue, 25 Mar 2014 08:05:40 GMT
Accept-Ranges: bytes
Cache-Control: max-age=86400
Date: Sat, 17 May 2014 22:17:11 GMT
Age: 64486
Powered-By-VeryCDN: HIT from ctc-dg-1-1-c1111, HIT from utn-yz-1-1-c1131
Connection: keep-alive
CWS.U...x...wTTO...d.....$#[email protected]..(Qh$..,((HjP$CCwMw.
.i.7;;;{v..1......~.n..uo..H../[email protected]!.......Q.stV4...>....W.~
R.u...Q............HH)((HHJKHK.aK...{..?........K.r.w.s..p.yCq.......y
y.E.#/...../n..{.$....xd.#!%.)...-....d...3..<U.q..:....Pc?....?V..
'T.LV\.*.}........U..o...iNZ._.iI..b.2b...RW.e..e.D%..%%.C..J.S..)...&
gt;..?U...Q.... .We..:...9.......*I.7........).'...?b...N.N^N...X.K...
........P....ts....x$...s.....$..S......_m..g....!.........N.......>
;N..N..@?.'l...b2...z......NzZ*...nn...:..W5..ikh.h.HIi..KjJiKK^......
.........`..8...4.....C...f.....5...T...k..r....c......V'?..N.:~0/.(..
..;.4........._E......&....*....C....J...Q............o.....U..MB.....
.". .y.k..P).D.R...A.S.{.P.D..'. .N.SB ...?8...&N..&..?......g..O#9q.N
.J."k.Um)....`..e.Q.n.{[email protected]/..F.>....|..A.Hc/..B(.0..rr..
....Jj...XC6Ou..S....a..e.....Wo..I..'...-....>?.^~Bc,..P...f<EM
>...t..\..z......'...q..lED...@...... ..z.?....a%..D.... q.t]...|..
0u...0.e....~."u.L....B.uWN.`B>%_.8[.~..R..].......kNR.Y..x...5r.."
.T......VR.1IE..l...(4EK..Nj..E....;....m..>....DPv.Oe."E1q...yW...
.R=Yqx.yd.<$<n.H.f0Z...2..b9...1.....uR..e.3...[.$.:.#..A...*...
...<'&>Q..A...........n.$A..k%.2.R.%a.K.Y....I...p..._5W.....q,.
.-G..\!...yo. ~N.....u....../?.. ].......8c...1.*$&...S^.Z.P..v...}...
_....#...<.BN.....7...^...>..\.......%.U..?u'/..eu..`T1..V..2.).
........L.......c.....p...|..f..C..Cg....O.9u.......q..V.....p-..'{s..
bE..W\.US.K.E.Tk.6.`f(.}y...y.K........Ul.....RA...x...l`kn...q.Z.
<<< skipped >>>

GET /img5/flashlayer/533138d44ad23/ps.swf?v=3 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://cdn.51img3.com/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=6256
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.51img5.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/0.7.66
Content-Type: application/x-shockwave-flash
Content-Length: 15920
Last-Modified: Tue, 25 Mar 2014 08:05:40 GMT
Accept-Ranges: bytes
Cache-Control: max-age=86400
Date: Sat, 17 May 2014 11:31:19 GMT
Age: 80622
Powered-By-VeryCDN: HIT from ctc-dg-1-1-c1111, HIT from utn-yz-1-1-c1131
Connection: keep-alive
CWS.j[..x..|.XS.....B'.....)..^[email protected] .B..........E..E...^P,(vPQ@T,.
@......y............f..5.Zkf..5;;..B..X..r.p....,......0c..].i..I)....
N=..M.64...2.21`s.............PB?='....OI.P..!.WVz.'!...N....hv..N]}.6
;9..mJ.....f.........F.tC...Y.pX.....f'.;.R4.$Fz<....e..CzF..%...O.
.HHb.L-.l....O\,W.goL72........V.&..t.)tKk:...c.cM}Y\...eL46.....Y...Z
..[.M~n...xs63!6.o5.S.fk..=......_.nr...t:7.......sRY...tv.'...5.G...z
jJ:......j. ......nV.V...&FN.n&FF.....tS 7Ww. .3K...M'.\.1.....8.....S
..6?NB\........X.]]\-...............M.f..........a ....b.s..h.R..t..Sv
..].w.._...t...s./M'...u..........n...Y.;[.........].\'..?;2V......JA.
10....;..1?"45.... f.! ..kK.Qj.f.f.u,.....3RS..b.8.a.~z<;fN.#......
......$..I...\.pjl.......V..f....&.X......m.`..Z.U.O...|}......;....Q.
...........]...>..`.....}..$D%U.E%......Jb..*.t..sC#-%eI-#SSSg..15.
.......v.t.;T..p.LRZZ[UZA[]..H]YNAQ........XYUZ........27662..Gm-L-..~
4....1s.C...A.#.c.g..4.........|.....@ ........F.'..$...%..9y...[...1.
K.wK...%..E..r.H.7$..3..9#..9....P.$...`..../Y........i....]....1:V.$:
.MM.........I.mo......7..zy.z............R}C{...S./....B.....O...6LN.}
...W........}=..}.. .g^5.^3{g...t#..d..e........._..Z....59sy.V-.cv .w
....n.s...{.v'.\p0.j.q.......o..,4.z.....q...f.T......A......'>..Xe
_....|..BM....-..|..p.oY......5....t..G.Qp.......b...M6....f...^..O.g.
...o..>}.rk....g..r2.].....F..>.x......m..H./c.>6#YW..G...]=O
.V.V../*...w......;6VW..j[..R..#.....;.R.|.Q..h.......{.c.........04 w
J~p.........<..i.|.@.~{..<&...6{.)i.......o.....}..LIx..yS..
<<< skipped >>>

GET /img5/flashlayer/5360b616f2691/2.swf?v=3 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://cdn.51img3.com/game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=8506
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.51img5.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/0.7.66
Content-Type: application/x-shockwave-flash
Content-Length: 143873
Last-Modified: Wed, 30 Apr 2014 08:36:38 GMT
Accept-Ranges: bytes
Cache-Control: max-age=86400
Date: Sun, 18 May 2014 02:39:37 GMT
Age: 19699
Powered-By-VeryCDN: HIT from ctc-dg-1-1-c1111, HIT from utn-yz-1-1-c1131
Connection: keep-alive
CWS.k...x...u\U[.6...M.tK7H.4.Hwww7...J.twK...4(  ..........>.~~...
.}{..s.y.k.q.1.\kO1..;.....HA..&.....`A.@...._EB........Z...rss.ge...d
..`qt.d............E0.z;..{1;.RR.'.. a.j.b..f..@~[76qtw....I.e........
.................-.../.bn......hw_..E.eg.jE...ha....7.#.W.b."g&7q..3#.
`..d......K@?....q2.q2...........fd..gc.........n.f.n.................
.hfm.......\..?....kf.[\'w...3ff.jngno.......w..L.-.].....;9.Y.....z1.
Z9..z.{.3[..-.............Sno......bn.?.]....YU.]..]L..p...#/./...f.`j
.#q.z......M.S...].[R\J...=^^^vI.6I.6.^1..{...{._l.......d3..`.../6E.k
Kk........8........./...j.b.an&..h.}...]\.o....%..L......L.l..y...q...
!.../6......)..%..-.?...i..S../2.W......N....?..}[email protected].........
<.Z.T.].....d$.p57uw.v....Q......S......P..n.4....<..W..Wuw...,.
.......H0.0.......:*6..N....K....X..S./{...-G...2...1A2V....g.-.......
....E.}G...uL...4...D........6...4*B..'E'.~..0.F(,'.....RXc..|%.......
Dr.P8.t..r.F..C [email protected][email protected]...@}..E.c..*..Yy..
.E........,[email protected].. .-....X.
([email protected]....<G..........(... [email protected]$........D...!.....0.4.
../.T..@!*B?..f?.>...........~V".z....H9..^JO.:.n.$..{...`C.A"H Q. 
..K.`'.-Kuz)..\..f.....`...l......=f..ny... /...... .H...^4_..S...J.w.
E..C.0PG..s..Jp. =.L.>.&..z.K......I..(...... ..T....s.............
uj#I.......,.3.....Jt.....x.........F..c....j.nw....~:.^\..-(M..Pi....
.R.....K........V.j..Zz..y...P...@~.H.]"........H.......!.3..e6l&....T
..H.....C<...T4..xW*Z;y2)v..7eY......7..........V....F......tr.
<<< skipped >>>


GET /3a/fb/u327191383286771.png HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi2.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Sat, 12 Apr 2014 18:04:24 GMT
Content-Type: image/png
Content-Length: 2325
Expires: Tue, 07 Apr 2015 18:04:24 GMT
Cache-Control: max-age=31104000
ETag: "3998877045"
Last-Modified: Fri, 01 Nov 2013 06:19:37 GMT
Powered-By-ChinaCache: HIT from 06047113L7
Age: 3074601
Powered-By-ChinaCache: HIT from 060111b3TO
.PNG........IHDR...n.........FZ.-....sBIT.....O.....PLTE..............
......................................................................
......................................................................
...|..{..t..w..r..w..z..n..s..l..s..o..j..a..n..f..g..i..\..b..c..V..Q
..P..L..I..F..H..D..M..M..D..M..G..K..9..;..=..H}[email protected]..;..&l
t;t.2.. ..(..7..-..,..1..(..$..#.. .. ..*z. ..!..*r.!.. ........*d....
#r....!l.........."[..r........|.....\..o..j..u..x..z.....x.....]..s..
j........r.....k..U..o..Q..e..~..Q..k.....f..g.....m..d..l..J..e..o..a
.....R..[..J..U..][email protected]..?..;..O..8#.,Q....tRNS.
U.....................................................................
......................................................................
.............................................y2.I....pHYs.........B.4.
....tEXtSoftware.Adobe Fireworks CS4........IDATh....w.E..Co.P.gA.....
..(............Qk j. ...(. b.*.......-kk.;..3.;...v..3.nv.|....M......
.rd...M...L.........{.sI<......n....#.-!R........4.r.....l...W;...U
*[email protected]./..(.....,.\..R..8.._.U..t.VL.._ho....1|\.6.A_.Z...(.)K.E.v...
.Q..$..R..n.}35Z.Z.p....;%.R&E.Yl....5...gt..5....F..e#...1\.?.J...aK*
3mn.)....[q..7..K..`...0,.4.-6...t`...J8.j.sJ...qT*.B......}.C[...8P#.
....(.q...8.g.p...).YJm.}V.Vw........`.r..K....-1.,.9.S.^ni.q=..=C....
. ].p..aq{.p.Kp(/_...-..z\Fi.......]..B$.?E...<Hn&.....c..4..|q..1.
..C&...<E.K{.XA.....%.K-p!dD.W........B.VH_.!.....^.s..&..,.Y..p..J
.......<....Y.g9...e.....%.w..|...:H<......d.6.V.....:.c`...
<<< skipped >>>


GET /AClick.aspx?AID=1805&WebID=14516&DomainID=7292&APID=9756&Auth=090A76F47330861927C2B8CF643C84CCC3139F861463EF3F6D6AD6A145C310A3&Url=&referer=http://VVV.cfmogu.com/ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShow=1805|1796|1995


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShow=1805|1796|1995; expires=Sun, 18-May-2014 11:07:29 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:29 GMT
Content-Length: 372
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"~..q3..U.........]{....L>...
7N~..|...E.L/..'.y}..........".Z.?w~.o..x..:..f]..giYM3.7n............
U.*.8}....{..........~...'.G.m}...O>.......;w..nq.e.~...e....hG.2_^
...q.k..S...^..}d`...._......a..'..o.........H?j ..# U..[..w..z..^..Yu
5.#[email protected].....



GET /AP5Min.aspx?AID=9842&Auth=1D705CD055EE5F1D53F74430175EDBD7FD71063F5A61C4C46F8D7B152648211E&referer=http://VVV.cfmogu.com/&utz=1400382921808 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Server: Microsoft-IIS/7.5
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShow=1883; expires=Sun, 18-May-2014 11:07:20 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:20 GMT
Content-Length: 170
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://tg.51
.com/acpa/webgame/cy.html?from=tgly_14516">here</a>.</h2&g
t;..</body></html>......


GET /AClick.aspx?AID=1805&WebID=14516&DomainID=7292&APID=9756&Auth=090A76F47330861927C2B8CF643C84CCC3139F861463EF3F6D6AD6A145C310A3&Url=&referer=http://VVV.cfmogu.com/ HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShow=1805; expires=Sun, 18-May-2014 11:07:21 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:21 GMT
Content-Length: 372
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"~..q3..U.........]{....L>...
7N~..|...E.L/..'.y}..........".Z.?w~.o..x..:..f]..giYM3.7n............
U.*.8}....{..........~...'.G.m}...O>.......;w..nq.e.~...e....hG.2_^
...q.k..S...^..}d`...._......a..'..o.........H?j ..# U..[..w..z..^..Yu
5.#[email protected].......


GET /AP5Min.aspx?AID=9842&Auth=1D705CD055EE5F1D53F74430175EDBD754D01E8ABD08F3113992BEAC7A0623EE&referer=http://VVV.cfmogu.com/&utz=1400382924370 HTTP/1.1


Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShow=1805|1796


HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Server: Microsoft-IIS/7.5
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShow=1805|1796|1995; expires=Sun, 18-May-2014 11:07:28 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:28 GMT
Content-Length: 164
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://fligh
t.qunar.com/?ex_track=auto_52283dc6">here</a>.</h2>..&l
t;/body></html>....



GET /site/tupian/channel/adjz HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: eoa.intra.baike.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:41 GMT
Server: Apache/2.2.21 (Unix)
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
468c..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN
" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> ..<
html xmlns="hXXp://VVV.w3.org/1999/xhtml"> ..<head> ..<met
a content="text/html; charset=utf-8" http-equiv="Content-Type" /> .
.<title>............</title>..<meta name="description" 
content="........." />..<meta name="keywords" content=".........
" />..<link rel="shortcut icon" href="hXXp://cms.huimg.cn/shouye
/images/favicon.ico" type="image/x-icon" />..<style type="text/c
ss">..html,body,div,dl,dt,dd,ul,li,h1,h2,h3,p,form,input,button{mar
gin:0;padding:0;}..li{list-style:none;}..img{border:0;}..input{outline
-style:none;}..body{text-align:left;font:12px/1.2 ......, Arial, Helve
tica, sans-serif;position:relative;}..:focus{outline:none;}..input{fon
t-size:12px;color:#333;font-family:'lucida grande',taho,verdana,'trebu
chet ms',sans-serif;}...zoom{zoom:1;overflow:hidden;}...conbox{margin-
top:10px;border:1px #e1e1e1 solid;}...conbox1{margin-top:10px;border:1
px #e1e1e1 solid;}...l{float:left;}...r{float:right;}...bold{font-weig
ht:bold;}...clear{clear:both;height:0;font:0/0 Arial;visibility:hidden
;}...w-950,.foot{width:950px;margin:0 auto;clear:both;}...w-630{width:
630px;}...w-310{width:310px;}...pad10{padding:10px;}...mar-t10{margin-
top:10px;}...mar-r10{margin-right:10px;}...bor-no{border:0 !important;
}...bor-b-d{border-bottom:1px dotted #d8d8d8;}...gray6{color:#666;}...
red{color:#DE0000 !important;}a{color:#0268cd;text-decoration:none
<<< skipped >>>


GET /index.php?action=HdActive&do=getGoddessRank&user_id=lmx2369295492&t=0.22199426773624437 HTTP/1.1
x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.woxiu.com
Connection: Keep-Alive
Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20111931; __x_sid=214516; __x_webpage=1; toxiurefer=VVV.cfmogu.com; forever_={"uvisit":1}; __x_jump2uuid=38295037017807; __x_jump1zbroom=lmx2369295492


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:51 GMT
Server: ngx_openresty
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
P3P: CP=CAO PSA OUR
Content-Encoding: gzip
X-Via: 1.1 fsdx21:3 (Cdn Cache Server V2.0)
Connection: keep-alive
2cf...............v.0...w...d..$..'.'(=.WK...-n...;bW!.....3..|...r...
.w.vZf.$..=..Y.n....FAV.9...7Ve:_...#..."9..].Vu....^O.0.wr.T.g..Zr.&g
t;..(l.}..d...(\.i..&.l...:....3~.l.g<.GP.......`....`....m..O....`
.T.....7|v..:.H...F...m.]G.|EYh....u0.....U..U.R.!..N..V.y.m..q......C
.XD.....D....q......>.........M.)....7l.......H..WoHI..A..%.|?L..U.
D. .R...54Dd.'..<..).....f.I [email protected] 2kg.}[email protected]
%..z....*...<.....h#{......C.....X.f..*K.S...<L.<.R.gX..~....
.QX..J........2e...a'..s..T.N;.......\d5(.OWg.s..q..I.....?.h....w.|8W
..&.;..W.P.a.....G.%..i.....!....{[email protected].!.....kg..().
...A..(....r.U..0...g...'.<i7....0..'$............TD$m....KOq.l@...
.A....=.p..`.*e[MDv..A....J.6.{Cz.\.O/...g..P.....0..HTTP/1.1 200 OK..
Date: Sun, 18 May 2014 08:07:51 GMT..Server: ngx_openresty..Content-Ty
pe: text/html; charset=UTF-8..Transfer-Encoding: chunked..P3P: CP=CAO 
PSA OUR..Content-Encoding: gzip..X-Via: 1.1 fsdx21:3 (Cdn Cache Server
 V2.0)..Connection: keep-alive..HTTP/1.1 200 OK..Date: Sun, 18 May 201
4 08:07:51 GMT..Server: ngx_openresty..Content-Type: text/html; charse
t=UTF-8..Transfer-Encoding: chunked..P3P: CP=CAO PSA OUR..Content-Enco
ding: gzip..X-Via: 1.1 fsdx21:3 (Cdn Cache Server V2.0)..Connection: k
eep-alive..
<<< skipped >>>


GET /history/newhistory.html HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: history.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:51 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 18 Mar 2014 14:18:23 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip
Server: QWS/1.0
ce2.............[ms.6..,..F....-J.....t. .k.y.J.......m..H....l..... .
.;N.N..L...bw.`.......O.{..X...x....x..l.......h:2......^.`L.?JC....t.
..;Fg.....~.....I/N.......u.q...9.w...............u;...?z..8bA...W..c.
D....3....l.'i..w.........$\3.A....?...............#..a..Io..:..?..0LY
.\y.....`.^,...h..1..#.7\..Xk..O..&..B,......%........m..J77...K......
.........^8........c.............1>..........r...3h >...#.07.<
;8..`n...u1<....1p.-.At.<..6.%ujQ.a..Pr....a. ...o.ms...Z..2/v{.
X.\......,HL....c.......]....1.Y D....[.maG...9.G..f.=..i..,^...mt.3..
...??............iP....(.....T.g..\.M. .....g..7/..\....5=.F.*..D.M..?
. ..5.x..l......C<.Y..>..C.c...g:F...y....~.Z....'.....O.!.....w
...e.\...QB1.........../-V..2u...h..i/]/Cf.C...<Np.%F...!....{. .`.
..v.cf....."...D:)J-.....'...Z$.`.......J.[.rZ..:.AI.%.E.R..Y....p.y3.
!..F.......eS}.v:.P6...e s......g.P.t.^.,.B.k..A.......!......Y.M..g.q
YY0=. ..F^..3.e.;}...9m....o;.(.......A.........).N.W........p...?....
..... .N....T........`.....P[.,dW\...a.C.t.....B..._Dm..x.).1b...Y...N
b.#E...G.....I.rX.G.g......#.h..L3.......X\.%*$'Q.......H..!.,....|.!.
... ..... ......w.U..5D ...$.`...O<..d....=....Y....e.A....G..#...f
...&][email protected])..K9.:.....W:....T.Z .W5o..r-,5.N*....Sfd. ..
.5..(.)I.951Y..E.E......[xC...7..7..t..^.?(..B......D...r..D.t..,.%I..
i...s...;.<..y..I.....k....X...}f(C;b....X.....l.:......Gx9wW.?...u
....F..X.^%.....).^g_P........P..X!.f......VX_..ay. "[email protected].
..K..ZgKK.x.A!....?Y.d.....r8n.......i..._.P.......$.Gm..".H..x_.o
<<< skipped >>>


GET /jump1stat?roomid=lmx2369295492&pid=20111931&sid=214516&uuid=38295037017807 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: xiu.stat.corp.v-56.com
Connection: Keep-Alive


HTTP/1.1 204 No Content
Server: Tengine
Date: Sun, 18 May 2014 08:07:52 GMT
Connection: close
Expires: Sun, 18 May 2014 08:07:51 GMT
Cache-Control: no-cache



GET /live/2014/03/20/15/1003v1395300869395285901.jpg HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi0.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Thu, 01 May 2014 18:23:54 GMT
Content-Type: image/jpeg
Content-Length: 3860
Expires: Sun, 26 Apr 2015 18:23:54 GMT
Cache-Control: max-age=31104000
ETag: "3481075106"
Last-Modified: Thu, 20 Mar 2014 07:34:29 GMT
Powered-By-ChinaCache: HIT from 06047113L7
Age: 1431831
Powered-By-ChinaCache: HIT from 060311H3SN
......JFIF.....%.%.....C.....................................%...#... 
, #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((
((((((((((((((((((..........."........................................
<........................!..1A..Qq."a#2....BR...b......34S.........
.......................)........................!1.A."#2a..Q..........
.....?........If.A'..s.......g k...A.,u?.'aE.....z....l..Xs.F.B; ..a]R
3k.X...K..0..~..&.NFO..i...Nk.xe)..8..Z..Z..3...WW..ltk....8#.yP~.{...
..y...E...........V.Z...#r..fv.l...1....P>....8.a...Y#0......l~=*..
Wa..X.....j....Q..c......-..kn2..j;.. 5......:.,...U..._....^#..x.P...
.........=N7.=qC....nO.....<...u;......9..~4.. .X......M.%.bE.6o9.7
F=.....l"....T)..d...t...9<.....x......G:m.:...C.._..9..u....x.5.?.
..#V...W.8...gv#......P...w..Gj[.1.:(.R.B....*T..fl....b..9c..V.Z.^[..
...L5. ......6.t.....q)......Or{T..K.U5..._Y........Q..$.).......u..H.
..XR.....2\..r.}..?....._...x..,..O...E.%..:.....^U..PH..g.l.^\....-.'
...XD......O..T4...t;.....q.K...ks..Ik;\.r..G.n...Mg._...]M,......d...
......}.j5..c .....R...(.c}...:..$~.#..0.-'.....5..dO.Q......h[Q....O2
.....#x..I.._6.*.........."..TlN....Ot.....K......a.5..*@...y...;..Y..
 ..^..Guxc..,..8y....'...YxH....._7.r..v......n.K..|D{.........J.*...m
8.k.N-...<Zg.Y.[..U.}...=.{U..h..,/...0.lm..FV.*_jR._!.H.I..AD.V.3.
v..A.1.E(mA.|U...[3so'...........h.....0..,^0.y....W....Yl. ...j.%.n1.
.x.P.g..u;9G..r.....W...%..U]........Y...ydn..I...iW..(UZf<.G....Ux
.7zu..).JW..r....3......../.. [email protected].......'=....... ....&NG=
<<< skipped >>>

GET /f2/9a/v627061383118550.png HTTP/1.1


Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi0.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Thu, 01 May 2014 18:23:54 GMT
Content-Type: image/jpeg
Content-Length: 3860
Expires: Sun, 26 Apr 2015 18:23:54 GMT
Cache-Control: max-age=31104000
ETag: "3481075106"
Last-Modified: Thu, 20 Mar 2014 07:34:29 GMT
Powered-By-ChinaCache: HIT from 06047113L7
Age: 1431831
Powered-By-ChinaCache: HIT from 060311H3SN
......JFIF.....%.%.....C.....................................%...#... 
, #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((
((((((((((((((((((..........."........................................
<........................!..1A..Qq."a#2....BR...b......34S.........
.......................)........................!1.A."#2a..Q..........
.....?........If.A'..s.......g k...A.,u?.'aE.....z....l..Xs.F.B; ..a]R
3k.X...K..0..~..&.NFO..i...Nk.xe)..8..Z..Z..3...WW..ltk....8#.yP~.{...
..y...E...........V.Z...#r..fv.l...1....P>....8.a...Y#0......l~=*..
Wa..X.....j....Q..c......-..kn2..j;.. 5......:.,...U..._....^#..x.P...
.........=N7.=qC....nO.....<...u;......9..~4.. .X......M.%.bE.6o9.7
F=.....l"....T)..d...t...9<.....x......G:m.:...C.._..9..u....x.5.?.
..#V...W.8...gv#......P...w..Gj[.1.:(.R.B....*T..fl....b..9c..V.Z.^[..
...L5. ......6.t.....q)......Or{T..K.U5..._Y........Q..$.).......u..H.
..XR.....2\..r.}..?....._...x..,..O...E.%..:.....^U..PH..g.l.^\....-.'
...XD......O..T4...t;.....q.K...ks..Ik;\.r..G.n...Mg._...]M,......d...
......}.j5..c .....R...(.c}...:..$~.#..0.-'.....5..dO.Q......h[Q....O2
.....#x..I.._6.*.........."..TlN....Ot.....K......a.5..*@...y...;..Y..
 ..^..Guxc..,..8y....'...YxH....._7.r..v......n.K..|D{.........J.*...m
8.k.N-...<Zg.Y.[..U.}...=.{U..h..,/...0.lm..FV.*_jR._!.H.I..AD.V.3.
v..A.1.E(mA.|U...[3so'...........h.....0..,^0.y....W....Yl. ...j.%.n1.
.x.P.g..u;9G..r.....W...%..U]........Y...ydn..I...iW..(UZf<.G....Ux
.7zu..).JW..r....3......../.. [email protected].......'=....... ....&NG=
<<< skipped >>>


GET /live.6.cn/e6u2/r.php?location=v.6.cn/event/promimg/?src=pming393&referer=&browser=mozilla/4.0 (compatible; msie 6.0; windows nt 5.1; sv1; .net clr 2.0.50727; .net clr 3.0.04506.648; .net clr 3.5.21022; .net4.0c)&flash=10.0&msr=1024,768&uid=0&pro=4&stamp=1400382946245 HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: shrek.6.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DNION-2.1
Date: Sun, 18 May 2014 08:07:45 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sun, 18 May 2014 07:07:49 GMT
Last-Modified: Sun, 18 May 2014 08:07:49 GMT
Cache-Control: max-age=0
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: __uu=B1140040046964542; expires=Wed, 15-May-2024 08:07:49 GMT; path=/; domain=shrek.6.cn
Set-Cookie: __ut=140040046983365; path=/; domain=shrek.6.cn
Set-Cookie: eid=deleted; expires=Sat, 18-May-2013 08:07:48 GMT
1..1..0..



GET /live/91/28/57b557081c37a4c63ea3044817f3925a.jpg HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi2.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Sat, 12 Apr 2014 18:05:03 GMT
Content-Type: image/jpeg
Content-Length: 8939
Expires: Tue, 07 Apr 2015 18:05:03 GMT
Cache-Control: max-age=31104000
ETag: "823296313"
Last-Modified: Thu, 31 Oct 2013 10:35:19 GMT
Powered-By-ChinaCache: HIT from 06047113L7
Age: 3074565
Powered-By-ChinaCache: HIT from 060111b3TO
......JFIF.....H.H.....<CREATOR: gd-jpeg v1.0 (using IJG JPEG v62),
 quality = 100....C...................................................
.................C....................................................
........................"..........................................G..
.......................!..1..AQ.."Saq..2...#R.34Br....Cb.....$%5......
..........................."......................!.1."2AQBq..........
..?....D.G.-A..."..PX...A@n...)D....sr.D..a.._=uLT...<....^..p..2I.
.Pcn:v..=...n.....b[IAN........C#.$4x.........==..ak\#..p%.w.,......._
.6...........n.W...,....%....9G1>.qXJJ;. ...$...f..8S..=..|.>...
f....\....=.1....d8..a.]....4....&...&\.u#..r.'..F......B..h.k..h^C.K@
w..O....7h*..q..l......2.].w.....8...<......M.....9p.....j...'*..Q.
.c.V.r.UJ..U ""." ....aQ'P..%..........b.....Jvh.]...eL.*..7..g&..V^VG
.4!...u~.k.$..*(.q.......6..9.#q.....d.Hc..1.q.. .....'.. \x..c.......
s..(...-...>....e....t|..Aj.R.2...........N'>-v."WQ.5....nV.;=.9
$.v[.l{.Z.xA.0...}.eZ......n..p..p.&.*(#/........w. .ZZ:.Y...zy9%.x.$x
9...]]...........h.&..&..Y ..4...........3....4...F.jj..........O.X.r|
...s........,V...w..E$..".O.J...K.`.8....[[email protected]
.*^2B. [email protected]@DD...*IV......h..v..bo.cw|.......wOm).i....|Z...&.Ch...
...\...].f.......|w.r..r...] ..E....#.A-=]t....XHc$f.l..yq.........X..
s......c.d.W.5.h.G\....].'..:S^..\..:.]Rj.p...%...... ......n7.H..3..B
..i..=5}c.1..y.........3.........?c.:j.....K_.OU..rS.gq..'.i#8.s..v...
..GMX./tR:..nib.0...h##......c..7...o......MY.|t.(cd .....vuF.iw..
<<< skipped >>>


GET /pic/close.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p.tuigoo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Mon, 31 Aug 2009 17:03:48 GMT
Accept-Ranges: bytes
ETag: "0b28f15d2aca1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:20 GMT
Content-Length: 286
.PNG........IHDR.............\.......gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<....IDATx..S... ...?...>;.Y{........D.`.......-.
_w{..A8......O..>f.<`*V..1..N..........R.....`;."HJd...6..\...d.
I.... ..x...\q...D.....l..;.bw.Q=...)..h... .NR.......$.X........%..*.
.0.J......IEND.B`.....


GET /showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.com/CPVClick.aspx?AID=1805&PID=9756&Auth=6848383803FF6A6092490BA77624631CA1FA35D6FD9AE72FFF46957CF4C745CF&Url=http%3a%2f%2fv.6.cn%2fevent%2fpromimg%2f%3fsrc%3dpming393 HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p.tuigoo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Wed, 31 Jul 2013 15:22:38 GMT
Accept-Ranges: bytes
ETag: "0b345ca18ece1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:21 GMT
Content-Length: 2942
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"...O.<y...<M...L_~....I..
.....wr...7O....o.x...w.7u.l....Yy........m.zt........../..yu..`..e.u.
......GG.q.._......,.g......4...~..6#\..v.....g..T.6_..o.W.G.T....6...
....t..M.~.n...>J..L[.e~.........&..:m..2...EV_..G;.w..D3..U{....eV
...U1k..g.E...M...9}........(.I.../....v...</..m..|N..........V[]T.
....lW?YTM.*......}..-.y.f..g..*}.....1A.C.o..F.....E/...e%s.._....q..
)....*.....g~&....;....u.L...G...=J...../9.%. hG......'.........0&.We.
<?o...W...R....3..M.J.`.W........p._T.9............^..Yu5./..CK^.._
..E`i...j.-....F........e..2[.....f/.:[4...ZV..o...q..4m..{g........~.
D~.........0-............'.p7^?....|.......wR....<........>...U3
..e.L.Un..~.. ...,.Wu...r..............GP.....W.X.K.n...........~.1>
;......|...x.M..\.9..c.!u~..G.......j]..............?)..........}...E.
.......~.6..j..n........Z.]....*........Q:..Y^..Cz)...=.x...%.......J[
.w..~:......n*....fok.]..Y[..l....n..c&...[.}........Y..{.4L[.sR'.Y.. 
......BX.........V.`y.............9..VJ.N....1 z]e5..{..?..Y~.........
W....vF{.....z....3b.k4..T...o/........=..._3....J..U..;$'........>
%.a..;..5...O#=..w.?].....~F..=......M....w......loCJ...~z{...|..g.}..
.W..u8.YsU..y.._..R?..4k..cC..i.....uO"KzaR..[.i.k...;....'....?n|Cg..
....^YU .........*............A._7..*37$.q...<k..............."..c.
....D.......b.i_..n|g.j..$....%7.o..7..c./._7.3%-..w....)f..........=.
....T.....wf9.^......c-No8..O..Ue.>.UE...i.c@/}..o.........O..6
<<< skipped >>>


GET /AShow.aspx?AID=9842 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShow=2024


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShow=2024|1910; expires=Sun, 18-May-2014 11:07:15 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:15 GMT
Content-Length: 4137
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:...Y...W...~.:.E...|.....:_.
.m..?..s..'....-.e...................S...^~..a...5cz................w.
......-.F.......O../9......:'.w~1.k.....7.]..Yu5n..xVM..|...j.........
.>[email protected];.;.$/.\...._.K..~....f...... Ej4........~!u.
Q|..'.......U.4k.......~.....i..y..HLM....%^....?...E..........zT....U
~q.n......3...>A.O>.l.{.....ug..g~.;Dq.>.c.......G...I...R.C.
....;. ..r...C..&Dot...|....w....8b.4@|2.Wx...F...I?I..[..;...........
.-rj..QMg0.....G.....v....uN.A....6....u[.....p.S....]..U....~...C.T..
......]U..?gY.......!...o.....>[f..E.V.x........'.....~,._.........
_.>;.;n.........>.].....;.._.._(.~.~.M...>.?e.U93.......T>
.zu..=0..}t.M.......e^..m.3?s.'~.I]].....Vq...Gw....._......n>...6.
n:..E....]................$Fx^]..I...1....(......n.l7...........k.....
.(....o.u.>J.3..;..A.~..=a..{.IsN_........V...............^;B./...h
.4{.....f.-.A.u.!...6[.....o;t.....t..bE.Xb...6..V..osAr..h.&.........
..._../....0..../w.}....t>m.b..G..j.........).......bF......y^\.[.u
ZfM..'._.=}...g.?......{.............{.Ov.......q....~< .{..GG..J.G
. 6{.......u.....j...G....5..2?o..........7.&x......~<.{J......n?.j
..o.......S........C............Yq.h..Y.W ...h...~..y;$..U.H3V....EN.K
/..........4.......j.A.....o.@.\....^Q.f=Y..^...M.g..W>b.....YS{.|.
F.~.....c.. x.b..q.....o-.Kk....L.|A......=.P..6....|..=z.0....gl.....
.........o.....F.......9.....R.e...?..bY......`.........b<.f..j
<<< skipped >>>

GET /AShow.aspx?AID=9756 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShow=2024|1993|1899


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShow=2024|1993|1899|1805; expires=Sun, 18-May-2014 11:07:16 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:15 GMT
Content-Length: 2543
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:m.u.....]=.{ww..x.........w.
-..........>.._.......^....~0^\....]..{.i..{..'O.b.v.5.w......v.v..
.......?....v..........{..}z.......;O..<.to..{.'.............O..={.
l......<.?y...../..0......w.;..].?.O..K~./[....E....~.{.M=....V.byq
..=3.....<....f.t..7.e5...Zj.l..o..ql...'.u......i...%..`.../<..
..p..........s......'{O.N.}....`..........."...{.>}..1.. .7;.......
./.a.(>.$_N.Y.....j...4.-o.wtT.............*f......4..</...g{;;.
w}........WW..b<o...t..'...........|J_.>.1..E...&...&.Ut...j....
........x....8i.I[.>...`...V{.........g.z..K4...g......X...._...evY
\dmU....E~..&e>.....89.:_/....;......^|.}....u...>s..M^._.X.e;/.
..|....(.~...ei.xVVY....~.....7.[,.U.....b....#..W......lqA...........
..O..A..9/..3..< ....*.K.z......./^.....y.n.....O....y....../../.J.
.O....g.....).V..........mS.....Fa........s.......}V. W.~...l.~.~.....
.>....^.9)...h.g..."O@.,..B........[4m.........:.... LW..U..mVY...]
?..I6}........ .O..c..... .p]..}t^.m^?"{rQ..=.....E.....9.....X.....q.
.g...*....Y.6R]..*.wK.l.Z^....d....y5....w.?J..GC.6.l..A.Q.(eEJ*j....I
..~.T5.....#.;%f|...2x......1........|...3R.....~.._z...8}zv........WU
S...1........w.......<|....1z.....'.........Sn0...Z<.9.......c..
%....M..\.y.s..m.8............u.T..y.$J.9z.K.t..E..R@2|&.v..3.dM.=..G{
.......=.....hVev.hI....Z.C..G?.]f...V.#;..n..m.9..v]/E*?:.N....O.....
.y...].....rA].......]Z.n!1.O ..Y{/..........ysT ...,.=..9ir.|...&
<<< skipped >>>

GET /AShow.aspx?AID=9756 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShow=2024|1993|1899


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShow=2024|1993|1899|1805; expires=Sun, 18-May-2014 11:07:29 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:28 GMT
Content-Length: 2548
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:m.u.....]=.{ww..x.........w.
-..........>.._.......^....~0^\....]..{.i..{..'O.b.v.5.w......v.v..
.......?....v..........{..}z.......;O..<.to..{.'.OwO...?8.......O..
O.<..==}p..w.`..~E.....^...........K.%...-.\...X\.o.........f.E....
...H..u~..?.g.j.^.....fmQ-.M6..7..86.........._..Zd...|..p....d.y.s...
g.....9.t.........O.......<.t...{.;O..?y......;..=}p......'.{L..?..
..0h..../..,....I.XUK...7.;:.v]\T....gE.._.3.e...a..v...........>mV
c........j1....C:....Z....u...V>.._...c....P...X..*:.iY5.._...g..c.
f<q..~.4...V..~J0..t..^.........f...%........Y~^,..../...2.,.....T.
."?]f.2..I..o..n...Sp........W/..>......?g.9..&../h.......i>Y_|A
.H?K...._< ..}Z\F?.Vg....-...z...M.............}q....?..~.zZWe.....
..u......}|..M..A..%q=..cE......N....i.fwF....~W.<}...w.....n......
?.3..}...Z ...s..C.S..).........g~F{....c.x...> H..w.......g?.t....
...|~/.....U..3..y.'.X..g!.....AB.-.6..N.i..ki..ki... d.*l.6.......}.$
....g.G.pC.....1....r.y....>:/.6...=.(f....g..".Sg...dc.EA,.T....\.
3..y...z......n\...%u6^-/FM...J_....}V..;...x...w.U6.. .(..."%..z...$e
D.O..p.l......3>.M}.<o........qSuU.m.......b..G.../..._.>=;..
I{......).Q...a....T..G.....r.>..p..=.X.....W.......)7.Tm[-......~~
t.1.......&MU..<.....}..\.^....x....n...<[....=..Y:....o) .>.
g;...B..........]..h.....nV4.2.~.$.K|[-.!.......fZ......w7......y...".
...'......obU...z.....}i.........B..-.....'.b....y....\^.Y..9*...b
<<< skipped >>>


GET /Ä¢¹½Í¼Æ¬.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.cfmogu.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Date: Sun, 18 May 2014 08:07:29 GMT
Content-Length: 83
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
<html><head><title>Error</title></head>&
lt;body>........................</body></html>..



GET /?ex_track=auto_52283dc6 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: flight.qunar.com


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:38 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: no-cache
Pragma: no-cache
Expires: 0
Content-Encoding: gzip
Server: QWS/1.0
Set-Cookie: QN99=6547 ; Domain=.qunar.com; Expires=Thu, 23-Jan-2081 13:20:12 GMT; Path=/
f11...............w.E.8..r.....7......V....%...W....3.F.$..23..8>'.
..$$,....%,.B...!.s..r.d.....U.=3=/IV.,...K.gUuuuUuu..m.....?..#..F}V.
v......VA..vs&.]XX.,.f.s> OOOg...8.eU.....V.,.V.....].n......T.2.Q.
mu..b..P.).....]MO.Yh....:......o.........o.|.....kW..|te.....3?....&.
:g.......>...|..[.bf.FcG.6.`...Zx.(.......u1U5.uc!...'w?%...V......
p  .......~.l.b.W?M....O..v.....tN^c?...&)..L.x.O.. Jh..ZQ...5m..=h...
nsI......:.9.a........O.&$......>.>o.]{.%....s.\..O..<..BQ...
...g;...\......"4.....s......k_...............OO........n.z.o.*[email protected].
.~.i|.O.....y...:.......K..'Vo.......73..8.- ...F..F.%.n.I..U.a....V..
[email protected]:52G.........;K..e...Z.:Z.....~X0.z.....USU[..j.....c.
HK..6_..M.....5...s.<&.....<-IR.S.,.x.M..QY...vT(...f....d....."
mU..._...!....X6..9..c{$i|4/........;.|.......n..-.I.......q..........
.....;..n.x.......7..^......\...x.T..........y.T.....v........-....>
;un..5..xqG.....A.)..)h....Z7..XW.T.A..YMH...]..BE......p..._GZ.......
.3../ ....U......P..i..%.h.<....E@f=x..Ryvi..0.~.X,..Z..J.9I...W...
..u.....`...j.5.R.2.j4h.iw.\.4J%>....V.l..,..'s..,.O.....YnhzzA....
.).../..U.4.>.k....V....JY).KJ...i......,...<\.V..k%s..l........
.IPZ.!..rc...N....`.5.)73...*[email protected]].......l.....SS.)K.....Z...&}.MUKk
..e....7.=[.f).....i..IA..$.p6.....E....Vl(..@k.....$.G6Q7..e..3u.j..1
.t.=j.5.#(.. Ox4.......n.p.....L~T..QP...F..q.R...T7..cA4..&`.0S.*.U..
-......U....|,M..LZ...g.N..&...l]9..L&d..M.R..03...G)[email protected]..
......!L..*...4....}...|....CYG&.....'......./z....a%'|.Fe??..G.B.
<<< skipped >>>

GET /site/timetrack.htm?action=FH|domload|7.812&t=1400418465812 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: flight.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Fri, 16 May 2014 07:57:11 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Server: QWS/1.0
14........................0......


GET /site/main.swf?20090107 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: flight.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: application/octet-stream
Connection: keep-alive
Content-Length: 23580
Last-Modified: Fri, 16 May 2014 07:57:11 GMT
Accept-Ranges: bytes
Server: QWS/1.0
Expires: Tue, 23 Sep 2014 08:07:54 GMT
Cache-Control: max-age=11059200
CWS.P...x..}.\..........H.b.(.bW..)..R....p........[..E.k.]c/...5...Dc
o1Q....Sv.v..&..........y...7o...y3[.,..`9..w1.v.._.qUU.A..>[email protected]|
E.....WK..r/.)........6\'i.?...g......-.5...}..,. .."O....? ..w......X
.*..*.'....a..:M....2 .....|....9s.J...7........D[.l....._..]..8..6...
..-.a=<..a%[email protected]...[..{.Fu;.Q.o'......AM...A..j.A]..Q].A.....
.Q-W..6.......KPg...N..*.)B..IP...=)...A......:.".n.....*}..`.o..../0.
.g0..G..h....Y...........C..D.;..Ue...)#1..>[email protected]. \..2\
.7.1..-...k.8b*AL$.[....... p.Z_x.......... ..Z.......yZR.. 0.Y,e....f
.RTBh.A;V.."1.f1F.W..N..h.|.Z......38ks2..Eh..4v....3QVH6&.U.^...9k..C
....L..$..i...e...C..(.q.*.u.f.r).{.O...=..{$..TYB..R...J.....#.Eo.kY.
.%....."%.$y..&w.2..Q.u@]..H...h..J...u..Sj...le6....)[email protected]..<.
......Su.b ....x._Q9...D..A.-.`.,%..).....D.Eb....r*,...N......(\.T..@
.^..B..vn.v@&..2."(.-R.....BW....... ..HVd.....*..i*]..T.%:!..?.{....u
&..B..2..Y:@.t.7....9.7........(.F1..S*...{...7q#.sw.l..`.~.=.$N'oe...
. .:..|...)..U.J..5..t.....6.P.aV.R..g......Y c.J.....w.F...y.a..Lb.*.
..I.e.Af.&T.T...6."[email protected]...*....G.$... G..
D..HA.O.........FQ.U.T."-.Y..\...5....4(."...Flb..>. ,.KT.e KQ.r...
."P8<.J.)||4J....A....h..5. ......8.=.. ......Y....T..O...%k..`.E..
..I.%GC5..3...F....H... a.A.*m.......].g.|.}9S F.?.4B.E)P.........%k..
1..\-..e9.V.l.-L...-.Lr..._.....I8CR..,.E...`g.t..Ht...u........R.4.&l
t;I).y..$....'U...For..-..R./%.....x..L.....hk.....h{..v...\L...%U..'g
}.P......}..*I..W9|....1.B.....[..q=.....N....Z0f.....$.-....#...R
<<< skipped >>>


GET /MTFlashStore.swf HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: irs01.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:46 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 1877
Last-Modified: Thu, 06 Mar 2014 08:35:02 GMT
Connection: close
Vary: Accept-Encoding
ETag: "53183336-755"
Content-Encoding: gzip
Expires: Mon, 02 Jun 2014 08:07:46 GMT
Cache-Control: max-age=1296000
....V*.S..MTFlashStore.swf..-...CWS.....x..V]o...>..t..[.e....YI...
LJ..H....ex.. [email protected]."...........n.t.2l......aEWx....%A.?......sHY.
./.:.&..y..y..J...6....0.A1<...a...0k....b)...t G...u.n..akkkbkr.0o
..l6 ..!.I.D...mi;.[...q...-.T..j.q.,..-{....n7.]Z...j.:.....-5...(P..
..L,...f..|...%M......`.".../T.f...G.q...g.t&%^I..k.l...e....9Q<b."
].UlK5....O.&...$..M..5>....5U..V....Y...}.|..n:.-SsjT......m..4...
&...lH...lj.,QBa;e.......S.M.....]]"........p....Xy5.Z.ib.....)c.?.i..
...n......<..P.Z.4-..S...L>..N..3......b..(.K.'..M......y......#
..leS...6=.5;U\.f.2..L....K....li.8}%3.=d=... 6.M\ .F..BS2-L35.8L.M...
.zB.&.[`/.....K@/.....O..#E.[..y:.............`..E......x?....@.......
....MC.y ......k.p....{....o55i..jl.......Ef..N...T..........%.....X.9
UW......*K.i.....U..[.^S...r..<..7..k..L..R[a..j....s(.uh..~.i.6.p|
...]........s.A ..M....].. HN.gx.......s...............~..._......v.~.
...?...............m"M..^.,._.I....,i.G/..;p.....t...........{......*.
[email protected].?y...&j..l.VV.T6....j6I..lB....7.....{....n.R.
.._.}.Qr.W...............1Y<....I.w?.....~..{.>iSR5i]..J../....;
.E....l....R.V ...W..ew..Q..d.e...k.}...va...bKv.B...*....q.:.....|...
_<..o..M..I.....`....U..P..c..~.}.'w.....(.z.../....0........c..@l0
...Ec...kL..".......P_x.A.A.A.1^...<......"O/.....0..A...g....q.."&
gt;."..|..K....e..........".i.. .*.Y_..."~.., &..E...S....u....7.\..q.
L..Y...H..1....<.^..t.........g..2.C. ... ...........9`8o0t......&l
t;[email protected].`@^..1R..-...!..9..`L.....x..<U..3...[.$O.,[...0
<<< skipped >>>


GET /site/images/flight/home/bg_bd.jpg HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv


HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 62155
Accept-Ranges: bytes
Date: Sun, 18 May 2014 01:14:03 GMT
Last-Modified: Tue, 11 Mar 2014 13:52:41 GMT
Expires: Mon, 23 Jun 2014 01:14:03 GMT
Age: 24819
X-Cache: HIT from qunar_cdn_02
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
.......................................................&..............
......................................................................
...!..1A.Qa.q..."....2.....BR..br#..s........................!..1A.Qa"
.............?...?............P....!..................h.).A...........
`. ..A......T!....H. [email protected].`............H.}.!.AA.....J!.... .>...h.
..A..P.} [email protected]/..o...D4...............1..8r.......8........k.(J.[.C...
:..K.Q..P...P%...N..CR.D..........8. ..>...Yu.}..Kb}.=.=.......-Z..
.9..........~._...5..\.I.....a.3.`.z..].J.v; m..O[..8..Z/.Cx./..]..k..
[email protected].....................!..
....P.............@.@@[email protected]......"... ...H.....P.....DQ.
..!.B...... [email protected].!.B......!.@...@[email protected].$....b*......b)O
.JX.S.R.E(..S.)K.)F(R..h)F(R.B.b..(....B...P.F....(.B........{.. ..c..
[email protected]..(HT8..-.1...<W..;caA.r......n...R.....P.v....(
.c....~D.......j(1SU...;.......#U....V./u....P..!]l-)...h.T.....'...SW
..(M........M.....M.....V[..og......z.<(i...:=N;.uN-....C.......l.-
.nH.....U.{*...p.u.9..(Im.7.........N.-s.......`.uS..sr%...Lc..B.. .@.
.!....J..J........."..@..!.B....... [email protected].... ....!.B......!.B p.!.G
`Q....8@..!.%].).BR.".b)F".b*Q....S.R.".....)O.)F(R.P...J1R)F(R.P...E(
..Q.R.W....JP.(.JX.UB.)D....oAJM-.iJ;.Q..N;....)F".c.R....U..J1.).E(.R
....)F(R."...*Q..b*........].C]..E. .@&..AD"... [email protected]%Bh.........(
<<< skipped >>>

GET /site/images/flight/flight_search/qn1cs1_disable.gif HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 97
Accept-Ranges: bytes
Date: Sun, 18 May 2014 02:58:39 GMT
Last-Modified: Thu, 27 Dec 2012 04:15:02 GMT
Expires: Mon, 23 Jun 2014 02:58:39 GMT
Age: 18544
X-Cache: HIT from qunar_cdn_02
GIF89a...................!.......,..........2..i....d.&...y...........
...6...13..y.....D...d....;....


GET /site/images/flight/home/ico_la_ie6.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 6777
Accept-Ranges: bytes
Date: Sun, 18 May 2014 05:52:30 GMT
Last-Modified: Thu, 20 Mar 2014 03:40:04 GMT
Expires: Mon, 23 Jun 2014 05:52:30 GMT
Age: 8113
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR...d...^.....D.J.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE........Q..q.......q....z...j.......m..........r.....;.....
B....}'u..............}..u............. .........o......./............
.......v........i.n...................D........9r...........y.........
.............U..............e...........?.~(.................3.....G.y
 ....................O.t........r..k.........\....t..................o
..<....h......`........kw......n..|%.....x........u..5..|..Jq......
..v..............s.............i............{...m.....................
......l........-....|$....x...K..6...........W.................Z......
........T.........p................f.....0....................H...|..x
.......g.z!..].............s..l...........................*...........
.........{..N.v........n...............).........w..........~o........
.o.l...f.......l....tRNS..............................................
......................................................................
......................................................................
......................................................................
S..%....IDATx...w|.....H>.q.....N.....O.$Y...l....-Y....m06...`....
H..............z....7[gwgnw.I.>..|l..z.{;3.:3{...P\.XHZVN:O-.9Yi.{.
f{......6. I~>B.'...2Q.....I..#.\..4%..%.......P..I....e<;..R..~
[email protected]..].]... B.L......\$....o..}^M..P.........~#...r...z.
t6..l.Iw.)t...C.*.... ;GOl..e....4..).C.wq...A3.... ; ...r..bK.u.Q.s..
N.cM.PFM.[R...q...;b8n...%.:..9U...F..7AlI....B.C:.']..Iw......Bh.
<<< skipped >>>

GET /site/images/flight/home/ico_la_v2_0508ie6.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 2899
Accept-Ranges: bytes
Date: Sun, 18 May 2014 06:10:26 GMT
Last-Modified: Thu, 08 May 2014 06:45:04 GMT
Expires: Mon, 23 Jun 2014 06:10:26 GMT
Age: 7037
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR...d...A......]......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:5A37B171D67A11E395538975
B904D439" xmpMM:DocumentID="xmp.did:5A37B172D67A11E395538975B904D439"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5A37B16FD67A11E395
538975B904D439" stRef:documentID="xmp.did:5A37B170D67A11E395538975B904
D439"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.)......PLTE.....T~...p...................w
............o.}..........x.............h......K.....-....w.x..........
....y.............i...............v...j........j..g..h............w...
........h.....4.....l..|...........B.l........................9.......
......p..............s...............o.~(...z.........|$..Y....q...H..
..........|[email protected]...
...........n...........O...........[.................p................
.N..X.....J.....){...n...\........7....................S......v.......
...............*........A..b.....e.y ..g....m......5.....u........
<<< skipped >>>

GET /site/images/flight/flight_search/btn_normal.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 02:58:40 GMT
Content-Type: image/png
Content-Length: 2662
Last-Modified: Wed, 26 Dec 2012 08:35:14 GMT
Expires: Mon, 23 Jun 2014 02:58:40 GMT
Accept-Ranges: bytes
Age: 18544
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR.......X.......<.....tEXtSoftware.Adobe ImageReadyq
.e<...pPLTE........................................................
............................................Q...&{.$/.. {.............
.a...."r.......$t..h.h...~.)y...2m...Z...*.`..b..f.(x..d.y.#.....3.|..
.....y.............. p..n.{.!.w..v.....V......).S..j...)u..|."s....'.j
..t.w."m..}.%,}..X.....p.q...f..z..\..b..~..r....q...^.k...d.i..r. %v.
.U...'o.... .h.../.n..m...5..-w....... ..0.k.~.$u.!o...l.l..._..P..q.f
....6....q.0.......,.O..p..r.k..1.......7..-.^.e.................... .
.E....I...,........|.5......y.1..Y....................a...............
 `.D...........s. v./..@.............~........}..m....!a.0o......./o..
n.#b............tRNS..................................................
......................................................................
......................................................................
....................9.....IDATx....r.g.E...<.II.H.-..ff.'.3s.ff&33.
.......r..}.R...LyU.z....bW...p.......qy .....P...)..K.B?.@....}..._W 
.....L...*..y.B_.@....}....V ....>^........l...B..f..F...BO..ha..k^
XM9...SXM9...SXM9...SXM9...SXM9...SXM9...SXM9...SXM9...SXM9...S..k[...
[email protected] .....R..o)..\.B..@.[..}....U 
.}..>O...*..*[email protected].....<.z....<!.m..F..K.i...K.ym..)...r..)
...r..)...r..)...r..)...r..)...r..)...r..)...r..)...rJ#x..f..m.w...6.h
..6..R....,...)e..5....]!t-.].'..n%.....z..<.z0.....B.!.......DtsS.
..E/...B/'........Y...6.h...%t.W........C/.....6..UGD....L..^.....
<<< skipped >>>

GET /site/images/flight/flight_v1/postmk_wf.png HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 2575
Accept-Ranges: bytes
Date: Sun, 18 May 2014 02:58:40 GMT
Last-Modified: Fri, 16 Aug 2013 09:25:06 GMT
Expires: Mon, 23 Jun 2014 02:58:40 GMT
Age: 18544
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR...G...F.............tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..\]n.8.u.._.y....t...H.XXAa.... ...t....F"... h.0..YA..tn
{...;....A.......8....).......Z.....Co=.....q...|..........4..z..k.%.c
.......3.......... .1.......3....z[. s.g.G.{....m...c....f5.(.!f...d..
..}=.x.f.m.U...0....fv.......^ ...i.....0.s.p....Q.|...p.....v....g..$
..1f....g....o.~.....LY2g.?1(......i3......`.Bt...M...w...P...c"......
...c.X;..u.h`F`.7...........h.9`...m....0.......m4......T..0.C..`....`
_T3.Y.%...J..7.G..1o....Ys......:Z..............k...F.X...)8;t..0.3g..
;..`.,..j.k.)...1.!.q.....|.Y...O. .1m./...,x).!..UE.k.....8.*....w..'
.L*X.`..B>j..qU...6 .O..U.. ..1............W.....a...s2.6..V.N.....
&...#..!.`.@v..#..D...=......s.AT.n..CO.....i*Gd..".j<.c.7Q...`...5
;..`H..W0..0.dWW.. ..>..-.......cU.......Z..".8ca.K.HH.n...,....g
8....7...c.........._.02...D....a...P.4bQM2j........3xf..*...d.....ks.
..}[email protected]}Gf=.p.T..XYB.J-.)..9(%...*f..RH.D1..8{......>
;..E._..,$..t*.....,...zr..C...F(W.kp2.Xi..B.%F..Z.@^....N1......^PL..
.>.Q*.MJ.."...).>..`..B.iMBF..D.wE)..6 ^k.N.?...cL.;0uZ.;8....z&
v.0.1st...&....;s0.....c.mk...p....6.*.X..<..., vM.c...K...X0...E..
n.9.5}....wk.Ll.:eC._..[;.`RR.s...VtR..P.KY......K...B...T.`..1.. .|.#
.Q.jQ....I,.l.......G./"5.Z:=E.&..'...vs.>..., ......)U....`Mm.....
..Q......xVK...2.[G...s.p..d..4.. ......4.U..u...S.6.&....`[email protected].$.
y../..)..yE42,Z...`<U,-:...PIP..cVL...%.H..$.".te...{]q...#.....m..
Hm.g(.-.F.,..8.r.k.NV.^.dN.~..ntn.".d.T...|R<.u|.......9.7|...q
<<< skipped >>>


GET /qs/201311/14/98d9e829bcb252a26886324a.jpg HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS/1.2
Date: Thu, 10 Apr 2014 11:50:45 GMT
Content-Type: image/jpeg
Content-Length: 2556
Last-Modified: Thu, 14 Nov 2013 08:57:08 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
X-Cache: MISS from CNC-SDQD-18-67.fastcdn.com
Age: 3272169
Via: SX-119-114.fastcdn.com (DLC-3.0), CT-152-226.fastcdn.com (DLC-3.0)
Connection: keep-alive
......JFIF.....H.H......Exif..II*.................Ducky.......P.....mX
MP.://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzr
eSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adob
e XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> <rd
f:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <
rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/
mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmln
s:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did
:8B6C4BCCCC4CE31182B2F673021050F8" xmpMM:DocumentID="xmp.did:F4DA8DAA4
CF711E38F2AF298D8E9ADD1" xmpMM:InstanceID="xmp.iid:F4DA8DA94CF711E38F2
AF298D8E9ADD1" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <x
mpMM:DerivedFrom stRef:instanceID="xmp.iid:8C6C4BCCCC4CE31182B2F673021
050F8" stRef:documentID="xmp.did:8B6C4BCCCC4CE31182B2F673021050F8"/>
; </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xp
acket end="r"?>...C................................... $.' ",#..(7)
,01444.'9=82<.342...C...........2!.!2222222222222222222222222222222
2222222222222222222......>.>..".................................
.....2...........................!1.AQ"Baq...2b...R...................
............... ........................1.!AQ."....a..#23............?
.h...W:.u.x....<..,..RE..O.^ ....q.P....#...u!..e$09....K...l...N..
[email protected]........|.rp.....JJ...1!....F{...?P..#.V..-..o.
*.........Gn..|.<ot....p,.<./Y.XW............:....x. .......
<<< skipped >>>

GET /qs/201212/25/e0eaeaf8276dc5556886324a.gif HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS/1.2
Date: Thu, 17 Apr 2014 02:29:59 GMT
Content-Type: image/gif
Content-Length: 2264
Last-Modified: Tue, 25 Dec 2012 06:09:01 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
X-Cache: MISS from cncstatic-sdzb-23-69.fastcdn.com
Age: 3217387
Via: SX-119-115.fastcdn.com (DLC-3.0), CT-152-226.fastcdn.com (DLC-3.0)
Connection: keep-alive
GIF89a>.>.........3..f.......... .. 3. f. .. .. ..U..U3.Uf.U..U.
.U......3..f..............3..f..............3..f..............3..f....
.....3..3.33.f3..3..3..3 .3 33 f3 .3 .3 .3U.3U33Uf3U.3U.3U.3..3.33.f3.
.3..3..3..3.33.f3..3..3..3..3.33.f3..3..3..3..3.33.f3..3..3..f..f.3f.f
f..f..f..f .f 3f ff .f .f .fU.fU3fUffU.fU.fU.f..f.3f.ff..f..f..f..f.3f
.ff..f..f..f..f.3f.ff..f..f..f..f.3f.ff..f..f.......3..f.......... .. 
3. f. .. .. ..U..U3.Uf.U..U..U......3..f..............3..f............
..3..f..............3..f..............3..f.......... .. 3. f. .. .. ..
U..U3.Uf.U..U..U......3..f..............3..f..............3..f........
......3..f..............3..f.......... .. 3. f. .. .. ..U..U3.Uf.U..U.
.U......3..f..............3..f..............3..f..............3..f....
.................!.......,....>.>........H......*\......#J.H.a..
..F[.jS...B-[v1#..q..9.deK.GRn"i2b4.-[.......A..\8.d.e....b....;Y.....
. pDB3..T.e.C.i.2..e/s..3..J.)G..'pc.e.$.C.....#..R.7g.;.F.*|d..z...tH
....!g.\|[email protected],O.39*c.3h...\7......B.&...BP..Fn
.z..R...2.(... .0. ......AC...yS4..7]].g....M3.L.|....xD1..S.Ct..S.Y.T
.Y;,..2F.tAgk....)...C%1.\(...aO....w....H....^,...}...MUc}..o0.A.a1.1
.NX...t..V.G....Y!i".U.X..]1j.R1...JC....S..x.bA..WJ..T.o....YJ*..aBm.
![lbE..-q...p..fd.]..B#....p..._.1..Kp.......UH....BT...&....L.wl...H}
$.M..q...N.[.....z@.$.i~....#Y...9I.lK....A7-S..>uZ._H...(Km..[G...
..*.U....VG=U..M@[email protected].(s.a...b... #A{...
......e....!.Jl....WA.d%P(.u....F.l~G....19elA....Jb...G...fT....W
<<< skipped >>>

GET /qs/201404/30/1644498437263f636886324a.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS/1.2
Date: Wed, 30 Apr 2014 07:00:59 GMT
Content-Type: image/png
Content-Length: 48685
Last-Modified: Wed, 30 Apr 2014 06:55:33 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
Age: 1559218
Via: SX-70-137.fastcdn.com (DLC-3.0), CT-152-226.fastcdn.com (DLC-3.0)
Connection: keep-alive
.PNG........IHDR.............s.......IDATx...w.eWY/.}V.{....5.L:....B.
"......E..x.^.*.....zU.].^D.....d. .6.Lf2...{..k=.?v9...L..w}&o..g..W.
[email protected].}.]....t.J..9..=}_eLr?.....
...{[.[...-..?.f...... 47.J..v...........G.....C...?d....*.).G-.w.....
2...e}[email protected]<.[<....._.<.,......`p<
...B OP6...u?....{%.p.>.?...4>kM..|...l6...L\....}..wE....Tu....
S....t....,4.........u.l9....l.."..$sG.P......>.....^...&.`NIvO.W[.
..Q`$$f...Y.4...T1..%...>.C./.P;..q..!.r.wd...B.2B..l.$.:....W.8...
...$.m.g(.m.A.R.Ab.7`..m...<..}......7|Z..p......P....(nn.6z.y..^..
..6&..>....`. .)d.G...;l...B.....W...{[email protected]........=<
;...~..Y.3.?Q.,hx7z..j.......p...4DC.E.r.{...o...u.I. R...... K...Y...
.5..sZV.g.....V".P_=..[.I)...'..Rr:..k.J..0...g}`]a...N:.......H.]./.&
lt;.1..a...0b..<....X.;.y.>.;.qz..@./.|..PF.:..o.-..D<.>..
....j..{.zHU".....I.....'w..`.r...>.......;...r..t&*1D....:..s..;L.
..X.W9...}......}..I^IB........l...UV....R.C......}.t. y......r -..}O.
..^...f.9......V.u.!uen..m...$.D..B...0 d.....XK..... .y....AB8d4..e..
.r(g.S....K....>j..H..C[...h.(.2\....H....@...'(......L....3>ta.
...........P61.;).?.p...... m..j^....\;Z..S..Wx..g...]Q.<..01rH7s.{
.MC.L.....^....'.`....R.aq......K.].Y..."Jm.=w...y.?Gb..*2..w.....?..&
gt;..R...6.~$.uw%%...5iuE..j4..5......<..?.....0......0k.o....$.k:X
a.W..}P.T........q.L..F!Q....}......IOs....m...P<.)R.v...........J.
.W}._?.xd.\....P8B....`........=.......P..MCFb......U4.....D.\.A.q
<<< skipped >>>

GET /qs/201405/08/f1f51d8b645559506886324a.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=topicLinkL
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img1.qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS/1.2
Date: Thu, 08 May 2014 12:31:59 GMT
Content-Type: image/png
Content-Length: 2842
Last-Modified: Thu, 08 May 2014 12:13:12 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Accept-Ranges: bytes
Age: 849285
Via: SX-119-114.fastcdn.com (DLC-3.0), CT-152-226.fastcdn.com (DLC-3.0)
Connection: keep-alive
.PNG........IHDR...............Q*...;iCCPicm..x..SwX...>..e.VB....l
.."#[email protected]....(.gA..Z.U\8.....}z............y.
....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W
. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@
..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H...
....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o"&
gt;!.........N..._....p...u.k.[..V.h..][email protected].<......%b
..0..>[email protected][email protected]..#......)..4.\,...X..P
"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ .
..........\...L....D..*.A..............a.D@.$.<.B........A.T.:.....
........18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.
]H#.-r.9.\@.... [email protected].]...k....=.....K.ut.}..c..
1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.
'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m..
..... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%
...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2.
.g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_
.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.....
..9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.
c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x
.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..
J.6.....|...M....V>VyV.V..I.\.,.m.WlP.W...:........v.m.....).).
<<< skipped >>>


GET /count/headerImage HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547


HTTP/1.1 302 Moved Temporarily
Date: Sun, 18 May 2014 08:07:39 GMT
Connection: keep-alive
Location: hXXp://simg4.qunarzz.com/site/images/zhuanti/huodong/Header0428.png
Content-Length: 0
Server: QWS/1.0
....


GET /count/counts?t=1400382941105 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:41 GMT
Content-Type: text/javascript
Connection: keep-alive
Content-Length: 384
Server: QWS/1.0
__mobile_cnt_callback__ && __mobile_cnt_callback__("54,405,773#54,405,
773#54,405,773#54,405,773#54,405,774#54,405,774#54,405,774#54,405,774#
54,405,774#54,405,774#54,405,774#54,405,774#54,405,774#54,405,774#54,4
05,774#54,405,774#54,405,774#54,405,774#54,405,774#54,405,774#54,405,7
74#54,405,774#54,405,774#54,405,774#54,405,774#54,405,774#54,405,774#5
4,405,774#54,405,774#54,405,774");..



GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dnlive.fastcdn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS-R/1.0.3
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: text/xml
Content-Length: 120
Last-Modified: Mon, 17 Jun 2013 08:35:51 GMT
Connection: keep-alive
ETag: "51beca67-78"
Accept-Ranges: bytes
<?xml version="1.0" encoding="UTF-8"?>.<cross-domain-policy&g
t;.    <allow-access-from domain="*"/>.</cross-domain-policy&
gt;.....


GET /56get HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.56.com/flashApp/vshow_player_woxiu.14.04.24.a.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dnlive.fastcdn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: DnionOS-R/1.0.3
Date: Sun, 18 May 2014 08:07:55 GMT
Content-Type: text/plain
Content-Length: 254
Connection: keep-alive
{"sug":["121.12.94.70"],"bak":["122.228.251.26","122.228.251.30","122.
228.251.32","183.136.218.139","183.136.218.141","122.226.167.130","183
.136.233.215","122.226.163.15","116.10.187.99","113.17.171.199","218.7
6.198.59","124.228.254.9","218.76.222.132"]}..



GET /site/images/flight/home/bg_bd_rex.jpg HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 05:52:30 GMT
Content-Type: image/jpeg
Content-Length: 443
Last-Modified: Tue, 11 Mar 2014 13:52:41 GMT
Expires: Mon, 23 Jun 2014 05:52:30 GMT
Accept-Ranges: bytes
Age: 8112
X-Cache: HIT from qunar_cdn_02
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
.......................................................&..............
.\..................................................................Qa
!q................................?..q..xT...E.....W..:......z&8H.m2..
....=.W...E.Q.....Vj.J.i.j..Z...f.aQ..f..4....u..V... .....V... ......
...........................


GET /site/images/flight/home/bg_tabsel.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 05:52:30 GMT
Content-Type: image/png
Content-Length: 944
Last-Modified: Tue, 11 Mar 2014 13:52:41 GMT
Expires: Mon, 23 Jun 2014 05:52:30 GMT
Accept-Ranges: bytes
Age: 8112
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR...............nG....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:664B9366FBF411E1BC349E27
763C9AF1" xmpMM:DocumentID="xmp.did:664B9367FBF411E1BC349E27763C9AF1"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:664B9364FBF411E1BC
349E27763C9AF1" stRef:documentID="xmp.did:664B9365FBF411E1BC349E27763C
9AF1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..?u....PLTE..d...W1.l....IDATx.b``....l...
.......~{....IEND.B`.....


GET /site/images/2011/QN1CS1.gif HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 1283
Accept-Ranges: bytes
Date: Sun, 18 May 2014 05:52:30 GMT
Last-Modified: Wed, 08 Dec 2010 12:43:00 GMT
Expires: Mon, 23 Jun 2014 05:52:30 GMT
Age: 8113
X-Cache: HIT from qunar_cdn_02
GIF89aN.......-..i...................!..XMP DataXMP<?xpacket begin=
"..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:
ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32
:00        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-r
df-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://
ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" x
mlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:Creato
rTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:BAA956F7
029411E0AF8680AE74ACE497" xmpMM:DocumentID="xmp.did:BAA956F8029411E0AF
8680AE74ACE497"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BA
A956F5029411E0AF8680AE74ACE497" stRef:documentID="xmp.did:BAA956F60294
11E0AF8680AE74ACE497"/> </rdf:Description> </rdf:RDF> &
lt;/x:xmpmeta> <?xpacket end="r"?>...........................
......................................................................
.................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[Z
YXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! ......
...........................!.......,....N......8..S0JG....|..D(..@<
\..l....q.........5.f..T`F...\6y=..D%..Ras9...`..4..lX,x.8i..H..=O....
 ...q.. ebdcY. W&z!m~...t=.*U.#.N..^...n).xe..|..\OQ>Si.l....[.7...
U.1..3.I.H....4...;....
<<< skipped >>>

GET /site/images/flight/flight_search/bg_sephuan.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 02:58:39 GMT
Content-Type: image/png
Content-Length: 1120
Last-Modified: Wed, 26 Dec 2012 08:35:14 GMT
Expires: Mon, 23 Jun 2014 02:58:39 GMT
Accept-Ranges: bytes
Age: 18544
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR.......d.......0.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:288692CE0A0211E29AC582AC
3FB368C2" xmpMM:DocumentID="xmp.did:288692CF0A0211E29AC582AC3FB368C2"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:288692CC0A0211E29A
C582AC3FB368C2" stRef:documentID="xmp.did:288692CD0A0211E29AC582AC3FB3
68C2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.g}.....PLTE....................X.....tRNS.
.............IDATx...Q.. .D]......f-..I...5.O2..m...nMf...:./!. ......
&b{DDG. ..I.I..s....x.pr.$......OqH.j/^....M.~.^X..?..>.j.3.^.6g...
D..":...].D...y.".("....TUa7i......C..`..W#..{I.....IEND.B`....
.


GET /site/images/flight/home/ico_la_v2_0508.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 2099
Accept-Ranges: bytes
Date: Sun, 18 May 2014 01:14:04 GMT
Last-Modified: Thu, 08 May 2014 06:45:04 GMT
Expires: Mon, 23 Jun 2014 01:14:04 GMT
Age: 24819
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR...d...A.....'.......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:F70536CAD67811E3B6DFA373
ECAB6962" xmpMM:DocumentID="xmp.did:F70536CBD67811E3B6DFA373ECAB6962"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F70536C8D67811E3B6
DFA373ECAB6962" stRef:documentID="xmp.did:F70536C9D67811E3B6DFA373ECAB
6962"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.x......IDATx..[Wh.Q.}..h..FD. ......?...b.
.C0...4..?.!.P..CDl ....*.......A...1...........o.M..=p..&;..s^..6.y.I
........d....e.%......{....Lo.cd..d/B..gqM....?..o......k.1...../.x...
.....<M.w..W.v.C.Y.Ng..U.?../.....f.y...!h...z....nc. ...A....:6D.v
.C..xd...0..}....nc.]`..}........................K,...8...k...........
Q..<..........>.......g.R_.....x.X..u..!.S..p]../..31..y....\L_.
..k......`A.5.3.ea-....D..........=.J{...;.Y..`.{0.........jM.B.......
..Lc..G.[D.......(.a....U..&:.......,......m.O...v..4.L.s6......6..7&l
t;f.V&1m]e.B.........b|...$.... ..4D..0[[email protected]...
<<< skipped >>>

GET /site/images/flight/flight_v1/ico_arrsel.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 249
Accept-Ranges: bytes
Date: Sun, 18 May 2014 05:52:30 GMT
Last-Modified: Fri, 16 Aug 2013 09:25:06 GMT
Expires: Mon, 23 Jun 2014 05:52:30 GMT
Age: 8114
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR.......d......u......tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTEUUU.i....Z.......tRNS......A...wIDATx...K.. ......m..#N.].n
.....H.h..}......._......0.~..:j2. [email protected]...=9.X..#........H.:/..
....3./.....)....'x.0..... #......IEND.B`.....


GET /site/images/flight/flight_search/ico_a.png HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 05:52:30 GMT
Content-Type: image/png
Content-Length: 552
Last-Modified: Wed, 26 Dec 2012 08:35:15 GMT
Expires: Mon, 23 Jun 2014 05:52:30 GMT
Accept-Ranges: bytes
Age: 8114
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR................E....tEXtSoftware.Adobe ImageReadyq.e&
lt;...-PLTE ...h....UUUWWW<|..i.G...Z..a.0s.%j.Q..W......y.M....tRN
S......................vIDATx...... .E#.n.6... -*%.#...u.?.c..{.*.=hj.
..$.Jv.s...4l.5[`.2T...JGE&9H8....r4@.\..%.J.>...2g..N...x...T:*2.A
...l....F..8|M%.v?r3gt9.C.("...*.=.O..i"^./..4:..ZGZ...6.<.._...$..
..{....N.XDF...h......L.yd#)'.N...}.p'=A$..pKSNC7")'..wo.{ ......v.G9.
.H....:.Al.O..f.7..Y......`.. [email protected]....;r.w..F..|.m.5m.........
....*...z.0.6.8...}oa.u.......D3.m.`lE2-......C.o........S........IEND
.B`.....


GET /site/images/flight/flight_v1/postmk_dc.png HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 2429
Accept-Ranges: bytes
Date: Sun, 18 May 2014 05:52:30 GMT
Last-Modified: Fri, 16 Aug 2013 09:25:06 GMT
Expires: Mon, 23 Jun 2014 05:52:30 GMT
Age: 8114
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR...E...D.............tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..\Mn.8.f....g....O...`..O...uN...vN`..q...`..UN`f1..'....
..WR.......#....}.......Ul....T..q$.H.q...=J{\.. {<...=...S...?....
a......0`_.......{........d............`.1a..\..<..-.qL..........{m
G=......0....P.d\...../.../....)t.:[..[....x.I..\V1'.....so.{./....X..
.....C.IY_..7........5:y=......8...z6.(n.60..l...W..g.....z.P.Pt..1..L
......Y65.hP.....`.....Z..,X .o.L....h....i.~.6....O..*;.b.I.C....q.9.
.....KK.S...1.......b..^}.u..>.. ..M ....Xub.e......).h..-..bf8...L
HoZ....7./[email protected]...&..Y..Lg.... q..Pu`...0.....h...l(Is.4..k.>.
w.. .....%.. ...h.%S`f..]..2.....u.^....5...<%....XPG.X.bW.0M:..=.m
4..r.;..1........,bR.....>..i]....!...*[email protected].>
;P... )U.=C......U..`r[........vv)2.....].i.9 G...........Gx.....Q.).v
Lt.SbK..m..[WD...&P...H..=..eV..>y..=.U,..\...|>g.G..W.....S....
- ...N.rQp..50..I2U]jLX...h...a.B....*<..c^..L..J=b....$ ."\.<.,
.....a..q.D........i<!.U......fD.L....s..H..c..b|.*k.PyJ.mB...Z(v.e
.S..l...g.....w.5.p.5".E.....Ky..f7............%..g=."<. .<a.9..
...&G.....S.~.UI....9K.....|.k.J...........(Fp....-X...W....z.[?..t.J.
..t..}..:.:....G....{2..z`T%.|.3%g.........d^..%.}K3...."...\z.%.?....
.8c..X!.. G..C..>D.b.......9q.G.p..@..\c.......f.hl<..=.......0.
-.6..w..`E.|[email protected]{,.I{.kf.I*[email protected]
.#L....=nW..!..}.G..}j....i.._."....qBe...)r..0...j[L..Lm.1....M#;.z.~
.}W.)Ul..B..841....q..-{.j.....g(.h.8Ay.... ....0..i8..&.1.w>.x
<<< skipped >>>


GET /css/base_MIN_11.03.css HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vj1.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Thu, 12 Jun 2014 21:44:05 GMT
Date: Tue, 13 May 2014 21:44:05 GMT
Server: ngx_openresty
Content-Type: text/css
Content-Length: 14498
Last-Modified: Fri, 09 May 2014 03:38:01 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Accept-Ranges: bytes
X-HITS: 55
Age: 1
X-Via: 1.1 lydx173:80 (Cdn Cache Server V2.0), 1.1 yfdx32:0 (Cdn Cache Server V2.0)
Connection: keep-alive
...........}.n#....pJ0...).DI...]p..t....1..H.I1.x3.RU...y...>.?.~.
b.kv....s.8qIR....n.......~ND....r.[|.\.O...U.r5.\./W...z7....]S]....r
w.\..j.8V..n}...\.....bq.h..r......YU...Y.v..p.......<<..I.~_...
.a.{...........W....C..m..7../......xs?..w...p8.........v1i..../...y).
........M..4y.m=?...e...rU.o....{......<<[email protected].}~..M=/..r]?
l'.z.XW.....&...mS.^..........{S}l....:.?V.z.......O.=6.....[..{y..^4.
I..Q.....~..F......f.r.\.;...oVM..\]=.z....m..|........~......_... ..k
\....~..Eg....}U6.^.w...~]....-....O..............Z..m.B. (....r..&...
.4.N.,...z.i...4..P...fr...#..E5.....m'4O..{l................3...]U...
......l....K.>.W..d....u....G........a.........Ir]=T......Z.\]_....
[email protected]/..Z.....uU....'.]....?>3\.}R.../............,../.....5...
7....o..d^....X.w.w.T..Y...O...X....&*..\[email protected]....#.F.._......m.....
.|.....g..W/.v.%p.. ....7...)Q....c5.......{.v.. ...5._9..}l......6.p4
..y........9.l..AK..f.8..A....W.q=.M.F1..X ...0.J.....[[....{Y.L.y... 
.....cL2....O=.X?..M..nP...R..Z.|......%....`.r.PM..0.....#....m....b.
*......1.a....9.....[...E...W.z.u>...9.\..w.m...m..N..a~9...W......
...O...!..W....D........O..S..~.m..i............j.s.0Q.......Y....>
}.$..Z.%......=./..?.......N.Mg.....y...LWC4g~.....#.\?.c..i...s1.{...
N.)fUIO.u..j...6.....f[..#3..|....'...n.4GP2?.?i.q...t..st.t..O4|.F2..
P&.'.`...O..4..S..".....GS.M..-~..d.l..tA....&....}|..!..`..5%*.P....;
.El....`......S.l..8]...1...#}I.M#.hF..%...e..(.9Vo..A........q5S5J..p
..u!.{.J..|[email protected]....:~V?...C}..rz..!Y.pT.....O...
<<< skipped >>>


GET /style/xiu/v1/css/sub/xiu_guide_v.8.css?v20140224 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 18 May 2014 11:56:10 GMT
Date: Sat, 17 May 2014 11:56:10 GMT
Server: Tengine
Content-Type: text/css
Content-Length: 6284
Last-Modified: Mon, 17 Mar 2014 05:56:04 GMT
ETag: "53268e74-188c"
Content-Encoding: gzip
Cache-Control: max-age=86400
Age: 1
X-Via: 1.1 zjjx159:8106 (Cdn Cache Server V2.0), 1.1 gl28:10 (Cdn Cache Server V2.0)
Connection: keep-alive
....t.&S..xiu_guide_v.8.css..=.. .q.. ...H'.e....<..>....!9...K.
.p..C...p.XI....` .C.'.m......F.G..L..g...%.A........uu......./.......
...."..........o....*z....F?...... .J.....pr.. .E..2..w......../......
...................i.....?|....y.......~...o...r>.]..k.]..Q.^/_....
.....K..7.....\....L....z],6.b].j..*^=D....F......w...........U5.o....
.........tTW.......W4k`...M...p.#...U1.V..AW.....1.y.(...A|......r...i
.C1.S3.j.E.....)..&..!..;.uy.X.>.Zn..Z6..f.....k.|.H1...V.rT...F...
..(..G.u...........\..T.i..L...Z.4..a.@@.X.s>s}9.g..Y.;1bR.w.f1._.z
.R..||S....V..$....n.K.Rp.........5..LhZmV....x..| !.G.y....?.j../.A .
O..M.. .......!..Q......W..F.,.>.PCr...(.$.kP....&./..^..Q`.g...._,
..uwn.h.....]Q-v=..g...n.]o...ZV..\[.).<`Y.Ul ..~O$..3.)|M.k*TJ...k
.4.(p...L~\.Q.E..i.....5...T......).,..A.....$..I..dAH&.X.8.3. d*.AR..
.J..o.U\\....a.{......R.C.p..N|...:.5....z.*&U......7.yU.W.........'1X
....v=....WW...^.Iuw...pS.....6....y8.KcxO....jq..w].b9X..........FE..
F..:3]$L.TCE..H/]..t........>........2 Gb.E.^.-..,...3..#_i<..t/
..Co|fz...gP........`^.}..3.%...c..E....$g.1...0@.....!......}c....^..
3.......Z....).....6v<.,m...........FI.i. .......o.....]^...y..qc..
l...'I.^1..r.......>P...Xg_.....h/.AQ.IH...I....o....".mg...9.m..6L
.N...5.@mz.'...c..|..5.a.@ [email protected][..fH....&..3'..`.1Kfmsf...1..
.62^.heo..q....N...-F.Da.C..#".b.....B...0......<..#...H.)..4.X.6.P
.I.VQc..$.;f....V.H.96U.Lh(.W8...Dz.Qd.0..7.LZQ....6.0.G.v.).u.....z.d
,&..*........'..u.3R..u...........b .j..|DPbe.u...P...".i,J. .h.!q
<<< skipped >>>

GET /style/xiu/v1/css/topic/xiu_activity.css?v20140429 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 18 May 2014 11:56:10 GMT
Date: Sat, 17 May 2014 11:56:10 GMT
Server: Tengine
Content-Type: text/css
Content-Length: 6284
Last-Modified: Mon, 17 Mar 2014 05:56:04 GMT
ETag: "53268e74-188c"
Content-Encoding: gzip
Cache-Control: max-age=86400
Age: 1
X-Via: 1.1 zjjx159:8106 (Cdn Cache Server V2.0), 1.1 gl28:10 (Cdn Cache Server V2.0)
Connection: keep-alive
....t.&S..xiu_guide_v.8.css..=.. .q.. ...H'.e....<..>....!9...K.
.p..C...p.XI....` .C.'.m......F.G..L..g...%.A........uu......./.......
...."..........o....*z....F?...... .J.....pr.. .E..2..w......../......
...................i.....?|....y.......~...o...r>.]..k.]..Q.^/_....
.....K..7.....\....L....z],6.b].j..*^=D....F......w...........U5.o....
.........tTW.......W4k`...M...p.#...U1.V..AW.....1.y.(...A|......r...i
.C1.S3.j.E.....)..&..!..;.uy.X.>.Zn..Z6..f.....k.|.H1...V.rT...F...
..(..G.u...........\..T.i..L...Z.4..a.@@.X.s>s}9.g..Y.;1bR.w.f1._.z
.R..||S....V..$....n.K.Rp.........5..LhZmV....x..| !.G.y....?.j../.A .
O..M.. .......!..Q......W..F.,.>.PCr...(.$.kP....&./..^..Q`.g...._,
..uwn.h.....]Q-v=..g...n.]o...ZV..\[.).<`Y.Ul ..~O$..3.)|M.k*TJ...k
.4.(p...L~\.Q.E..i.....5...T......).,..A.....$..I..dAH&.X.8.3. d*.AR..
.J..o.U\\....a.{......R.C.p..N|...:.5....z.*&U......7.yU.W.........'1X
....v=....WW...^.Iuw...pS.....6....y8.KcxO....jq..w].b9X..........FE..
F..:3]$L.TCE..H/]..t........>........2 Gb.E.^.-..,...3..#_i<..t/
..Co|fz...gP........`^.}..3.%...c..E.HTTP/1.1 200 OK..Expires: Sun, 18
 May 2014 11:56:10 GMT..Date: Sat, 17 May 2014 11:56:10 GMT..Server: T
engine..Content-Type: text/css..Content-Length: 6284..Last-Modified: M
on, 17 Mar 2014 05:56:04 GMT..ETag: "53268e74-188c"..Content-Encoding:
 gzip..Cache-Control: max-age=86400..Age: 1..X-Via: 1.1 zjjx159:8106 (
Cdn Cache Server V2.0), 1.1 gl28:10 (Cdn Cache Server V2.0)..Connectio
n: keep-alive......t.&S..xiu_guide_v.8.css..=.. .q.. ...H'.e....&l
<<< skipped >>>

GET /style/xiu/v1/img/rev/rev_h.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Fri, 01 Aug 2014 02:43:16 GMT
Date: Sat, 03 May 2014 02:43:16 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 47680
Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT
ETag: "53268e81-ba40"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx162:80 (Cdn Cache Server V2.0), 1.1 gl24:4 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR...@... .....R.......tEXtSoftware.Adobe ImageReadyq.e&
lt;...iiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:CD5BD31BF552E211BA5CFCB8C20AB4A8" xmpMM:DocumentID="xmp.did:02D1
5BAE92E411E381C0BD108278F0FF" xmpMM:InstanceID="xmp.iid:02D15BAD92E411
E381C0BD108278F0FF" xmp:CreatorTool="Adobe Photoshop CC (Windows)">
 <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:061d4a78-0c58-8e4d-85
ee-4fce171b0355" stRef:documentID="xmp.did:CD5BD31BF552E211BA5CFCB8C20
AB4A8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?>W......mIDATx....`.......N:u.V.d[nro..M7.4
[email protected] !......l.Ih!@.. .w0.... .E..-Y]....o.....^.N...............
[email protected][email protected].. .t... .. ..,@. ..... ....&.... .... ."
I.6@. .W....&..,@. ....... .$.. .$.. .$..Hl... [email protected].
.A.H..A.0A..Y..A.$..A.$..A.$..A.q.u...A. A... A.....A.d...A....A....A.
...A./..B..Y..A.Ig..@..!..\`. .r... H... H... ..j.$..,@. ..@. ..@. ...
.... .. .... ..\`. ..... H... H... H... H... ....&."i..M.... .r... ...
d..t...HV..E.. .d......A$..R/0A...u...A.H..A.H..A.H..A.H..A.H..A.H
<<< skipped >>>

GET /style/xiu/v1/img/bg/bg_car.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 29 Jul 2014 11:50:10 GMT
Date: Wed, 30 Apr 2014 11:50:10 GMT
Server: Tengine
Content-Type: image/jpeg
Content-Length: 44675
Last-Modified: Mon, 17 Mar 2014 05:56:06 GMT
ETag: "53268e76-ae83"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl41:88 (Cdn Cache Server V2.0), 1.1 gl25:2 (Cdn Cache Server V2.0)
Connection: keep-alive
......Exif..II*.................Ducky.......=..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
1 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmp
MM:InstanceID="xmp.iid:BDEEBC1F49AC11E28F10966BC2E906A5" xmpMM:Documen
tID="xmp.did:BDEEBC2049AC11E28F10966BC2E906A5"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:BDEEBC1D49AC11E28F10966BC2E906A5" stRef:d
ocumentID="xmp.did:BDEEBC1E49AC11E28F10966BC2E906A5"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
..................................................................Dt..
Plj.R..S.a..... .\...] .%oL..}...!..^.v.e..A..J.......{z.F...........\
.s.:D.U.n.x[.e........W.v........o/.........t.r.{;?.GT.X.7.z..v.......
[email protected]...?.:h...u.uQ.T.t..h:..;..)m..)E
....Vf..z.p....*.......$.n.;..i.;..=%".....!........... .......b..n%.{
z..S....u,....-.R..u I`...5.....-..J....Q]4....T..%....P.....n...!9:t.
..)Ko/./.xcR......._[...^yv..IY...El....P|.....0.ogk.....Z.]]..-.}
<<< skipped >>>

GET /style/xiu/v1/img/col/peihua.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 29 Jul 2014 19:41:25 GMT
Date: Wed, 30 Apr 2014 19:41:25 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 77267
Last-Modified: Mon, 17 Mar 2014 05:56:22 GMT
ETag: "53268e86-12dd3"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl38:8107 (Cdn Cache Server V2.0), 1.1 gl25:7 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.............PP|.....sBIT....|.d.....pHYs.........B.4.
....tEXtCreation Time.01/25/13u./}....tEXtSoftware.Adobe Fireworks CS4
........prVWx..Y.~....A........@[...q.4....7.u.U}.....:|.=.>|....;.
.H..).R....A.!.}.............g..fY.eq..YF...Y.di..a.....Y.dI.%a..,...d
!....>..#.$M.=LS.&I..i...I.8..4&iH....b.../a....8..$&I.&!..ga......
8!....a..a..0%...S....S...B.}.r.._8.9.-6....r....G..eC........q.......
-m..Q6..U|..c....1.7......9../..4..x....C...a...w9X......yI.#.?...uE|k
.W..t.r...u._....V......i..[s...... .Z..:.........[v.S......'*..n.. ..
m.....oO.......@_._9>.m..v....d.v.U......}........[........ .X.....
.t...:]...T.J.._c..Y.....Z....KL..k8m..Y........%.Vi..5.p.....,..\Y...
..t..'z....*..?.....O..E...Q5x..M?/]..e..0.(3...S..,.dP7.Z. .._....sI.
.:.p.....k..Z.).7y....o#...F.y\../..K.. ..S...S.e....@j..?.HG...e.T.8E
[email protected].;.u...CZ.w|N(2i.~.............x-..K.T.S..tZ...QG.....?
.(... f.......~...l........mwT.....A>...p..L..A"-.......0....7...,.
...~>..o.._-...l.|=. ...@ ...s.:..w..9D.#.Z..|.o......Na..0.F......
."...d8B.....E}[email protected]....`BdQ..? .r..v..>.|.
..........W.R..E..|..L....i..e0.3>...h.......7.7...Y. .....i...."s`
.yjf...6..[...F..1..{..........7...0z.......4....#s....F...W.'..\...r.
..ZEP....:J....I.O....|o....(...T../..]<D...AE....h.."l...._..`?X( 
...:....sq....E..(R..z...J.....dWS}.-.. #....P.5....Q...2....._.......
.4......8...%..h.....T../.........4....t.(T.DY.w?.gW.O?... .x.?.~c...?
(."}..<L....7'/_^.|..../a.E...E...fZi.......!..x..} d..... .(..
<<< skipped >>>

GET /style/xiu/v1/img/rev/rev_icon.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Fri, 01 Aug 2014 02:43:24 GMT
Date: Sat, 03 May 2014 02:43:24 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 25248
Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT
ETag: "53268e81-62a0"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl39:88 (Cdn Cache Server V2.0), 1.1 gl28:9 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR...............mT....PLTE.............................
...........P.........s.w..;.K......s....e.......9.........W~=.6v......
..............i......jjk.....3.....P..........Q..y*..........c........
.........S...........<..C..A.......4.............NH.f...d.W*.......
......i...........,.....K..1.....u.I..2V.............:....yq..........
.............b.........................`....1.....^..x8.u....z........
.........[Z....h.......865.2......................r....P.........c...M
.............v3...............7.'.................l..K.....c.........u
.....T....n...............|..n.B.........u.V..............Q...........
...............gO................x........U.........H.................
..b..................o.{.....s...C......................I_[.W...u.....
..5............................X........2\[email protected].._NIDATx^.
..........=.m....m.....m..G...?.oU.I&......}..J...N........|C../.~..].
.$i*?.p....|[email protected].;..5......)7WW...`@..Y...&O.I..o.\..
..N.W.....Y...Tl..0.)...m..9' .9..N.........Q=*........uO....p...h}...
j...t......fZ.>.7..;.....s..'..H{p.....h.g....5..^[[....5..8..v[.X.
jG.....T.q0...;......D.,%v..3.".w. ..ZRK...C..5..`.=.n...=....>.'..
.N.Ld.o'.......##mW..xl.k.q.....K.N,9f?c..1f.W3[.....`.-...J.....E:.aZ
.\...W.Y4..cRc.........v....*VJ...HF...j[[email protected]...>7:tj\h\N.
.j.....#KJ.....lg.v..(.$..h%0/28.d..Hxg.e.\.....l......nh....v.(..L...
...>.i....!......G.R..-M.u.j..9.r...-^...U.pL..fL../..../Q..]f .J..
G..g.im.....BbH....]....."......$.....QV..e..".%....>.bI.jm...:
<<< skipped >>>

GET /style/xiu/v1/img/rev/rev_icon.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Fri, 01 Aug 2014 02:43:24 GMT
Date: Sat, 03 May 2014 02:43:24 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 25248
Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT
ETag: "53268e81-62a0"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl39:88 (Cdn Cache Server V2.0), 1.1 gl28:9 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR...............mT....PLTE.............................
...........P.........s.w..;.K......s....e.......9.........W~=.6v......
..............i......jjk.....3.....P..........Q..y*..........c........
.........S...........<..C..A.......4.............NH.f...d.W*.......
......i...........,.....K..1.....u.I..2V.............:....yq..........
.............b.........................`....1.....^..x8.u....z........
.........[Z....h.......865.2......................r....P.........c...M
.............v3...............7.'.................l..K.....c.........u
.....T....n...............|..n.B.........u.V..............Q...........
...............gO................x........U.........H.................
..b..................o.{.....s...C......................I_[.W...u.....
..5............................X........2\[email protected].._NIDATx^.
..........=.m....m.....m..G...?.oU.I&......}..J...N........|C../.~..].
.$i*?.p....|[email protected].;..5......)7WW...`@..Y...&O.I..o.\..
..N.W.....Y...Tl..0.)...m..9' .9..N.........Q=*........uO....p...h}...
j...t......fZ.>.7..;.....s..'..H{p.....h.g....5..^[[....5..8..v[.X.
jG.....T.q0...;......D.,%v..3.".w. ..ZRK...C..5..`.=.n...=....>.'..
.N.Ld.o'.......##mW..xl.k.q.....K.N,9f?c..1f.W3[.....`.-...J.....E:.aZ
.\...W.Y4..cRc.........v....*VJ...HF...j[[email protected]...>7:tj\h\N.
.j.....#KJ.....lg.v..(.$..h%0/28.d..Hxg.e.\.....l......nh....v.(..L...
...>.i....!......G.R..-M.u.j..9.r...-^...U.pL..fL../..../Q..]f .J..
G..g.im.....BbH....]....."......$.....QV..e..".%....>.bI.jm...:
<<< skipped >>>

GET /style/xiu/v1/img/rev/rev_icon.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Fri, 01 Aug 2014 02:43:24 GMT
Date: Sat, 03 May 2014 02:43:24 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 25248
Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT
ETag: "53268e81-62a0"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl39:88 (Cdn Cache Server V2.0), 1.1 gl28:9 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR...............mT....PLTE.............................
...........P.........s.w..;.K......s....e.......9.........W~=.6v......
..............i......jjk.....3.....P..........Q..y*..........c........
.........S...........<..C..A.......4.............NH.f...d.W*.......
......i...........,.....K..1.....u.I..2V.............:....yq..........
.............b.........................`....1.....^..x8.u....z........
.........[Z....h.......865.2......................r....P.........c...M
.............v3...............7.'.................l..K.....c.........u
.....T....n...............|..n.B.........u.V..............Q...........
...............gO................x........U.........H.................
..b..................o.{.....s...C......................I_[.W...u.....
..5............................X........2\[email protected].._NIDATx^.
..........=.m....m.....m..G...?.oU.I&......}..J...N........|C../.~..].
.$i*?.p....|[email protected].;..5......)7WW...`@..Y...&O.I..o.\..
..N.W.....Y...Tl..0.)...m..9' .9..N.........Q=*........uO....p...h}...
j...t......fZ.>.F...w.L t.%.b...C....p.8..8-.I[.]H....Q.).....bKKC.
..'..{D.I.8q.._..W.:.......'...g....'.}'\GG.KB.4tsH...xN...*..........
w.[.9...u.*....m...=f..E.z.F..`...pM..7..p.t.>...=.......2//u1.2.SQ
,U..-X.w...../.Xr...6mR.R.a.jy.l....7..O..................?.a.......rO
O...Z5.g......7...?..'.....7$**$**.[.O.t.sd.D....-)y....8....;....c...
....1......2.Sj..Mr..3y..N8}!......\9.....?m...=O.m...$d_........d....
:.FA...M`;<.....U.....m.....>....3>..P.......i.9@E. JJp.p
<<< skipped >>>

GET /style/xiu/v1/img/rev/rev_gift.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive



jj.................`0.....`0.....`0..........c.7.b-......IEND.B`.HTTP/
1.1 200 OK..Expires: Tue, 29 Jul 2014 11:50:10 GMT..Date: Wed, 30 Apr 
2014 11:50:10 GMT..Server: Tengine..Content-Type: image/png..Content-L
ength: 1126..Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT..ETag: "5326
8e81-466"..Cache-Control: max-age=7776000..Accept-Ranges: bytes..Age: 
1..X-Via: 1.1 zjjx157:8104 (Cdn Cache Server V2.0), 1.1 gl24:2 (Cdn Ca
che Server V2.0)..Connection: keep-alive.....PNG........IHDR...x...x..
...........tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.x
mp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <
;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 6
4.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf="http
://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:a
bout="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="htt
p://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adob
e.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:FB33041E0987E211A3AE
8E6F1AE7A727" xmpMM:DocumentID="xmp.did:D6435675871011E2BBF5D45DA86052
CD" xmpMM:InstanceID="xmp.iid:D6435674871011E2BBF5D45DA86052CD" xmp:Cr
eatorTool="Adobe Photoshop CS5.1 Windows"> <xmpMM:DerivedFrom st
Ref:instanceID="xmp.iid:FB33041E0987E211A3AE8E6F1AE7A727" stRef:docume
ntID="xmp.did:FB33041E0987E211A3AE8E6F1AE7A727"/> </rdf:Descript
ion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.
b.[....PLTE......U..~....tRNS....0J...vIDATx......1..0n...B>)..
<<< skipped >>>

GET /style/xiu/v1/img/rev/rev_sprite.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 29 Jul 2014 19:41:25 GMT
Date: Wed, 30 Apr 2014 19:41:25 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 36532
Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT
ETag: "53268e81-8eb4"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx155:8107 (Cdn Cache Server V2.0), 1.1 gl28:7 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR...D...8.......3.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...iiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:21988CCD6D29E211A03E8433F7940ECA" xmpMM:DocumentID="xmp.did:C840
5DF35BCA11E3A5E9DC973D7B02ED" xmpMM:InstanceID="xmp.iid:C8405DF25BCA11
E3A5E9DC973D7B02ED" xmp:CreatorTool="Adobe Photoshop CC (Windows)">
 <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ef6e30a8-5a5d-8f42-86
f4-d8249bc420ec" stRef:documentID="xmp.did:21988CCD6D29E211A03E8433F79
40ECA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?>..D.....PLTE.....M...............r......@.
....9.qqq........S.F...............R.....e.6x.P...._......z.@@@... F".
.rD.z.....J...1...Q....B......4.....Z.&.7S_.r._.rtN{[email protected].....
.j...>,.P#J....VWRH$w.U!Q.'`.}.....Y..[/..b.-..9}.............W".;[
"FE.]|.NTP.s).r3...]|H.:...O..{:l.d... GWtG.z..G.........H...t.P... ..
...ADD r..........h.e....=....."=......[...0..`..../u..w..,.........e.
.lO...E.W.#DI...%!.;...!JN..i,&.8N..B}.i..G....%...q.Q.....{.bp. .Y ..
.-b...h{ ][email protected] ..'B......Lw...J}...zB..4&.g.
<<< skipped >>>

GET /style/xiu/v1/img/rev/airing_sprite.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 29 Jul 2014 12:44:58 GMT
Date: Wed, 30 Apr 2014 12:44:58 GMT
Server: Tengine
Content-Type: image/gif
Content-Length: 8346
Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT
ETag: "53268e81-209a"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx155:88 (Cdn Cache Server V2.0), 1.1 gl25:1 (Cdn Cache Server V2.0)
Connection: keep-alive
GIF89a,.......?h..........K.."I........$..H..........Kr.$K..;.Gm..U..A
..*UW\.Bi.'N.......7^.f......V.*Q.Jp.Io....Ek.3\.;a.....8..=.......w..
.,[email protected].....@d.....
..o...........Uo.e..Ei..........V..,Q.............`...E....Kj.Op....h.
....H..l........Xw....k......0....L........)N.|.....[~.k...........l..
...q...........9s.........................g.....U|.a..Mu.Hp....X......
..q........l.....V}....b........Ks................h...................
.......Lt.d.....b.................W}......111&&&......................
......................................................................
......................................................................
......................................................................
...........!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSz
NTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe X
MP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> <rdf:R
DF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf
:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xml
ns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adob
e.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 
(Windows)" xmpMM:InstanceID="xmp.iid:184D01FE031811E38602A40AF9F9E5ED"
 xmpMM:DocumentID="xmp.did:184D01FF031811E38602A40AF9F9E5ED"> <x
mpMM:DerivedFrom stRef:instanceID="xmp.iid:184D01FC031811E38602A40AF9F
9E5ED" stRef:documentID="xmp.did:184D01FD031811E38602A40AF9F9E5ED"
<<< skipped >>>

GET /style/xiu/base/v1/img/gift/game_icon/lock.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive



.....S.<....4>g.KY.-.....B.d..&.A.....R.).6..(..P..aU..Y.f....v.
.. .(..$.h..(....,....0.(c....;HTTP/1.1 200 OK..Expires: Tue, 29 Jul 2
014 11:50:10 GMT..Date: Wed, 30 Apr 2014 11:50:10 GMT..Server: Tengine
..Content-Type: image/gif..Content-Length: 1159..Last-Modified: Mon, 1
7 Mar 2014 05:56:41 GMT..ETag: "53268e99-487"..Cache-Control: max-age=
7776000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 tzwl38:80 (Cdn Cache
 Server V2.0), 1.1 gl28:5 (Cdn Cache Server V2.0)..Connection: keep-al
ive....GIF89a*.*......................................................
|.....|.....{..z..............j..k........j..n..n.._..................
...........i.....b..a.....[..............b..b..f.....Z..g.....Z.......
.............[........u........t..Z.....[.....}........w..U........V..
v..S..R..C.....M........N..L.....N...........&..L..L..H..B..M..A..G..L
..7..7..@[email protected][email protected].....#..".....6..>..=.
....6..6..<.....<..6..6..7..?..1..?..1..6..:..#../.....:.. .....
8..#..*..8.....3..3../.y(.|c.yW.xZ.x[.x[.x-.w-.t .W.9&................
......................................................................
......................................................................
......................................................................
...........................!.......,....*.*.....[..H......(\.......f. 
.....!jD.....Z.i1..C..(..H`.."..X [email protected]&....!.."h....D..E9.
A.bi..A.F-.P........&..... A.....I.4i.d....f...BC..06P......w.....C..i
........a|$......C.L....&6CV....'.%ulTa... To.I.qgI....4Rr..$P.@9J
<<< skipped >>>

GET /style/xiu/base/v1/img/gift/game_icon/lock.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 29 Jul 2014 11:50:10 GMT
Date: Wed, 30 Apr 2014 11:50:10 GMT
Server: Tengine
Content-Type: image/gif
Content-Length: 1159
Last-Modified: Mon, 17 Mar 2014 05:56:41 GMT
ETag: "53268e99-487"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl38:80 (Cdn Cache Server V2.0), 1.1 gl28:5 (Cdn Cache Server V2.0)
Connection: keep-alive
GIF89a*.*......................................................|.....|
.....{..z..............j..k........j..n..n.._.........................
....i.....b..a.....[..............b..b..f.....Z..g.....Z..............
......[........u........t..Z.....[.....}........w..U........V..v..S..R
..C.....M........N..L.....N...........&..L..L..H..B..M..A..G..L..7..7.
.@[email protected][email protected].....#..".....6..>..=.....6..
6..<.....<..6..6..7..?..1..?..1..6..:..#../.....:.. .....8..#..*
..8.....3..3../.y(.|c.yW.xZ.x[.x[.x-.w-.t .W.9&.......................
......................................................................
......................................................................
......................................................................
....................!.......,....*.*.....[..H......(\.......f. .....!j
D.....Z.i1..C..(..H`.."..X [email protected]&....!.."h....D..E9.A.bi..A
.F-.P........&..... A.....I.4i.d....f...BC..06P......w.....C..i.......
.a|$......C.L....&6CV....'.%ulTa... To.I.qgI....4Rr..$P.@9Jd...).Q..b.
..;.B...... ..Dd...O./......S.<....4>g.KY.-.....B.d..&.A.....R.)
.6..(..P..aU..Y.f....v... .(..$.h..(....,....0.(c....;....
<<< skipped >>>

GET /style/xiu/base/v1/img/gift/game_icon/lock.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive



.....S.<....4>g.KY.-.....B.d..&.A.....R.).6..(..P..aU..Y.f....v.
.. .(..$.h..(....,....0.(c....;HTTP/1.1 200 OK..Expires: Tue, 29 Jul 2
014 11:50:10 GMT..Date: Wed, 30 Apr 2014 11:50:10 GMT..Server: Tengine
..Content-Type: image/gif..Content-Length: 1159..Last-Modified: Mon, 1
7 Mar 2014 05:56:41 GMT..ETag: "53268e99-487"..Cache-Control: max-age=
7776000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 tzwl38:80 (Cdn Cache
 Server V2.0), 1.1 gl28:5 (Cdn Cache Server V2.0)..Connection: keep-al
ive....GIF89a*.*......................................................
|.....|.....{..z..............j..k........j..n..n.._..................
...........i.....b..a.....[..............b..b..f.....Z..g.....Z.......
.............[........u........t..Z.....[.....}........w..U........V..
v..S..R..C.....M........N..L.....N...........&..L..L..H..B..M..A..G..L
..7..7..@[email protected][email protected].....#..".....6..>..=.
....6..6..<.....<..6..6..7..?..1..?..1..6..:..#../.....:.. .....
8..#..*..8.....3..3../.y(.|c.yW.xZ.x[.x[.x-.w-.t .W.9&................
......................................................................
......................................................................
......................................................................
...........................!.......,....*.*.....[..H......(\.......f. 
.....!jD.....Z.i1..C..(..H`.."..X [email protected]&....!.."h....D..E9.
A.bi..A.F-.P........&..... A.....I.4i.d....f...BC..06P......w.....C..i
........a|$......C.L....&6CV....'.%ulTa... To.I.qgI....4Rr..$P.@9J
<<< skipped >>>

GET /style/xiu/base/v1/img/gift/game_icon/lock.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive



.....S.<....4>g.KY.-.....B.d..&.A.....R.).6..(..P..aU..Y.f....v.
.. .(..$.h..(....,....0.(c....;HTTP/1.1 200 OK..Expires: Tue, 29 Jul 2
014 11:50:10 GMT..Date: Wed, 30 Apr 2014 11:50:10 GMT..Server: Tengine
..Content-Type: image/gif..Content-Length: 1159..Last-Modified: Mon, 1
7 Mar 2014 05:56:41 GMT..ETag: "53268e99-487"..Cache-Control: max-age=
7776000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 tzwl38:80 (Cdn Cache
 Server V2.0), 1.1 gl28:5 (Cdn Cache Server V2.0)..Connection: keep-al
ive....GIF89a*.*......................................................
|.....|.....{..z..............j..k........j..n..n.._..................
...........i.....b..a.....[..............b..b..f.....Z..g.....Z.......
.............[........u........t..Z.....[.....}........w..U........V..
v..S..R..C.....M........N..L.....N...........&..L..L..H..B..M..A..G..L
..7..7..@[email protected][email protected].....#..".....6..>..=.
....6..6..<.....<..6..6..7..?..1..?..1..6..:..#../.....:.. .....
8..#..*..8.....3..3../.y(.|c.yW.xZ.x[.x[.x-.w-.t .W.9&................
......................................................................
......................................................................
......................................................................
...........................!.......,....*.*.....[..H......(\.......f. 
.....!jD.....Z.i1..C..(..H`.."..X [email protected]&....!.."h....D..E9.
A.bi..A.F-.P........&..... A.....I.4i.d....f...BC..06P......w.....C..i
........a|$......C.L....&6CV....'.%ulTa... To.I.qgI....4Rr..$P.@9J
<<< skipped >>>


GET /v3/op/gamenew.51.com/platform/act/51wt/apic_img/swfobject.js?file_v=20140103001 HTTP/1.1
Accept: */*
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p1.pic.51img1.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Date: Sun, 18 May 2014 08:07:33 GMT
Content-Type: application/x-javascript
Last-Modified: Mon, 06 Jan 2014 03:45:43 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
f07...............v.H.W.....Y..1.......`'.....{...l!1..8X..U......f...
.....y...x9..w.I.h.8.....Z..)%...#/..1"J$.1.)......-......1.,....>.
./J.l.{..3Z.v..ag$1>..?...)g.f.E..i... ..}...pg..1'..]z....;...|...
Hh....­....cn|.....i.`\...~..'..86. $.....1.I4.F....h.0..h.......x..
...MO...k....._.).b8.M...,.lB.s...h..3.?.K....k.a...g.(...%..}..9.....
f.........S..0.'.1..%..{I.<..(...........Z.1....-..mj.&|.......A...
]oKAZt.In.{.`c..5.....4..~..iJ...|..qY@9..=.4.W...3].;.7C. -6l4...So.o
.A.,.......0y..>w?........X. :[email protected]...~k.
B2.v....6.)....o...V..|?...2....6..P.H.L.....X\...2..........WI. ...._
nU..?u!.W....[.|e........bP..HC}eI.J......l....=.B.._.....5...u.....4.
..L......O.Q.Z.h3f..m66..m62<...p.6...C.9i..u_vz..v.\..W.L..-wb...1
".; .(%N8..<.D.|.....ms...0t.@.....;..t.........%....u......'<..
..:X#.W..0H..2.C...F..vM.7...x.nO..L....Q.....>....h,.sl:..9.;.D*..
..$.. .J.}.m.< .b...<_;Q.....(!.R...b...g.s.....................
n.BV......".....6...:..[.M.....OM......d...v..x....N....M......p.%N/..
c.y..g....b.<.'..d..A6....V.n6....=@....../oo...)_.....J.1$.J..h..`
.6...vf............/hx.......a.\.G..$.^.h....J.....(HA0..S...l"-.F_}.d
.."..Zv.O-.....-.(.L...$...<.4...4.#........lO...P..%.^9....3......
...5g.. -dj...y........^.Z..AI.d..N......j.1.3oBF.o.............'...m.
g.....%:....2..<........XU\......j..H.O...:.u.x.tu.I.P...j....h(2..
...}.jK.60,.:...g.D.@4#....!....<.C...X.....#MW...*.0.tY..&d\\zn2..
.e.LU.1..].h...'.:..g.B.5..............`...K7.`.7....{}.BI....\..D
<<< skipped >>>


GET /game/upload_data/201403/201403181447095327ebeda78ee_1290.swf?v=3&s=6256 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.51img3.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/0.7.66
Content-Type: application/x-shockwave-flash
Content-Length: 11420
Last-Modified: Tue, 18 Mar 2014 06:47:09 GMT
Accept-Ranges: bytes
Cache-Control: max-age=86400
Date: Sat, 17 May 2014 10:30:30 GMT
Age: 80396
Powered-By-VeryCDN: HIT from ctc-sa-1-1-c1111, HIT from utn-hz-1-1-c1131
Connection: keep-alive
CWS.ZU..x..\.|TE......9........A.!.....c..D9<I2o&o2#[email protected].../..
..x ........C`.]W..............I..............~...._"Il.$....Y.K.t}.f.
I..o..s/.c.p42yhiQ.P..S..b5....{....'.5yh(.h.X\.l...e.........&...*.5j
$F../.$.....YC.8..'[email protected].....@
......JJG.3..j....X....54.....Y.42..../...#.uZ<4..{`/..nM..A=..F&..
:}J.i...P.|1.].=..`.........CzlJcdq$....M.58...D.......:-R....Sf......
 ....9Z.]:.......$j.8.v"L....c..V.O..k......n3..........<t..1..%C.M
'(>...]..{M..... .2J @Q..Z..........:....I.....?..^...5.K*..jI..kS.
N.;d&eX%>Z..<.F.V.._.mhl.....h.N."RFu....fG..=f5.L.!E5.xC...U...
z">-...G0j~C,....t....wsT..h..>n....#..j.d..`,Z?#......,...R..i.
...i.j...b.z..n..v.hda$.5...3b.h.OH..`o.cz<|.n/.>...X.Q..p.Q.ieb
.~.......[.M.6..!......b..!.f..a.R.....:.qei4\.tK<..t...pM"....1S..
.-..V.`..G...t8}..^.].....xB.F8...D42......6c.......!h.......4.....M..
.....K....N.6.c."...A....."{C...:..A.........M.n....1C.Y..=hV..5....1p
.w....|..B._K`.bVcL?/N....R....'[email protected]:..p...k..eA.....n..#
...5..be.V.5..zF.:.oP..}L]L.E.c$..~......<.....G.....;?..B.huu2$;..
.E.U...F.\.?[...0W.....%...paOz..][...4.NvC4.(...t\tq\..00.N....U....p
..y..F=...JG......=..d.v.6.l.F..5.!.$......x...IT..#....V;.G.#5s.Mz.i.
..k...OD......qS.j....^A.FUS9.:K......q...}.,.`.8.P}......D..0]KhV.2.n
r.....z.&.-..#.S..cp.D:..E#..56.!.e.'K....3.X/........P8....]...l$..P.
....xf/.m..h.9YnF..r....8...e............8.t.....es.H.,...J....c.F...w
..u..5:...hd.......x...'...^{...#i./.G.;k...Zk..T'........u5..i.k.
<<< skipped >>>


GET /imgs/201103/29/66Iba26Dsd1_IiKO6720.jpg HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: userimg.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 2111
Accept-Ranges: bytes
Date: Sun, 18 May 2014 01:14:12 GMT
Last-Modified: Thu, 18 Oct 2012 07:03:22 GMT
Expires: Mon, 18 May 2015 01:14:12 GMT
Timing-Allow-Origin: *
Age: 24823
X-Cache: HIT from qunar_cdn_01
......JFIF.............C..............................................
!........."$".$.......C...............................................
........................>.>.."..................................
..........................}........!1A..Qa."q.2....#B...R..$3br.......
.%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz........................
......................................................................
................................w.......!1..AQ.aq."2...B.....#3R..br..
.$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.................
...................................................................?..
*.........>....A.....Z[4.)...y...S.. .Ex'..v. .oM^/..-iB*U.`..8k...
....s..k..h....q.O.......^....r.....|Q.xs.5.....[.$.H.xD....o....k....
.B..~... ....Y.cM......vg..xL5G.A.y..........A._..'.......~?h.2j7...C.
.....G......\Q....?......*.?.:....-7R.T....I.i.E.w.........1..2...~F.$
.]..XLKq...............7.e.[yo..,h...%[..*k.. ...e....#...._......^)JI
w<..............E.....z.^..m... ....1...... .............2.i.X.V...
Z...8.....X.i-...m2..L<.r..D..p......<..v.....0.......&..'.._u..
l..........(...W.....'>.M..86.wm.c3........'........^x._...:l.$.2.[
.......yr....._.......H...X............5Q.]G..%..i.|'.8.\g.Q>.....H
.......sI.<SJ...rI/M.`.F..S..=..`......../..z......_......../..z...
....i...[.z._.s.I].......r..w.........N.m_.....~......=...n...g....\..
r.e...........~... .....i.....}..Wq9m.....;...M..p[x.Q;..}FD.1..\N".Y.
^....EU....VG...n[..o.%.W..7.V^r.....\K..O.W...8s....z..Q.........
<<< skipped >>>


GET /live/39/11/b5adf698bf4292a509a926ce6c0e72ca.jpg HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi0.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Sat, 12 Apr 2014 18:12:38 GMT
Content-Type: image/jpeg
Content-Length: 8511
Expires: Tue, 07 Apr 2015 18:12:38 GMT
Cache-Control: max-age=31104000
ETag: "258459546"
Last-Modified: Fri, 20 Dec 2013 06:20:44 GMT
Powered-By-ChinaCache: HIT from 01057413L3
Age: 3074110
Powered-By-ChinaCache: HIT from 060311H3SN
......JFIF.....H.H.....<CREATOR: gd-jpeg v1.0 (using IJG JPEG v62),
 quality = 100....C.....................................%...#... , #&'
)*)..-0-(0%()(...C...........(...(((((((((((((((((((((((((((((((((((((
(((((((((((((..........."........................................=....
.....................!1..AQ"2aq....BR....#$3...%Sb....................
...............".......................!1..A"2.a............?.....1.Nb
M...M....2....W ...DK..J.>...H\.;(.L.2.j....QU..E.Hv..?.`.....3H.o.
.#.e.&...UA_..*..2L$..:.n~T......%...p.&R.3.I.;2.p...V....UbTU...DLq..
;..z....x.1.'..m.vW..Cw.#RM....c/..?"...z....!.^/`u .W.I=C.....*.%C. .
.s..TVU5..yK....m.!.1g.[ Z.....}E\D31!...:X.e......|N.....Y..m..\.7..r
E..P.u/....p....5mc.E.7l..........t.....0.|.....[....)|.'.k.Z...cN.W2S
x..}.&...gc.....h..........U.bMsZ..l..Vi..k.Rr...*uvS.v..@....*.L$2[..
....et&F.%.....&*.}M..].K....C.@.........@{z.\........Yz...<g....}=
Y.c.....RJ ].q.....n>..G........w..q.X...u-t&..r.b..D.ek.u..sGc...7
.L..u...u....$4.U...&..6.. .....r>[email protected]...?e7D..A..JM.
.)... }..:..'p.ZF.B.....1S.#.N..d.) .6f..\.......H....ir.....7J..qg.X\
Ha...\*...U.c......wUKV..p.]......Q.AJ...........T.....F").lOp...uA..r
0i..... u...q^d8.j*...!..Y.co..%9..C.`.t.Zg4_...N.5.m..9|..-..AW.:|...
.......qk..`M.:$..-,s.....6VrH.:n..U<.%.7&'.C.JF....P......(..i....
.{.=.:#...--E.,q..b.......4f:..[cp.`.n..@'oe..... L.......Xn......'E3.
e..T.;.$d.....1.\.#i.3...c.........0).b.K\7..."a{5.%.......D.4.dC...ui
V.]....i.jM.P..:h^^..3N.Q..9..&u.c[.."......('k..R....T......=..\.
<<< skipped >>>


GET /js/jquery-1.8.2_v4.js HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vj0.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 15 Jun 2014 21:44:01 GMT
Date: Fri, 16 May 2014 21:44:01 GMT
Server: ngx_openresty
Content-Type: application/x-javascript
Content-Length: 41683
Last-Modified: Fri, 16 May 2014 03:02:09 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Accept-Ranges: bytes
X-HITS: 31
Age: 1
X-Via: 1.1 zw12:80 (Cdn Cache Server V2.0), 1.1 yfdx32:0 (Cdn Cache Server V2.0)
Connection: keep-alive
............kw.G...~...@.=2 .!.v.3...c...=.MK.v7I..R.A.......|...#2..@
H.<.g..ETU.32............w{......d.........&>,..G.............9.
......./........~..u..7.>?..uo.....f9..n...y..^].....U.J41l..N.g...
w.bp....E..Q.v:n.......~{.../.].<.yge.1......a{Y^.....M.8....j.....
..g.U.l......\..^/...u.,[.4....x.>. ..'...z..v.U.....l...w.i....x..
..........A.A.Q.`.....W.....n_....//~.....n._......u[#... i.>.wwa.F
.Z.gZ...b...M.{,6..h.j....u{....z....E9\7.'..V.v.......N..5..F.,CG.G.O
6!m.....T.....<;\U.o6.}.....g.6.....GY.S...........Oge..o>s8jE..
g./T...;.l.ks.&.#..X.......qZ.....ew.....g3. .. A...e..&.{-.....^....x
S....u..........A..tP..m<..K.....[w.Z.^."...Jk.Vh:.|.......v.......
\&...f.l76.V1....e.]~...\.......r...a........o..= ...9 [/.......V ..0.
.g6.8l;......^.'[email protected]/.q...._5./.......D...}._}iG9
...v..U......Oz....A1n...q.|......|T..u.7...hV...Y.TG...O9..u..e......
x..<....n..j......a.B'.3..nbX.....`<..5K....7..6..|.6...>..-w
..Y._&..z....&..}U.'e... ....~.wu,.'...0\.'.H(.9.........}...........^
,........f.y).2...*...........eM.G.L.[...d:..Y.|......:.-.lT..7....rxY
.........X....M. ...uh......Z4....W..pM......&..fc.[...P_..........5W.
...f.d..mX.a...j..6rY^-^W;..-.^.....<.HB.y...~.q3g|.y9j.v.i6.6Z....
*>.....l....^..,;...l..sM....mX>..T.!...9.~.m.u$........8...P.U.
.U.....O..;*,..a.x}R.....m...x.&..YG...}@..Z..1.....5Z:[email protected].::
..eK.Q.....'g`.. .~..p.....x,...8..i....j.nV..."%..&....l.FW.z.}.x. Tl
.oi..............gs....>.....\......v.|.dh....F.._>.\...S...
<<< skipped >>>

GET /js/s/e6u5-min.js?101016 HTTP/1.1


Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vj0.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Wed, 04 Jun 2014 21:44:50 GMT
Date: Mon, 05 May 2014 21:44:50 GMT
Server: ngx_openresty
Content-Type: application/x-javascript
Content-Length: 969
Last-Modified: Mon, 28 Apr 2014 02:16:31 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Accept-Ranges: bytes
X-HITS: 97
Age: 1
X-Via: 1.1 bjdam110:88 (Cdn Cache Server V2.0), 1.1 yfdx32:6 (Cdn Cache Server V2.0)
Connection: keep-alive
...........U.n.6.}/..p..K....C..j.l.]l...iR..E.....L.$e'.......q......
y...9sT.J8.U'M...Ts[Q6.q.).rHB.(>.%w....*j....v.....U..M.m...2..R..
{.mA.&.an.....B$U....J...x...t...v...a.d.n....F6...6.t/<;........0.
....s.1..Gg......}...j?...H.....M.yZ.Q'0.5%...-o.n]...h./..q....y...w.
MQ.........`.3..5.S.....F...Z}.wmj.........x...H..0..n..A.....A"......
.%.$Y@.)..... .l-..~..o./..k. ./. [$.I.E;.."1?{.bL.l.,O..{yuA.U.9.....
.s=l...t7.m3..T%.....^.l8..........z:.......'A.......=#....P.N....Ul.q
......oW._..).MV..SBXd..9.....vz...g}.L7... C.:....(.4.%. ..N.D.t=.J..
.....;.g.l..#..MX.w.'...`b..f...p.g.U.4..&c....B......]~...k..@^q....o
FY....-}..Z....................P/h......f....$...`...YSk~./.....:..af.
.!..x.-k..<.g......c0.........Bl.0....<...*...U...,./....r,D6...
......N.....o.0......FS..W........~|.......T..95.<rO.$....}.#......
$....Ff ...I$T.FU^<.I{.3QS5$.,.P].M..P...a...Xw^.:....|Z.......o...
.*.3..~..m~...a3........'s%.0lA=.. ..^.m.6..z.5...H=|..m...oQ.5..?....
.=._.......


GET /js/mootools_MIN_1.4.5.js HTTP/1.1


Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vj0.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Wed, 04 Jun 2014 21:44:50 GMT
Date: Mon, 05 May 2014 21:44:50 GMT
Server: ngx_openresty
Content-Type: application/x-javascript
Content-Length: 969
Last-Modified: Mon, 28 Apr 2014 02:16:31 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Accept-Ranges: bytes
X-HITS: 97
Age: 1
X-Via: 1.1 bjdam110:88 (Cdn Cache Server V2.0), 1.1 yfdx32:6 (Cdn Cache Server V2.0)
Connection: keep-alive
...........U.n.6.}/..p..K....C..j.l.]l...iR..E.....L.$e'.......q......
y...9sT.J8.U'M...Ts[Q6.q.).rHB.(>.%w....*j....v.....U..M.m...2..R..
{.mA.&.an.....B$U....J...x...t...v...a.d.n....F6...6.t/<;........0.
....s.1..Gg......}...j?...H.....M.yZ.Q'0.5%...-o.n]...h./..q....y...w.
MQ.........`.3..5.S.....F...Z}.wmj.........x...H..0..n..A.....A"......
.%.$Y@.)..... .l-..~..o./..k. ./. [$.I.E;.."1?{.bL.l.,O..{yuA.U.9.....
.s=l...t7.m3..T%.....^.l8..........z:.......'A.......=#....P.N....Ul.q
......oW._..).MV..SBXd..9.....vz...g}.L7... C.:....(.4.%. ..N.D.t=.J..
.....;.g.l..#..MX.w.'...`b..f...p.g.U.4..&c....B......]~...k..@^q....o
FY....-}..Z....................P/h......f....$...`...YSk~./.....:..af.
.!..x.-k..<.g......c0.........Bl.0....<...*...U...,./....r,D6...
......N.....o.0......FS..W........~|.......T..95.<rO.$....}.#......
$....Ff ...I$T.FU^<.I{.3QS5$.,.P].M..P...a...Xw^.:....|Z.......o...
.*.3..~..m~...a3........'s%.0lA=.. ..^.m.6..z.5...H=|..m...oQ.5..?....
.=._...HTTP/1.1 200 OK..Expires: Wed, 28 May 2014 21:17:15 GMT..Date: 
Mon, 28 Apr 2014 21:17:15 GMT..Server: ngx_openresty..Content-Type: ap
plication/x-javascript..Content-Length: 35358..Last-Modified: Mon, 19 
Aug 2013 07:18:15 GMT..Cache-Control: max-age=2592000..Content-Encodin
g: gzip..Accept-Ranges: bytes..X-HITS: 99..Age: 1..X-Via: 1.1 zw13:80 
(Cdn Cache Server V2.0), 1.1 yfdx34:1 (Cdn Cache Server V2.0)..Connect
ion: keep-alive...............{.F...W$...F.%9......-....gcg..b..I..E..
/.X....}....r<..<gwb.@_.......q.1...r.....bV.W...r4K........
<<< skipped >>>


GET /style/xiu/base/v1/css/gift_v.1.css?20130918v1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 18 May 2014 21:12:39 GMT
Date: Sat, 17 May 2014 21:12:39 GMT
Server: Tengine
Content-Type: text/css
Content-Length: 12529
Last-Modified: Mon, 28 Apr 2014 02:40:03 GMT
ETag: "535dbf83-30f1"
Content-Encoding: gzip
Cache-Control: max-age=86400
Age: 1
X-Via: 1.1 tzwl42:88 (Cdn Cache Server V2.0), 1.1 jydx41:2 (Cdn Cache Server V2.0)
Connection: keep-alive
......]S..gift_v.1.css..].n.9.~.,..40....J..G1..v<.........}.E..9..
.c...Y..9$u#)J...w.W..~.......?........................7.~~x.....g..v.
w...........?~.........../...^?..=~......O....v.......>....~......o
....n>......^^~|..a6....~..........7...........?....\......~^..?...
...(../..?..r.|.........`K[..<.]..vu..].v...C'.{.Wj.$..O..........!
T....z......................6T1.`.......?y.....Z.0...F.....0..U`[email protected].
..|..Z.U...Z.e3..Z.u3........V..4h..v...C...:g.... b.......0....4.../.
......."^.4_.....E.......&.#Eb..{.I.8......k...#RB.,......9"%d......X.
....*..X........:..-.35@G'......'2v..4!ue.......N.miHqY..............&
e..HwY.#...........8.0..s.a ........X....F..Zj...Z..t.C&.F.......rh..R
[email protected] z....E... ....[.....&.9Zs....V,.....Cj..5wH.y....h#Zs.t....#]7.5
.H..h.=.p....4r..#.pP..H..h.G..F..#.p..`@.*...H_.......V0.}...........
[Aa.b..........;.#..........=S#$z.FH.l.....!.36B..l.D........=s#$z..#y
c.y.O.............`2%.h=...#;.#..........D...@&......'s.4...3......M..
q.....u*.....N.......a....!.vc..&vk...i..W....B....!.v_..,..@H... $.n.
..Ho..V....k.........a)8j.K@.... 5.% 5.% 5.%`.>..H......$ =.H@.... 
[email protected] .=..M..9....I9.#......Ai.CZ..g...8.......!.............T..!
!5=kHH..DBZz.(...$|4.O..#..L.$. I.F2.Ed.Fz.....G$.DO$.....g....iDBjz..
...C$..'.....CBzz...#[email protected]......!.O..R......."!.=.HHKO"B......7...
..A....F.<..S...AN..x......eI.$\......`...p...p..................:.
.... .....-%..-%..-%..-%..-%..-%.......L..>"9......4....F..S.(...o.
.[4.2B~.f...p:...J..[U....}.9a)lU.'...Z....U.OG..-$ =.....m!...-$ 
<<< skipped >>>

GET /style/xiu/v1/css/xiu_v.12.css?20140312 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 18 May 2014 21:12:39 GMT
Date: Sat, 17 May 2014 21:12:39 GMT
Server: Tengine
Content-Type: text/css
Content-Length: 12529
Last-Modified: Mon, 28 Apr 2014 02:40:03 GMT
ETag: "535dbf83-30f1"
Content-Encoding: gzip
Cache-Control: max-age=86400
Age: 1
X-Via: 1.1 tzwl42:88 (Cdn Cache Server V2.0), 1.1 jydx41:2 (Cdn Cache Server V2.0)
Connection: keep-alive
......]S..gift_v.1.css..].n.9.~.,..40....J..G1..v<.........}.E..9..
.c...Y..9$u#)J...w.W..~.......?........................7.~~x.....g..v.
w...........?~.........../...^?..=~......O....v.......>....~......o
....n>......^^~|..a6....~..........7...........?....\......~^..?...
...(../..?..r.|.........`K[..<.]..vu..].v...C'.{.Wj.$..O..........!
T....z......................6T1.`.......?y.....Z.0...F.....0..U`[email protected].
..|..Z.U...Z.e3..Z.u3........V..4h..v...C...:g.... b.......0....4.../.
......."^.4_.....E.......&.#Eb..{.I.8......k...#RB.,......9"%d......X.
....*..X........:..-.35@G'......'2v..4!ue.......N.miHqY..............&
e..HwY.#...........8.0..s.a ........X....F..Zj...Z..t.C&.F.......rh..R
[email protected] z....E... ....[.....&.9Zs....V,.....Cj..5wH.y....h#Zs.t....#]7.5
.H..h.=.p....4r..#.pP..H..h.G..F..#.p..`@.*...H_.......V0.}...........
[Aa.b..........;.#..........=S#$z.FH.l.....!.36B..l.D........=s#$z..#y
c.y.O.............`2%.h=...#;.#..........D...@&......'s.4...3......M..
q.....u*.....N.......a....!.vc..&vk...i..W....B....!.v_..,..@H... $.n.
..Ho..V....k.........a)HTTP/1.1 200 OK..Expires: Sun, 18 May 2014 21:1
2:39 GMT..Date: Sat, 17 May 2014 21:12:39 GMT..Server: Tengine..Conten
t-Type: text/css..Content-Length: 12529..Last-Modified: Mon, 28 Apr 20
14 02:40:03 GMT..ETag: "535dbf83-30f1"..Content-Encoding: gzip..Cache-
Control: max-age=86400..Age: 1..X-Via: 1.1 tzwl42:88 (Cdn Cache Server
 V2.0), 1.1 jydx41:2 (Cdn Cache Server V2.0)..Connection: keep-alive..
......]S..gift_v.1.css..].n.9.~.,..40....J..G1..v<.........}.E.
<<< skipped >>>

GET /script/page/xiu/v3/broadcast_v.1.js?20131107v1 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive



.g$R...{._%FN..-. 9- ?..#...O..........3i~}.P.YK....j.......Y.........
..lo..Y.R54xrZ......(.o04I..A .A...JEB..]B(R..6K...,).j^C."V...C...6t.
.Z......W.z.-=U..e0..I.r...S.g...v...PP01"a.......h..(. 3As_\...j.X..{
...$qs.....c.2........l...M..*]..../...m.8....^J)[email protected](/5
.......K.....o4...[..Z b E$...u2#j.."...i....N#.a...9.XR.......6s....Y
ap&..Y.......oLX"e...2w..Caox.p.(DGY.i...j._.y.....[i...f=.@*Y...K....
.)....v.._m..d5N.L.2.&M.M.,j.7.$\6...\.....y .<.q.....I,..BE (..J|.
(.N.....n....Jo...J.b.{4Y,E..4......yx...O..d.u..CHY.....N.0..S...1..|
.....lu.. .JZq...M;...}=*Q:X.Y.E.3.........I...`..... c)S"_G......,...
V.3.S.{Z...$.n.}a">x......[J......~GJ.<g..?._.H#..E.g%..p....]..
.U.....#H....i.c,......da.?...R....nNj..;......F...Vs..,.*..>.!..Y.
.n1..,Y5.V...........ma.&".P..Q....A. M...\.}.....1.6...6.O...4?.g.4.s
..(.l.J..\Q|......S_.a_M.9.d......jD.1q...<..2.Q..>.....q6$h.a..
..3.NX?<fHl=..6.R.B'>.4x|8...2...K,.m...............0...!....|.*
.4..,.:.qW.)....U.u.nj1.....T}.X.~.4G..........g.....Z..d7...($.'...R.
...u(.M.?......H..a..6...n..e;.....2.G.Yz.g8.X.....'..........Q.......
....h....U._,..b.NM....}.u(;.........D...,.XE.....b.6H........L.C.....
.r....X...Z..X........4......M...?V....f.....`.VQ_..Xo]........T...)b.
.[..."\.e.s...S.>V..."&....N......d....n....1.\~.7Y......i.v.J.H..*
.kJw...u.....I..$p..^.>..Z...2.3]t.nH...Y.|.\.../.=..U..W.%8.5}....
...\%=..`.%.m...U.. .d!..Hr.N.W.1. .. ..)......j.s.y..p"..G._....n..@.
.B3...b..l..=....4~....d>62G._....n....PpO...q/1.c....n.vSR. A,
<<< skipped >>>

GET /style/xiu/v1/img/bg/rev_marquee.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Mon, 14 Jul 2014 08:09:22 GMT
Date: Tue, 15 Apr 2014 08:09:22 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 1220
Last-Modified: Mon, 17 Mar 2014 05:56:06 GMT
ETag: "53268e76-4c4"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx163:88 (Cdn Cache Server V2.0), 1.1 jydx40:0 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.......\.....TB.y....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:98D0348A228911E2A673C9AA
D84A8F90" xmpMM:DocumentID="xmp.did:98D0348B228911E2A673C9AAD84A8F90"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:98D03488228911E2A6
73C9AAD84A8F90" stRef:documentID="xmp.did:98D03489228911E2A673C9AAD84A
8F90"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>i."%...KPLTE...............................
..............................................VX....IDATx...... .D..X{
..^.._.`..L..<...M .}..0.x?_.0..4.hPP...5D]./!.;c}....7..Sd.O,./..|
..J;...I.)X?:...U. CI...Q...2. |.j...s..Ta..[..Q...E.P....AP..$A[.'.Vs
.Uto..dl.LH..........|.ND. .~..t`c...0.X(`.#$..iR.....Z,../@.;...#..0.
.!{.).......IEND.B`.HTTP/1.1 200 OK..Expires: Mon, 14 Jul 2014 08:09:2
2 GMT..Date: Tue, 15 Apr 2014 08:09:22 GMT..Server: Tengine..Content-T
ype: image/png..Content-Length: 1220..Last-Modified: Mon, 17 Mar 2014 
05:56:06 GMT..ETag: "53268e76-4c4"..Cache-Control: max-age=7776000
<<< skipped >>>

GET /style/xiu/v1/img/pic/xiu_small_avatar.jpg?t=2014051816 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Mon, 14 Jul 2014 08:09:22 GMT
Date: Tue, 15 Apr 2014 08:09:22 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 1220
Last-Modified: Mon, 17 Mar 2014 05:56:06 GMT
ETag: "53268e76-4c4"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx163:88 (Cdn Cache Server V2.0), 1.1 jydx40:0 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.......\.....TB.y....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:98D0348A228911E2A673C9AA
D84A8F90" xmpMM:DocumentID="xmp.did:98D0348B228911E2A673C9AAD84A8F90"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:98D03488228911E2A6
73C9AAD84A8F90" stRef:documentID="xmp.did:98D03489228911E2A673C9AAD84A
8F90"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>i."%...KPLTE...............................
..............................................VX....IDATx...... .D..X{
..^.._.`..L..<...M .}..0.x?_.0..4.hPP...5D]./!.;c}....7..Sd.O,./..|
.HTTP/1.1 200 OK..Expires: Mon, 14 Jul 2014 08:09:22 GMT..Date: Tue, 1
5 Apr 2014 08:09:22 GMT..Server: Tengine..Content-Type: image/png..Con
tent-Length: 1220..Last-Modified: Mon, 17 Mar 2014 05:56:06 GMT..ETag:
 "53268e76-4c4"..Cache-Control: max-age=7776000..Accept-Ranges: bytes.
.Age: 1..X-Via: 1.1 zjjx163:88 (Cdn Cache Server V2.0), 1.1 jydx40:0 (
Cdn Cache Server V2.0)..Connection: keep-alive...PNG........IHDR..
<<< skipped >>>

GET /style/xiu/v1/img/rev/sub/ph_flower.png?v=0910 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Wed, 13 Aug 2014 21:12:05 GMT
Date: Thu, 15 May 2014 21:12:05 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 51708
Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT
ETag: "53268e81-c9fc"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx159:80 (Cdn Cache Server V2.0), 1.1 jydx41:9 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.......Z.....(..C....tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:ECFB7F47E919E3119C4DE8FE60143149" xmpMM:DocumentID="xmp.did:F59E
C33A19FE11E397A19C318A8F63D7" xmpMM:InstanceID="xmp.iid:F59EC33919FE11
E397A19C318A8F63D7" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EFFB7F47E919E3119C4D
E8FE60143149" stRef:documentID="xmp.did:ECFB7F47E919E3119C4DE8FE601431
49"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>L.r....,IDATx.....\Wy..;.....j...eim..6.....8
......&....H! ^x...K.......P.."S...ll.6...d.*......3...>...$...*|l.
....;..9...|.s...0DS....4.)MiJS~s.7..)MiJS....4.7K..j.o..v\...'.KY.[..
..#T..9......*....P...j..|..K...G.......?<.;....?{...m5.G.'...f.:P.
=...........?z.k...~.M...,6....,..L.Fe.......p.?..v......>Ct.g-1...
.....z.\......CJ!..._....g...|.Ac..s...'......c...:qw..)...o...."t.`=-
.;oD...Tr.=/D{fg....U..I...cmi.G....}.....y....5I..KEi<g...$ac.Wz..
Dc..77W....&.>.............A..Oi..m......C.w..qzz._.j....A:x..U
<<< skipped >>>

GET /admin/images/no_userhead_s.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: s1.56img.com



.[..x.j.......*...S...}....$q...O........a.R.x.... 2.C02...?.5i..Q....
...,!t.i.8..........Dfb....Hs...i7.^..A.;..f@.`J.b.otr.-......3....,..
..3g..../.-.y.TeLa.....Cx...4iH.qM..Yf....uL..f3...gJ.d...p...d....,r~
n.FU..O.D...`........Y........BW.......VL.e.......:....=\qi.Y.:....\..
IcPw.....~\I...t;<........:1.]T.e.S.dF,.[.7B.F....Utn...[#.....,t..
...n...cI.e,.p9.8.g.y.Hc..A..~.y.}.O.>.....IPM....!..%FX..y.8R.E...
...K..v.w..8n..E....A.....)...._...../....tN...L.<......0Dq."&....y
......=..8-*O,g.....\....t2...3...wY......wq...$&M..e.... ..$....~b..D
r."WXp.t.{ I..........'b.bx..a.)...Z.'.(m..<..._|.{.n*.J#.y...v..C.
B..EZ..>.(...;.3sS[..._.Xw......=...l._t..V.%..S....]q..3..s...zz0.
......._. .@..{_1....?,.1%...T.6...i#....?.s.\.. :<.......2.^BQ...y
.t:...[......c...cN...Q?\.n......Ej.o...;R@.../..E.q...*.....xRW.. .3D
..M8...A...x\?..O......RO..U..%......iJ..Hh...{M..L'..E. ..{..u..7.{T.
e.$.fd.y....&jV..n...q.....4....V._. ...u...P.I.{.c..x..........|.S...
H..$`\....R.Q$.....!.1..f..#.{..{7......T....x.....Bx.....p.aZ..Xv...e
....=YG.m..hT.-~........X}j.,)..R....P..i..93.=o..6..B.R...u.>T.9/.
..x.~.... ...&.Mw_...w $K^.J.Y..W....sj<...(/.t......2zD:#...>.&
}...'...;z........4j...n&.H".w.Auk.e....R...K.:Kh.*%F..N....E,./&%UMR.
D......UX.S....g...?...)..J.w#....Ri.....QE.`...W..6..^.E}......O...j.
mV.X.c|..pV]....#.D\.w......gxs.{L.r=*.H*.../.........RI...P..U.G.wk.6
'.P.Wqz....9....P....v.[. ..ut.6........}V:MJl. .n/s.,....4....o`...CN
:...A{...}./\z.E..[..x.j.......*...S...}....$q...O........a.R.x...
<<< skipped >>>


GET /script/static/xiu/v5/main_play_v.7.js?20140515 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive



.D.o..../....6s.g..C.&...cL........{}..!.!.%!=L...X.p.......mx........
VI.s........Y.........2.d.3Ur.l...9lV..31.."r.`W.Z...V.:.%...........W
.'[email protected]...!P0.X-...k...#t...4...
Kw....4=.H.JC.xx...]..}.........d....:.kB..)......k...'F*...b..Ue.....
`.~..AE.D.7N,...*..........K..L..At<..D....j.,$./.Y.....'T.|...8J.J
..R3......i.......^k.c.h]..._V.].....Z;.....u.n.:...b.k..w.ux....}.!.Z
8`i..........*...2....t{.}........s...g.... c ..v....Po.g....;........
..h1..Zf..C...r...fG.tN...n~4.....c!i2..MaC.uP.......c...F.N..3.^.C...
bwl......|a.G.w-7..2$...mYj.;..j,...j..&vF.....\.G.H#....6`..AH"..".0T
......"..F.o.]%[email protected]..............[4..t./7.
9...-g..}.....y>X.........E.x...........a.7..m..1.#......i.[[.l..E\
...'...w)w....u..E.& k"...$.{D..x....;..;b~7.:7..l.y..E.0.....0......d
.sL.[....L.CR.P&...m"F..F..2%..0.a(3..>......Q!.../<......HTTP/1
.1 200 OK..Expires: Sun, 18 May 2014 08:21:11 GMT..Date: Sun, 18 May 2
014 05:21:11 GMT..Server: Tengine..Content-Type: application/x-javascr
ipt..Content-Length: 1937..Last-Modified: Thu, 15 May 2014 02:21:03 GM
T..ETag: "5374248f-791"..Content-Encoding: gzip..Cache-Control: max-ag
e=10800..Age: 1..X-Via: 1.1 zjjx165:80 (Cdn Cache Server V2.0), 1.1 jy
dx38:10 (Cdn Cache Server V2.0)..Connection: keep-alive.........$tS..m
ain_play_v.7.js..Y[..H.~..0<.....\4d*..VR....M.n..j....\h0........3
.d.[s..........q.t.....|/.]............g.kEP.-....D.E..5[.]..g...n.~6f
...C......Q....!y..J.\/..C.<.;...t{.z..gcDa..[..U..vF.'Lb.g...*
<<< skipped >>>

GET /script/page/xiu/lib/jquery/jquery-1.4.4.min.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 18 May 2014 08:21:11 GMT
Date: Sun, 18 May 2014 05:21:11 GMT
Server: Tengine
Content-Type: application/x-javascript
Content-Length: 1937
Last-Modified: Thu, 15 May 2014 02:21:03 GMT
ETag: "5374248f-791"
Content-Encoding: gzip
Cache-Control: max-age=10800
Age: 1
X-Via: 1.1 zjjx165:80 (Cdn Cache Server V2.0), 1.1 jydx38:10 (Cdn Cache Server V2.0)
Connection: keep-alive
.....$tS..main_play_v.7.js..Y[..H.~..0<.....\4d*..VR....M.n..j....\
h0........3.d.[s..........q.t.....|/.]............g.kEP.-....D.E..5[.]
..g...n.~6f...C......Q....!y..J.\/..C.<.;...t{.z..gcDa..[..U..vF.'L
b.g...*....._.......p...<SG...Qk.D)....Z....iQ....................r
.....C...6.A.W..MI..........KM.IZ.%.s}....Q.3i.$.4.<n....O.mH.H$.8.
..........b.{cH..R.........9..2..........^...)aM...X"...{...g....65..I
....z...GEK..;..x[. .f&.y.../[email protected]%..[.).i.V@V.^..5G..
...B3l*...V...or..........M(....P.......&.T&B..U.L...".l......gI<..
t2!.=B..:s.)r..Z.j.........K....n_...;CKl.. ..i.~.K.r......!.\.1..$.F.
..aU......=.'k....p.Z....BV..%..kY.uM.5i....`e.b...Q..%....lVX.W..t.&.
.(.j...Y.1...vj...CSF.}.J..........j2q<~B...N.P`...k.....;..\.,"63.
.K..!..u.$..rS......%.**....w.;...X\.."...)x.......f..HK......Va..;..5
.8.C.^....9#...`=.-........&LO..^.d.Fj....A\c.........*.W..0.<...?.
.).k'Y..*.`.....t~U#U.<..|.d..:Q.#......6........t. .g..].NI....3..
........7"C.I.(X.( q...i.#.B!-T....Z@%3.x..R....^...L.R}....V...t....0
]iU..2r)..s......H.n.u..e................:..B....q6..D.;k.QK.....p....
q.S[....C.....f..}..=6.d.>.....,...=......z.p92.".$......4..1./V<
;.a..S.....1X.H6.(..../..[...-..0t.$.t.-..y...g~...Tx...(.Jq{..l.ze..i
*.........g..#&2....l!X..(.....[w5...l..8rj1....)[email protected]...`.|p
...w...V*.>..F\...yF"W.......i:....C..."......w.....VAN.. . p..]2$.
F.....1....ft0.......Q...68.q[..N.n34$.......Vv.....h.B..l.gK!.."...z.
>i..pVq...v*C.A..c`.m.....:."}-X.%.G.o...:..WMNH.o..).y.ED.....
<<< skipped >>>

GET /script/page/xiu/v3/common.js?20140417 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sat, 16 May 2015 03:24:31 GMT
Date: Fri, 16 May 2014 03:24:31 GMT
Server: Tengine
Content-Type: application/x-javascript
Content-Length: 24611
Last-Modified: Fri, 16 May 2014 03:24:03 GMT
ETag: "537584d3-6023"
Content-Encoding: gzip
Cache-Control: max-age=31536000
Age: 1
X-Via: 1.1 zjjx160:8106 (Cdn Cache Server V2.0), 1.1 jydx39:1 (Cdn Cache Server V2.0)
Connection: keep-alive
......uS..common.js..\m..F.........F...M..YB..=..C.,g.{}d.d.dI ..n...H
.....;y!a....f&@f.!...c..n>......,......~..`[.r...{o=.V.wuTG...(Z..
y.e.Hz.!^.1..Uk.......l......:.(......}Y..{A7...|..w...............Z.:
......M..M\... .w.......[.....$...'%....fM.P.L.(#....}....:...9).."u.[
..dN..c.7UeY...Z8l.M..?..CE..9NqVZ..y...7..=9w~.....%...u.....I.......
....Vyc...*e{}....:.|..a..zF.~tw.... .6>~...{..>....[....R......
.......(....~.k.......po}._.a..........o.>.........T..x..._~......G
.f..;.k..........n.Zx.Z,.J...5UO...[...>...M ...{P7......#'N.d..,2Y
...}P......O.-.Z.k...zbv. .S.......Tz5.......2..~ 3.A....2..,..Z.R*].K
e..6S.t]....8u......M7<.....T..q.U.E1..*4..).i...5G..b....|.$..Y3..
.E.(......u.. .j....z.9iQoW\....s.|....ij......a.dNB..G.x..B.....vj:.n
5?.....f]..i.h...v..Mk......[..uj.(ep.e...F-.U...$..z.h..1....d..iN.M5
W ...GtP...&,.z....`F....}.G...\.p.......d..vt...F.Z.5..4...{.... ....
.q.L.Z...\W=.gKzV.H..Q....h....d.-.DQ...T...^..X...J......R.J....kz0.T
.OM...|.9.m.v.b...Z..D.....<hM`.R...c/g...:...:.q..R5T..<."ac...
.....u....q.t>.Q......X.Zk...M.w.........~..3\m....T?]........llS..
...y..p....9...!... 6.ry....>.xp..c.~.]...}A....=w~T........f.q.<
;.ID.w."...foa~...$m..T.z(....1x..........g.E......bE....4..9m\..:....
.*....H.R....3..y.g...T....JZz.0R.D..Ba...e...'..o..Q.....j../.T...l..
.T..C..|~.FN.y......K...#.l...}-...F...b.C....a....o../^......;.I.....
*.VL.Mh..5?m.fJ...-........YZ.b.b.d...R.......RM7! XY..W.<...T..KRZ
..b..>..[.{.0......1x...[.=.........a....N.U..E.'=....5.MIM..].
<<< skipped >>>

GET /script/page/xiu/v3/sns_daytask_v.2.js?20131231 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sat, 16 May 2015 03:24:31 GMT
Date: Fri, 16 May 2014 03:24:31 GMT
Server: Tengine
Content-Type: application/x-javascript
Content-Length: 24611
Last-Modified: Fri, 16 May 2014 03:24:03 GMT
ETag: "537584d3-6023"
Content-Encoding: gzip
Cache-Control: max-age=31536000
Age: 1
X-Via: 1.1 zjjx160:8106 (Cdn Cache Server V2.0), 1.1 jydx39:1 (Cdn Cache Server V2.0)
Connection: keep-alive
......uS..common.js..\m..F.........F...M..YB..=..C.,g.{}d.d.dI ..n...H
.....;y!a....f&@f.!...c..n>......,......~..`[.r...{o=.V.wuTG...(Z..
y.e.Hz.!^.1..Uk.......l......:.(......}Y..{A7...|..w...............Z.:
......M..M\... .w.......[.....$...'%....fM.P.L.(#....}....:...9).."u.[
..dN..c.7UeY...Z8l.M..?..CE..9NqVZ..y...7..=9w~.....%...u.....I.......
....Vyc...*e{}....:.|..a..zF.~tw.... .6>~...{..>....[....R......
.......(....~.k.......po}._.a..........o.>.........T..x..._~......G
.f..;.k..........n.Zx.Z,.J...5UO...[...>...M ...{P7......#'N.d..,2Y
...}P......O.-.Z.k...zbv. .S.......Tz5.......2..~ 3.A....2..,..Z.R*].K
e..6S.t]....8u......M7<.....T..q.U.E1..*4..).i...5G..b....|.$..Y3..
.E.(......u.. .j....z.9iQoW\....s.|....ij......a.dNB..G.x..B.....vj:.n
5?.....f]..i.h...v..Mk......[..uj.(ep.e...F-.U...$..z.h..1....d..iN.M5
W ...GtP...&,.z....`F....}.G...\.p.......d..vt...F.Z.5..4...{.... ....
.q.L.Z...\W=.gKzV.H..Q....h....d.-.DQ...T...^..X...J......R.J....kz0.T
.OM...|.9.m.v.b...Z..D.....<hM`.R...c/g...:...:.q..R5T..<."ac...
.....u....q.tHTTP/1.1 200 OK..Expires: Sat, 16 May 2015 03:24:31 GMT..
Date: Fri, 16 May 2014 03:24:31 GMT..Server: Tengine..Content-Type: ap
plication/x-javascript..Content-Length: 24611..Last-Modified: Fri, 16 
May 2014 03:24:03 GMT..ETag: "537584d3-6023"..Content-Encoding: gzip..
Cache-Control: max-age=31536000..Age: 1..X-Via: 1.1 zjjx160:8106 (Cdn 
Cache Server V2.0), 1.1 jydx39:1 (Cdn Cache Server V2.0)..Connection: 
keep-alive........uS..common.js..\m..F.........F...M..YB..=..C.,g.
<<< skipped >>>

GET /style/xiu/v1/css/sub/xiu_login_v.2.css?20131212 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 18 May 2014 21:40:55 GMT
Date: Sun, 11 May 2014 21:40:55 GMT
Server: Tengine
Content-Type: application/x-javascript
Content-Length: 4000
Last-Modified: Fri, 14 Mar 2014 09:33:12 GMT
ETag: "5322ccd8-fa0"
Content-Encoding: gzip
Cache-Control: max-age=604800
Age: 1
X-Via: 1.1 tzwl38:8106 (Cdn Cache Server V2.0), 1.1 jydx42:4 (Cdn Cache Server V2.0)
Connection: keep-alive
......"S..sns_daytask_v.2.js...ko...{~...&. ...N#.6.W.ay.v..i@P...."Y&
gt;ly....., ..[.u.PdX.`..n...^.k"'....s...H.z.I....K.}.{.y.s...i^!....
..Q=.;..Tj.._:C4.x..?(.-g.......Kv.Q.....cKr...,.....i.l...........@z.
5..G...C..B.9._6..T...g..U.4.p..\;Xj..g...I.../..r.l.W... ._.xC..aS..e
.-T..AI|..}.E....F...~h7..UwB;..R h[..rm.X>[email protected]|=. 
....{...?}.{.................7..vA.4.W........4]qZ<V&..........E..0
}..6..c..P0.E..9a.B.......Vw.@[email protected]....(..)..(6=.,^.(......0.f`.L.
 .%..1..W.......M..!)M......H...-.n..w:}y3HC....c....@....;..aD..4....
E.f.b..1.#[email protected].`;.y..K ..L...6.M......U.r4#;...u&
gt;j.......-.o.l......_........X...oI.1.\...=7....o....o..3q.B.H.~y..r
.(............q..OJF.....!.).M....y..)..........k7...."...Phy.....5..=
...k.iH..T..u..W.!^._7....Ho..]#[email protected];.%......`......L.{
........Oz.>.].....Iq......n.!{dM5u`.g............g.....i.Ft....?{j
Z\..8FB!.<.....-....~~..g.fV......"2Zp8c;.x..N..%...D.T[..........h
r.I.....T.#A....`.A.;....O..1A.....5......=.....1......h..:UJE........
....&......^HTTP/1.1 200 OK..Expires: Sun, 18 May 2014 21:40:55 GMT..D
ate: Sun, 11 May 2014 21:40:55 GMT..Server: Tengine..Content-Type: app
lication/x-javascript..Content-Length: 4000..Last-Modified: Fri, 14 Ma
r 2014 09:33:12 GMT..ETag: "5322ccd8-fa0"..Content-Encoding: gzip..Cac
he-Control: max-age=604800..Age: 1..X-Via: 1.1 tzwl38:8106 (Cdn Cache 
Server V2.0), 1.1 jydx42:4 (Cdn Cache Server V2.0)..Connection: keep-a
live........"S..sns_daytask_v.2.js...ko...{~...&. ...N#.6.W.ay.v..
<<< skipped >>>

GET /script/page/xiu/v3/play_flv_v.8.js?20140421 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 18 May 2014 10:45:07 GMT
Date: Sat, 17 May 2014 10:45:07 GMT
Server: Tengine
Content-Type: text/css
Content-Length: 2583
Last-Modified: Wed, 23 Apr 2014 03:40:03 GMT
ETag: "53573613-a17"
Content-Encoding: gzip
Cache-Control: max-age=86400
Age: 1
X-Via: 1.1 tzwl40:8105 (Cdn Cache Server V2.0), 1.1 jydx42:0 (Cdn Cache Server V2.0)
Connection: keep-alive
.....6WS..xiu_login_v.2.css........W...f......Y..E....E.2(......D.....
t.....of.../....6]5..%....~.IY...W.Y.hU_9jII2.8y..!.vb...a....k...]0..
.%[email protected]..@...>).7...a-;q.o. ... ..B..W.........).2V.f.6.
"I.....%.9.st-. QIQ.."DE....kT$.n..XN..5.t...[.QI.....Zn#*.QZ.....q.x.
x~...L....q........Ulz i..-.Z.}.*r...V...?..r....EN2.`NY%.l.F\K.-Z....
...A>~!.\.}...n.....I..=..m..3i........_h....d..d ..S^.o.q..ey>.
 .-.m]..J.....zKP..vv..V....I.Ga....J;.e..Yt\rq{3&....'..CV...vx..4...
%.f].XPo....~.|...J.5.....)A.gr.Bs^..1.u....Z...[@..o).>...jZh.O...
PF...`30..d_....Tw.....?...A./......hYS&.Q..........m.......&<.z.m.
..........W.=L...d..J.....?.5h.D.P......r..:..p..2;.k.u.B ...?.....{.h
...o.C.._.L..^.$..\......... .C............|?.O_.....R.......0K1Sk..bE
........).....^.........$..9...Z{z...B.ui5.O5.._.Z5.......M.C.y._..h.N
.....e%....^W....W..,............n..f.:..h.Z....o.^..N"......`{.Z.V...
[email protected].....%. .XC...`v....0...[.&.c.*..1.;.p;#.r.9.04.(...[.!.yA...
[email protected]....!.g.b.~.....#. :..a.
Mab[c..7....U.E....O...d..HTTP/1.1 200 OK..Expires: Sun, 18 May 2014 1
0:45:07 GMT..Date: Sat, 17 May 2014 10:45:07 GMT..Server: Tengine..Con
tent-Type: text/css..Content-Length: 2583..Last-Modified: Wed, 23 Apr 
2014 03:40:03 GMT..ETag: "53573613-a17"..Content-Encoding: gzip..Cache
-Control: max-age=86400..Age: 1..X-Via: 1.1 tzwl40:8105 (Cdn Cache Ser
ver V2.0), 1.1 jydx42:0 (Cdn Cache Server V2.0)..Connection: keep-aliv
e.......6WS..xiu_login_v.2.css........W...f......Y..E....E.2(.....
<<< skipped >>>

GET /script/page/xiu/v3/56Ubbface.js?v=20140117 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive



....`.....`.........[......s.......P..S.2...JM.G.....R...Z..b...X.....
{.S/b.2..m.y..>.[U.Rc..i..1.&..h..U......C1Q....%.9...T...T......y.
_%A........w.}v(..X....%.......L$..Mi........ .. ...X...Hi.K....b.)...
.).(.:.)..........~%.2.........r..v.e4.o9..&=.n..-.........m...l5X...J
.c6u.\:....*.....Y...<.c..M)....&$.....Y.}ewR*... .......Q.d.R..'O.
4-(......2.kic2..&.bp;<d...z.J!. @ G;s.....N>.B.....}X..~....\..
.;)..&..O..4..v..]...s../.>|......U.|.G.....u..;..=..v."..z...u....
. ....o@@...;...Z..x..0m........4.......Pl..I6.x............ol......O.
.._.._. .nO...CO...B.....mq....#....i2s..U..FY....Vs.D#..Z.ZV.....6...
....C.........t&......{.j...T4....W..$G.e.m...`..s...`......4H.S......
..z.....rF]I.&.<.  h.J.!.?,"...O..DF,bd..m...h.).N..]....q.S....z..
...>c...g/__..f~..m........n.....Y...9...X.etS..Z.D.....D..O...`R.h
_..u....(N.."._k._.^.Hd.{...G..p......B.\].q&...,....n...HA.i.1z..o.eg
h......bJ..M'.._..}.....j...?..{.s....%.|.....1......l4.X....).\...Eg)
[email protected].)@.Z.....$.V .%.}.-9R.6P-@f..#T".....M..K....4 .....&.f....y..
.y.....\..[......D.. ..G2..'.@);..O$?...F.j.K.\&... %..vj8T.'.......9D
~".4j6.....*...5....O.....K<.q...,.....@C.......\.`2\0...;.......r.
.JrN.d.Y$..X... ....".?P.....)Q.;.....`.....K... L.A...w..1.L..j.Sc..p
.z.....z{3..k..ifC....M.gL|..EE..Q..!.....0.........3.....o..5.y.....'
.......#..p..\..&.4>.Ks...o..e..;P.8.]2(|.>.....{.O>.2[ds(k.l
...;w?.2....d.....p.8........>}......m.)...Q......?.../.......(LR..
...].<.........T.>.....DC..VZ.?.z..:f..@]!s.d....R[..P......
<<< skipped >>>

GET /script/page/xiu/v3/liver.js?2012v1 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Mon, 11 May 2015 06:55:32 GMT
Date: Sun, 11 May 2014 06:55:32 GMT
Server: Tengine
Content-Type: application/x-javascript
Content-Length: 3740
Last-Modified: Sun, 04 May 2014 05:42:03 GMT
ETag: "5365d32b-e9c"
Content-Encoding: gzip
Cache-Control: max-age=604800
Age: 1
X-Via: 1.1 zjjx164:8104 (Cdn Cache Server V2.0), 1.1 jydx39:1 (Cdn Cache Server V2.0)
Connection: keep-alive
.... .eS..56Ubbface.js...ks.T.{~. <.T;[email protected]...
If..Biy.P...s............9.'...s..,?R.Naa.uu...}.=..c-.K.T.<..DY.I0
...%.L.i......x.2.(...#...R~...ly..;.*..\...*....ZV,.hjzj.,....0..aY).
.z.!..)[email protected]~.....W...R. ...<.]...0..V|e..i.Ri1.<.A.B...9).
{^.-.5N...OIO....<...p... .<.4=;.f*.f..g.,.WM#...d)..9D....A(D.J
4XYY^-.._*..VJiQf..N.U...?k......T)..Jv.L..6n....s.X..J%[.0...\..E....
B]W*.G....R./.Ru.T....*[email protected]$.7.bi...0.......k.&l..<..R...2D..c:...
-....HcnTh.Y..x.e.*=.....W.a.l.#.U.~...G.. R......Ow....-.l...........
....,.WWu-.....W..J`...~....(.0...R,[email protected]>..s..kA}nR...
...X.r.....7..N..D...2...<e.T]N......:...1..(S#.T*.HK.*...r....w..f
...=.|S..w&._\\.=.xNw.y.....G!...|z......x.T..0./[email protected].~
....x..K...]a.X>.h.J.".4...=..1..WVz...C...N?&....... ....P.|h.....
E.......]>....... ...=bQ.3..#z..i.......M.HT|b..........e..W'.....[
.a$X.~D.....L..q....hG.a...=...8.^...}...f`.E.Z.............| .....u.0
.f....1O../.y.~.Y.m.'....M?g.f..O..I.D{'..b8z.A. .D.Y..O..1$.....L....
s~..`K4}...Aj;6..6zZ.X..b!HTTP/1.1 200 OK..Expires: Mon, 11 May 2015 0
6:55:32 GMT..Date: Sun, 11 May 2014 06:55:32 GMT..Server: Tengine..Con
tent-Type: application/x-javascript..Content-Length: 3740..Last-Modifi
ed: Sun, 04 May 2014 05:42:03 GMT..ETag: "5365d32b-e9c"..Content-Encod
ing: gzip..Cache-Control: max-age=604800..Age: 1..X-Via: 1.1 zjjx164:8
104 (Cdn Cache Server V2.0), 1.1 jydx39:1 (Cdn Cache Server V2.0)..Con
nection: keep-alive...... .eS..56Ubbface.js...ks.T.{~. <.T;v..3
<<< skipped >>>

GET /script/page/xiu/v3/signin_v.1.js?2014v6 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Wed, 13 May 2015 06:35:38 GMT
Date: Tue, 13 May 2014 06:35:38 GMT
Server: Tengine
Content-Type: application/x-javascript
Content-Length: 3689
Last-Modified: Fri, 14 Mar 2014 09:33:12 GMT
ETag: "5322ccd8-e69"
Content-Encoding: gzip
Cache-Control: max-age=604800
Age: 1
X-Via: 1.1 tzwl35:80 (Cdn Cache Server V2.0), 1.1 jydx37:0 (Cdn Cache Server V2.0)
Connection: keep-alive
......"S..signin_v.1.js..Z.s.F.....U{.T...7.-3-.....M.ws.2.E...Y..:N..
.z.).4..P...WZZ...Z......q~._....,.r..\.M.a.....o.{.y...kB."...uX-..ua
.R*../...P...H5t...TH).ba4%...s...m.:..?_...y.V...l..QD64...K.3.T6..r.
...L.C.k.. ....m ^.aE5....h..M......x....QF.>~../....ffvaY,M..J.5..
.8.u.~w....:w.6>..q....B.JzB...S..6.?q...zc......[.W..P..6...-.....
...7.......O9...q..p.y..c..........].....|.Z .C......?.<...ud.....{
...&.KH!6.=48>......,k......t2.......1.M..}d...v.0...}..TU/#....z. 
...=Zd..[..,[.0....%.FR......1..49..<`.*[:v.....J.#33..#b.="f.\V)Ed
M.m.Qe].#.WL&.L..PJ...0.....W]....lu.....o...[2...;...M.Q. .....b.....
.....>z.......z>.M......`.2:.2..|1..!b.[...E...;&bow"..R.&5n.,..
...sJ......!.$t...Fn/...N....u...../....y....:......-=JM..t..k.......y
.....e..i. ...'S.W8.e.j.U.e....c.....3............}.H.I.z^...c.>...
h.....P.....L..C...[..7J.?..Kq.6t...*..R....TM.fi.;B......<...@....
.........:"k.I.Ut...N!M.i.FYG...I..w....).............Hg"..k.<.0.R0
n.?0U,J..f......".$y...EGG.....Z.-.(.....<..."...G.........X.^prA..
%Is......rFrI~.z.K.i.. .h....3.J&.N>...arUM"/....|.bo...3|lA....-.8
...Lz.. C6..G........1X..t.......q.{../..LcVC......P.y.A$.R.....D ....
.H.....#K..q.u...7.)i.n..(..E....:.....RN.2.kLo.0}.T...o`.t.O.....{.i.
.-.........g....h%~......|..d.Y8.,..?>.4..>._I\.f......... ...oY
.....O.0...............7..w....O....k..T[.G......O.q.:S].p....K.8 ...q
...tk....|..4.4.K..3...".?.......)..O`.t...../..B....w..N.3....k  .K.C
]e.w.l.g2.o....2<g.....3...a.........|.....~...py..b..H........
<<< skipped >>>

GET /style/xiu/v1/img/bg/dy_rkxin1.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 12 Aug 2014 12:51:21 GMT
Date: Wed, 14 May 2014 12:51:21 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 56801
Last-Modified: Mon, 17 Mar 2014 05:56:06 GMT
ETag: "53268e76-dde1"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx163:8105 (Cdn Cache Server V2.0), 1.1 jydx37:6 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.......l.......Fe....sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS4....... prVWx..Y.v.6........S.....
.........2==...S....}.Y..Q.0.F.0.pT.].K@...{/W..../../...[.X.X.X...gy.
...)...#..,.X.X..4eI......*,.W...4O.<...(...Y.-..$...p....$A.q.....
/<.=..........|[email protected][.lS.....E...).S.
..(..G.....u}......E :.../..}.^......."J.ZB...5>gm....Q.....F...._-
...8v.GN.........c.!.nq..!..H..D}iZ;......8..n.8$...:.O....{.Y..B..O9y
...iI....,Gw.W..i.g.h.......47..]U.C.O.K~sg{..\......<.....c...V).5
.K...Y\.$.~I".....*.;..O...M..<..?[jp`z..N...V.B.....k...J...Q.{..7
.......?.4.[..<.h...e/.............Oc...?$.......xY....5....9P.1...
.2..94..z..A...^.9...o_.'.,.....v...a...M..r..>*.<c.....{z......
o.........f.....nwB..W.................q.."..4"M.a........-."....3.i..
".s.......Xt..#..o...b.................OZ..\..Xy?`......d.....O.......
..d......_.?q.....>.............=..........p......{....Bv.........b
Km.w.....qk.._....c......M....w .{.....a/U?....}...6........b.l=......
...9..=..GA...![..t.~....P>.... .GPF=..-&....b..dw..!B.....$.H.k..&
lt;.5..F.LVa!..ip.Q.......&...l..(..4p.HRM.j ..()'\@;.../....c:...T.T.
..b.....Q.9...)...)....`.K...0"~.du`...g...XsR.....'h.B..8M<..F|H..
.y........A.L..&)...#.V.=....3.tG..i........$......g.._.g.. .../.r...@
...yN36..P....Gv$;...^}..I.L..;.]...F..Q.#.....X..wy.._:..../..._V...,
.Z...I. ...0r..p....E,B..J.Y.T.<.F..H.......DV....uN.K....O..%.]...
c...v..9`[.D.._$...T..d...9.h.nHqJ../j.......%.S..4.0.(L.s.S.K<
<<< skipped >>>


GET /js.ng/framId=flight_float_layer&chan=flight&pg=home&pos=top&site=qunar&type=floating_layer&tile=14003829506057166236&city=北京 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=flight_float_layer
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: application/x-javascript
Connection: keep-alive
Set-Cookie: NGUserID=c0a8e01e-7792-1400400475-1; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/
AdServer: l-ads5.ad.cn6:9678:50
Content-Length: 74
Server: QWS/1.0
document.write('<div site=\"qunar\" style=\"display:none\"> 
;</div>');....


GET /js.ng/framId=homeadSy&chan=flight&pg=home&pos=right_top&site=qunar&size=230x200&type=Tear_angle&tile=14003829506057166236&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=homeadSy
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:55 GMT
Content-Type: application/x-javascript
Connection: keep-alive
Set-Cookie: NGUserID=c0a8e01d-27725-1400400475-14; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/
AdServer: l-ads6.ad.cn6:9678:50
Content-Length: 74
Server: QWS/1.0
document.write('<div site=\"qunar\" style=\"display:none\"> 
;</div>');....


GET /js.ng/framId=couplet_load&chan=flight&pg=home&pos=right&site=qunar&size=120x300&type=couplet&tile=14003829506057166236&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=couplet_load
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:55 GMT
Content-Type: application/x-javascript
Connection: keep-alive
Set-Cookie: NGUserID=c0a8e01d-27723-1400400475-43; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/
AdServer: l-ads5.ad.cn6:9678:50
Content-Length: 59
Server: QWS/1.0
document.write('<div style=\"display:none\"> </div>')
;....


GET /js.ng/framId=ad_home_leftAD_bottom&chan=flight&pg=home&pos=mid&site=qunar&size=728x90&tile=14003829506057166236&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_leftAD_bottom
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6; NGUserID=c0a8e01e-7792-1400400475-1


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:56 GMT
Content-Type: application/x-javascript
Connection: keep-alive
AdServer: l-ads6.ad.cn6:9678:50
Content-Length: 1399
Server: QWS/1.0
document.write('');.;(function(){.    try{.        var ad_type="image"
;.        var css = '',.            html = '',.            jsCode = ';
(function(){\n    var clickTag = "hXXp://qde.qunar.com/event.ng/Type=c
lick&FlightID=115713&AdID=208940&TargetID=5768&Segments=13,28,
53,147,152,373,530,534,535,536,539,540,541,543,544,545,546,548,549,550
,551,552,553,554,555,556,558,559,560,561,562,564,565,567,568,569,570,5
71,572,573,574,575,576,577,578,579,580,581,582,583,584,586,587,610,611
,1101,1102,1143,1183,1831,4053,4648,4649,4676&Targets=5302,29,206,15
04,5768&Values=34,46,51,63,77,80,101,110,150,204,206,228,230,243,250
,252,305,308,321,5402&RawValues=&Redirect=hXXp://VVV.ztehn.com/hon
gniuproduct.php?id=335&utm_source=qunar&utm_medium=AD&utm_content=V5&u
tm_campaign=14003";\n    var img_src = "hXXp://source.qunar.com/site/i
mages/wns/20140509_zx_728x90_4485_banner.gif";\n\n    var container = 
parent.QNR.AD.create_div_container( Current_ad_id );\n\n    container.
innerHTML = [\'<a target="_blank" href="\', clickTag ,\'"><im
g border="0" src="\', img_src ,\'" /></a>\'].join(\'\');\n})(
);',.            jsrc = '',.            run = '1';.        if( css || 
html || jsCode || jsrc ){.            top.QNR.AD.run_in_content( Curre
nt_ad_id , css , html , jsCode  , jsrc , run);.        }.    } catch(e
){.        if( window['console'] ){ console.log( e ); }.    }.})();.do
cument.write('');..
<<< skipped >>>


GET /style/xiu/v1/img/bg/520_z5n6_bg.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive



............................."........................................
.....................................................!1.AQ.aq"2.....BR
#....r.sU..b.3S$4.........ECc...Dt...%5....&.Tdu......................
....!..1AQaq."R........2Bbr..S.........#3..C$4..sT...c...............?
......X.P.F....[.......w..f1...W......U....([x..j../z..<..G.<E.5
|f.....r.(G.......j..9FP...M_......r..."...3Gy..<..B<E.5|f..W.y.
2.x..j.....\..e.......;.^..(.../...4w..s.Q.#._.W.h.5z...(G.......j..9F
P...M_......r..."...3Gy..<..B<E.5|f..W.y.2.x..j.....\..e.......;
.^..(..<U.5|tw..s.R...>"..W.h.Uz...(\_u....P6.......r..........y
B>V["..}......W.y..,-iHc.|.BU.w...=..........s.V........\"n.....3..
....:G.UH.*..y.Z.u..)..{...=.~2T22.......J.U...9\.[XF^......M.I.....~_
......K.......&.7.A.i9Y\..._.T.._..r.....`....:ZA..B.....%y\...r.....`
....P....3...M....\...>...(....N].L....W..s...>...b'd..>I..._
...W..s...>.....2G....g.......\...>...F......|./.....d..;.}Q...M
..........w...Y.r...Ts..R...d....~:^._.%.}.{.}Q.....@...|.......d..N..
Ts....3..e'.........K.......sj^P.K%,.._...W..s...>...R..t..I....t..
..K...).G0H./-..N].N..T....K...).G0K....j.IW......W..s...>.....).O.
.?.......d..N.O.9.b....M.RE.........K.......$..S...........W..s.j^.O.9
.\..$......W..;....9I...G0K>..!.)Y...2....MJ..>...Ao.}...i....$.
....<.%......*..y......s.. \.....|.D..=.U0.U..r........b....e....Lx
_..q_*.E.^.. 2...F....t.y.4..V.n$..N.W.y..*@.. ......;.^..*<.."...3
Gy..<..B<E.5|f..W.y.2.x..j.....\..e.......;.^..(..HTTP/1.1 2
<<< skipped >>>


GET /style/xiu/special/v1/img/topic/520days_2014/520_Entrance.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Wed, 13 Aug 2014 03:01:20 GMT
Date: Thu, 15 May 2014 03:01:20 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 24173
Last-Modified: Thu, 15 May 2014 02:16:03 GMT
ETag: "53742363-5e6d"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl34:8104 (Cdn Cache Server V2.0), 1.1 jydx39:7 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR...x...r.............pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S....].y......n&...%...v...w..L.]z.x...
...........e.m..`.`..Y.............G.G.#F#..........d.........~V.y.s..
....K.X.........y..r....:.#....y=......}.........([email protected].>.|.
./....%..3... cHRM..z%..............u0...`..:....o._.F..S.IDATx...w.%G
u.....7M...Q.w...*...E@.. 0..G0..cc0?l...`.ll.&....([email protected];y......
..{o..Y.l....~.......o.:.{..........!....j...>._...3.^...x)p..:..6.
....C._>... ._.c..o..)?. =..x...Ykp.E.....!.w.......>...C..?
<<< skipped >>>

GET /style/xiu/v1/img/pic/z5n6_psmall.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Wed, 13 Aug 2014 03:01:25 GMT
Date: Thu, 15 May 2014 03:01:25 GMT
Server: Tengine
Content-Type: image/jpeg
Content-Length: 1482
Last-Modified: Thu, 20 Mar 2014 16:29:10 GMT
ETag: "532b1756-5ca"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx156:8104 (Cdn Cache Server V2.0), 1.1 jydx42:2 (Cdn Cache Server V2.0)
Connection: keep-alive
......Exif..II*.................Ducky.......>..... hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c061 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" 
xmpMM:InstanceID="xmp.iid:866ED6BA823A11E29FFEFA7C739E75B5" xmpMM:Docu
mentID="xmp.did:866ED6BB823A11E29FFEFA7C739E75B5"> <xmpMM:Derive
dFrom stRef:instanceID="xmp.iid:866ED6B8823A11E29FFEFA7C739E75B5" stRe
f:documentID="xmp.did:866ED6B9823A11E29FFEFA7C739E75B5"/> </rdf:
Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="
r"?>....Adobe.d....................................................
......................................................................
.......................2.2.............k..............................
.........................................!.1A.Qaq2....................
.!..1............?...r......xx:.. ......p..nR.s.....utT.PIU...>&.F?
K..cm.......}....... /~..].l...d..0.......iXI$DFX...k)qx..]..-......o;
.37..L:..P..x....M$.........5.....([.#....91S.d..rRe..i.eF..G.m.,.p...
..X$K.}%..'..m=R.P.fbX...\..O..Y...!.WYr.d.u\D.......]..........V/.r..
.....k..c.6.P.t.`.y<X.>.G......!....E,D ..38s....0..-.i|.B.@
<<< skipped >>>

GET /style/xiu/v1/img/pic/xiu_big_avatar.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: s1.56img.com


HTTP/1.1 200 OK
Expires: Wed, 13 Aug 2014 03:01:25 GMT
Date: Thu, 15 May 2014 03:01:25 GMT
Server: Tengine
Content-Type: image/jpeg
Content-Length: 1482
Last-Modified: Thu, 20 Mar 2014 16:29:10 GMT
ETag: "532b1756-5ca"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx156:8104 (Cdn Cache Server V2.0), 1.1 jydx42:2 (Cdn Cache Server V2.0)
Connection: keep-alive
......Exif..II*.................Ducky.......>..... hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c061 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" 
xmpMM:InstanceID="xmp.iid:866ED6BA823A11E29FFEFA7C739E75B5" xmpMM:Docu
mentID="xmp.did:866ED6BB823A11E29FFEFA7C739E75B5"> <xmpMM:Derive
dFrom stRef:instanceID="xmp.iid:866ED6B8823A11E29FFEFA7C739E75B5" stRe
f:documentID="xmp.did:866ED6B9823A11E29FFEFA7C739E75B5"/> </rdf:
Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="
r"?>....Adobe.d....................................................
......................................................................
.......................2.2.............k.........................HTTP/
1.1 200 OK..Expires: Wed, 13 Aug 2014 03:01:25 GMT..Date: Thu, 15 May 
2014 03:01:25 GMT..Server: Tengine..Content-Type: image/jpeg..Content-
Length: 1482..Last-Modified: Thu, 20 Mar 2014 16:29:10 GMT..ETag: "532
b1756-5ca"..Cache-Control: max-age=7776000..Accept-Ranges: bytes..Age:
 1..X-Via: 1.1 zjjx156:8104 (Cdn Cache Server V2.0), 1.1 jydx42:2 (Cdn
 Cache Server V2.0)..Connection: keep-alive........Exif..II*......
<<< skipped >>>


GET /AShow.aspx?AID=9842 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShow=2024|1993


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShow=2024|1993|1899; expires=Sun, 18-May-2014 11:07:15 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:15 GMT
Content-Length: 4105
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:...Y...W...~.:.E...|.....:_.
.m..?..s..'....-.e...................S...^~..a...5cz................w.
......-.F.......O../9......:'.w~1.k.....7.]..Yu5n..xVM..|...j.........
.>[email protected];.;.$/.\...._.K..~....f...... Ej4........~!u.
Q|..'.......U.4k.......~.....i..y..HLM....%^....?...E..........zT....U
~q.n......3...>A.O>.l.{.....ug..g~.;Dq.>.c.......G...I...R.C.
....;. ..r...C..&Dot...|....w....8b.4@|2.Wx...F...I?I..[..;...........
.-rj..QMg0.....G.....v....uN.A....6....u[.....p.S....]..U....~...C.T..
......]U..?gY.......!...o.....>[f..E.V.x........'.....~,._.........
_.>;.;n.........>.].....;.._.._(.~.~.M...>.?e.U93.......T>
.zu..=0..}t.M.......e^..m.3?s.'~.I]].....Vq...Gw....._......n>...6.
n:..E....]................$Fx^]..I...1....(......n.l7...........k.....
.(....o.u.>J.3..;..A.~..=a..{.IsN_........V...............^;B./...h
.4{.....f.-.A.u.!...6[.....o;t.....t..bE.Xb...6..V..osAr..h.&.........
..._../....0..../w.}....t>m.b..G..j.........).......bF......y^\.[.u
ZfM..'._.=}...g.?......{.............{.Ov.......q....~< .{..GG..J.G
. 6{.......u.....j...G....5..2?o..........7.&x......~<.{J......n?.j
..o.......S........C............Yq.h..Y.W ...h...~..y;$..U.H3V....EN.K
/..........4.......j.A.....o.@.\....^Q.f=Y..^...M.g..W>b.....YS{.|.
F.~.....c.. x.b..q.....o-.Kk....L.|A......=.P..6....|..=z.0....gl.....
.........o.....F.......9.....R.e...?..bY......`.........b<.f..j
<<< skipped >>>

GET /AShow.aspx?AID=9756 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShow=2024|1993|1899


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShow=2024|1993|1899|1805; expires=Sun, 18-May-2014 11:07:16 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:16 GMT
Content-Length: 2543
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:m.u.....]=.{ww..x.........w.
-..........>.._.......^....~0^\....]..{.i..{..'O.b.v.5.w......v.v..
.......?....v..........{..}z.......;O..<.to..{.'.............O..={.
l......<.?y...../..0......w.;..].?.O..K~./[....E....~.{.M=....V.byq
..=3.....<....f.t..7.e5...Zj.l..o..ql...'.u......i...%..`.../<..
..p..........s......'{O.N.}....`..........."...{.>}..1.. .7;.......
./.a.(>.$_N.Y.....j...4.-o.wtT.............*f......4..</...g{;;.
w}........WW..b<o...t..'...........|J_.>.1..E...&...&.Ut...j....
........x....8i.I[.>...`...V{.........g.z..K4...g......X...._...evY
\dmU....E~..&e>.....89.:_/....;......^|.}....u...>s..M^._.X.e;/.
..|....(.~...ei.xVVY....~.....7.[,.U.....b....#..W......lqA...........
..O..A..9/..3..< ....*.K.z......./^.....y.n.....O....y....../../.J.
.O....g.....).V..........mS.....Fa........s.......}V. W.~...l.~.~.....
.>....^.9)...h.g..."O@.,..B........[4m.........:.... LW..U..mVY...]
?..I6}........ .O..c..... .p]..}t^.m^?"{rQ..=.....E.....9.....X.....q.
.g...*....Y.6R]..*.wK.l.Z^....d....y5....w.?J..GC.6.l..A.Q.(eEJ*j....I
..~.T5.....#.;%f|...2x......1........|...3R.....~.._z...8}zv........WU
S...1........w.......<|....1z.....'.........Sn0...Z<.9.......c..
%....M..\.y.s..m.8............u.T..y.$J.9z.K.t..E..R@2|&.v..3.dM.=..G{
.......=.....hVev.hI....Z.C..G?.]f...V.#;..n..m.9..v]/E*?:.N....O.....
.y...].....rA].......]Z.n!1.O ..Y{/..........ysT ...,.=..9ir.|...&
<<< skipped >>>

GET /AShow.aspx?AID=9756 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShow=2024|1993|1899|1805


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShow=2024|1993|1899|1805; expires=Sun, 18-May-2014 11:07:29 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:28 GMT
Content-Length: 2548
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:m.u.....]=.{ww..x.........w.
-..........>.._.......^....~0^\....]..{.i..{..'O.b.v.5.w......v.v..
.......?....v..........{..}z.......;O..<.to..{.'.OwO...?8.......O..
O.<..==}p..w.`..~E.....^...........K.%...-.\...X\.o.........f.E....
...H..u~..?.g.j.^.....fmQ-.M6..7..86.........._..Zd...|..p....d.y.s...
g.....9.t.........O.......<.t...{.;O..?y......;..=}p......'.{L..?..
..0h..../..,....I.XUK...7.;:.v]\T....gE.._.3.e...a..v...........>mV
c........j1....C:....Z....u...V>.._...c....P...X..*:.iY5.._...g..c.
f<q..~.4...V..~J0..t..^.........f...%........Y~^,..../...2.,.....T.
."?]f.2..I..o..n...Sp........W/..>......?g.9..&../h.......i>Y_|A
.H?K...._< ..}Z\F?.Vg....-...z...M.............}q....?..~.zZWe.....
..u......}|..M..A..%q=..cE......N....i.fwF....~W.<}...w.....n......
?.3..}...Z ...s..C.S..).........g~F{....c.x...> H..w.......g?.t....
...|~/.....U..3..y.'.X..g!.....AB.-.6..N.i..ki..ki... d.*l.6.......}.$
....g.G.pC.....1....r.y....>:/.6...=.(f....g..".Sg...dc.EA,.T....\.
3..y...z......n\...%u6^-/FM...J_....}V..;...x...w.U6.. .(..."%..z...$e
D.O..p.l......3>.M}.<o........qSuU.m.......b..G.../..._.>=;..
I{......).Q...a....T..G.....r.>..p..=.X.....W.......)7.Tm[-......~~
t.1.......&MU..<.....}..\.^....x....n...<[....=..Y:....o) .>.
g;...B..........]..h.....nV4.2.~.$.K|[-.!.......fZ......w7......y...".
...'......obU...z.....}i.........B..-.....'.b....y....\^.Y..9*...b
<<< skipped >>>


GET /ips.jcp?callback=QNR.ips.callback&_=1400382951167 HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ws.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:52 GMT
Content-Type: application/x-javascript; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: QWS/1.0
Content-Encoding: gzip
38.................,(.KN..IJL...VJ.,.T.Rz.3...5J....#...$.....0..t>....


GET /lpisearchd?callback=jQuery152011194646905334254_1400382946808&from=&to=Hot&month=All&cachefrom=&cacheto=&type=ow&source=fhome&_=1400382952605 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ws.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:53 GMT
Content-Type: application/x-javascript; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: QWS/1.0
Content-Encoding: gzip
[email protected].....&iZ..k.)1...%...o......Uk-T....J.}.....#
V2....Y....gv~r.q...Q.XR7u3I..u..g.N).48..5.D\.#).]p..-.Yo...(......#:
 D!.i/MRSK$...:...s...n.vHJSH&..sP.....Y...9(.P...T.A..o.. ..k...0.E..
.(_~..r(G.|.....~&.1T..z.kb.)..POV...7....._......."......../.C.......
..z.y..PB...~...C.p.GIBe.aq..e..y.[ &..t].Q. F.O..[.d.Z..#y<.......
{.6.?..nS<T.'f.!s..-.X.I....../......P.w.8..;...........8........".
...p.;.bb*. .....-..b......V......'D..'>.i.........0......


GET /airCoPromote.jsp?airCoList=CA,SC,CZ&num=5&callback=AirLineDeals._parseData HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ws.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: application/x-javascript; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: QWS/1.0
Content-Encoding: gzip
8eb..............koT....._.V.f..*....n N.M.TQ5W..c;.K..x..V..@ .....7R
.*NB....x..[t..x..^LV6....hw.w.......h......Ss.._/.v.M.....#.......pP}
[email protected]#{Gz..,.......3.m...N..=2=..nZ.....;.M....o.......M..?..../.^
....Z...n..N`..Q.Uu..$...".....w[..'.s...nwq..='O..{...j.....TwtNu....
...w:.?7....:n..&.#.:..:9..s...j.....V.........{.D..,..i......D......v
..E7oO.....&aT....5.f5..0.].wlk.u....*.'R#...T8M...I...j...Y81..h.U'T.
.L.....2...a.^....j.1.9C.x.0..:C..`.Kf..F*...@.'.'He...N..^..w.. .....
...e.85...X.-.(....jN.....*.....a..BKX..0D.E.F..Wz..0.........".u...P.
>.VDqf.QG...%JC..S...R....0..d.k  .Zsh.I).1.P...$..(>A.NQ.:.lg .
..... .2.S.aJ...`\).(f.K...^z.d.....2$Y$>I..oW.3...B.............\.
M..oRW.(..s....hh.......O b. ...>.V...O..y..pj.Zj...J%.rB!n<..Rd
...z...H./.=.|./y...(..A0..Nq;pd_.mm<97(Rna...$... :.X...\.....Y*.O
..1.p{..........nUn.......F......0..-..B)..Z.$.DQ.B..PC...A.s.........
.k.t8.........SZp..o......P....C...:. ..[G..y.......A.X.3!/..q;|...k..
..._I......3.1!...g-.U.s. ..!.y.-.;......o.>.X)...(Q.g....*B..B....
..........!.......1..Y..E.c&.RNp..V...V.#.<...s.].{..t#.......Q...]
x....).c5....(M...!.. ...#c.G....G.h.3...P...n.2Rp.s.....E.6qKc.....'.
FE..<.........?*..V.....i...cY.=-.ooy.....;_.li]...1...w.5%sm<E.
diL.iDR#0..[...l... -.r.#.2kSX..d..s.l.....nF.k.D...p.. ...~.....D..IO
...QX).0..kI..$d.7.A...c0....I;.....c;.m.d.m.`].....tI"L#..n..!..p.Z..
".P...B...[........_.!w....)=5.V.n6."n......x........H.."#.8.V..BO....
.....V....}..?.x{\!#...x.e.&..Y..\|.xCP@`.7.......8k.qNz....<O.
<<< skipped >>>

GET /holidayService.jcp?count=2 HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://flight.qunar.com/site/main.swf?20090107
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ws.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:57 GMT
Content-Type: text/xml; charset=utf8
Connection: keep-alive
Content-Length: 35800
Server: QWS/1.0
<?xml version='1.0' encoding='utf-8'?>.<root>.<airline 
from='......' to='......'><line date='2014-05-18' go_start='21:0
0' go_expires='22:55' back_start='21:50' back_expires='00:20' go_avc='
........................ HU7603' back_avc='........................ HO
1251' go_isNew='1' back_isNew='1' go_update_time='55......' back_updat
e_time='54......'><client name='' price='518' discount='4.6...' 
type="go"/><client name='............' price='502' discount='4.4
...' type="back"/></line><line date='2014-05-19' go_start=
'21:00' go_expires='22:55' back_start='20:40' back_expires='23:10' go_
avc='........................ HU7603' back_avc='......................
.. HU7602' go_isNew='1' back_isNew='1' go_update_time='1......' back_u
pdate_time='1......'><client name='' price='402' discount='3.6..
.' type="go"/><client name='........................' price='380
' discount='3.4...' type="back"/></line><line date='2014-0
5-20' go_start='06:50' go_expires='09:05' back_start='18:30' back_expi
res='20:35' go_avc='........................ HO1252' back_avc='.......
................. KN5956' go_isNew='1' back_isNew='1' go_update_time='
1...' back_update_time='5......'><client name='' price='459' dis
count='4.1...' type="go"/><client name='' price='381' discount='
3.4...' type="back"/></line><line date='2014-05-21' go_sta
rt='06:50' go_expires='09:05' back_start='21:50' back_expires='00:20' 
go_avc='........................ HO1252' back_avc='...............
<<< skipped >>>


GET /live/2014/02/12/01/1003v1392141486221499555.jpg HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi1.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Thu, 01 May 2014 18:14:52 GMT
Content-Type: image/jpeg
Content-Length: 3928
Expires: Sun, 26 Apr 2015 18:14:52 GMT
Cache-Control: max-age=31104000
ETag: "3529773593"
Last-Modified: Tue, 11 Feb 2014 17:58:06 GMT
Powered-By-ChinaCache: HIT from 06047113L7
Age: 1432390
Powered-By-ChinaCache: HIT from 06043343SN
......JFIF.....H.H.....C.....................................%...#... 
, #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((
((((((((((((((((((..........."........................................
.9.........................!.1..AQ"aq..2B...#R.r....4b................
................."......................!1..."2ABQ............?...... 
...4C>&..V.V.3E3...%%!.~' s..._\%... ....1.......\o..N..K<ZL..kP
....<(.X.I...T..b.\..p]_n..........su,...D.,0..a.}..v....}".l.$.C#9
...6.C....(.omM;qo...Ic........j...R.$.}J...O.F.k:...B...v....X%Dh....
g.z..J..d...h^...PK.M4...T.]J..;/J.G..v.L.?..}..].O....vfy.nb.o...9...
...[GD?t.Z....#./..L*}[email protected]$..%.W.y....6.</.zD...5...zMV]QalG&l
t;[email protected][......Q...{..I.J..J.1.........a.l....{.p.1.ziWz.
N...^..-sk..^m. [email protected]..*.....b2eI..=....b..8d.......?.Ooq
LL..eh..7...2.RHg..H. zO..o..\.....5K8l..e..p.......Y.r3.>b.Y......
.A^.4~......R$...:.0.VS.G..;U..t.._.&..%f..^...}W...NE.Z%3.....5.6.5.l
.>...M.....vK....}=........n...T....1...-.g......f..U%....}.......n
L....#9.......n.*.5.m6...PL.P...OJz..bz.8.....#4]/F.u!..=..Kv..M..z...
rX..c........\..{sI]:.0B..y$..........y..[.=.h-.-..X;3Ns..$.>..<
.V,[...c1G.1.s../..B.....}s...i.2.....K..,.....hG...F*.'...7..........
d..}h2.....Ol..Y~.m...R...X61.I...B........n%.....Q.(U......c...k....%
.. .;...|?......'...)3.^.xw.f....=8..JD..r~...^..7Z]..Tl..G.!".3tH....
.qj. T5.Q..y.=z.R.|Mo ..~%..B2 qm.R._F...9.T.9....k!I.18..V..;j.}.Q...
.....w..L}B_..^7j..'...g/....x...o.2....\g.....:...T......m.l.V...
<<< skipped >>>


GET /live/55/07/6cf4565a9b319e36561b4af95c4522df.gif HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi4.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Sat, 12 Apr 2014 18:10:16 GMT
Content-Type: image/gif
Content-Length: 49894
Expires: Tue, 07 Apr 2015 18:10:16 GMT
Cache-Control: max-age=31104000
ETag: "3751911374"
Last-Modified: Fri, 20 Dec 2013 07:54:32 GMT
Powered-By-ChinaCache: HIT from 06047113L7
Age: 3074253
Powered-By-ChinaCache: HIT from 060531B33F
GIF89a.........%..)..&.. ..&..,..'..0..1..0..-..3..9.. ..&..-..-..-..3
..:..5..;..3..4..;..8..1.!<.!5#.-'. #.3".:(.33.**!.$"5$#; #4 %;,*&l
t;))98%,3C&;4*54 <;,<;)5<2<61;319.....A."C#%B, C()F4,C;-
B4 G42D43K<3C<7J99T-1L6<`>BZD 9C3<J6:U::J-.c,6C-BC4CE:D
D<KK4CK<DK<KE5JE=RS<CW;GU;Pf<FZB<M@=eG<uH=LCLJCIJ
FUSCDSDK[CD[KLYGJTKS[LSVHVZTYZQOYVdNNfcKKfHGfKSiSKcSTiXXuLGwWJvXWtMTg[
dv]dkb[xfY|iTjdgvhgvkszsi{uvlht]bqtv.z....K.YH.\Y.QP.]c.eM.hY.t[.kY.wY
.iM.if.vh.yv.ke.ud.xg.yu.mr.{X.{k.zh.zu.mq.Qa.\q.V?.|.....s...\..x..i.
.x..u..\..h..w..k..w..z..i..x..g..w..q..x..{..........................
......................................................................
......................................................................
..............................................................~.{!....
...,............e... ..<.&.R5)O.P.^..... ..`......"E~......J.x.[I..
5q0...'.%.k8.....W1^.t..D...)<,hh@`.......J..U...Z....U...<.....
.*.h..EN.7...H..I.D....3g..%E...R...S.....D..Q.........*T.02w..-k.lQ..
..X.L.2e.....-5jD.S Y.F)..EQ).n..J.......J....... ...Kb..2k.Dw..L./k.^
.F.Z.^....T4....$,(..i..\.z.0.j..V..VX.D...)L...m....H`...Z ...{..G.H.
F.!.0..bX$........].qF. ..C.sU.......j....i.......6['..rJ.r`..)....C..
..E..R.j.M2..G..C........B.K2...:p..g./.G^5k.3L0.....KH!...H....8.(U.d
5..]...~.. .......3d...n...hr.!Z^q....a$.D..Z(..$...Q.....Fw...)p`...5
2....(.Jb.\..j.... .1..)K...(.$2..a..."...Kq...Q*x.Q...|[email protected]
....r...vx...1..rK%m.....H A....(VS5..V......_......A......L.....i
<<< skipped >>>


GET /80928328?p=20111931 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.woxiu.com
Connection: Keep-Alive
Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20111931; __x_sid=214516; __x_webpage=1


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:38 GMT
Server: ngx_openresty
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
P3P: CP=CAO PSA OUR
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 18 May 2014 08:07:38 GMT
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Content-Encoding: gzip
X-Via: 1.1 fsdx18:2 (Cdn Cache Server V2.0)
Connection: keep-alive
500a..............iw.F.0.Y....8..X"..\lKsbg........7.......$..........
w;q.M...[.oc'.............H.S..[... .J....G..4..................o....b
.y.........F...m.F_z.%...|....n.e..H....ZI*D./..a"y]/o.F.....ccZe2....
3X.........1Y.#..[H.3.B.:.P..N....."......RTt.....G5uj<.M .JI.}g..D
.,.........73..T.*.xM..."L.]SI**..W..R.t......K..2;.U...`}.D...F...?.&
gt;..]..zay.H.....#..K.....Onlyk\....U.s(._...........R$....j......F..
b....#....p (..(..sw..]...O.5/.....'.Y.~.q...._..6..\~pyy.h ....G.w.7&
gt;[email protected]..'.......c..E..4..k.T....jqr,...U
}..Dg.Z4#U.....7.Z..IrtZ..c..'}..f.......6.X.t5Sp7....I.C]...D.i.g?.I&
lt;J.K.....8vk...%J?.U........#UE.d..F.N..H.rA.J..Q....[W....W..W..C..
.A(.|...M..R.#.I...!...o...6J..Z....b.JS.}....*.X.n..q.c.v..R.4T.H.C.6
o..r....^)L.Y. R......M)6..b|j#}T.*..<R(...D.O..4.1_.....C......X..
..`.$.........p..s.w...I....g....E]%..P|g.......]=W.&#.....*.k.....c..
}XQ.$]q?%u{..j....C*.1 .F.Q.....".>..X..N.!8.$.1%.$.I..%.)!'g.J*'..
XV.Ev.5.X.ge1'.....:..a.....,..?..h.i..Z...*@c...d.kU..W.......L..ui..
....p.....S..;...._.l.......j...6.PP.PyN*T.|..<....m.e..2.]F.H.V.xM
{.n2zI,..y.U.!.d&)l.iU.._.V....t.q..d.......J.O..@>..r...2.Y..M....
]..;...\...m2N........J%s...-....E..Z..xL`.1eFA....T....jI..#...V.....
F8.....a([email protected](%x7.IpJ.Og.IEI$Sq9 K.d..e.L:%gE!...2....
...i..l...J.K...{.V.....eE....1..umR3i...6#..H...I>.~-....:...M..:.
..-...; qX.M.KFhE.*......).... W,..2!AI.F.ig..,.......( 5...}Z%.r....A
.Q..\.V.=Fi.....e,F...U.tV...kx?)}4V.U.....z.........C.'..\....c..
<<< skipped >>>

GET /index.php?action=Game/Lothario&do=Init&room_user_id=lmx2369295492&t=0.16804625496624326 HTTP/1.1


x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.woxiu.com
Connection: Keep-Alive
Cookie: __x_wx_ww=1; __x_osite=offsite_56; proxy=20111931; __x_sid=214516; __x_webpage=1; toxiurefer=VVV.cfmogu.com; forever_={"uvisit":1}; __x_jump2uuid=38295037017807; __x_jump1zbroom=lmx2369295492


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:51 GMT
Server: ngx_openresty
Content-Type: text/javascript; charset=UTF-8
Transfer-Encoding: chunked
P3P: CP=CAO PSA OUR
X-Via: 1.1 fsdx18:2 (Cdn Cache Server V2.0)
Connection: keep-alive
119..{"status":1,"gift":[{"gid":"286","name":"\u6211\u7231\u4e3b\u64ad
","dou":"1000"},{"gid":"409","name":"\u6cd5\u62c9\u5229","dou":"5000"}
,{"gid":"404","name":"\u79c1\u4eba\u98de\u673a","dou":"10000"},{"gid":
"615","name":"\u6d6a\u6f2b\u70df\u82b1","dou":"50000"}],"play":{"step"
:"4"}}..0..HTTP/1.1 200 OK..Date: Sun, 18 May 2014 08:07:51 GMT..Serve
r: ngx_openresty..Content-Type: text/javascript; charset=UTF-8..Transf
er-Encoding: chunked..P3P: CP=CAO PSA OUR..X-Via: 1.1 fsdx18:2 (Cdn Ca
che Server V2.0)..Connection: keep-alive..HTTP/1.1 200 OK..Date: Sun, 
18 May 2014 08:07:51 GMT..Server: ngx_openresty..Content-Type: text/ja
vascript; charset=UTF-8..Transfer-Encoding: chunked..P3P: CP=CAO PSA O
UR..X-Via: 1.1 fsdx18:2 (Cdn Cache Server V2.0)..Connection: keep-aliv
e..HTTP/1.1 200 OK..Date: Sun, 18 May 2014 08:07:51 GMT..Server: ngx_o
penresty..Content-Type: text/javascript; charset=UTF-8..Transfer-Encod
ing: chunked..P3P: CP=CAO PSA OUR..X-Via: 1.1 fsdx18:2 (Cdn Cache Serv
er V2.0)..Connection: keep-alive..119..{"status":1,"gift":[{"gid":"286
","name":"\u6211\u7231\u4e3b\u64ad","dou":"1000"},{"gid":"409","name":
"\u6cd5\u62c9\u5229","dou":"5000"},{"gid":"404","name":"\u79c1\u4eba\u
98de\u673a","dou":"10000"},{"gid":"615","name":"\u6d6a\u6f2b\u70df\u82
b1","dou":"50000"}],"play":{"step":"4"}}..0..
<<< skipped >>>


GET /9.gif?abc=1&rnd=633829471 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Server: Tengine
Date: Sun, 18 May 2014 08:07:33 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=RVj/Cy0IRhYCAbhrJiY9QmtQ; expires=Wed, 15-May-24 08:07:33 GMT; path=/; domain=.mmstat.com
Set-Cookie: sca=86f6df01; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=0e1b1ba714bea1243904f592_1400400453; expires=Wed, 15-May-24 08:07:33 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=RVj/Cy0IRhYCAbhrJiY9QmtQ
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..



GET /imges/live2013/logo.jpg HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vr0.6.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 12 Apr 2014 18:05:15 GMT
Content-Type: image/jpeg
Content-Length: 4111
Expires: Tue, 07 Apr 2015 18:05:15 GMT
Cache-Control: max-age=31104000
ETag: "246892552"
Last-Modified: Mon, 02 Sep 2013 08:45:57 GMT
Powered-By-ChinaCache: HIT from 01057413L3
Age: 3074550
Powered-By-ChinaCache: HIT from 06053213yO
......Exif..II*.................Ducky.......O..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
1 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmp
MM:InstanceID="xmp.iid:22A6BBA813A911E38CBF872E69BADB11" xmpMM:Documen
tID="xmp.did:22A6BBA913A911E38CBF872E69BADB11"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:22A6BBA613A911E38CBF872E69BADB11" stRef:d
ocumentID="xmp.did:22A6BBA713A911E38CBF872E69BADB11"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
......................d...............................................
.............................................!1..AQ...a"2..q...BRb#35.
..r.$4e..S.t...U.('........................1A.!Qa."...q.....2BRbr.....
...S.T.............?.......Q .Rvl....L......P.........R..O..G.z.1....?
L..g..-....).K.].K..2%....t..g.c...3..q.2[JCM..\......I.==..s..v..^.&l
t;....WT..-c~7.....i9z..K..!nFk.0..mf*)O@[email protected]...
.'z..q.R"..=u.6.....0....F.jEv..l.{.V....*<...DC...O`. ......%J
<<< skipped >>>


GET /live/2014/03/13/02/1003v1394650357861917005.jpg HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi1.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Thu, 01 May 2014 18:06:43 GMT
Content-Type: image/jpeg
Content-Length: 3509
Expires: Sun, 26 Apr 2015 18:06:43 GMT
Cache-Control: max-age=31104000
ETag: "4193178486"
Last-Modified: Wed, 12 Mar 2014 18:52:37 GMT
Powered-By-ChinaCache: HIT from 06047113L7
Age: 1432879
Powered-By-ChinaCache: HIT from 06043343SN
......JFIF.....H.H.....C.....................................%...#... 
, #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((
((((((((((((((((((..........."........................................
<........................!..1A.Qa."q..#2B.....$3R..r..6CS..........
............................................!.1A..2Q............?...A 
e.Q.C......zu\..c....&...5..*b2I....vG?A.T..{b.p1.L.l.QG....J..?MU[.~.
.....g....X...e.-.....g.8.Z..........T..Y..m..F>........[81...y4y..
..Ebk.,.....S`......yT.\>..Q.m.wl.3A3t}u...M#.*..q@..[u.A.3.#%."..'
.{.....$.......i....u9g..)V1'9.2.\.....j.q.`.G.l...XJ|6.D...6.Yl..{..3
#.4 .4.q...a.s..`:......8sU........t.I..%./.7He.......)A._......V.A...
iD.0*Iz-..8.......}2.[...u..N..:.wQ...T##r......E<$..........$.U6S.
......F..OJ.J....%..c.6....N....Z....:.......]L.....p......])VQ..p....
..K...!1..d.#..g.H...N..n......."U .%...kw.... ..{..*...(.T.S...6.n7..
...e,aF..._..GJ.{..<.z......c..r...{.......}G..8......o4.,e9*.)S...
.I..1.H.U.v...;.*.[.7l.P..t..K.og1.J.w...>.>.||.h.6...<(.n.R!
.......c.....,H....srvb...... ..|..).p.....j../...(V.......Q..6..j...p
..4.....;.:.....#1e...va.^[email protected]".r....o..UY. .7.h......8.
..$C1.\......\0.y"..p..d.t.Q...V.)..:U.D...k{..77K..a}..5u..E...Q(..a.
._FU.>..U.."..(...#....4 ..T.V..)fZ....).b.o......D.....M.`.\.a E#.
T.i.\....{....!X.....zX.hP....M...*$.b.......6.."..R.a.2........|k....
w.{.S.Fv..v.C..|2.. *......L....l...2j.r.~r.g)H.........=.@..%.ue...Yu
...^I..r1.l}.Bcf.......F..`.q....Q.{ .$.......J.B.=eA....i...k.4.n
<<< skipped >>>


GET /script/page/xiu/v3/global.js?2013v6 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 18 May 2014 21:11:59 GMT
Date: Sun, 11 May 2014 21:11:59 GMT
Server: Tengine
Content-Type: application/x-javascript
Content-Length: 5517
Last-Modified: Fri, 14 Mar 2014 09:33:12 GMT
ETag: "5322ccd8-158d"
Content-Encoding: gzip
Cache-Control: max-age=604800
Age: 1
X-Via: 1.1 zjjx155:8104 (Cdn Cache Server V2.0), 1.1 jydx41:2 (Cdn Cache Server V2.0)
Connection: keep-alive
......"S..global.js..;....u........A.<I'.....r...UKv......I........
.i:..N.8..d.i;..g....d..n......O....... y'..4............]m%......1...
.../`..=...Zs.:.;2.9_n....xaP:|#t.<2.p...r.I.........;r..'...3..XhZ
S61...ao.j}Wk..,.],........z,.m...>.....cg...sC.q....Z........pIah.
.y.D3....N8..~.T..cGB.."g...^...6....r.8r..6....S.....>...S.'..s...
....>o.lA.?......>.y.KnsI....9..Cf.Z.............'.....46@@x....
!...O.%.&.4.....b...`..j....F..a..`..8.]>..\..0....a.s...$..I...n.|
....P..V.2....%.;...n.........L....?.......#O.d..b.;..[..[b.......J...
.i.../.}..K4&.....L.....5q.QC.T59c..t..*.l.......`L.......b.d'...?~.D^
04...a..\..y.s.d...^.........{.\.c(?.....;{5...V...T?1\..Mg.n..(..Ez4.
-..U.1....Q.^V...D...C)H|"...T.!...;.rq.'..7..r.!..M..3....K.........:
.....C...D..`...C/0t=...!....J.X.t{{...O7.... .....CoBG.02..c..wS..>
;.......*#v`.T......&..2..b1S5.. ...&c.j....A.....|MSk...L%......]g...
~..n....V..i..zn.Ws%.y..g..|.B..l..jCq.Y,.......7...^..A#..|..RB......
.L...K...m..=..?....W....I....90L.E..<.~..*....Nd.e............ .M@
[email protected].^0M...G0.A_..Ro.._6.._....D..w...N..:*....~.=a.vg.....N
.~.j..=......3...].....n..V.1.....c.>.j.....>......1.V..Y...9v..
h.....>..........!....0.K....as...9....w.zM.5..._..:...^#x..M.....c
iE|..V.....G.?s.....8..2........n.......;....q..aZ.L;.C1.Q...L.zs..-.E
o.(.T/.:..^v(O...s;1j...2...L.q|...\...k.!g..gSIc..M...>d.B".:..-.t
.1....!}K<......m ......m5.@...!w...HM..:...@[email protected]., 
.g.z\U.p.N.S.6....K:B..Dc.e...T..j...tA...\oH6.H......R.=..O K..-.
<<< skipped >>>

GET /style/xiu/base/v1/css/common_v.1.css HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 18 May 2014 21:11:59 GMT
Date: Sun, 11 May 2014 21:11:59 GMT
Server: Tengine
Content-Type: application/x-javascript
Content-Length: 5517
Last-Modified: Fri, 14 Mar 2014 09:33:12 GMT
ETag: "5322ccd8-158d"
Content-Encoding: gzip
Cache-Control: max-age=604800
Age: 1
X-Via: 1.1 zjjx155:8104 (Cdn Cache Server V2.0), 1.1 jydx41:2 (Cdn Cache Server V2.0)
Connection: keep-alive
......"S..global.js..;....u........A.<I'.....r...UKv......I........
.i:..N.8..d.i;..g....d..n......O....... y'..4............]m%......1...
.../`..=...Zs.:.;2.9_n....xaP:|#t.<2.p...r.I.........;r..'...3..XhZ
S61...ao.j}Wk..,.],........z,.m...>.....cg...sC.q....Z........pIah.
.y.D3....N8..~.T..cGB.."g...^...6....r.8r..6....S.....>...S.'..s...
....>o.lA.?......>.y.KnsI....9..Cf.Z.............'.....46@@x....
!...O.%.&.4.....b...`..j....F..a..`..8.]>..\..0....a.s...$..I...n.|
....P..V.2....%.;...n.........L....?.......#O.d..b.;..[..[b.......J...
.i.../.}..K4&.....L.....5q.QC.T59c..t..*.l.......`L.......b.d'...?~.D^
04...a..\..y.s.d...^.........{.\.c(?.....;{5...V...T?1\..Mg.n..(..Ez4.
-..U.1....Q.^V...D...C)H|"...T.!...;.rq.'..7..r.!..M..3....K.........:
.....C...D..`...C/0t=...!....J.X.t{{...O7.... .....CoBG.02..c..wS..>
;.......*#v`.T......&..2..b1S5.. ...&c.j....A.....|MSk...L%......]g...
~..n....V..i..zn.Ws%.y..g..|.B..l..jCq.Y,.......7...^..A#..|..RB......
.L...K...m..=..?....W....I....90L.E..<.~..*....Nd.e............ .M@
[email protected].^0M.HTTP/1.1 200 OK..Expires: Sun, 18 May 2014 21:11:59
 GMT..Date: Sun, 11 May 2014 21:11:59 GMT..Server: Tengine..Content-Ty
pe: application/x-javascript..Content-Length: 5517..Last-Modified: Fri
, 14 Mar 2014 09:33:12 GMT..ETag: "5322ccd8-158d"..Content-Encoding: g
zip..Cache-Control: max-age=604800..Age: 1..X-Via: 1.1 zjjx155:8104 (C
dn Cache Server V2.0), 1.1 jydx41:2 (Cdn Cache Server V2.0)..Connectio
n: keep-alive........"S..global.js..;....u........A.<I'.....r..
<<< skipped >>>

GET /script/page/xiu/v3/chat_v.7.js?20140419 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 18 May 2014 23:38:37 GMT
Date: Sat, 17 May 2014 23:38:37 GMT
Server: Tengine
Content-Type: text/css
Content-Length: 3258
Last-Modified: Thu, 08 May 2014 07:40:03 GMT
ETag: "536b34d3-cba"
Content-Encoding: gzip
Cache-Control: max-age=86400
Age: 1
X-Via: 1.1 zjjx165:8107 (Cdn Cache Server V2.0), 1.1 jydx38:2 (Cdn Cache Server V2.0)
Connection: keep-alive
.....4kS..common_v.1.css........W.,......%.2..\...........DY..E.I..../
.c.....i....D].=9.K.`."....p.i}.n..X.|.,k....P.S....$.._H.D.yM.....d..
_NU..,'...W..3.3..(..)C,C.E..R...JW(.P...$(b1A. .(.$. R...H.#.....cpI0
*P......j....1JK.......5.2.pE.]LjL..0."\...`x*.A..D).1...U.#.O(.gT....
..<.<.v..c............5....)..E8?....?k.h............W...-e..!.V
..NjdwKX^..S\.....8eG.2.8C?{.&.y.x..p^. R.....Py`[......p..l.3z..#....
[email protected].*p$.\.7aW...S...7.A....`iR.#..2.K.....c.....9.9...
..{L2yVL"[email protected]..../IU!.....\.$G....p*....(....B.i.x.u..?e..V-....
..9#I}..JO....p...........{.....L.\;......{u.Qu*..k....B*q.......$.!..
........;.T.".[...9rP.....8|.......a46."...C....`~d...E.jN..|KX.p.Uz..
;[email protected]..*.B88S`..... eg!:............B..C./..6r.......`......!/"
v\.U-......,az)B.>c..(...Y..%)..5ZNJ... ..#......r..-9J6(..61..mq.}
mNZ;....E..B.:....h-..m...53s....>.3..........k<[email protected]...
5.0.}..6.j.{.._..X...'p./w.4..Z0\..&0.~.A..?S...K...0.......?.2.9F.$..
p..........F.l2..j%......n..BV.[..;....b.G...mLm.P..*r.....x\7..v=*M.6
NR)0.FHQ.1.w.O..k.l..x<.=HTTP/1.1 200 OK..Expires: Sun, 18 May 2014
 23:38:37 GMT..Date: Sat, 17 May 2014 23:38:37 GMT..Server: Tengine..C
ontent-Type: text/css..Content-Length: 3258..Last-Modified: Thu, 08 Ma
y 2014 07:40:03 GMT..ETag: "536b34d3-cba"..Content-Encoding: gzip..Cac
he-Control: max-age=86400..Age: 1..X-Via: 1.1 zjjx165:8107 (Cdn Cache 
Server V2.0), 1.1 jydx38:2 (Cdn Cache Server V2.0)..Connection: keep-a
live.......4kS..common_v.1.css........W.,......%.2..\...........DY
<<< skipped >>>

GET /style/xiu/v1/img/activity/newie/n5_ledbean.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 15 Jul 2014 22:12:52 GMT
Date: Wed, 16 Apr 2014 22:12:52 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 3473
Last-Modified: Mon, 17 Mar 2014 05:56:18 GMT
ETag: "53268e82-d91"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx160:88 (Cdn Cache Server V2.0), 1.1 jydx42:8 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR...1...(.....WE.O....tEXtSoftware.Adobe ImageReadyq.e&
lt;...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC (Windows)" xmpMM:InstanceID="xmp.iid:4A0F41B45D6011E3BD96E6FA8
765522F" xmpMM:DocumentID="xmp.did:4A0F41B55D6011E3BD96E6FA8765522F"&g
t; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4A0F41B25D6011E3BD9
6E6FA8765522F" stRef:documentID="xmp.did:4A0F41B35D6011E3BD96E6FA87655
22F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>1.<.....IDATx..YilT.....}.3..x....R(KCV..
.B.R...h....D#.6R..V...K.Z!.....DiR.B..VBP.P.).......;...{.7.L..3w.f..
...W:3...........Qz{{..>....".H.g..e.-.fm.....$..X...I.'..(.\. . 3_
j...t.@0./......./."..L.u...N.Z=......^....oM2Jr...$. ..%..Z.F}.9716..
....@.].P[k....\o...,.....k.$[H.......!...eGW...!...N......._ y'.e.3.N
......06x...C..&...`0.auV.........h9.....I..z'....y......81......C:...
i.<.yfZ../>......yc.. N.0Pt...7^..%!.}9.jg.fs.......C#.p..(..k..
~.I...`:.&..y ~....V.@..`......f....V|..n.9..5...8....\;.a... .Y{...}Z
[email protected].... mx.....O/).......L#..7.....z n}.7...........<l.V..
<<< skipped >>>

GET /style/xiu/v1/img/topic/Satyr_Game/Satyr_Game_icon.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 15 Jul 2014 22:12:52 GMT
Date: Wed, 16 Apr 2014 22:12:52 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 3473
Last-Modified: Mon, 17 Mar 2014 05:56:18 GMT
ETag: "53268e82-d91"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx160:88 (Cdn Cache Server V2.0), 1.1 jydx42:8 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR...1...(.....WE.O....tEXtSoftware.Adobe ImageReadyq.e&
lt;...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC (Windows)" xmpMM:InstanceID="xmp.iid:4A0F41B45D6011E3BD96E6FA8
765522F" xmpMM:DocumentID="xmp.did:4A0F41B55D6011E3BD96E6FA8765522F"&g
t; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4A0F41B25D6011E3BD9
6E6FA8765522F" stRef:documentID="xmp.did:4A0F41B35D6011E3BD96E6FA87655
22F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>1.<.....IDATx..YilT.....}.3..x....R(KCV..
.B.R...h....D#.6R..V...K.Z!.....DiR.B..VBP.P.).......;...{.7.L..3w.f..
...W:3...........Qz{{..>....".H.g..e.-.fm.....$..X...I.'..(.\. . 3_
j...HTTP/1.1 200 OK..Expires: Tue, 15 Jul 2014 22:12:52 GMT..Date: Wed
, 16 Apr 2014 22:12:52 GMT..Server: Tengine..Content-Type: image/png..
Content-Length: 3473..Last-Modified: Mon, 17 Mar 2014 05:56:18 GMT..ET
ag: "53268e82-d91"..Cache-Control: max-age=7776000..Accept-Ranges: byt
es..Age: 1..X-Via: 1.1 zjjx160:88 (Cdn Cache Server V2.0), 1.1 jydx42:
8 (Cdn Cache Server V2.0)..Connection: keep-alive...PNG........IHD
<<< skipped >>>

GET /style/xiu/v1/img/rev/sub/ph_flower.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Wed, 13 Aug 2014 21:12:05 GMT
Date: Thu, 15 May 2014 21:12:05 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 51708
Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT
ETag: "53268e81-c9fc"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx159:80 (Cdn Cache Server V2.0), 1.1 jydx41:9 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.......Z.....(..C....tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:ECFB7F47E919E3119C4DE8FE60143149" xmpMM:DocumentID="xmp.did:F59E
C33A19FE11E397A19C318A8F63D7" xmpMM:InstanceID="xmp.iid:F59EC33919FE11
E397A19C318A8F63D7" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EFFB7F47E919E3119C4D
E8FE60143149" stRef:documentID="xmp.did:ECFB7F47E919E3119C4DE8FE601431
49"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>L.r....,IDATx.....\Wy..;.....j...eim..6.....8
......&....H! ^x...K.......P.."S...ll.6...d.*......3...>...$...*|l.
....;..9...|.s...0DS....4.)MiJS~s.7..)MiJS....4.7K..j.o..v\...'.KY.[..
..#T..9......*....P...j..|..K...G.......?<.;....?{...m5.G.'...f.:P.
=...........?z.k...~.M...,6....,..L.Fe.......p.?..v......>Ct.g-1...
.....z.\......CJ!..._....g...|.Ac..s...'......c...:qw..)...o...."t.`=-
.;oD...Tr.=/D{fg....U..I...cmi.G....}.....y....5I..KEi<g...$ac.Wz..
Dc..77W....&.>.............A..Oi..m......C.w..qzz._.j....A:x..U
<<< skipped >>>

GET /admin/images/no_userhead_s.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: s1.56img.com



.[..x.j.......*...S...}....$q...O........a.R.x.... 2.C02...?.5i..Q....
...,!t.i.8..........Dfb....Hs...i7.^..A.;..f@.`J.b.otr.-......3....,..
..3g..../.-.y.TeLa.....Cx...4iH.qM..Yf....uL..f3...gJ.d...p...d....,r~
n.FU..O.D...`........Y........BW.......VL.e.......:....=\qi.Y.:....\..
IcPw.....~\I...t;<........:1.]T.e.S.dF,.[.7B.F....Utn...[#.....,t..
...n...cI.e,.p9.8.g.y.Hc..A..~.y.}.O.>.....IPM....!..%FX..y.8R.E...
...K..v.w..8n..E....A.....)...._...../....tN...L.<......0Dq."&....y
......=..8-*O,g.....\....t2...3...wY......wq...$&M..e.... ..$....~b..D
r."WXp.t.{ I..........'b.bx..a.)...Z.'.(m..<..._|.{.n*.J#.y...v..C.
B..EZ..>.(...;.3sS[..._.Xw......=...l._t..V.%..S....]q..3..s...zz0.
......._. .@..{_1....?,.1%...T.6...i#....?.s.\.. :<.......2.^BQ...y
.t:...[......c...cN...Q?\.n......Ej.o...;R@.../..E.q...*.....xRW.. .3D
..M8...A...x\?..O......RO..U..%......iJ..Hh...{M..L'..E. ..{..u..7.{T.
e.$.fd.y....&jV..n...q.....4....V._. ...u...P.I.{.c..x..........|.S...
H..$`\....R.Q$.....!.1..f..#.{..{7......T....x.....Bx.....p.aZ..Xv...e
....=YG.m..hT.-~........X}j.,)..R....P..i..93.=o..6..B.R...u.>T.9/.
..x.~.... ...&.Mw_...w $K^.J.Y..W....sj<...(/.t......2zD:#...>.&
}...'...;z........4j...n&.H".w.Auk.e....R...K.:Kh.*%F..N....E,./&%UMR.
D......UX.S....g...?...)..J.w#....Ri.....QE.`...W..6..^.E}......O...j.
mV.X.c|..pV]....#.D\.w......gxs.{L.r=*.H*.../.........RI...P..U.G.wk.6
'.P.Wqz....9....P....v.[. ..ut.6........}V:MJl. .n/s.,....4....o`...CN
:...A{...}./\z.E....t=.g.......'...[.R%.Y.....V%G.rc..O.$.t}d,....
<<< skipped >>>

GET /style/xiu/special/v1/img/topic/520days_2014/520_Entrance.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive



.GXO.$`$BX...j..........F:.y.........B...|.....N....:...?.w.....^=..7.
...4.v/...p.&..p..4..N...Q........xB}.._.G......W..5.\.2J9..asED..R.r.
N...3.................g'.;.A..(......5.....rY..?...=.........2...L..L.
3N_3....~ .S..A.;_=...3P.....4..S.[........_.. .~.........G..n..'.`Boz
../...V.w)E.$'!...2~.X'.XC.SM.....i3..T3..&Zd.Y.."]D&.O....:......98..
...[.._5...J5.....2.6.`.zX...$./.nA..5..... w...w..9n...$./a./_.ZNk8.A
V.......0'.0....J...O.w.{W...<...\.......$.y...AJ..`..Bl..b..e!1...
.h.t~..S.S.a..[b.....2J.....~...._..{...y...>K.y...9......T........
.H....o..N.o...=.v.;E.U...@....<...\.....w]...P9....&."...........;
RDt...4...F.....CW.....w?t....W...K..r....M`.."[email protected].&5...o.i6 K.MrO
...4!.............G<9.E./Y..koz.M_|.MBl>i...g..*].y..W..H.[]s#./
.......}..'7.u..c[v.X>..x....Z.=oIO.mfQ..Y..t..f....../..........&l
t;>|p..]G..9vbgMo8.,.TD..,........Z.U.89.<.....{.^...g....kV...)
....D.p1....E.I...E..wY.....)....~...T....[..a.(..Le..]|..o.v.....m.".
..3..!.......L..0...H..j|t.x.c...}.?.zx..3..t.?w. 7..=w...R.b].?s...2b
..&...x.r.y.......;~t....?..{....|`rh.O_..[ ..`.".=;.....vh||,......o.
y...eo_.d.j.&.y........A..Xm.9NR...Q..6.3kS.."X..w..........2..(.e....
....n.1..mb...._.........=p...A.y....f.BVi.UM..<z..r..;.'..;.}...WO
..h....ra.=..JUW0.6.B....V..Q.c5f..B?..y.V.=g...N....cO?...w.......x..
.hl......D....yv...X=.uK......1..~......D{.Y..M...T.u.....W"..h..k2...
. ](.3..#7.\q.....}..f7_?....G.U..5...W..-o.....b.......".Y...4.4...N.
........7..._|.Xx..`....].y......n&...%...v...w..L.]z.x...........
<<< skipped >>>

GET /style/xiu/v1/img/topic/Satyr_Game/timer_bg.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Mon, 14 Jul 2014 09:16:55 GMT
Date: Tue, 15 Apr 2014 09:16:55 GMT
Server: Tengine
Content-Type: image/gif
Content-Length: 241
Last-Modified: Mon, 14 Apr 2014 08:56:03 GMT
ETag: "534ba2a3-f1"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl36:8104 (Cdn Cache Server V2.0), 1.1 jydx39:9 (Cdn Cache Server V2.0)
Connection: keep-alive
[email protected]&.............!.......,....r......H..>..I..8
....`.r.h..G.i.Zk,.tM.x..|.....` .m..r.l:...t.....A...z..........x.*..
p...v...9}l...z{Y}..R..W...M..F.....H..r.b.....3..~..1..w..7....Z.....
.h....f.............T.D.dB.......;....


GET /style/xiu/v1/img/pic/xiu_big_avatar.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s1.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Mon, 14 Jul 2014 09:16:55 GMT
Date: Tue, 15 Apr 2014 09:16:55 GMT
Server: Tengine
Content-Type: image/gif
Content-Length: 241
Last-Modified: Mon, 14 Apr 2014 08:56:03 GMT
ETag: "534ba2a3-f1"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl36:8104 (Cdn Cache Server V2.0), 1.1 jydx39:9 (Cdn Cache Server V2.0)
Connection: keep-alive
[email protected]&.............!.......,....r......H..>..I..8
....`.r.h..G.i.Zk,.tM.x..|.....` .m..r.l:...t.....A...z..........x.*..
p...v...9}l...z{Y}..R..W...M..F.....H..r.b.....3..~..1..w..7....Z.....
.h....f.............T.D.dB.......;HTTP/1.1 200 OK..Expires: Mon, 14 Ju
l 2014 08:09:28 GMT..Date: Tue, 15 Apr 2014 08:09:28 GMT..Server: Teng
ine..Content-Type: image/jpeg..Content-Length: 5737..Last-Modified: Mo
n, 17 Mar 2014 05:56:12 GMT..ETag: "53268e7c-1669"..Cache-Control: max
-age=7776000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 tzwl41:8105 (Cd
n Cache Server V2.0), 1.1 jydx39:6 (Cdn Cache Server V2.0)..Connection
: keep-alive........Exif..II*.................Ducky.......=..... http:
//ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzN
Tczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XM
P Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> <rdf:RD
F xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:
Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmln
s:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe
.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.
1 Windows" xmpMM:InstanceID="xmp.iid:33DE06DA440A11E294F1EB606DDF17E1"
 xmpMM:DocumentID="xmp.did:33DE06DB440A11E294F1EB606DDF17E1"> <x
mpMM:DerivedFrom stRef:instanceID="xmp.iid:33DE06D8440A11E294F1EB606DD
F17E1" stRef:documentID="xmp.did:33DE06D9440A11E294F1EB606DDF17E1"/>
; </rdf:Description> </rdf:RDF> </x:xmpmeta> <
<<< skipped >>>


GET /AShow.aspx?AID=9756 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShow=2024|1993|1899


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShow=2024|1993|1899|1805; expires=Sun, 18-May-2014 11:07:16 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:16 GMT
Content-Length: 2543
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:m.u.....]=.{ww..x.........w.
-..........>.._.......^....~0^\....]..{.i..{..'O.b.v.5.w......v.v..
.......?....v..........{..}z.......;O..<.to..{.'.............O..={.
l......<.?y...../..0......w.;..].?.O..K~./[....E....~.{.M=....V.byq
..=3.....<....f.t..7.e5...Zj.l..o..ql...'.u......i...%..`.../<..
..p..........s......'{O.N.}....`..........."...{.>}..1.. .7;.......
./.a.(>.$_N.Y.....j...4.-o.wtT.............*f......4..</...g{;;.
w}........WW..b<o...t..'...........|J_.>.1..E...&...&.Ut...j....
........x....8i.I[.>...`...V{.........g.z..K4...g......X...._...evY
\dmU....E~..&e>.....89.:_/....;......^|.}....u...>s..M^._.X.e;/.
..|....(.~...ei.xVVY....~.....7.[,.U.....b....#..W......lqA...........
..O..A..9/..3..< ....*.K.z......./^.....y.n.....O....y....../../.J.
.O....g.....).V..........mS.....Fa........s.......}V. W.~...l.~.~.....
.>....^.9)...h.g..."O@.,..B........[4m.........:.... LW..U..mVY...]
?..I6}........ .O..c..... .p]..}t^.m^?"{rQ..=.....E.....9.....X.....q.
.g...*....Y.6R]..*.wK.l.Z^....d....y5....w.?J..GC.6.l..A.Q.(eEJ*j....I
..~.T5.....#.;%f|...2x......1........|...3R.....~.._z...8}zv........WU
S...1........w.......<|....1z.....'.........Sn0...Z<.9.......c..
%....M..\.y.s..m.8............u.T..y.$J.9z.K.t..E..R@2|&.v..3.dM.=..G{
.......=.....hVev.hI....Z.C..G?.]f...V.#;..n..m.9..v]/E*?:.N....O.....
.y...].....rA].......]Z.n!1.O ..Y{/..........ysT ...,.=..9ir.|...&
<<< skipped >>>


GET /site/images/flight/home/img_qnkhd.png HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Date: Sat, 17 May 2014 19:22:38 GMT
Content-Type: image/png
Content-Length: 8490
Last-Modified: Tue, 11 Mar 2014 13:52:41 GMT
Expires: Sun, 22 Jun 2014 19:22:38 GMT
Accept-Ranges: bytes
Age: 45914
X-Cache: HIT from qunar_cdn_02
.PNG........IHDR...z...z.....G.......tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE***........................................................
......................................................................
SSS............===......888))){{{....q..........MMM..................x
xx...DDD.o.000...___mmmJJJ...............---...............&%%GGGjjjLL
Laaa...ggg...POO............}}}.......{.:::666.l........v.UUUAAACCC222
......(((uuu...\\\.x.......WWW...ddd...QQQ...$$$...###444...rrr...""".
.....ppp..................'''.........FFF......vvvYYY.Pn....PX........
.......!!!............z............s....#...i........-8...7..k...4>
....",.............z..ENb........Y...d.;..S..}........1|.<..u..K...
.........Sf...B75n...BL............e..o..0'%...%..sSP...&fp.OZh][!PU..
....1$ 3(&R@<......V........'S^... =ES........7....................
..IDATx.|[w\[email protected]>.i.`...8g....~......6....s.w/.
.........a|e.p.5..tuu..QM.U!...8-,..F...;P|...,.kT.F[h.*....^s...dr...
C..Wpx..m$.;\R20{../,H.s....&a.:'B....$.....ll.`{......B#....j..c.$.s.
a4.TB...8z.... .B:A.0&A...@..?$...F.{..0.a..B....Y..n..:.Y.......##...
..?lAn_.7#..4.y....oY...........7...-.<5.O..~z_.02.o.!..&"#........
..I.....Q.E...6.(.2.....[.6B....n1a.R.2..^...a..>k.j5Z.u..^.......F
...........}....Gfl..Q4} ..L/!0<.#..."t$...z.999..h...E....C.K.4H..
&...5......$V7.BIu...[.)KM.$.>%c..# o...j..C....^..#E.ho~..C;.A"E.(
R'....1.z..K1.fd.nA....zD.J.^.......... Ni.:.c.Y[..w.......)D..M).CB.B
....V. v.....i.-.p.......>....A....Z..K(.O..*3...T.......N...z.
<<< skipped >>>

GET /site/images/new_main/tb.bg.gif HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094


HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 268
Accept-Ranges: bytes
Date: Sun, 18 May 2014 02:17:45 GMT
Last-Modified: Thu, 11 Nov 2010 08:54:59 GMT
Expires: Mon, 23 Jun 2014 02:17:45 GMT
Age: 21007
X-Cache: HIT from qunar_cdn_02
GIF89a2......................................................!.......,
....2........I..8W...`(.di....l..p.>tm.x.......p......r.;8...tJ.Z..
lU..z...x.e....z.n...x.A.....~....{...................................
............................................................;..
..


GET /site/images/airlines/SC.gif HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 05:52:33 GMT
Content-Type: image/gif
Content-Length: 1232
Last-Modified: Wed, 01 Jan 2014 14:03:10 GMT
Expires: Mon, 23 Jun 2014 05:52:33 GMT
Accept-Ranges: bytes
Age: 8121
X-Cache: HIT from qunar_cdn_02
GIF89a................................................................
......................................................................
......................................................................
......................................................................
......................................................||.}}.xx.yy.{w.u
u.vv..j.ll.sj.olvllzll.ii.pjwikwkkw{d.ff.ta.ee.dd~l^.xY.ccdb`.[^.^^.c\
.X].WY.ZZ_XX}XXpWV.TU.WVrUUwTTx\Q}QRx^G.bHv_EpKKoII.OH[VAfGDlEF`BDoJCc
DDeSAOAAo@@jO:a>>t==g><`==e>=G::d<>@9;[F4O35`81U3
3Y//`..[--S  b,*Q''S&&Q%%N"#F..[..I..T..J..G..Y..M..F..E.. ..?..6..O..
B..?..>..8..$..*..<..9..G..0..?..B..4..3..2..1..0../.....-..*..)
..(..'..&..%..$..#.."..!..............................................
......................................!.......,...............8...)Q..
 ....&.z]..-..........4i}..\.&c.*..Q.......!\.u##.r.s.. [email protected]... .cY.iH
...3.O,..5,.3..,nI.A &C..a1.zp....'[email protected]`.6....0pA.
`..N..A ...Y..X...$..3.!P....z..2N.....Y.('.@U>.:.vl.......2I . .7]
C...bp..JQ$.......2...brx.*.$........r.,sVmE..!#.........I.Zp.....H...
u0.....2..6<.........h!......@[email protected],......a.(.... ..s....
..9..........h.aF.DfA....CK.....8Pv#..Sv.B..$QJ3....)[email protected].$c..CT
.Q@.;....


GET /site/images/airlines/CA.gif HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 1206
Accept-Ranges: bytes
Date: Sun, 18 May 2014 05:52:33 GMT
Last-Modified: Wed, 01 Jan 2014 13:56:04 GMT
Expires: Mon, 23 Jun 2014 05:52:33 GMT
Age: 8121
X-Cache: HIT from qunar_cdn_02
GIF89a................................................................
......................................................................
..................................x....................r.....|........
x........d.}t.x..v..xA.tQ.q{[email protected]<.iZ.ff.jD.l7.fO.dL.`s.dZ.cB.b=
.\r.e3.Zm.[[.Zd.\A.Vd.Tl.TU.SZ.X).U0.IW.M .JI.HA.EQ.EX.EB.I!.=:.;B.6#.
[email protected](.2..)@.*:....)".%6.)..$2.%0.&..$-.!...3. .. ...!..(........
...&..................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..............!.......,...............H............)...T....2q......D.
[email protected]`|..dRIBUp.......F$IJ......B..RB....@. .(R$G.l.(.......HR.A.
#I..<.AA...E... .$...$%...A.H~L.|..../.....F.....`Z...$..B0.2..A...
.P......*.Pa.R$Ir0......A....tI..K7...D...IV"......G..."`.po.....0|...
..,......T...`..S...*x.C..P.T*[email protected]'A.'......\.... ....%.D..4..
&5.P...|..`[email protected]....=..B....Q..\p..Z....tX!.J...E.l8a.
.aLa.J.!.....p..S%...;....


GET /site/images/wns/20140430_728x90_4245_dfs_new.jpg HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 26269
Accept-Ranges: bytes
Date: Sun, 18 May 2014 01:14:12 GMT
Last-Modified: Wed, 30 Apr 2014 07:29:46 GMT
Expires: Mon, 23 Jun 2014 01:14:12 GMT
Age: 24823
X-Cache: HIT from qunar_cdn_02
......JFIF.....H.H.....C..............................................
......................C...............................................
........................Z...."........................................
....................}........!1A..Qa."q.2....#B...R..$3br........%&'()
*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................
......................................................................
..........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.
....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................
.............................................................?.....(..
..~>|......d.-....xI..;.._...m&..V.Y./..w..BUOj...................j
.....;..G..O....(... .o.g...~k..]........P.....~....[e..x....b...E..g.
..A|d.k....}...>?.{.....@........:....|.....-B..._..O......_..c....
Y....u.Iu]A..v.....|..P3...(...(...(...(...(...(............z.........
....._.A.n..I!T.K..K<V.&T..y.D.\.]....Q9....K...*...t..'.J..%.=^...
&......q....^..].-,..==.<..PAb. g...........-...........Nx..w......
..X..{....R.H.>.4...H.3...%..N......8......>..*.h.W....../7.ug.U
..W._. ...3.~...i.|Z].-k\x<...e.rX.XH...}>.........%.k...9..O. .
..K..I.T.. c.;o.|4.....e.S...l..9.-....wz..Ng .B..0.%..yfi..)...).^RZj
.z =m.V...%.....e.b.g.n..nMY&...m......C..........XD.W.m_.O.%......W.7
..;.ZG...q-.vN.Bc..-.H.?<m3...k...e..(..g}.n.....7./t..!i:%..p....R
j6.F.nh......c..Y$..L.1.dX..s..n....&..ii.....g...s.Vg..J*...J-.e..{;]
.4.F~.._.?........&.. ....Y..C.u...Z.m....i..M....e6jT*.o.@.,...v.
<<< skipped >>>

GET /site/images/wns/20140509_zx_728x90_4485_banner.gif HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: source.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 10521
Accept-Ranges: bytes
Date: Sun, 18 May 2014 02:17:48 GMT
Last-Modified: Fri, 09 May 2014 09:46:34 GMT
Expires: Mon, 23 Jun 2014 02:17:48 GMT
Age: 21008
X-Cache: HIT from qunar_cdn_02
GIF89a..Z........eR..^...D..p..J...c......(.........H..........t...TTT
........5....?a.*5_...!......`.. ..'y.......k2.............<[email protected].
....'o..}wx..F.......(4....Tu...................^^a'3...:56.........!.
.XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c
011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf=
"hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description 
rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef
="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns
.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:1E112FE94DCFE31
185E0A9D58DE93487" xmpMM:DocumentID="xmp.did:20C9AA32CF5711E396CEE91AD
B3D1528" xmpMM:InstanceID="xmp.iid:20C9AA31CF5711E396CEE91ADB3D1528" x
mp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:1E112FE94DCFE31185E0A9D58DE93487" stRef:d
ocumentID="xmp.did:1E112FE94DCFE31185E0A9D58DE93487"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>..................................................................
................................................................~}|{zy
xwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9
876543210/.-, *)('&%$#"! .................................!.......,...
...Z......pH,....r.l:...tJ.Z...v..z...xL.....z.n....|N.....~..........
.................P.22....................... .....66.6..5.........
<<< skipped >>>


GET /app.gif?&cna=RVj/Cy0IRhYCAbhrJiY9QmtQ HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: pcookie.cnzz.com


HTTP/1.1 200 OK
Server: Tengine
Date: Sun, 18 May 2014 08:07:34 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=RVj/Cy0IRhYCAbhrJiY9QmtQ; expires=Wed, 15-May-24 08:07:34 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..



GET /flashApp/vshow_player_woxiu.14.04.24.a.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.56.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 25 May 2014 03:21:23 GMT
Date: Fri, 25 Apr 2014 03:21:23 GMT
Server: Tengine
Content-Type: application/x-shockwave-flash
Content-Length: 88836
Last-Modified: Thu, 24 Apr 2014 10:28:52 GMT
ETag: "5358e764-15b04"
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx161:8106 (Cdn Cache Server V2.0), 1.1 gxnndx29:7 (Cdn Cache Server V2.0)
Connection: keep-alive
CWS.....x...wTT..-...$*.D....$*Y....%..H...(fD. ....M.%.......((...D.Y
.U..i..}........\......v.....sU..D....M.A.q...:.A"V..#....15.=....n.&g
t;j.Js.q_..j22.........N2r...2..2..R..). ..#.R.>.6.X.....c..|....c=
.>r...Ws.FJ...'.v..#}.........L...2r..2..p......_OoSOO.......nG|...
=..........x..7....M..Q...!/ ' %''%.j*........UVEMV..-.Nr....G....Yj.(
%.(%.h*..&....H.x............/..^C...._...._s...v....^..........T.3...
.1Oo.#.;..8..l..v(.(.s...5.....1h^.........l...~...e....5q<....c.t.
[email protected]]==.}.
. .....i...F.....7..K...vvr....zUQ.UV../.`.../''..l......#....d.......
.X........=..U8q....ZJs.....0..9..3...&...K.9.{B.....J......Xo:...'.]=
Y]m.9.....'B...........].e;.g............b..*..8..V.....r....M.?1.....
..NC.=....?./.?.V....b'..p.s............X.',&..GJVT@.[TV^^.LCGM^JLTLFI
.^h(.(k`......j..-.<..l.... .v...YyeM5%eYAa.-.....:.*J..2.j..B]Y^Y.
..vR.p1!..>Z.F...G..[|...1...Q/..3.h.h.w2...x....1....p!......Vo.6&
gt;r.K^[email protected]!8Z.:Z&.....\.........N.z.......q5...*Z.
K.d'..../.<@[.....).;.HV..[.X;F_=?......1....x7..m..m.'...W{.p.Ki..
.W.w...0.....{.....3........P..o.O.z...Y....=......=..0h.lk..!.VpT.~.Z
n..X.v....QW.........^.Q..n..e,.p...=...u^(\....)....41.a...A6....._..
..J......... .....m........F....P.[..v.1.|x.L.^[^G.;c...*E....V..00...
.M...|y..332......|&\....<t..vBY....l...,Sf.....8._..u..l...I......
...r7..q.....>..p..s...M.N..gDYN...G..k4.7.\L....{.....K.D@@%...." 
..u7.........W$...~.Z\.wU..........;...]}6.o.f.W...; .(...j...}..[
<<< skipped >>>

GET /flashApp/vshow/gift_shape/gift.13.10.18.a.swf HTTP/1.1


Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.56.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Wed, 11 Jun 2014 19:49:35 GMT
Date: Mon, 12 May 2014 19:49:35 GMT
Server: Tengine
Content-Type: application/x-shockwave-flash
Content-Length: 23257
Last-Modified: Fri, 18 Oct 2013 02:56:08 GMT
ETag: "5260a348-5ad9"
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx164:8107 (Cdn Cache Server V2.0), 1.1 gxnndx32:7 (Cdn Cache Server V2.0)
Connection: keep-alive
CWS.{...x....tT..?~.v..sg&.L..A0<3.8..=..-,......,3..........es....
5.;.(....N&..W.\.......;K"...?.w.....C............7.....4....L...O....
z.i..M..........5.KQ:fHMs.........Xx....y%..:.....KF..........E.....9V
2...G.j.7.66.Q9.nli>f...ku$.t~KS.dY.)..E......Q#F.Qu.4..T.j>64.~
]m$D.J....4FN[.Z......k....R.......c..........C..d.KjEB...A...f.Z..4..
[email protected]]m.&.tlK.i...U..,.D.......).........E..0]...R.Ps..`
..h.....#G... ..%=.mc0..j..{...8....d...;....WM.s....1...].B.....So.4.
.XS.>:J.j#4Sc..K......._...A.[...C.;N.x..G......>.yo....:6&.u.w.
...i...q?..yrZx.q............a..'{...;D....~...`..#..|...).)..x.8~.zj{
m.............q...X.X[.#MgDum|~]hq.x...O.F..5..k..M.E.]@FiL..C..f..G..
FU.c...k....T.0/..W.Y|q.9Z............X..58.....M.......c..B.E.....Z.7
4..)......g..h.ajm.........<......5...9*h.s..].n.5U........3.1T.m..
j..5..hj..mj^<.!.......xtbm.yn}.5.qAmt\].|.4....[.K23$.CJm..j..q."H
..F5.....D#.Q]neec.8*.Q..m..k....y. .....u......&)<..PS..Up))( YI..
.[....8>%E.4.<.../.)Z.. :..N....R.*...slH.7.J......vW..%....R3g%
.BS....a.Q...0...q.M...Y[?OJ=...>4.|.9.&....L.Iyt..:.M.vQQNM...I..$
.....5...#..QM..<.h..T..<Up.%e.f."...'...."r.B......f..q>TC..
.V.....(.9...f.......~.Es...#.v!...%.....D..\.4..3......oM.....G.I..hH
.Dc...sh..z......&#.].|K......\.....X0.v.5.&4?.5.T.9..k.Sb.6TG......*.
.55.*')..2v().y...R.Lh....|D..#D.i^<gN<...5_...e....Q.].v..!51=.
.9......=R..P\-........./)......H:..f.eY3.......B..[..R.wL[L..zKU.YV.y
..ahH....6..Zq2..........Gq...y1.*...R.p.uQ7I..5.[f..rZA...J,-...y
<<< skipped >>>


GET /live/2014/05/14/23/1003v1400080135920524999.jpg HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi0.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Wed, 14 May 2014 15:08:57 GMT
Content-Type: image/jpeg
Content-Length: 8469
Expires: Sat, 09 May 2015 15:08:57 GMT
Cache-Control: max-age=31104000
ETag: "2465111181"
Last-Modified: Wed, 14 May 2014 15:08:56 GMT
Powered-By-ChinaCache: HIT from 01057413L3
Age: 320328
Powered-By-ChinaCache: HIT from 060311H3SN
......JFIF..............Exif..MM.*.............................J......
.....R.(...........i.........Z........................................
.........................C............................................
........................C.............................................
......................................................................
...=..........................!..1AQa.."2q..B.#Rr.....$3b...4.........
.........................4.......................!..1.AQ"a.2q.#....$3B
..................?..........K.'SA......H.<....c..8z.'./.65....^...
.IFJ.H[!..J9.)J.......t....`a............P.mJ*....5...d.B....\....UKYS
..Y%Ao1...]M..9E.(%....D..:..?..)...1G......4.....0.=.lt6.*n\~....6.~.
.3H.)JN."...`d.....C!W)H.k......b.8..&]K.d..Rv.{....z.A. .q.5^0....%jW
.F.rH...3Q$s ...k'Ty-...uo......^...y......@R..[.E.\.f.Aj...Y...X...=F
...W ...,5.Z%6.W^.."L).D.%.:X.^L....k*>7..........Mvb*r..R.....i..Q
...\....;>e&. ).....c...:.*.'J...r..E.....<.>.}....*.."K.H}.3
.(.J..T.I.2`.4$.5P.....Z.....ZN.)P7.lj....,.2.W....Sx.U..V..s#C.....7&
......i6=..V....P..v54^]../. q.0.v..c..........W.xN:..!7..!Q%.dV.x....
....-E..{j.KH....`[email protected]}.2....3D.^R.R..7..w..*...7*....#.. ..S..-I
...R......z..!.;.;.......T(.5n.H..2..X..3cX.h....2..kX.ab..x.Ua.d\..lW
e.)...ma.|9.... .Q[YG....m..5..BZ...a.. k.]T{....S...;.x6m..Y...&Pb.'Q
..*.S.%.J..ms....7h....,....pd..BX#.....^6e......_.J.{D?...f.q.zHZ4.,7
.$..C......)`.k.$.....;...$.znFu...........zv.0.,%.X4.k.......).u.,...
....G..s..q.....j.i.ui...z......v.[....r.vJ;.:...1...[........'?;.
<<< skipped >>>


GET /AClick.aspx?AID=1805&WebID=14516&DomainID=7292&APID=9756&Auth=090A76F47330861927C2B8CF643C84CCC3139F861463EF3F6D6AD6A145C310A3&Url=&referer=http://VVV.cfmogu.com/ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShow=1805|1796|1995


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShow=1805|1796|1995; expires=Sun, 18-May-2014 11:07:29 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:29 GMT
Content-Length: 372
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"~..q3..U.........]{....L>...
7N~..|...E.L/..'.y}..........".Z.?w~.o..x..:..f]..giYM3.7n............
U.*.8}....{..........~...'.G.m}...O>.......;w..nq.e.~...e....hG.2_^
...q.k..S...^..}d`...._......a..'..o.........H?j ..# U..[..w..z..^..Yu
5.#[email protected].....



GET /flight/prd/styles/home-2014051615190002.css HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:39 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Mon, 23 Jun 2014 08:07:39 GMT
Cache-Control: max-age=3110400
Last-Modified: Tue, 03 May 2011 06:22:57 GMT
Content-Encoding: gzip
Server: QWS/1.0
ef9.............}........H0.j.,...`..e7....y.1.a.H2..lq..T.T...o..._.{
..y#...[z...j...q..KD..\.z.m....O.......n......|^...>]...........Eo
y.[^.v..j;....-..n...^:..{.|..<.{i.....7 .{.....Y...U/[lz..W..{....
0.z.{..!].z.u.Z..........}.p....^Y.>....w...y.).}/#pe/.z.U........W
........U:..W.}..ze:[....,..^.....m. .yJ...C..z..,.44=...<.|J..z...
..>.3...H....<."......o..u.9.6....X..eo..=..DX`p8.....W.Da......
b..D.n....b3........>..{.M...M.?._..h8...sRl...(.>..>]..Uq...
.C.*6..s.*[._....B....8.V........|.<.e^./.....yB_....q.O6[.........
..d...r'c.t..~._>..Os"......;.(.0...d..v.Jw.|b...}......y...}.5\..w
..Z..%.ID..E6.....t..Z.F&.....hp...r.&%..)Ix.9......,....l....bA.Xm...
...w..|..(...5.e.\.MI0.bl....g..~..r<..!......D.C.0.x.)Q.....n.....
..v.Bh.S.d.%A....a...|..._yJ...dF..S!....b.}.,.,.7w.x`Q|~....!D.o.v.".
...Sq(f..(.........G..Ax!)..X.....*...O. .....(._..k...m...p.9.&c...C.
.....-}.4e0>..1....X=N~b..K...C....(0.H.LXn......%.b.!......H...,..
.?<. .r".U.^."H.=.........M...OL..?..<..s....SO_...>...!.o.'.
..:$.......&i....x[.Y......W....:AS..KH..r...}.....G...v......B...:...
....X.E...vL].c@)I...F.N..955..v7.........Y....{....yg-T.U..G.9.k.i...
1T...U.....tM...2.|Q.k...d..buU.....Of.(..8%"?.@.?.(..S)...Q......%.&l
t;...~...V8.....P.g...3..t.f.s..._........0sj...9.uA?YT.U.../d2>...
4#[email protected]^.W..._.P......(.L...!.....M...0.W.....".$....M.....)NH
..}...9L.d..r..&..D.....F.c#,..._.;#6..H.S.'g#...8..W..w......?.w...j}
...".n.,.. .5>.w_..Y.yrK.....<...M7.....fJgd..e5....t......$
<<< skipped >>>

GET /js/jquery/build/jquery-1.5.2.min.js HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:45 GMT
Content-Type: application/x-javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Mon, 23 Jun 2014 08:07:45 GMT
Cache-Control: max-age=3110400
Last-Modified: Tue, 03 May 2011 06:22:57 GMT
Content-Encoding: gzip
Server: QWS/1.0
eda...............~.G....}.0.-#..&.z.@A.[.......\U ..%.. @..D.`?.<.
<.|.'...!.}g>wj......8.9q.x..4.7....\.k.....r..^...L...EoN..x.Du
&..u.........WG........t<Y7........&....j:...7.Yc6...U9l.........o.
~.X,.........j..7..z.......#......`v3,W..._..........][email protected].\0
........Y.{0......E.7....q..a....u.j...4..-...4N..z....OlE......S...4G
7...j..~~....i...-...r...NW?M...[.;.V.p.....]..v........nf..O...M....,
.k.Ek...ju.V...^..n.<.{....a3{.....gY~......W.f._..ey1h....U3.NW...
E...ey.xS6.S..0.l....fc..|......2;....{?.{L.T.yk..........&...m..zk.g.
..=/(Zi...,T^.95..Aw=........w3....D...]X.y...;..E.S....E9X7.o...b....
...7_.z.C...;#aS......1}.Y...$...?.'..Y....l..V.../[email protected].?......y..
.I./Y.A~.n.../..u.|...O....=.8..T.....V..U........Y9..'.Eq........*...
.>..........x...f.>..z3.H{..7..q..5./F..@a.^N.............r..3..
......<?../....`.R.<..........e.= {.H?.....l?kd....=.^.o6.n.X...
.<..n.m...t..].......n..4z.|.k..._...F.....k..............;..u..~2.
y{.qX...{..7..h...#.x.d......H..F.......p..e.Sd...1.........;.. o]7...
..pzR..Q.P........c.-.``U.yZ.......i9.....s[..Vh....:...............d.
m..B...d:Z7.B[....._M...q.....To.}U.@.....@@.L....#...y....#.{.....s.Y
q.M..SS.a....]9>7(.#........V.......x..=..v...t....}..\..4x.^...G. 
."v.v/.S...BblFi..[..\...;.=..C.{...0.?A^.M....n.:...>-.g.l........
[email protected]....,..r.|c...~.:...z...H...... `..a.&l
t;.ydc.wG.lV$A`?8.-JF:f{.#.... .&..`.o6BP|.a0.....i...hO:[email protected]
.|:}z.@..{3...5kO.(.....~.fZ..G.Q....wf.~...'B.,/xW.~...b..'~.....
<<< skipped >>>

GET /flight/prd/scripts/oneway_index_config-2014051615190002.js HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:47 GMT
Content-Type: application/x-javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Mon, 23 Jun 2014 08:07:47 GMT
Cache-Control: max-age=3110400
Last-Modified: Tue, 03 May 2011 06:22:57 GMT
Content-Encoding: gzip
Server: QWS/1.0
20a............uTQk.P.. r.... W|....K.>.!w.]r..li2..<.a.nuC.V.d.
.sb Y.v.....4../i:...C 9.;.;........e...d..f.._.e.B._\.%F*. ..\.SN..v.
....Cy9...{..H*U.H.S... ../. %.&.w....nr...~..H..........|.c..n...1..h
.E..W}.g.q...M.DG.....>.....;Q.{.F9.lu...<[..$...4.....h.....-..
..6.,.z....a...,.......lId[A......gV9=..^-..%.._....U.S.w.F.3K..u.....
.e.......U.*^\2..0.....[..>J.....^2n".Eo.b..0*X67.f`::..y..[..Ae...
. XsG.!..x.j..e....m....S......!x^..h2.MF..)..I. ......",n8.E...Y.o...
t. ~....X.}........C..nG.5..{.L.q.}<I......."...h.....0.....
.


GET /flight/prd/scripts/home_pack-2014051615190002.js HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qunarzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:47 GMT
Content-Type: application/x-javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Mon, 23 Jun 2014 08:07:47 GMT
Cache-Control: max-age=3110400
Last-Modified: Tue, 03 May 2011 06:22:57 GMT
Content-Encoding: gzip
Server: QWS/1.0
eda..............iw...?.U...S.9.)yI.p.#Qr..k.$.v(^..J....ZL../Q.o..8..
x..Y^...,..|..$_..........9q../..............|..XZZnv...K.U;.{....R...
....w..3..}....z...D............~}...GU.....o........_.Qa..o{.}zD..S/.
>...._~.{....z/|...?..p...v?{....v.yiD...c......k...B....FW...v....
.W.....Q].......Q....zW^..=.!.o.....#........p~...7..vT..{...U./..?.E.
.O..dNL.hc...... .......?|q..}.....-...>.B..?.^xgD.....s#*...M.....
s..".l...`@..[.......V.......W....o.W?.!.z/^..N.. ..5....n...q....<
{cm....8c..... .A...J. .g.....q.....A?;s...............Ul...kWz...{.=.
/[f.......i.q..X.p.Y4..4....f.........vL....../........>.td.....6C.
7.....6q2.k..................=.1.g.h...C.Z......KWv.a.L;@8@.?..f...z7.
....3.......>.......g.[..L.-RG....>.r..O...o.....~.../...w..{...
'.p..,.A....T.%%.....t....._.^x=j.......!."N.7.....C...g?..m,..<.^.
[../..>....g.Wv.......v.....^.}..N..v..g..7.s1 M.x........i*...N...
.....].b2..},{.|;Zg.....~.A.yw..I...[L.EQ....o.r...E............>..
t...7......NkCi...s. .f...|....o:uv_..l}..';...{.....B.1.h9T%..Y..[...
...G9..-z.E. .Q...=.....=...u$...Z.#..U..V....|..."Zi.[!.z...ul......u
..m.l.jC.........._%.m ...O.r..".[J.w..|.Q.V..o...`.2]....n...:......n
.>l.......R...z/~......>.......0m.......L.....|>.....){......
A......].m....5...;...5.#..P0.....-`.x.........?r.d....4..l..^...,lx..
.z.<.F..}....O.r........gv.R.v.S#......Eb#..!^a..........].....-:..
...k?.}.a..I.#.X.......5......c..=w....#.............?....o......{..Q.
>.O^.y.]..'..%.7....9nt5.C.1..J.....?}w.......WG......A......[c
<<< skipped >>>


GET /MTFlashStore.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: irs01.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:48 GMT
Content-Type: application/x-shockwave-flash
Content-Length: 1877
Last-Modified: Thu, 06 Mar 2014 08:35:02 GMT
Connection: close
Vary: Accept-Encoding
ETag: "53183336-755"
Content-Encoding: gzip
Expires: Mon, 02 Jun 2014 08:07:48 GMT
Cache-Control: max-age=1296000
....V*.S..MTFlashStore.swf..-...CWS.....x..V]o...>..t..[.e....YI...
LJ..H....ex.. [email protected]."...........n.t.2l......aEWx....%A.?......sHY.
./.:.&..y..y..J...6....0.A1<...a...0k....b)...t G...u.n..akkkbkr.0o
..l6 ..!.I.D...mi;.[...q...-.T..j.q.,..-{....n7.]Z...j.:.....-5...(P..
..L,...f..|...%M......`.".../T.f...G.q...g.t&%^I..k.l...e....9Q<b."
].UlK5....O.&...$..M..5>....5U..V....Y...}.|..n:.-SsjT......m..4...
&...lH...lj.,QBa;e.......S.M.....]]"........p....Xy5.Z.ib.....)c.?.i..
...n......<..P.Z.4-..S...L>..N..3......b..(.K.'..M......y......#
..leS...6=.5;U\.f.2..L....K....li.8}%3.=d=... 6.M\ .F..BS2-L35.8L.M...
.zB.&.[`/.....K@/.....O..#E.[..y:.............`..E......x?....@.......
....MC.y ......k.p....{....o55i..jl.......Ef..N...T..........%.....X.9
UW......*K.i.....U..[.^S...r..<..7..k..L..R[a..j....s(.uh..~.i.6.p|
...]........s.A ..M....].. HN.gx.......s...............~..._......v.~.
...?...............m"M..^.,._.I....,i.G/..;p.....t...........{......*.
[email protected].?y...&j..l.VV.T6....j6I..lB....7.....{....n.R.
.._.}.Qr.W...............1Y<....I.w?.....~..{.>iSR5i]..J../....;
.E....l....R.V ...W..ew..Q..d.e...k.}...va...bKv.B...*....q.:.....|...
_<..o..M..I.....`....U..P..c..~.}.'w.....(.z.../....0........c..@l0
...Ec...kL..".......P_x.A.A.A.1^...<......"O/.....0..A...g....q.."&
gt;."..|..K....e..........".i.. .*.Y_..."~.., &..E...S....u....7.\..q.
L..Y...H..1....<.^..t.........g..2.C. ... ...........9`8o0t......&l
t;[email protected].`@^..1R..-...!..9..`L.....x..<U..3...[.$O.,[...0
<<< skipped >>>


GET /vataplan?framId=topicLinkL&f=s&cur_page_num=0&rep=1&tag=99&vataposition=QNR_ZTc=_CN&vatacon=&rows=1&qtype=js&vataframe=bannerDefault&callback=QNR._AD.topicLinkL&ab=b&tile=14003829506057166236&city=北京 HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: a.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: text/plain;charset=UTF-8
Connection: keep-alive
Set-Cookie: sn=1400400474_1; path=/; expires=Sun, 18-May-2014 16:37:54 GMT; HttpOnly
Content-Length: 951
Server: QWS/1.0
QNR._AD.topicLinkL({.  "response_stat": {.    "elapsed": "3299",.    "
url": "notshown",.    "stat": "success".  },.  "key_data": [.    {.   
   "description": "........................ .....................",.  
    "e": "0ivzVmODiieLztpA42LwC0rhX45dETzRr9OggNZI5v12aeJH2X0RqDlkE6gg
L42S3iOwotW2W11IP71AlEsS8ZJ9AYYkhJmE/fODQRuroehRL60aAvcUBi5iS7jvCtr637
oqZ848 anI5MDsSIPkGO9DBxrQwz XhlIMOpW9gQqyHlxIxGrdzQMwonwybEkJ71ZHLEYw
WlB9bSoIXB52wYu7l//nDtxb84ycGI3qB8SPPQmvYJlLDEcJuLuxJ9RjphA5fW sZ2 9N4
ePzVSY8YRr7st8i6277iP/8tyonNwLl5DTDCmFPLxyyEX4kY4el0Ytwp778jQmy/LErOAV
S8b5AoLtePtVSeIH2dGYJ6QEtUbH8vo76Pk4V8PpDl2y8nZ5d/pdnLgCDbPQXNZZecBAoX
CCLD6BkXTuFYuYuwTRrqtzdQLc6o9sijK/awN8dDS8Ad6ILofZBVcrldNYbWFy",.     
 "img": "hXXp://img1.qunarzz.com/qs/201405/08/f1f51d8b645559506886324a
.png",.      "show": "VVV.qunar.com",.      "title": "................
.................",.      "cus": "",.      "s": 4662489,.      "margin
": false,.      "phone": "".    }.  ].}.)....


GET /vataplan?framId=ifmRightTextlink&vataposition=QNR_OA==_CN&tag=99&rows=14&cur_page_num=0&rep=1&f=s&callback=QNR._AD.ifmRightTextlink&ab=b&tile=14003829506057166236&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: a.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: text/plain;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: sn=1400400474_1; path=/; expires=Sun, 18-May-2014 16:37:54 GMT; HttpOnly
Server: QWS/1.0
Content-Encoding: gzip
a5c..............Y..f....)........./q.%^.'v.P.5../..;A.:T......3tX...T
-j.G..|..s.\..p...N....Dz........y^]._....GA2..ae.m..........^ .2.....
....7.=........N.F.$t..Wr]..R.Ue.5.....^ k....Z.>.....w.yvew..~.z.|
7...[Dy.e.q....:|.........n..pz.......yx...?.q..7.>..../.......z<
;.q.lk.R.A....05..(V..7ca.2.i......%.Dj.z^0.tN...VN)..Kx-...N.p.34[k.P
......g.;.')cE.#5.w0.6.........>....I.|!..*. >.Q.i.....".....h#]
O]@..&C.F.`5u.q<..........fb.v.^....t..{.<j.(.#..x....P.n..g.!5R
w8-f.,.qM.1...0u;.0I..5.....W....<.1 2........6\......<&y.....dU
..jT..n..\d.KO1.<.*_.7..!Q..-..2/5.i.[.>[email protected].....\Y^
..(\4R|J.5...tJ9@ h..{.`[email protected].. .@...
.Ez.O...:0..0N.8....8_~.....%....g^...q.O...Z?v.c..........~x.....<
......?.w.....;t!..0A..h.],....{]...y......Xy.._H...W.w..~...........w
.{~.....?...8}x....N.?.w...>...[....9........)..j...l.....9...a16E.
.|.......C.:?.*[email protected]......]F.7.z.
...r...:Z3.%.....$..2B...R[...a...9..$ ......t.....g.J......N....W....
..$6..9v.A.hEQY.9:J..V....jM..zQ..iX)..|...'P.p.Q...x...z*...-..V...p.
...z[Mc.R.bZ".1..86...Nd.RO.=.....HR.sn. jQH..g..`......4$.OTJ.$.mN.f.
6.h.].Z..Y&...?.'....z.$........DH........S....5......u...p...._/.<
.....7......x..g..)..P....j....>...:..O.;......._....W...x....<.
|.p......;...1O.......5M..%S{....6...jo.S.i.Xi..<.."3$...q..H.\....
x.0q..4.......[2......=>.....^....[I. u....S..M<*Yy[..]W..TF..#.
{...@[email protected].....\.-6...H....j...y$......-.W3.}<-.E..}o.
<<< skipped >>>

GET /vataplan?framId=ifmRightFlightExt&vataposition=QNR_NmE=_CN&tag=99&rows=1&cur_page_num=0&rep=1&f=s&callback=QNR._AD.ifmRightFlightExt&ab=b&tile=14003829506057166236&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: a.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:55 GMT
Content-Type: text/plain;charset=UTF-8
Connection: keep-alive
Set-Cookie: sn=1400400475_1; path=/; expires=Sun, 18-May-2014 16:37:55 GMT; HttpOnly
Content-Length: 880
Server: QWS/1.0
QNR._AD.ifmRightFlightExt({.  "response_stat": {.    "elapsed": "2247"
,.    "url": "notshown",.    "stat": "success".  },.  "key_data": [.  
  {.      "description": ".........",.      "e": "wvgtI7am7JZzIOW0OeJu
HPI7R2JH/bsMcy/wVdHJF7FHz1fYxUu u4KQnWj7bN2W1/FZDXAxbT8iWW4gcOUU4KhNLj
ByZYyqrgPA/CPCGvN86dI xHngXqMBv3q8k5c8VfIU71oZYZb5G8uvh2oYZi1Qu0fzP9Rk
hiEANY6Ejzplna72fo4iT4Ic6tMKiIUfIEYFR0CDIGqKLx/ZzpKjn80wmkbgHLWS2/R9tx
6FlSMOC5QJddYgVVb3wIKI9IMac0O6P5AeGCqLeZa6hCBjEKKlNkFonKNx3ByHbcKdoL0 
Mvk EOqa5pzyhMCJFRZp7S51d/krEC0kfpxEBuI2ws94vsZZZmi3pTnnkqlUuRjK5TQKwl
YOWrqY686ilr4pHXBO61w3gCccJwalnpeQFzvvNsyDzhOXDz5ls8tSoozcwzskUCrOhW7Z
1b0WmYvrcg==",.      "img": "hXXp://img1.qunarzz.com/qs/201404/30/1644
498437263f636886324a.png",.      "show": "flight.qunar.com",.      "ti
tle": ".........",.      "cus": "",.      "s": 6791183,.      "margin"
: false,.      "phone": "".    }.  ].}.)..



GET /acpa/webgame/cy.html?from=tgly_14516 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:30 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=db654d626ae3cb4a9b64891af62bba76; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|||; path=/; domain=51.com
Set-Cookie: FO_TUID=3xPqED; path=/; domain=51.com
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; path=/; domain=51.com
Set-Cookie: wtids20140518=4lr4; expires=Mon, 19-May-2014 08:07:30 GMT; path=/; domain=tg.51.com
Set-Cookie: foru=14004004503amIWTb||game; path=/; domain=.51.com
Content-Encoding: gzip
c82.............ZKo..../[email protected]..^..,.N...'..D.....aSdsFcy...[.
K..!. ..0..y......CNA...!."9..I..>..Y]]]].u..O^}........2..@y......
)...xwxf.O..(?......S.(.1....,$.a...UQ..G#.X,..b...3..6........^....U.
.r.D.x=.....c.....H..s2.....>..(....J........?8_FTU.Y.TN......gJ..r
.....*[email protected].|.._.......?|..'...'.......O......~.o...}.._>..
o~..............A....$|.P..\.8N..5.....r..]>.).`0...g$..p....rv..v7
....7......M.KD\..=....3w....s..,.....X<R.1.O...!&.HQ..l..... .....
.....V.'.*....cK....QL...9=V..nH.,&P3..._Z.......|A.D....Y.Zd......?..
.....".#3.......`...g.q..o..A......../.....t....[..so`.....2..;.....eN
.Bp.e..,E......$V&..)..xs..........:........Ih<......6....g..6.Tz`.
.l%,..j-..Y.5.........m.........=........0.MC2..k.j........29n(../...!
...%..?...Cwo...C...4.QQ......WW...u.......8Q.....$...b..h..V.).....t.
.......\...O..,b!...?...... k.........N....../kR `..G...d\uxo.:.d6....
.}..r/.-.....Y.1j.J.RG$.?|...?|R.......h.`...q.....`...nj......./&....
Z.....T..V......:.i.p..:.F......WzYy ..W).._..|oZ..Q-f`=H#v:h..j .a...
p....&8.J..Y&u...c..rZ d.Bt6...w..........H....v.'...a.c..{{..G.......
.........w:..[[email protected].#.U..(.........*[t....
.F.2..d.....rT[......[.2..9....(=..R..]..0.Y..f.-.4.y........|..sM.N..
..C.t..(K.......8.lW....3.s4........$.!E.....e.0<.....".Q..>R$. 
.. ^...h>R4MP..G..F...G ....:.S?...h..T...).#(...0.{E.......}.J[.LW
RzYn#.u-........>y...j...\..j9.W#.<..B..#..s..;..uh.?.....dKr.v.
.wc.b.u.....%....C!..s..."...;..[2..wO..].l.*...U(xo... ...8u.En..
<<< skipped >>>

GET /market/game/shequ.htm?f_com=tgx2_14516 HTTP/1.1


Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game
Connection: Keep-Alive
Host: tg.51.com


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:33 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: wtids20140518=4lr4_4m1e; expires=Mon, 19-May-2014 08:07:33 GMT; path=/; domain=tg.51.com
Content-Encoding: gzip
c83.............Z...F......1..G........(;..........UmW.=.vy.r.L&..D..\
rI.....D..... .r....^..v{lww.>.x?......W...=W.......?~..e........==
W.......0.\<Q~.....).n*......,".a..=UQ'..C.....|...7..1n......C^..{
.S....T.x3...n.c.....H..s:.....>..(..!..........?.......f...p.9.(..
$).....WU.*3...>..~../?........~../>..........o.|...|.w../.-.e..
>.._~.._...?../....O....X}NS~.R..\.8n........r7.<>.*.i.....$~
...S!.g'/.w..Y_.B..............zS...n...q...e...e!K...L..z..b2...l....
..)rm..)...!Ia.q...xEI0...I[.&4$<.........|.5.....5L.$.yU..dFd pO..
.......o.S_..1..,6|2....r......dj.........9...9....\.L..AH...kZ{.e.L.B
...k.....cn.Bp.c..lE...'.f$Q.....Rxs........%.:,...(...Ii2...D..1.Sc.h
p&..P..y8.JY.......lk.........u..}.@4.{S.:....8.8.....QH=.R..F(..'....
"..}!...1....p...st`..w...G...AE....A.\_;[email protected]$..)).EtZ4
d0s'.~..z.Lh.F.....<=g..E.....2..*...5rT.W,;T.:&...|...I..9...B..q.
..I.....6x...7./...B.p..r(...'..........;H3xR.......h.`.?.I....'`...ni
'.........&..Z8..f.*,..`So'..\.4J9.C...a.....3....o...L......R..S..`?H
#.:h..j!.a...p..]..8.J.9.M..$.'.(..Q....tD.......q..#T...!#...N..W...:
.........!.F...R..=6Qqg3...>.7................W.._.V?WB.2.........a
......._e...Z....Z..J.Y...!Gu.qo[....!...../.....me......[.....*O...bz
.XLys..k1....]..?.M.....pqI...G..].....X.......<T....:[email protected].
b.aDU..P......x).V..P.4A]l.E...F...L.....O.T.".1.R....(....*.\..}^..V(
J.)*].r]I.e....../* :......&[kX..ri...h]...,.J.6.P0,.bs....".n....fKr.
N.....0.&......Dz....z....I.............b..b...'.q......&H#..N...0
<<< skipped >>>

GET /stat/pv_stat/?p_k=tst_4lr4_tgly_14516&r=0.3391658119186485 HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4_4m1e; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:34 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
36............ )..)I......&..f5F&.5f.ff5&.5&&f&5..././&.....0..
....


GET /tools/js_flow_cookie/?channel_alias=tgly_14516&r=0.29170465536844125 HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4_4m1e; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game; _51usi=g7LuIL


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:39 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: wt_ch_flow=tgly; expires=Mon, 19-May-2014 14:07:39 GMT; path=/; domain=51.com
Content-Encoding: gzip
14........................0......


GET /tools/wt_js/?channel_alias=tgly_14516&js_type=js_1&callback=wt_js_callback HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4_4m1e; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game; _51usi=g7LuIL


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:40 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
31............ /..*.ON..IJL...V.(..Q.RR.......Vj.......0......


GET /tools/wt_js/?channel_alias=tgx2_14516&js_type=js_1&callback=wt_js_callback HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/market/game/shequ.htm?f_com=tgx2_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4_4m1e; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game; _51usi=g7LuIL; wt_ch_flow=tgly


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:40 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
31............ /..*.ON..IJL...V.(..Q.RR.......Vj.......0......


GET /stat/pv_stat/?p_k=swf2_4lr4_tgly_14516&r=0.6105091539305322 HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4_4m1e; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game; _51usi=g7LuIL; wt_ch_flow=tgx2


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:42 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
37............ .O3.)I......&..f5F&.5f.ff5&.5&&f&5...~.E'.....0..>....


GET /stat/pv_stat/?p_k=swf2_4lr4_tgly_14516&r=0.7722198539588714 HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4_4m1e; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game; _51usi=g7LuIL; wt_ch_flow=tgx2


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:42 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
37............ .O3.)I......&..f5F&.5f.ff5&.5&&f&5...~.E'.....0..>....


GET /stat/pv_stat/?p_k=swf1_4m1e_tgx2_14516&r=0.0333559750407566 HTTP/1.1


Accept: */*
Referer: hXXp://tg.51.com/market/game/shequ.htm?f_com=tgx2_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tg.51.com
Connection: Keep-Alive
Cookie: PHPSESSID=cc029a1ab38a782cb3ddb58d74850e98; wtids20140518=4lr4_4m1e; FO_RFLP=|aHR0cDovL3RnLjUxLmNvbS9hY3BhL3dlYmdhbWUvY3kuaHRtbD9mcm9tPXRnbHlfMTQ1MTY=|MjAxMDEwMQ==|fHx8|; FO_TUID=HcydFs; foru=140040045031D2IWdC||game; _51usi=g7LuIL; wt_ch_flow=tgx2


HTTP/1.1 200 OK
Server: Apache/1.3.37.sa
Date: Sun, 18 May 2014 08:07:44 GMT
Content-Type: text/html; charset=gb2312
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
37............ .O3.)I.0....&..f5F..5f...5&.5&...5......'.....0..



GET /js.ng/framId=flight_active_dynamic&chan=flight&pg=home&site=qunar&type=dynamic_skinned&tile=14003829506057166236&city=北京 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=flight_active_dynamic
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:55 GMT
Content-Type: application/x-javascript
Connection: keep-alive
Set-Cookie: NGUserID=c0a8e01d-27718-1400400475-16; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/
AdServer: l-ads5.ad.cn6:9678:50
Content-Length: 59
Server: QWS/1.0
document.write('<div style=\"display:none\"> </div>')
;....


GET /js.ng/framId=ad_home_leftAD_middle&chan=flight&pg=home&pos=top&site=qunar&size=728x90&tile=14003829506057166236&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_leftAD_middle
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6; NGUserID=c0a8e01e-7792-1400400475-1


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:55 GMT
Content-Type: application/x-javascript
Connection: keep-alive
AdServer: l-ads6.ad.cn6:9678:50
Content-Length: 1366
Server: QWS/1.0
document.write('');.;(function(){.    try{.        var ad_type="image"
;.        var css = '',.            html = '',.            jsCode = ';
(function(){\n    var clickTag = "hXXp://qde.qunar.com/event.ng/Type=c
lick&FlightID=113975&AdID=208362&TargetID=5791&Segments=13,28,
51,132,148,373,530,534,535,536,539,540,541,542,543,544,545,546,548,549
,550,551,552,553,554,555,556,558,559,560,561,562,564,565,567,568,569,5
70,571,572,573,574,575,576,577,578,579,580,581,582,583,584,586,587,610
,611,1101,1102,1143,1183,1831,4050,4648,4649,4676&Targets=5302,29,20
7,311,1504,5791,6425&Values=34,46,51,63,77,80,101,110,150,204,217,22
8,230,243,250,252,301,305,320,5402&RawValues=&Redirect=hXXp://8cqn
eu.c.admaster.com.cn/c/a18169,b200364998,c2597,i0,m101,h";\n    var im
g_src = "hXXp://source.qunar.com/site/images/wns/20140430_728x90_4245_
dfs_new.jpg";\n\n    var container = parent.QNR.AD.create_div_containe
r( Current_ad_id );\n\n    container.innerHTML = [\'<a target="_bla
nk" href="\', clickTag ,\'"><img border="0" src="\', img_src ,\'
" /></a>\'].join(\'\');\n})();',.            jsrc = '',.     
       run = '1';.        if( css || html || jsCode || jsrc ){.       
     top.QNR.AD.run_in_content( Current_ad_id , css , html , jsCode  ,
 jsrc , run);.        }.    } catch(e){.        if( window['console'] 
){ console.log( e ); }.    }.})();.document.write('');....
<<< skipped >>>

GET /js.ng/framId=ad_home_rightAD_top&chan=flight&pg=home&pos=top&site=qunar&size=230x200&tile=14003829506057166236&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6; NGUserID=c0a8e01d-27725-1400400475-14


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:56 GMT
Content-Type: application/x-javascript
Connection: keep-alive
AdServer: l-ads6.ad.cn6:9678:50
Content-Length: 2765
Server: QWS/1.0
document.write('');.;(function(){.    try{.        var ad_type="flash"
;.        var css = '',.            html = '',.            jsCode = ';
(function(){\n\n    var swf_click = "hXXp://qde.qunar.com/event.ng/Typ
e=click&FlightID=108395&AdID=206888&TargetID=6878&Segments=13,
28,50,132,148,373,530,534,535,536,539,540,541,542,543,544,545,546,548,
549,550,551,552,553,554,555,556,558,559,560,561,562,564,565,567,568,56
9,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,586,587,
610,611,1101,1102,1143,1183,1831,4054,4648,4649,4676&Targets=5302,29
,208,1504,5800,6878,6419&Values=34,46,51,63,77,80,101,110,150,204,21
7,228,243,250,252,269,301,305,320,5402&RawValues=&Redirect=hXXp://
bsch.serving-sys.com/BurstingPipe/adServer.bs?cn=tf&c=20&mc=click&pli=
9635822&PluID=0&ord=[timestamp]";\n    var clickTag = encodeURICompone
nt(swf_click);\n    var swf_src = "hXXp://source.qunar.com/site/images
/wns/20140415_flighthp_tbut_230x200_4211.swf";\n    var link_click = "
hXXp://qde.qunar.com/event.ng/Type=click&FlightID=108395&AdID=2068
88&TargetID=6878&Segments=13,28,50,132,148,373,530,534,535,536,539
,540,541,542,543,544,545,546,548,549,550,551,552,553,554,555,556,558,5
59,560,561,562,564,565,567,568,569,570,571,572,573,574,575,576,577,578
,579,580,581,582,583,584,586,587,610,611,1101,1102,1143,1183,1831,4054
,4648,4649,4676&Targets=5302,29,208,1504,5800,6878,6419&Values=34,
46,51,63,77,80,101,110,150,204,217,228,243,250,252,269,301,305,320,540
2&RawValues=&Redirect=hXXp://bsch.serving-sys.com/BurstingPipe
<<< skipped >>>

GET /js.ng/framId=ad_home_rightAD_top2&chan=flight&pg=home&pos=top&site=qunar&size=230x90&tile=14003829506057166236&city=北京 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.qunar.com/vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top2
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: qde.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6; NGUserID=c0a8e01d-27725-1400400475-14


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:56 GMT
Content-Type: application/x-javascript
Connection: keep-alive
AdServer: l-ads6.ad.cn6:9678:50
Content-Length: 1813
Server: QWS/1.0
document.write('');.;(function(){.    try{.        var ad_type="super_
text";.        var css = '.qde_super_text {height:90px; width:100%; ov
erflow:hidden; }\n.qde_super_text a { display:block; text-decoration:n
one; color:#0069ca; }\n.qde_super_text a:hover { text-decoration:none;
 color:#f60; }\n.qde_super_text dl { padding:6px; margin: 0; font-fami
ly:Arial,SimSun,sans-serif; font-size:12px; text-align:center; backgro
und-color:#d9eefb; }\n.qde_super_text dt { line-height:26px; font-size
:14px; font-weight:700; text-align:center; color:#0069ca; }\n.qde_supe
r_text dd { text-align:center; }\n.qde_super_text a:hover dt { color:#
f60; }',.            html = '<div class="qde_super_text">\n    &
lt;a href="hXXp://qde.qunar.com/event.ng/Type=click&FlightID=105546%
26AdID=204666&TargetID=821&Segments=13,28,132,147,373,530,534,535,
536,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,55
6,558,559,560,561,562,564,565,567,568,569,570,571,572,573,574,575,576,
577,578,579,580,581,582,583,584,586,587,610,611,677,1101,1102,1143,118
3,1831,4386,4648,4649,4676&Targets=5302,29,6967,821,1504,6489&Valu
es=34,46,51,63,77,80,101,110,150,204,212,228,243,252,255,301,305,320,3
57,5402&RawValues=&Redirect=hXXp://affiliate.lufax.com/action/3ove
" target="_blank" hidefocus="on" style="font-weight:700;">\n    <
;dl>\n        <dt>.....................,1000.........</dt&
gt;\n        <dt>3...........................6.2%</dt>\n  
      <dt>hXXp://VVV.lufax.com/</dt>\n    </dl>\
<<< skipped >>>


GET /play_buf?room_user_id=lmx2369295492&user_id=&try=1&cdn=dl HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: xiu.stat.corp.v-56.com
Connection: Keep-Alive


HTTP/1.1 204 No Content
Server: Tengine
Date: Sun, 18 May 2014 08:08:06 GMT
Connection: close
Expires: Sun, 18 May 2014 08:08:05 GMT
Cache-Control: no-cache



GET /imges/live/CSSIMG/base_head_search.png HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vr0.6.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Content-Length: 928
Cache-Control: max-age=31104000
Date: Thu, 01 May 2014 18:04:27 GMT
Content-Type: image/png
Expires: Sun, 26 Apr 2015 18:04:27 GMT
Last-Modified: Fri, 24 Jan 2014 10:39:30 GMT
ETag: "3171668671"
Powered-By-ChinaCache: HIT from 06047113L7
Age: 1432998
Powered-By-ChinaCache: HIT from 06053213yO
.PNG........IHDR...c............$....tEXtSoftware.Adobe ImageReadyq.e&
lt;...BIDATx..Z.kRQ.>.P...a..]..!..0.=D............{Z....^... ..b..
.,h:R.....Bs......m.^.z...|.q.9.y............d6.#.......b.iX.@,...E.'b
..?9z..&>'.i}.........`1~.8O.>LFd...<...s^.k..,A...D...O.N...
...2...a......M..Yf..w.......if.K..0..3..f...s\......b5G.^g...l{{....1
....^/.F.....~=t.C\.f<%.h....j.....N....0.X,.r..".......p.z....,.8.
..6..T*.Y... [email protected]>799.b....../.f..F.Q.V;FLMM.x<...p.g..Z.x
[email protected]..<....~...c.p......:...T*.......y....0Co..`....].W.
89/.....c.E`.Z.....^..lv...2^.c0cW.......j.........]..k....z.q...-6P..
?u.....xo.n.Y2.d....%.G|.8.....W..t..q[..7....t&....l.$.u.....nP.b..K.
...Z...D..I...X...7..6::........\>.x..c0..,W..,.g........}......C`L
..a....... ..}...!.....B.#.]..|!........d.*.J...~%.A.....;b..W..~..E..
..3p&&n...V..5....A.Wu...W.V...g........a...o...5v.z..:.......8l.k.Z2#
z..k.FqB.k....... ~<[email protected]`.....


GET /imges/live/IMGSRC/logo_foot_v1.png HTTP/1.1


Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vr0.6.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Content-Length: 1956
Cache-Control: max-age=31104000
Date: Thu, 01 May 2014 18:06:18 GMT
Content-Type: image/png
Expires: Sun, 26 Apr 2015 18:06:18 GMT
Last-Modified: Fri, 29 Jul 2011 05:57:47 GMT
ETag: "740367150"
Powered-By-ChinaCache: HIT from 06047113L7
Age: 1432888
Powered-By-ChinaCache: HIT from 06053213yO
.PNG........IHDR...c..........#W....XPLTE......wtt.........ZZY........
....fff...qpo.................!...{{{...SRSlkk...)():9:...333....!#...
#"#..~..#tstCBA...GED.."............HDFYWV......PNM...................
...04..$.......? .05....Q9..........8=...JIJ.......IN.sv....#(......*%
'._c'"#.LQ.mq....?D.......{~.Z;....DJ.(,....|..(...a.....!.x|.}.....&,
.................i....MQ..2.ru.>B.T8..k.il....]?.ad.;?.......w|....
...PT.9=....8 .NT.......38.......iL....6;.............BF..r..v....RV.\
`.jm....7,.X=.1'.|^.E2..c.PT.*#."'....;@.w[.!". (./5.*1.=A..........x{
....AE.)........PT.HL.5:....; .z}....%).....{.;A.kn......."!..x....08.
[email protected]^..S.$K..........m..c..m....N.....]Y..E?...
'j..j.4....s....].d....x(...h..r:.o.l.Rp....  .M6l.7{Bi....Z*......V}.
 Wb'.2.I..........Y.......zISH...r9.rd...0&Li.W..r......B..@$...a..&..
....P............h$....A2.dk`.1".&..z.W^..ccc?N..H.@. D.RA;5....J...q.
Vg..=h,.....H$P(.~.........c........U..c.R}}.....J..J..1...[......E..d
a....>j....d.....*9.....N..,b."... ..'[email protected]..*..0.|^.3...A
..H)....."......U....).X...5lC@!..P........... ...P&P.....!GI......F.Z
T...!..d..3g...2.o..k....9...)..U1..D.{>..q!.N?p....5:..O.C.;..e..B
...~vi&Uc.g..{.,.$.)]J...$..>].$Ec.wB8...&..NF.......l/o....... (!.
m...0C2..i..X..J.A..[."~..K.O'.......g$.B..H.C....)[email protected]...!\5#.....
.UL..x .....&.MX.......f..DF.C.....?..HN.0E....'.k.....,..5e..p...4...
......q..n^f'.^?..y..IH.BD.A!.b......S.X.PV...\..C..s.^x....N ...I3{.0
~.....g..A......[CN..j...p9.F[z.;.ib...M.V.....w..O.... qr#.D.A..6
<<< skipped >>>


GET /b7/aa/h199941397100951.jpg HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: i2.6.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Sat, 12 Apr 2014 18:04:22 GMT
Content-Type: image/jpeg
Content-Length: 26627
Expires: Tue, 07 Apr 2015 18:04:22 GMT
Cache-Control: max-age=31104000
ETag: "1214466722"
Last-Modified: Thu, 10 Apr 2014 03:35:56 GMT
Powered-By-ChinaCache: HIT from 01057413L3
Age: 3074594
Powered-By-ChinaCache: HIT from 06047153PC
......Exif..II*.................Ducky.......K.....ohXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:2081451ABFBBE311B
7DDFF05BB46AFC6" xmpMM:DocumentID="xmp.did:E7835211BFD211E3A4EAF9355B1
5FAAA" xmpMM:InstanceID="xmp.iid:E7835210BFD211E3A4EAF9355B15FAAA" xmp
:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:2181451ABFBBE311B7DDFF05BB46AFC6" stRef:doc
umentID="xmp.did:2081451ABFBBE311B7DDFF05BB46AFC6"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
......................................................................
.........................................!..1..AQa"..q2..BR#34..b...C$
.r56......c%...s.DE&7......................!1..AQ"..2aq3.B#.....bC....
........?...^..u..hkz.bdH....6ET.S,....H7.I`-...x.G..l.......v.f7G..\D
yR...L.1..>.........Des......w..Y-H.[E..1......l...........r.......
kt.....U..a.=...W...:.u\.e..J.J...O..}8..z...n..qC..Qq...w..-/.-..
<<< skipped >>>


GET /imges/live2013/base_head_v24.png HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vr0.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: max-age=31104000
Content-Length: 4090
Server: tux/3.3
Date: Fri, 09 May 2014 03:36:33 GMT
Content-Type: image/png
Expires: Mon, 04 May 2015 03:36:33 GMT
Last-Modified: Fri, 09 May 2014 03:36:10 GMT
ETag: "3206007855"
Powered-By-ChinaCache: HIT from 01057413L3
Age: 793872
Powered-By-ChinaCache: HIT from 060108b3Se
.PNG........IHDR...d..........ic.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:FD597F45D69211E3A24FA34F
193FE1FB" xmpMM:DocumentID="xmp.did:FD597F46D69211E3A24FA34F193FE1FB"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FD597F43D69211E3A2
4FA34F193FE1FB" stRef:documentID="xmp.did:FD597F44D69211E3A24FA34F193F
E1FB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>M o....&PLTE.........***.......33......222.
...........fff.........SSS............{..............DDD..............
........86............<<<ooo..............y...&&&............
.........666...................55.z^.........yyy....z^......jjj......d
ddlll..............................   ###!!!......""".........E7p....b
tRNS..................................................................
.................................V......IDATx....W.9......I..,.....@..
$.=....>[.T%.$;..O........T<dZ.`."......u..F.J9]..|.6.^eZ.J)..k.
u6s...."h..7YP!....{..B.PX...u....S%..Z.<8........|ar..LqnK[..*
<<< skipped >>>


GET /stat.htm?id=4693566&r=&lg=en-us&ntime=1400400449&repeatip=2&rtime=0&cnzz_eid=442332282-1400400449-&showp=1024x768&st=-17510&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=698202374 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hzs9.cnzz.com
Connection: Keep-Alive
Cookie: cna=RVj/Cy0IRhYCAbhrJiY9QmtQ


HTTP/1.1 200 OK
Server: Tengine/1.4.1
Date: Sun, 18 May 2014 08:07:39 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Tue, 28 May 2013 02:57:17 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..



GET /js/LAB_0.1.js HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vj0.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 15 Jun 2014 22:11:09 GMT
Date: Fri, 16 May 2014 22:11:09 GMT
Server: ngx_openresty
Content-Type: application/x-javascript
Content-Length: 2787
Last-Modified: Mon, 19 Aug 2013 07:18:16 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Accept-Ranges: bytes
X-HITS: 12
Age: 1
X-Via: 1.1 zw12:80 (Cdn Cache Server V2.0), 1.1 yfdx33:0 (Cdn Cache Server V2.0)
Connection: keep-alive
...........Yis.8.......;..b.rfw...xu..-...$....EA.c..y........$.8....*
".F..........v{...A..~:..Pz. .it.I..J.._..{....EJ_.h.....].......2...`
.Hd..O.]6../.D4^.x.~."...C.M...$CoL..7..!.,..@F..].{qc.....Q.;.>%b(
}/.::........L>."...8.'"......a.-...R.X.3...?..,I-v......^:..9o.u..
.c.........l.C..Y,...... t..s..n..=..u{.S.. . >.~6.Qj..7.l.......G.
....y....P..Lp.....{......S{..T....Sy.....{.....r..m....E7.b..Uw..^.E.
..A.(-0...v...(.T.....*...(..y......'[email protected]},e(..b...V.d...."...V..d.(
..4..`%p..o^...,#.s...`.....ZM...4.$..X.Y.5~.MP...`...K]..........'..i
f.uR...6.D..m..R")]K..:)..2.......`..d.%m.......&....%w..eQ...H...d...
...m.}...4.v......`8.H.Iqmi....!..#..%@D.wn0...)...t.aG*(.....8.V...o.
.y....n...... ...W..w[..a...~s#b.A......?..Q....~.8.,@.I[F...... w...F
p...L........|9_."...........lb...q...F..;B...[$n.u...B41....%./.V..
. IE$...Ry..^..r....T..;r.... .<..;.U2.1..e0.2K......%.......g)F...
b......y.ivK....l...'.........8.../...ugc...L..%.....7....G...P.......
- ....=..I.....hd>....~...F..]C..D....X.e.(.VkiC...gS....n.......G.
.qu:<J.....0.P'........U...;1......d!.._...u....n$2.}..|.......f,DD
...K.-..DD......O,[email protected](.`.....Y.NH....Qp........H{..C..
 `}..J..5.7B?.2..Y...1....U..?..9.......L...s...h& .....C.Hp|.#..Q....
..?W..#nYUUMH...J/[email protected].. .?...'.
........W....Lh.q.....{.g fU..QT...k......J.......~.[....$...9.W..`...
..O.........5.]K.19....@{e..Y.^.V..d....U=..5o..........s@sg..........
..7c<..>..C..h..........QCt.j}.:..7hG....B.lC.9.sB_..5....-.
<<< skipped >>>

GET /csjs/_/girlfall_5.js HTTP/1.1


Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vj0.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 15 Jun 2014 22:11:09 GMT
Date: Fri, 16 May 2014 22:11:09 GMT
Server: ngx_openresty
Content-Type: application/x-javascript
Content-Length: 12124
Last-Modified: Tue, 01 Apr 2014 06:25:05 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Accept-Ranges: bytes
X-HITS: 35
Age: 1
X-Via: 1.1 zw11:8080 (Cdn Cache Server V2.0), 1.1 yfdx33:0 (Cdn Cache Server V2.0)
Connection: keep-alive
............iw.F....WPH^..!J...4)X......m........H."...6...>...(P..
{f..I.P....[%.|.L..X.y8..n.u'....D>b....:z..EV\W...o..........|>
......0.....<..'Y.f.-.eU...=.../2. .u...`......3.....rRM.N/.~.^E.4}
YU.|t].$....._....l6...X0...$..'Ygq......qy.L.":......Y.I.2........._.
....?....iU....U.[f....-.oV4...\.]............(.O......~.....s_N.I<
...`..Noa.<.../`.E'...`8;...^/H....2.....2..q..-...p<..~......t&
lt;..id.......c..:.....e...q.....u.....?..^...=C./..V}....f.2..~.....N
........V.V#..Dzz4...`d....tdU.';...qF2.....m.......r1..l.~...P......m
x..-pO"....."9O......v..C...>.....-x.4....g7...........h...I....I4.
[email protected]~0......i>.(..>.2..M..fT........l...,..O.......7.Ny
...G..,.....W.nW.B[^......<t&B..aJ...{?q...y.....-.e........A.PU...
.........l..J/.....0.l|..=L...eX.N..i==...Y.<_^yA8.O..8......WV....
fY..).Y..~..../K..U..e......f.2z......U.<...?.......~...M.2Af....~.
/.....Dy....5...P...|....u..gYQ...q....0./ .X2...,:pz....i^.rj..Z@r...
.j.U...y?...,}..^..f.....M..0.'.,^.E.J..........a......D<...jJf....
2..tEg......^[email protected].|...&..$.1..l...(....k.C.......)... ..C...
........pd....e...=..Y....}...Y.\J..Nu..x.D.\X.$x.).._.i...\\*63.N....
...9..g...$....N....[A..fs'\.........N....O....^..j.u..u:.:...K.a..a.E
7...=(`[email protected].... Q.....YQu..zy..6\9....B......%[ .:.E...6L....H..0.....
....9...?.....<0.t....l.H.g"...$...q.a:<D.\v....N.!....?W..t....
...j...%.Y.7..o..".'w................~.*...4j.tv1K..qi.....^T.L..S.[9.
.......d.3yQK`..4....^$.<E..8...J....).&.j...0../.E....j.._.G-.
<<< skipped >>>

GET /js/s/iwt-min.js HTTP/1.1


Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vj0.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Mon, 16 Jun 2014 21:17:01 GMT
Date: Sat, 17 May 2014 21:17:01 GMT
Server: ngx_openresty
Content-Type: application/x-javascript
Content-Length: 1531
Last-Modified: Mon, 28 Apr 2014 02:16:30 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Accept-Ranges: bytes
X-HITS: 169
Age: 1
X-Via: 1.1 zw11:8080 (Cdn Cache Server V2.0), 1.1 yfdx34:3 (Cdn Cache Server V2.0)
Connection: keep-alive
...........V.o.6..W4np....v...l.......I....P.%....m........i;..8"y<
.>~...h.....s..m?rb..v.....D.....U."...0.....mnZ.P.1..vSB..!...6.}9
_...B.e..U^M.mR.....s..*A.....p....C0......e%.*..w;.......f..w.z"..C..
.V<.{..VRW...Zp#...m.`x.f.p.O8..d...g..|......F..W\..........,u^.,M
(......<.....2....J.;..bi...ryY......I.`.1..... ....nP.....Tr.....c
B.}D..\...x'W.S..2.M..Fj:........_.Q8..l.....A..$*r)x.".....NZX|...j:s
.T..Z[...>#..,_...h..~.Vj]h..\.......R.{.....'H}...j.....p...Si...P
......\..U.4...lR.(.Ve.7^..w.........H...*N.7...."k>t(...^>".}@7
R.2W.T.E7..!..]F.....C........<l.B~R...K....[v..h..Q!Cg..&.3...p;..
........I.)%C.{.2.B.=.W}>.GM>:k..9.d..D........G.....k.99....X).
....FOn4:.]gEx.5......B...>.{...OL.|...Q.K!dU./..5............*u...
.........Z._......h..u.............&q!...0.y"'.......<...%m..1}a...
...........?..5......L..Q..I..T.h8..n...,.......|.....J (.?$..9.;/T...
T....1.nsG~.;.P..#X......}s.........k5...0...Od...p..{.....@ .2_.J.zT7
>...T.-..|4.9Hww%X..`..`^.y......R.Ve.RP...P.......T..G.l...<...
i.%..K.y..I|.Y..&.......7..^_...;....t.B4E.".@.....:...._.1..M-.K...eX
.{...$a}% d.......i2c....'..24.8.:.........m.M...2.Q........QX...GZ..a
..:y(1..F#............t...<.:...CU.&.a^[email protected]......
...5W...d'... `..~/.R....?. l..X...Mao8O......BQ...h.!....BA...x0x..B.
.f:../.mK;.w8.i.lM>..]mv....9X.kj......oP8t">L.V-.......6..Vo...
..i..'..3DK...)*..\..2 ..."\......'.O-..........J.Pg........l{}.E.....
."....D.Z...H............ .;........].l.>[email protected];YC.`y......
<<< skipped >>>

GET /js/z_MIN_14.64.js HTTP/1.1


Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vj0.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sat, 14 Jun 2014 10:12:20 GMT
Date: Thu, 15 May 2014 10:12:20 GMT
Server: ngx_openresty
Content-Type: application/x-javascript
Content-Length: 59944
Last-Modified: Thu, 15 May 2014 10:09:18 GMT
Cache-Control: max-age=2592000
Content-Encoding: gzip
Accept-Ranges: bytes
X-HITS: 1
Age: 1
X-Via: 1.1 zw11:8080 (Cdn Cache Server V2.0), 1.1 yfdx33:3 (Cdn Cache Server V2.0)
Connection: keep-alive
............kw.7...y.......E.M.y.i..I&....8...e{....L.4I..H...S.t..nZ.
df.:[email protected](T..U....t.m..ngo......1^....b..~WY.....m.>8[]n..h.N..
.....*..m.../B.cW...Y.[)E...E..-...W.......^'..!....t..f..!?3.'...O<
;...I.Y.|......{..u<Z...tH5/.....^<.7.o.o.....0I..,1..R}.....<
;......{..{T....(8......ac.8O.m-.B.L..o..t.<.....m.T...D.../.Wf$..z
.\{..I..F.x.....t[..4.>><...g.)..fPT...V/Y.<...z..g2...=Y/
.a...4.......}[email protected].....?-....H.w.\.Af...k.M..]..........M..l.6.p..
r..=<...m.2.~7K..a.G..Pi<..~.F....0.m.....[...."Y.k0..m...d..k..
[email protected].~L.....r>._[,..
.l.`....._.............p.O..[S.N.mZ....-P8.^^........;//.. ....zy..w./
/...J:i...I.~y9.7c...c<...........N....o..g.....G....r.....{.q...E.
...W.......1..Ux..b"W........k,..w....k.....E....{!...4.B...8.........
..{.|.l..C..|.Xl..3..y.-.zxx..7).Th........'....t.U.....j71O..a...dK..
........9....Y....^I..z...N.p......u2...........W.;.......7.%I....._".
..p.J....5..6i..D...".H.Q.?on<..g....m..l......^.i.Ng.......6._....
..-..[.y.yK......z.....9.....TL..........Z2..>.a4O..z2j.......R.Kc.
m.....i......<....7..7.z....x...........E..o.._7.)Ok/..U."~.J.~9z..
........m..?\...[B...6.Q....{.....hL".....i:..;..d.... .p=..h.jl..8.a.
...E........<..d/......`..]L.0=#-8..c.NC..z~4y.|u....{.'.^.G....hs.
...QH....A.:... ..:....\.I....4.6..."...E.Yy..Sx#.\o.......r..n.......
.PL.!./...h.B.....!..t6..S.y.p...F^.=.....p..\..c.!Cu.".y'.....5....6.
...8....mD.SL.. h^.s.[$ .i... ..xt.v$...N..=).5...B...:43J..5..Y..
<<< skipped >>>

GET /js/s/login_3.js HTTP/1.1


Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vj0.6rooms.com
Connection: Keep-Alive



.3........="F.G...|.,bc....^d.q...dg......:.*4........P.....G.J.4Q...0
u..R^}...O..0..0..}E...W...g.7u...........  %._p.M...*..N..r.1A.J...j.
XQ.......l..,h...x.;...B..J.........rx7.... .wRr8...t...T..(*...w...Y.
)../....W@.*.n..>..&c.......u.sS&.P(.R..o6......iC.R^.r.\.>.DU..
V.rzwy5;..e ...YRO).........P)..tCw...`^...r .u..~V.k.... $.. ..K....{
6.w.~U.....D.g..q.......]U(J....b$.G)]0.Y.....n...'.. .TqV............
[email protected].~.....|[email protected].^.3.R?.................aK....
3`..n.".X......t..t8}_:/;[email protected]"...8.U.L.,>....t..A...H...n....
..A.E..s.cw..-c..w\...Q......Lcr.$j....MT/\.$..`.}.[c..-G....hd..|.n:.
.D..f..M..... >$...S. n..~.O...?..y..".h......r..;u..u....q...=..F&
lt;.yDQx?(Q^....\;..>s.,....l..I..A....~.......R..s..Ml.{wWWWW...=.
...C.C...L.....5...d.(.._x....^......M.........x..43.#......)!.*0.....
.$.9..~W.W.E.(..$`.Wh....?....?.d....a...X.....,6..P..e.!O...~...q!...
....e1sX.........P..e.{..LiK.."..N(.b......%..?G^=.......Le....G......
..^T.e....Q...gQ..L!...z.|.L..$..T.Z.....k.7.....rh.....[....<.Cd..
[email protected]`..).c....W.......VHa.Yf%|..4..Y)..
.j.zD.BI...,..N.6....oyV..O...........`[email protected].&]...(]Y..#.sY.3..).z.}..
...2#....^.~..>...\.. ..j.P..........<.m.O..I...L..|.x.9.K ...ah
Y...U....9.t...)..y.2..%....m.B.....zv.'8.....x.` X}.&n..uQ./V...dL.&l
t;...'*A...T..K...1.......__.tQT....(CY.[i4cn..i.y*Jx..S..v...HTYa..Z.
zy.$...Z..CY.E.6.....B..r .0......a...}.....uQVT \Y..Dma.<t{2...S..
....=...q...Q.>/j.Ya|os...[H..z{X9..........e,N../.s` o........
<<< skipped >>>


GET /play_conn?room_user_id=lmx2369295492&user_id=&ts=6065&try=1&cdn=dl HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: xiu.stat.corp.v-56.com
Connection: Keep-Alive


HTTP/1.1 204 No Content
Server: Tengine
Date: Sun, 18 May 2014 08:07:59 GMT
Connection: close
Expires: Sun, 18 May 2014 08:07:58 GMT
Cache-Control: no-cache



GET /stat.htm?id=4693566&r=&lg=en-us&ntime=none&repeatip=0&rtime=0&cnzz_eid=442332282-1400400449-&showp=1024x768&st=0&sin=&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&rnd=112104309 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: hzs9.cnzz.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine/1.4.1
Date: Sun, 18 May 2014 08:07:32 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Tue, 28 May 2013 02:57:17 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..



GET /style/xiu/v1/css/xiu_base_v.2.css?2012v5 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 18 May 2014 11:56:10 GMT
Date: Sat, 17 May 2014 11:56:10 GMT
Server: Tengine
Content-Type: text/css
Content-Length: 14516
Last-Modified: Mon, 28 Apr 2014 09:40:03 GMT
ETag: "535e21f3-38b4"
Content-Encoding: gzip
Cache-Control: max-age=86400
Age: 1
X-Via: 1.1 zjjx155:8080 (Cdn Cache Server V2.0), 1.1 gl24:1 (Cdn Cache Server V2.0)
Connection: keep-alive
.....!^S..xiu_base_v.2.css..=...:r... .....u..."@.. ..}....m..%.$..m..
.1..?..l.#..DJ$.....4.-..b.,..Ev.......n..q.{....K....y[...[.EUd..n..~
.V..-M..C...|..F.gu..o.ah.?.......a.5....Z.?..........!.86......iWYQ.E
...uW.E2L..}q*om..C............5#..,..<%....k.$ ...&......&U{L..._.
...l..~~J....*rqP.$-.[v.z(i...J.W.....~..7...X$y.=mNE}..<_m0..N....
.k<4M...r.d.CO..k..b.I.:f/..OC.6u....~.....F..5..'......>m...c&l
t;~.....>Y..e......P....~.......W(.q-..P..V...<..v.$.P8tM}..U.%&
lt;\......~...Tq.3..0....!npG.%.&.gU.C.~....*.........C.........,J7...
...7/...t.i..L......l....'%8.*.......r...$...%.Y.J8>.t..q......6...
..{.\O....`&[..K...w{....}[email protected].[l:...'..?....x_v..)...C[.O._.E..J...
.....u...).......^.D.I.C..]..}....M.X............IW....#.......G..m>
;{.......cxI....... .c....V...OuC...Xn86'6..!=..$x=..?..Y...O..N.y.YL.
.f..c*..s.[..C.O..1.%E..zq.,....a)70E..N...`.....E..D........<.}_.E
J$.$.q{....AT....>.Z.. = .....?..........O.....|..&.B...~....../...
..H8.K.gXRv|.am.....l.*\!...W.g.,b......`....b...S.>}....K".....%/.
.RL.n.$%......!..^...4>5.........&- `......d..........%...m........
~.0x.....~;.7.1<./di.|).x.e...a..b..^...4....!M;..............%...h
.......m'.L......7......_-......}.t...q....=../....E.ZgG......,X.M....
@.|.l6..c.0.|.F...xnY.dw.....<.....t:h..)>J ....|...!i~ W....R..
...vK.=....H%2....(.....g..FW.....bE...^<.E.]..(="N..>..j_^.(...
.{....e]...^.#...e.Q.B.. e^......IG5=".s..xa6.Br..O..:......l.n....uZ5
.....PfI.N*....2..b.....&.*...6..(l...2..[.....pYo......a.........
<<< skipped >>>

GET /style/xiu/v1/css/sub/xiu_sns_v.1.css?20140415 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 18 May 2014 11:56:10 GMT
Date: Sat, 17 May 2014 11:56:10 GMT
Server: Tengine
Content-Type: text/css
Content-Length: 14516
Last-Modified: Mon, 28 Apr 2014 09:40:03 GMT
ETag: "535e21f3-38b4"
Content-Encoding: gzip
Cache-Control: max-age=86400
Age: 1
X-Via: 1.1 zjjx155:8080 (Cdn Cache Server V2.0), 1.1 gl24:1 (Cdn Cache Server V2.0)
Connection: keep-alive
.....!^S..xiu_base_v.2.css..=...:r... .....u..."@.. ..}....m..%.$..m..
.1..?..l.#..DJ$.....4.-..b.,..Ev.......n..q.{....K....y[...[.EUd..n..~
.V..-M..C...|..F.gu..o.ah.?.......a.5....Z.?..........!.86......iWYQ.E
...uW.E2L..}q*om..C............5#..,..<%....k.$ ...&......&U{L..._.
...l..~~J....*rqP.$-.[v.z(i...J.W.....~..7...X$y.=mNE}..<_m0..N....
.k<4M...r.d.CO..k..b.I.:f/..OC.6u....~.....F..5..'......>m...c&l
t;~.....>Y..e......P....~.......W(.q-..P..V...<..v.$.P8tM}..U.%&
lt;\......~...Tq.3..0....!npG.%.&.gU.C.~....*.........C.........,J7...
...7/...t.i..L......l....'%8.*.......r...$...%.Y.J8>.t..q......6...
..{.\O....`&[..K...w{....}[email protected].[l:...'..?....x_v..)...C[.O._.E..J...
.....u...).......^.D.I.C..]..}....M.X............IW....#.......G..m>
;{.......cxI....... .c....V...OuC...Xn86'6..!=..$x=..?..Y...O..N.y.YL.
.f..c*..s.[..C.O..1.%E..zq.,....a)70E..N...`.....E..D........<.}_.E
J$.$.q{....AT....>.Z.. = .....?..........O.....|..&.B...~....../...
..H8.K.gXRv|.am.....l.*\!...W.g.,b......`....b...S.>}....K".....%/.
.RL.n.$%......!..^...4>5.........&- `......d.....HTTP/1.1 200 OK..E
xpires: Sun, 18 May 2014 11:56:10 GMT..Date: Sat, 17 May 2014 11:56:10
 GMT..Server: Tengine..Content-Type: text/css..Content-Length: 14516..
Last-Modified: Mon, 28 Apr 2014 09:40:03 GMT..ETag: "535e21f3-38b4"..C
ontent-Encoding: gzip..Cache-Control: max-age=86400..Age: 1..X-Via: 1.
1 zjjx155:8080 (Cdn Cache Server V2.0), 1.1 gl24:1 (Cdn Cache Server V
2.0)..Connection: keep-alive.......!^S..xiu_base_v.2.css..=...:r..
<<< skipped >>>

GET /script/page/xiu/v3/lothario_v.1.js?20140425 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive



......gd...k.V.....i'r..:M..D..]`W.R.o..........?.nO.......V...}.T_.X.
.8.."..}a...4R...[!im....>w...;X..9.6.-.Bmi6 |j6..v.....&=....hT...
....}..#D...9.91....v....y..u.S./K>w.....oo6..5j..g..'{-/_H.0X...q.
]....w?P....6.XS..(.>............h!.;[email protected]...
.st.aR.........L&C.I.......2G.. ....U...uE...........t.C.[;'........az
..$K..2...R!.;@..b.H...L...........=m.*'...Wk...?...RD%N6G.J.M....-.Iu
.......ijl__.ZM.<..)...G4.o..c.iN. ......7U.....3......4.`...3 n._j
...6P..7..&z.;j..k.........)....|.J1X<......#....=..=...........j.w
lR..$.'0....73...eRLg..\..>..n..s..V=...$... ....Np.85'..Z.........
..@..=.C.}...v....z~.Z.|...u...._O..3.....g.W.$.g..~X.......;.[.....3.
.....nwj0C.C..tGX......Oz.4.[.....~^.6....{o....8..... ..K....S'....~&
8........Ba..g.g$}j........M.z..y..(.:...Y..U...br..Q..Ql..~>...A.n
.{.2:C........A...7..E...%.<..6B......<}Ka.]i....H..o.'..HTTP/1.
1 200 OK..Expires: Wed, 13 May 2015 08:43:49 GMT..Date: Tue, 13 May 20
14 08:43:49 GMT..Server: Tengine..Content-Type: application/x-javascri
pt..Content-Length: 3382..Last-Modified: Tue, 13 May 2014 08:24:03 GMT
..ETag: "5371d6a3-d36"..Content-Encoding: gzip..Cache-Control: max-age
=31536000..Age: 1..X-Via: 1.1 tzwl41:80 (Cdn Cache Server V2.0), 1.1 g
l29:4 (Cdn Cache Server V2.0)..Connection: keep-alive..........qS..lot
hario_v.1.js....s.F......U..8N.L Ga..^..67............F.c..3&-........
...\).........d.....vW_...&...q..o.{..}.{..=vB5K........A6P.(.Lgh.Hc3.
.PF...S.. <.t.c4*...*.YNI..9.PQ...*..8F]1..K"W1..3N$.R!.|I...W.
<<< skipped >>>

GET /style/xiu/v1/img/lnt_bg1.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 29 Jul 2014 11:50:10 GMT
Date: Wed, 30 Apr 2014 11:50:10 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 865
Last-Modified: Thu, 20 Mar 2014 16:29:30 GMT
ETag: "532b176a-361"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl42:80 (Cdn Cache Server V2.0), 1.1 gl27:8 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.......|.....9.!.....PLTE.............................
..............................w.....u........c..}[........^./.........
.................................d.2...........................b.1....
............................|...........s..z.._..n.....}..w........x..
|.....w..y..x..t]./[....z..~..s..u.....s.....d.....]..}`.0............
..x........v..g..._.0......c.1..vZ.-..h...........r..z.....k.....}....
.......y..e`.0..p..`..y..j......b.1..t.....~..l.....{..o.....v..a.....
...u..~..w\..........r..{c.1.....}..r_.0..{.............nz....$IDATx^.
.3...........m..m..m.of...d.H.y....B.h.{.W...=.GT..b.*...3(.2..S.....}
.w4..J#...".G.(.R.cl0(.......a....h.Q.E.. s=r...<..z.\..l..u.1.\.Qk
.\7.fE..1......A....yS|..R.,..^-.1.8.\2.:..._K...."..t.e..v.Kk...._.W.
...z..5..=.b..^....n9a....No..1..V.....2?b.nBWa..1]......>.c.......
...mc.....oM.H....b....IEND.B`.....


GET /style/xiu/v1/img/bg.png?v=0531 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 29 Jul 2014 11:50:10 GMT
Date: Wed, 30 Apr 2014 11:50:10 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 865
Last-Modified: Thu, 20 Mar 2014 16:29:30 GMT
ETag: "532b176a-361"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl42:80 (Cdn Cache Server V2.0), 1.1 gl27:8 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.......|.....9.!.....PLTE.............................
..............................w.....u........c..}[........^./.........
.................................d.2...........................b.1....
............................|...........s..z.._..n.....}..w........x..
|.....w..y..x..t]./[....z..~..s..u.....s.....d.....]..}`.0............
..x........v..g..._.0......c.1..vZ.-..h...........r..z.....k.....}....
.......y..e`.0..p..`..y..j......b.1..t.....~..l.....{..o.....v..a.....
...u..~..w\..........r..{c.1.....}..r_.0..{.............nz....$IDATx^.
.3...........m..m..m.of...d.H.y....B.h.{.W...=.GT..b.*...3(.2..S.....}
.w4..J#...".G.(.R.cl0(.......a....h.Q.E.. s=r...<..z.\..l..u.1.\.Qk
.\7.fE..1......A....yS|..R.,..^-.1.8.\2.:..._K...."..t.e..v.Kk...._.W.
...z..5..=.b..^....n9a....No..1..V.....2?b.nBWa..1]......>.c.......
...mc.....oM.H....b....IEND.B`.HTTP/1.1 200 OK..Expires: Mon, 28 Jul 2
014 11:28:07 GMT..Date: Tue, 29 Apr 2014 11:28:07 GMT..Server: Tengine
..Content-Type: image/png..Content-Length: 39507..Last-Modified: Thu, 
20 Mar 2014 16:29:30 GMT..ETag: "532b176a-9a53"..Cache-Control: max-ag
e=7776000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 tzwl38:8106 (Cdn C
ache Server V2.0), 1.1 gl28:6 (Cdn Cache Server V2.0)..Connection: kee
p-alive...PNG........IHDR...`.................tEXtSoftware.Adobe Image
Readyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id=
"W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/"
 x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27  
<<< skipped >>>

GET /style/xiu/v1/img/bg/car_ivaca.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive



D.B`.HTTP/1.1 200 OK..Expires: Tue, 29 Jul 2014 11:53:06 GMT..Date: We
d, 30 Apr 2014 11:53:06 GMT..Server: Tengine..Content-Type: image/png.
.Content-Length: 2527..Last-Modified: Mon, 17 Mar 2014 05:56:06 GMT..E
Tag: "53268e76-9df"..Cache-Control: max-age=7776000..Accept-Ranges: by
tes..Age: 1..X-Via: 1.1 tzwl34:8080 (Cdn Cache Server V2.0), 1.1 gl25:
0 (Cdn Cache Server V2.0)..Connection: keep-alive.....PNG........IHDR.
......v........]....IDATx^..{.TW...........E.Rv.T....ak.hjZ.)[email protected]"H.
..Z.i...&..........I........&....R,P............xr&3gw...Yf.;.~?......
.~.....J)...H|.!..P(B(..P.B..E.."..P(B(..P.B.B..."..P(B(..P.B.B..."...
.*.=/...S.6.X....M..].v......p.R..../.8.`n#f..C<[email protected].\.....p.WW&
lt;....p=(.2u..Sf,.oK.@... \O..'..m=P.s.T.P.8[.nE%q.....xC.......H.. J
.J.*6D....`.Bd.....2eA......k{....O\.........kM.H.*l..:....]...: P...$
.8.*...zD....8......!.5..92.$m..q.....J.#^;.p. *D.A(.r1..?....I8R .. .
2{...L.-SUm.d..B:.$....W...e......L2.e...PI....j.t#L(..!..u"..PP.H.D.P
(........?~0...ZK...'...p.S6....*...F..`7Z;\..B)....l......g.kp..:0.w/
..XK.#!.3..... .X.Z......M;..H.%.23)q..f/.3..t.{.L..x.M..k....9i......
.Q.!.B~bA..q.|.....&'....,.U.,......O..F;..2.de1..&k=....l....m.......
..B...B...F[...w. lz.......2Y..s....~.=..l...xA.[;<<.2.;.m...(..
.uVL....K...Q.u.R....%1..*.).R...XP.1..)V.S.\..<h.K. .Ii..s..i...g3
...je.\;...l...Y...*.*3..}..~0b.....d..q.u7...y1......&3.....t..k..F..
N.X...l]V...........0.Kv\-....%%..Y.,.S.4..d0...9.?...o.d..........b..
.f/4.......5....qD_.^.....J..}.2...J.....[.~~W...|...~....<z...
<<< skipped >>>

GET /style/xiu/v1/img/bg/player_woxiu.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 29 Jul 2014 11:53:06 GMT
Date: Wed, 30 Apr 2014 11:53:06 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 9299
Last-Modified: Mon, 17 Mar 2014 05:56:06 GMT
ETag: "53268e76-2453"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx164:8080 (Cdn Cache Server V2.0), 1.1 gl24:6 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.......3.....3fR.....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S..;s.4.. .J....K..F.....-\.....H..Q:w.
Bh......f..g?..."....q6lP.I0x..KJ4r......1..z....]EE..u.V..9......s...
...; ......0..71....{....m.,..t...C.k....A...?%.8$.~.....4. ..G....).@
rr?....]Nn.....i.._..}_Q!b.c.^.,.v........6.'-.i...;%.....y..f.V..e>
;m.Z..;..T..O_...~]]-oL.X.D"!###.555|. .........$}.T.xf......V..@.....
o... ...6. ....r.c..5o..>...........\].....uw....lll...fd..-Z...M..
..........y........j...:..([email protected].......\
<<< skipped >>>

GET /style/xiu/v1/img/rev/rev_sprite.png?v=0930 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 29 Jul 2014 19:41:25 GMT
Date: Wed, 30 Apr 2014 19:41:25 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 36532
Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT
ETag: "53268e81-8eb4"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx155:8107 (Cdn Cache Server V2.0), 1.1 gl28:7 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR...D...8.......3.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...iiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:21988CCD6D29E211A03E8433F7940ECA" xmpMM:DocumentID="xmp.did:C840
5DF35BCA11E3A5E9DC973D7B02ED" xmpMM:InstanceID="xmp.iid:C8405DF25BCA11
E3A5E9DC973D7B02ED" xmp:CreatorTool="Adobe Photoshop CC (Windows)">
 <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ef6e30a8-5a5d-8f42-86
f4-d8249bc420ec" stRef:documentID="xmp.did:21988CCD6D29E211A03E8433F79
40ECA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?>..D.....PLTE.....M...............r......@.
....9.qqq........S.F...............R.....e.6x.P...._......z.@@@...(=..
..}.C.........)V....Q..u}.`..!D.C.Z..Ucw...QS.c......#_.....].../B.=K&
K.-K2........gP...f.C.V(.D."/qujZ...]......uc....[.......?Mt...|A$...:
...I2.... 5o..4..R;.vQ........P.3.T.tu9......[...T........V.Z.Q...Zf.^
,KOO.j.%].......RB.=..,..l.bAA.......K..*X3.]..*..... ..]{......E.....
%.lB.`.P.C....i-T..h..E. .........B...^.:%Y.....R.... o...........V).'
.m....r..h.......Q)T.*......>!=. .Z."bC-K...x. .I...>.s.}...
<<< skipped >>>

GET /style/xiu/v1/img/rev/rev_icon.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Fri, 01 Aug 2014 02:43:24 GMT
Date: Sat, 03 May 2014 02:43:24 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 25248
Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT
ETag: "53268e81-62a0"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl39:88 (Cdn Cache Server V2.0), 1.1 gl28:9 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR...............mT....PLTE.............................
...........P.........s.w..;.K......s....e.......9.........W~=.6v......
..............i......jjk.....3.....P..........Q..y*..........c........
.........S...........<..C..A.......4.............NH.f...d.W*.......
......i...........,.....K..1.....u.I..2V.............:....yq..........
.............b.........................`....1.....^..x8.u....z........
.........[Z....h.......865.2......................r....P.........c...M
.............v3...............7.'.................l..K.....c.........u
.....T....n...............|..n.B.........u.V..............Q...........
...............gO................x........U.........H.................
..b..................o.{.....s...C......................I_[.W...u.....
..5............................X........2\[email protected].._NIDATx^.
..........=.m....m.....m..G...?.oU.I&......}..J...N........|C../.~..].
.$i*?.p....|[email protected].;..5......)7WW...`@..Y...&O.I..o.\..
..N.W.....Y...Tl..0.)...m..9' .9..N.........Q=*........uO....p...h}...
j...t......fZ.>.7..;.....s..'..H{p.....h.g....5..^[[....5..8..v[.X.
jG.....T.q0...;......D.,%v..3.".w. ..ZRK...C..5..`.=.n...=....>.'..
.N.Ld.o'.......##mW..xl.k.q.....K.N,9f?c..1f.W3[.....`.-...J.....E:.aZ
.\...W.Y4..cRc.........v....*VJ...HF...j[[email protected]...>7:tj\h\N.
.j.....#KJ.....lg.v..(.$..h%0/28.d..Hxg.e.\.....l......nh....v.(..L...
...>.i....!......G.R..-M.u.j..9.r...-^...U.pL..fL../..../Q..]f .J..
G..g.im.....BbH....]....."......$.....QV..e..".%....>.bI.jm...:
<<< skipped >>>

GET /style/xiu/v1/img/rev/rev_icon.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Fri, 01 Aug 2014 02:43:24 GMT
Date: Sat, 03 May 2014 02:43:24 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 25248
Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT
ETag: "53268e81-62a0"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl39:88 (Cdn Cache Server V2.0), 1.1 gl28:9 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR...............mT....PLTE.............................
...........P.........s.w..;.K......s....e.......9.........W~=.6v......
..............i......jjk.....3.....P..........Q..y*..........c........
.........S...........<..C..A.......4.............NH.f...d.W*.......
......i...........,.....K..1.....u.I..2V.............:....yq..........
.............b.........................`....1.....^..x8.u....z........
.........[Z....h.......865.2......................r....P.........c...M
.............v3...............7.'.................l..K.....c.........u
.....T....n...............|..n.B.........u.V..............Q...........
...............gO................x........U.........H.................
..b..................o.{.....s...C......................I_[.W...u.....
..5............................X........2\[email protected].._NIDATx^.
..........=.m....m.....m..G...?.oU.I&......}..J...N........|C../.~..].
.$i*?.p....|[email protected].;..5......)7WW...`@..Y...&O.I..o.\..
..N.W.....Y...Tl..0.)...m..9' .9..N.........Q=*........uO....p...h}...
j...t......fZ.>.F...w.L t.%.b...C....p.8..8-.I[.]H....Q.).....bKKC.
..'..{D.I.8q.._..W.:.......'...g....'.}'\GG.KB.4tsH...xN...*..........
w.[.9...u.*....m...=f..E.z.F..`...pM..7..p.t.>...=.......2//u1.2.SQ
,U..-X.w...../.Xr...6mR.R.a.jy.l....7..O..................?.a.......rO
O...Z5.g......7...?..'.....7$**$**.[.O.t.sd.D....-)y....8....;....c...
....1......2.Sj..Mr..3y..N8}!......\9.....?m...=O.m...$d_........d....
:.FA...M`;<.....U.....m.....>....3>..P.......i.9@E. JJp.p
<<< skipped >>>

GET /style/xiu/v1/img/rev/rev_gift.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 29 Jul 2014 11:50:10 GMT
Date: Wed, 30 Apr 2014 11:50:10 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 1126
Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT
ETag: "53268e81-466"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx157:8104 (Cdn Cache Server V2.0), 1.1 gl24:2 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR...x...x.............tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:FB33041E0987E211A3AE8E6F1AE7A727" xmpMM:DocumentID="xmp.did:D643
5675871011E2BBF5D45DA86052CD" xmpMM:InstanceID="xmp.iid:D6435674871011
E2BBF5D45DA86052CD" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FB33041E0987E211A3AE
8E6F1AE7A727" stRef:documentID="xmp.did:FB33041E0987E211A3AE8E6F1AE7A7
27"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.b.[....PLTE......U..~....tRNS....0J...vIDATx
......1..0n...B>)..Y.. A........{pJp.....,.#9..D..;..1.....`0......
.jj.................`0.....`0.....`0..........c.7.b-......IEND.B`.nt>....
<<< skipped >>>

GET /style/xiu/v1/img/rev/rev_gift.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive



jj.................`0.....`0.....`0..........c.7.b-......IEND.B`.HTTP/
1.1 200 OK..Expires: Tue, 29 Jul 2014 11:50:10 GMT..Date: Wed, 30 Apr 
2014 11:50:10 GMT..Server: Tengine..Content-Type: image/png..Content-L
ength: 1126..Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT..ETag: "5326
8e81-466"..Cache-Control: max-age=7776000..Accept-Ranges: bytes..Age: 
1..X-Via: 1.1 zjjx157:8104 (Cdn Cache Server V2.0), 1.1 gl24:2 (Cdn Ca
che Server V2.0)..Connection: keep-alive.....PNG........IHDR...x...x..
...........tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.x
mp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <
;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 6
4.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf="http
://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:a
bout="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="htt
p://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adob
e.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:FB33041E0987E211A3AE
8E6F1AE7A727" xmpMM:DocumentID="xmp.did:D6435675871011E2BBF5D45DA86052
CD" xmpMM:InstanceID="xmp.iid:D6435674871011E2BBF5D45DA86052CD" xmp:Cr
eatorTool="Adobe Photoshop CS5.1 Windows"> <xmpMM:DerivedFrom st
Ref:instanceID="xmp.iid:FB33041E0987E211A3AE8E6F1AE7A727" stRef:docume
ntID="xmp.did:FB33041E0987E211A3AE8E6F1AE7A727"/> </rdf:Descript
ion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.
b.[....PLTE......U..~....tRNS....0J...vIDATx......1..0n...B>)..
<<< skipped >>>

GET /style/xiu/v1/img/rev/rev_uhd.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 29 Jul 2014 11:50:10 GMT
Date: Wed, 30 Apr 2014 11:50:10 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 4383
Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT
ETag: "53268e81-111f"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl33:88 (Cdn Cache Server V2.0), 1.1 gl27:0 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.......X......>......tEXtSoftware.Adobe ImageReadyq
.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0M
pCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
tk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        ">
; <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"&
gt; <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/
xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRe
f#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID=
"xmp.did:E4D38D0E6881E211842D8E94CD835775" xmpMM:DocumentID="xmp.did:5
1CD88D8033711E385EEAF2E30CE333E" xmpMM:InstanceID="xmp.iid:51CD88D7033
711E385EEAF2E30CE333E" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0A0C74C5FE02E311B
2A8C78864F3AB4B" stRef:documentID="xmp.did:E4D38D0E6881E211842D8E94CD8
35775"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?>.`\.....PLTE......,,,....k................
....r........}....................[...................................
.....]..]..]..]..]..]..]..]...........................:tA.tA.tA.tA.tA.
tA.tA.tA.t...........................]..]..]..]..]..]..]..]...........
................:tA.tA.tA.tA.tA.tA.tA.tA.t...........................]
..]..]..]..]..]..]..]...........................:tA.tA.tA.tA.tA.tA.tA.
tA.t...........................]..]..]..]..]..]..]..].................
.........C.tA.tA.tA.tA.tA.t......W.|.qj.Y....IEND.B`..........m.44
<<< skipped >>>

GET /style/xiu/v1/img/rev/rev_uhd.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 29 Jul 2014 11:50:10 GMT
Date: Wed, 30 Apr 2014 11:50:10 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 4383
Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT
ETag: "53268e81-111f"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl33:88 (Cdn Cache Server V2.0), 1.1 gl27:0 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.......X......>......tEXtSoftware.Adobe ImageReadyq
.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0M
pCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
tk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        ">
; <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"&
gt; <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/
xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRe
f#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID=
"xmp.did:E4D38D0E6881E211842D8E94CD835775" xmpMM:DocumentID="xmp.did:5
1CD88D8033711E385EEAF2E30CE333E" xmpMM:InstanceID="xmp.iid:51CD88D7033
711E385EEAF2E30CE333E" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0A0C74C5FE02E311B
2A8C78864F3AB4B" stRef:documentID="xmp.did:E4D38D0E6881E211842D8E94CD8
35775"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?>.`\.....PLTE......,,,....k................
....r........}....................[...................................
.....]..]..]..]..]..]..]..]...........................:tA.tA.tA.tA.tA.
tA.tA.tA.t...........................]..]..]..]..]..]..]..]...........
................:tA.tA.tA.tA.tA.tA.tA.tA.t...........................]
..]..]..]..]..]..]..]...........................:tA.tA.tA.tA.tA.tA.tA.
tA.t...........................]..]..]..]..]..]..]..].................
.........C.tA.tA.tA.tA.tA.t......W.|.qj.Y....IEND.B`..........m.44
<<< skipped >>>

GET /style/xiu/v1/img/rev/rev_uhd.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 29 Jul 2014 11:50:10 GMT
Date: Wed, 30 Apr 2014 11:50:10 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 4383
Last-Modified: Mon, 17 Mar 2014 05:56:17 GMT
ETag: "53268e81-111f"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl33:88 (Cdn Cache Server V2.0), 1.1 gl27:0 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.......X......>......tEXtSoftware.Adobe ImageReadyq
.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0M
pCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
tk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        ">
; <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"&
gt; <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/
xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRe
f#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID=
"xmp.did:E4D38D0E6881E211842D8E94CD835775" xmpMM:DocumentID="xmp.did:5
1CD88D8033711E385EEAF2E30CE333E" xmpMM:InstanceID="xmp.iid:51CD88D7033
711E385EEAF2E30CE333E" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0A0C74C5FE02E311B
2A8C78864F3AB4B" stRef:documentID="xmp.did:E4D38D0E6881E211842D8E94CD8
35775"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?>.`\.....PLTE......,,,....k................
....r........}....................[...................................
.....]..]..]..]..]..]..]..]...........................:tA.tA.tA.tA.tA.
tA.tA.tA.t...........................]..]..]..]..]..]..]..]...........
................:tA.tA.tA.tA.tA.tA.tA.tA.t...........................]
..]..]..]..]..]..]..]...........................:tA.tA.tA.tA.tA.tA.tA.
tA.t...........................]..]..]..]..]..]..]..].................
.........C.tA.tA.tA.tA.tA.t......W.|.qj.Y....IEND.B`..........m.44
<<< skipped >>>

GET /style/xiu/v1/img/activity/blank.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 29 Jul 2014 11:50:12 GMT
Date: Wed, 30 Apr 2014 11:50:12 GMT
Server: Tengine
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 17 Mar 2014 05:56:18 GMT
ETag: "53268e82-2b"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 tzwl38:8106 (Cdn Cache Server V2.0), 1.1 gl29:0 (Cdn Cache Server V2.0)
Connection: keep-alive
GIF89a..........o.r!.......,...........D..;....


GET /style/xiu/base/v1/img/gift/game_icon/lock.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive



.....S.<....4>g.KY.-.....B.d..&.A.....R.).6..(..P..aU..Y.f....v.
.. .(..$.h..(....,....0.(c....;HTTP/1.1 200 OK..Expires: Tue, 29 Jul 2
014 11:50:10 GMT..Date: Wed, 30 Apr 2014 11:50:10 GMT..Server: Tengine
..Content-Type: image/gif..Content-Length: 1159..Last-Modified: Mon, 1
7 Mar 2014 05:56:41 GMT..ETag: "53268e99-487"..Cache-Control: max-age=
7776000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 tzwl38:80 (Cdn Cache
 Server V2.0), 1.1 gl28:5 (Cdn Cache Server V2.0)..Connection: keep-al
ive....GIF89a*.*......................................................
|.....|.....{..z..............j..k........j..n..n.._..................
...........i.....b..a.....[..............b..b..f.....Z..g.....Z.......
.............[........u........t..Z.....[.....}........w..U........V..
v..S..R..C.....M........N..L.....N...........&..L..L..H..B..M..A..G..L
..7..7..@[email protected][email protected].....#..".....6..>..=.
....6..6..<.....<..6..6..7..?..1..?..1..6..:..#../.....:.. .....
8..#..*..8.....3..3../.y(.|c.yW.xZ.x[.x[.x-.w-.t .W.9&................
......................................................................
......................................................................
......................................................................
...........................!.......,....*.*.....[..H......(\.......f. 
.....!jD.....Z.i1..C..(..H`.."..X [email protected]&....!.."h....D..E9.
A.bi..A.F-.P........&..... A.....I.4i.d....f...BC..06P......w.....C..i
........a|$......C.L....&6CV....'.%ulTa... To.I.qgI....4Rr..$P.@9J
<<< skipped >>>

GET /style/xiu/base/v1/img/gift/game_icon/lock.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive



.....S.<....4>g.KY.-.....B.d..&.A.....R.).6..(..P..aU..Y.f....v.
.. .(..$.h..(....,....0.(c....;HTTP/1.1 200 OK..Expires: Tue, 29 Jul 2
014 11:50:10 GMT..Date: Wed, 30 Apr 2014 11:50:10 GMT..Server: Tengine
..Content-Type: image/gif..Content-Length: 1159..Last-Modified: Mon, 1
7 Mar 2014 05:56:41 GMT..ETag: "53268e99-487"..Cache-Control: max-age=
7776000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 tzwl38:80 (Cdn Cache
 Server V2.0), 1.1 gl28:5 (Cdn Cache Server V2.0)..Connection: keep-al
ive....GIF89a*.*......................................................
|.....|.....{..z..............j..k........j..n..n.._..................
...........i.....b..a.....[..............b..b..f.....Z..g.....Z.......
.............[........u........t..Z.....[.....}........w..U........V..
v..S..R..C.....M........N..L.....N...........&..L..L..H..B..M..A..G..L
..7..7..@[email protected][email protected].....#..".....6..>..=.
....6..6..<.....<..6..6..7..?..1..?..1..6..:..#../.....:.. .....
8..#..*..8.....3..3../.y(.|c.yW.xZ.x[.x[.x-.w-.t .W.9&................
......................................................................
......................................................................
......................................................................
...........................!.......,....*.*.....[..H......(\.......f. 
.....!jD.....Z.i1..C..(..H`.."..X [email protected]&....!.."h....D..E9.
A.bi..A.F-.P........&..... A.....I.4i.d....f...BC..06P......w.....C..i
........a|$......C.L....&6CV....'.%ulTa... To.I.qgI....4Rr..$P.@9J
<<< skipped >>>

GET /style/xiu/base/v1/img/gift/game_icon/lock.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive



.....S.<....4>g.KY.-.....B.d..&.A.....R.).6..(..P..aU..Y.f....v.
.. .(..$.h..(....,....0.(c....;HTTP/1.1 200 OK..Expires: Tue, 29 Jul 2
014 11:50:10 GMT..Date: Wed, 30 Apr 2014 11:50:10 GMT..Server: Tengine
..Content-Type: image/gif..Content-Length: 1159..Last-Modified: Mon, 1
7 Mar 2014 05:56:41 GMT..ETag: "53268e99-487"..Cache-Control: max-age=
7776000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 tzwl38:80 (Cdn Cache
 Server V2.0), 1.1 gl28:5 (Cdn Cache Server V2.0)..Connection: keep-al
ive....GIF89a*.*......................................................
|.....|.....{..z..............j..k........j..n..n.._..................
...........i.....b..a.....[..............b..b..f.....Z..g.....Z.......
.............[........u........t..Z.....[.....}........w..U........V..
v..S..R..C.....M........N..L.....N...........&..L..L..H..B..M..A..G..L
..7..7..@[email protected][email protected].....#..".....6..>..=.
....6..6..<.....<..6..6..7..?..1..?..1..6..:..#../.....:.. .....
8..#..*..8.....3..3../.y(.|c.yW.xZ.x[.x[.x-.w-.t .W.9&................
......................................................................
......................................................................
......................................................................
...........................!.......,....*.*.....[..H......(\.......f. 
.....!jD.....Z.i1..C..(..H`.."..X [email protected]&....!.."h....D..E9.
A.bi..A.F-.P........&..... A.....I.4i.d....f...BC..06P......w.....C..i
........a|$......C.L....&6CV....'.%ulTa... To.I.qgI....4Rr..$P.@9J
<<< skipped >>>

GET /style/xiu/base/v1/img/gift/game_icon/lock.gif HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s3.56img.com
Connection: Keep-Alive



.....S.<....4>g.KY.-.....B.d..&.A.....R.).6..(..P..aU..Y.f....v.
.. .(..$.h..(....,....0.(c....;HTTP/1.1 200 OK..Expires: Tue, 29 Jul 2
014 11:50:10 GMT..Date: Wed, 30 Apr 2014 11:50:10 GMT..Server: Tengine
..Content-Type: image/gif..Content-Length: 1159..Last-Modified: Mon, 1
7 Mar 2014 05:56:41 GMT..ETag: "53268e99-487"..Cache-Control: max-age=
7776000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 tzwl38:80 (Cdn Cache
 Server V2.0), 1.1 gl28:5 (Cdn Cache Server V2.0)..Connection: keep-al
ive....GIF89a*.*......................................................
|.....|.....{..z..............j..k........j..n..n.._..................
...........i.....b..a.....[..............b..b..f.....Z..g.....Z.......
.............[........u........t..Z.....[.....}........w..U........V..
v..S..R..C.....M........N..L.....N...........&..L..L..H..B..M..A..G..L
..7..7..@[email protected][email protected].....#..".....6..>..=.
....6..6..<.....<..6..6..7..?..1..?..1..6..:..#../.....:.. .....
8..#..*..8.....3..3../.y(.|c.yW.xZ.x[.x[.x-.w-.t .W.9&................
......................................................................
......................................................................
......................................................................
...........................!.......,....*.*.....[..H......(\.......f. 
.....!jD.....Z.i1..C..(..H`.."..X [email protected]&....!.."h....D..E9.
A.bi..A.F-.P........&..... A.....I.4i.d....f...BC..06P......w.....C..i
........a|$......C.L....&6CV....'.%ulTa... To.I.qgI....4Rr..$P.@9J
<<< skipped >>>


GET /style/xiu/v1/img/bg/dy_rkxin1.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 12 Aug 2014 12:51:21 GMT
Date: Wed, 14 May 2014 12:51:21 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 56801
Last-Modified: Mon, 17 Mar 2014 05:56:06 GMT
ETag: "53268e76-dde1"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx163:8105 (Cdn Cache Server V2.0), 1.1 jydx37:6 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.......l.......Fe....sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS4....... prVWx..Y.v.6........S.....
.........2==...S....}.Y..Q.0.F.0.pT.].K@...{/W..../../...[.X.X.X...gy.
...)...#..,.X.X..4eI......*,.W...4O.<...(...Y.-..$...p....$A.q.....
/<.=..........|[email protected][.lS.....E...).S.
..(..G.....u}......E :.../..}.^......."J.ZB...5>gm....Q.....F...._-
...8v.GN.........c.!.nq..!..H..D}iZ;......8..n.8$...:.O....{.Y..B..O9y
...iI....,Gw.W..i.g.h.......47..]U.C.O.K~sg{..\......<.....c...V).5
.K...Y\.$.~I".....*.;..O...M..<..?[jp`z..N...V.B.....k...J...Q.{..7
.......?.4.[..<.h...e/.............Oc...?$.......xY....5....9P.1...
.2..94..z..A...^.9...o_.'.,.....v...a...M..r..>*.<c.....{z......
o.........f.....nwB..W.................q.."..4"M.a........-."....3.i..
".s.......Xt..#..o...b.................OZ..\..Xy?`......d.....O.......
..d......_.?q.....>.............=..........p......{....Bv.........b
Km.w.....qk.._....c......M....w .{.....a/U?....}...6........b.l=......
...9..=..GA...![..t.~....P>.... .G...Ga:@.AM...l=.B~...z....;......
\...!?B.l=.....j...e.Q..#t...0...P.o....l=.B~...z........r.V.....![..t
......Z.e.Q..#t.........i3......HmkBF.................................
.......................................).3...:0mkTSx..}K..IZ...x.n.m{f
e..4....03.........{...\Um...S..i....~.."g`[email protected].
.{#./".2##.........|F../~.."s.....n.w0..w...c.mu..E.....V.t....v....}.
...t..j..[}g..U...s...........r.....v.l\..?....X....Ky....r..(....
<<< skipped >>>

GET /style/xiu/v1/img/bg/dy_rkxin1.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.woxiu.com/80928328?p=20111931
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s2.56img.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Tue, 12 Aug 2014 12:51:21 GMT
Date: Wed, 14 May 2014 12:51:21 GMT
Server: Tengine
Content-Type: image/png
Content-Length: 56801
Last-Modified: Mon, 17 Mar 2014 05:56:06 GMT
ETag: "53268e76-dde1"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zjjx163:8105 (Cdn Cache Server V2.0), 1.1 jydx37:6 (Cdn Cache Server V2.0)
Connection: keep-alive
.PNG........IHDR.......l.......Fe....sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS4....... prVWx..Y.v.6........S.....
.........2==...S....}.Y..Q.0.F.0.pT.].K@...{/W..../../...[.X.X.X...gy.
...)...#..,.X.X..4eI......*,.W...4O.<...(...Y.-..$...p....$A.q.....
/<.=..........|[email protected][.lS.....E...).S.
..(..G.....u}......E :.../..}.^......."J.ZB...5>gm....Q.....F...._-
...8v.GN.........c.!.nq..!..H..D}iZ;......8..n.8$...:.O....{.Y..B..O9y
...iI....,Gw.W..i.g.h.......47..]U.C.O.K~sg{..\......<.....c...V).5
.K...Y\.$.~I".....*.;..O...M..<..?[jp`z..N...V.B.....k...J...Q.{..7
.......?.4.[..<.h...e/.............Oc...?$.......xY....5....9P.1...
.2..94..z..A...^.9...o_.'.,.....v...a...M..r..>*.<c.....{z......
o.........f.....nwB..W.................q.."..4"M.a........-."....3.i..
".s.......Xt..#..o...b.................OZ..\..Xy?`......d.....O.......
..d......_.?q.....>.............=..........p......{....Bv.........b
Km.w.....qk.._....c......M....w .{.....a/U?....}...6........b.l=......
...9..=..GA...![..t.~....P>.... .G...Ga:@.AM...l=.B~...z....;......
\...!?B.l=.....j...e.Q..#t...0...P.o....l=.B~...z........r.V.....![..t
......Z.e.Q..#t.........i3......HmkBF.................................
.......................................).3...:0mkTSx..}K..IZ...x.n.m{f
e..4....03.........{...\Um...S..i....~.."g`[email protected].
.{#./".2##.........|F../~.."s.....n.w0..w...c.mu..E.....V.t....v....}.
...t..j..[}g..U...s...........r.....v.l\..?....X....Ky....r..(....
<<< skipped >>>


GET /AP5Min.aspx?AID=9842&Auth=1D705CD055EE5F1D53F74430175EDBD796364E506195CA19674CEFD23C1AB6A9&referer=http://VVV.cfmogu.com/&utz=1400382923323 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Server: Microsoft-IIS/7.5
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShow=1883; expires=Sun, 18-May-2014 11:07:20 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:20 GMT
Content-Length: 170
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://tg.51
.com/acpa/webgame/cy.html?from=tgly_14516">here</a>.</h2&g
t;..</body></html>......


GET /AP5Min.aspx?AID=9842&Auth=1D705CD055EE5F1D53F74430175EDBD796364E506195CA19674CEFD23C1AB6A9&referer=http://VVV.cfmogu.com/&utz=1400382924245 HTTP/1.1


Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShow=1805


HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: hXXp://tg.51.com/market/game/shequ.htm?f_com=tgx2_14516
Server: Microsoft-IIS/7.5
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShow=1805|1796; expires=Sun, 18-May-2014 11:07:24 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:24 GMT
Content-Length: 172
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://tg.51
.com/market/game/shequ.htm?f_com=tgx2_14516">here</a>.</h2
>..</body></html>......


GET /AP5Min.aspx?AID=9842&Auth=1D705CD055EE5F1D53F74430175EDBD754D01E8ABD08F3113992BEAC7A0623EE&referer=http://VVV.cfmogu.com/&utz=1400382933261 HTTP/1.1


Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: z.myzwqwe12.com
Connection: Keep-Alive
Cookie: UnionADShow=1805|1796|1995


HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: hXXp://v.6.cn/event/promimg/?src=pming393
Server: Microsoft-IIS/7.5
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
X-AspNet-Version: 2.0.50727
Set-Cookie: UnionADShow=1805|1796|1995|1946; expires=Sun, 18-May-2014 11:07:32 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:31 GMT
Content-Length: 158
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://v.6.c
n/event/promimg/?src=pming393">here</a>.</h2>..</bod
y></html>....



GET /pic/spacegif.gif HTTP/1.1
Accept: */*
Referer: hXXp://p.tuigoo.com/showcpm.htm?width=270&height=200&SCUrl=http://115.236.19.58/xm/2013.11.261.gif&gourl=http://z.myzwqwe12.com/CPVClick.aspx?AID=1805&PID=9756&Auth=6848383803FF6A6092490BA77624631CA1FA35D6FD9AE72FFF46957CF4C745CF&Url=http%3a%2f%2fv.6.cn%2fevent%2fpromimg%2f%3fsrc%3dpming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: js.tuigoo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/gif
Last-Modified: Tue, 06 Sep 2011 15:04:12 GMT
Accept-Ranges: bytes
ETag: "0fe5c3ca66ccc1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sun, 18 May 2014 08:07:24 GMT
Content-Length: 60
GIF89a.............!.......,............................S..;..



GET /live/2014/01/08/1003v1389132341757446858.jpg HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi5.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Sat, 12 Apr 2014 18:09:42 GMT
Content-Type: image/jpeg
Content-Length: 3504
Expires: Tue, 07 Apr 2015 18:09:42 GMT
Cache-Control: max-age=31104000
ETag: "2697778507"
Last-Modified: Tue, 07 Jan 2014 22:05:41 GMT
Powered-By-ChinaCache: HIT from 06047113L7
Age: 3074283
Powered-By-ChinaCache: HIT from 06011323SJ
......JFIF.....H.H.....C.....................................%...#... 
, #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((
((((((((((((((((((..........."........................................
7.........................!.1.AQa"q.2R.......#3Bb..$..................
..............."......................!.".1A.2aQ............?.~../ ...
U}F..H.....J.n...=.<.)..4....1...$............"....4.h.[.'..b..n..\
.y...#_.i5.k$O..f-&..<..a..*.....\.B..V...*..'...x.....I,.JO.-..j8.
 .;..X[....^G.....S....#\..F.>.......f$.......a..g....Tk.]?m.l....i
..;_q...M.~...... [email protected]
...TZ.%.O..GpT.......q...#.G.uTM*..c..<...K..#.}..{... .;.T......e.
.K....7..p3UR............E...K.F......UG:so:Y.%....l.Nh...y.)zI6L.?...
.z...F;.5e,..5i..H.9...P...apG.2J<.19.z.........'..A...4....x......
....]....[[email protected]\.m..s..T....O....r......JZY.D.'.2y.Hf...
m.^>rI..I)....#.U.$'...Pd..{.?!D..&h..Am....m0U.L.Q.jk{...b......V.
m....0..r.z6......yc....)y...Y&.\O.8.O.^p{....T.7.......T}.-5...cQbO.!
F>.-e.w;...0...K;.K...!v...A|.u...Mq.H......w.%...#....^..h......f.
d.#......"...P$..<..V.&bq...;.......K...8..[V...{.^..j.]....jG.....
l.....\[email protected]. Q.CR..........K.*..3..w....<.d...
..(.qSE# .G..7&.`...b}.sT..e.....U.:..,.a.<..j.o/.I..5...w.i.G.q...
. ....Bhb2..Ks-.c....).....h..f....t...N]Fvv.e(.....M.u<X6iW9..C...
W...F..c...W..6X9.l..vK..-....3.Vp........ce.....t....5}.~..YoO..O..._
......9..8.....g.D...9....*....s....;.{|.m.`.y.n..i..e.H.dy|.<.
<<< skipped >>>


GET /v3/op/gamenew.51.com/platform/act/51wt/apic_img/swfobject.js?file_v=20140103001 HTTP/1.1
Accept: */*
Referer: hXXp://tg.51.com/acpa/webgame/cy.html?from=tgly_14516
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p1.pic.51img1.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Tengine
Date: Sun, 18 May 2014 08:07:33 GMT
Content-Type: application/x-javascript
Last-Modified: Mon, 06 Jan 2014 03:45:43 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
f07...............v.H.W.....Y..1.......`'.....{...l!1..8X..U......f...
.....y...x9..w.I.h.8.....Z..)%...#/..1"J$.1.)......-......1.,....>.
./J.l.{..3Z.v..ag$1>..?...)g.f.E..i... ..}...pg..1'..]z....;...|...
Hh....­....cn|.....i.`\...~..'..86. $.....1.I4.F....h.0..h.......x..
...MO...k....._.).b8.M...,.lB.s...h..3.?.K....k.a...g.(...%..}..9.....
f.........S..0.'.1..%..{I.<..(...........Z.1....-..mj.&|.......A...
]oKAZt.In.{.`c..5.....4..~..iJ...|..qY@9..=.4.W...3].;.7C. -6l4...So.o
.A.,.......0y..>w?........X. :[email protected]...~k.
B2.v....6.)....o...V..|?...2....6..P.H.L.....X\...2..........WI. ...._
nU..?u!.W....[.|e........bP..HC}eI.J......l....=.B.._.....5...u.....4.
..L......O.Q.Z.h3f..m66..m62<...p.6...C.9i..u_vz..v.\..W.L..-wb...1
".; .(%N8..<.D.|.....ms...0t.@.....;..t.........%....u......'<..
..:X#.W..0H..2.C...F..vM.7...x.nO..L....Q.....>....h,.sl:..9.;.D*..
..$.. .J.}.m.< .b...<_;Q.....(!.R...b...g.s.....................
n.BV......".....6...:..[.M.....OM......d...v..x....N....M......p.%N/..
c.y..g....b.<.'..d..A6....V.n6....=@....../oo...)_.....J.1$.J..h..`
.6...vf............/hx.......a.\.G..$.^.h....J.....(HA0..S...l"-.F_}.d
.."..Zv.O-.....-.(.L...$...<.4...4.#........lO...P..%.^9....3......
...5g.. -dj...y........^.Z..AI.d..N......j.1.3oBF.o.............'...m.
g.....%:....2..<........XU\......j..H.O...:.u.x.tu.I.P...j....h(2..
...}.jK.60,.:...g.D.@4#....!....<.C...X.....#MW...*.0.tY..&d\\zn2..
.e.LU.1..].h...'.:..g.B.5..............`...K7.`.7....{}.BI....\..D
<<< skipped >>>


GET /9.gif?abc=1&rnd=417627783 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.cfmogu.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive
Cookie: cna=RVj/Cy0IRhYCAbhrJiY9QmtQ; atpsida=0e1b1ba714bea1243904f592_1400400453


HTTP/1.1 302 Found
Server: Tengine
Date: Sun, 18 May 2014 08:07:39 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: sca=2b5210fd; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=0e1b1ba714bea1243904f592_1400400459; expires=Wed, 15-May-24 08:07:39 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=RVj/Cy0IRhYCAbhrJiY9QmtQ
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;..



GET /event/promimg/?src=pming393 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: v.6.cn


HTTP/1.1 200 OK
Expires: Sun, 18 May 2014 08:13:48 GMT
Date: Sun, 18 May 2014 08:05:28 GMT
Server: ngx_openresty
Content-Type: text/html
Content-Length: 5641
Last-Modified: Sun, 18 May 2014 07:59:29 GMT
Cache-Control: max-age=500
Content-Encoding: gzip
Accept-Ranges: bytes
X-HITS: 3
Age: 134
X-Via: 1.1 zw11:80 (Cdn Cache Server V2.0), 1.1 yfdx32:6 (Cdn Cache Server V2.0)
Connection: keep-alive
...........[.s.G..l...&Jn,g-...,..S` a/.68...M.....3.(3#....H.......o.
.. ....bH...~......_...==..%..`....>}.}.........|k.V.h.......S. .e 
.(.v%-......x.0......<G}.......... ....nU.e..F.V.vhr........lu..i..
. *.....].........L`J......j...ZA.).f.=.v..hS.....W ..}..H.0..cZWW.R.F
#oL.F.hm.O....f..)$.L..S.....1.....&.[..k8.m........>[email protected]
]...7g...........o.<^.t.}\.w.~..1.........)4a.* {J..p.......Nr.....
..<<..6..8b.^.....J.y...Z.......o./]._...x.~.J....._-...|.....|.
>i.....{...j^9P_..m.3.............Z^:...3'..../^m.{.........7..h..c
...x.{p"0G..;......]?|....O.n.]^:.@_...cy........cW..4....YE..^.V. ...
.XE..sU[.....h....jf4.....V.V-....S..........2..s!>......1.,T.9.@p`
a..>. .i.Q.J....-e2R...W.ZY..K/..^}.Y..7f....'l... ..V..U..........
.PTz.=)o..%.m..{5.{....p.s;..0.`..GW..\...H8i.F......f,9 W.......N.`.m
*..mT.C....x=>&.K......N....y............2.pV5.....d..c.1...j.U...g
^)gaN..f 3/..<.Xj...;..h8...1.....A;(..is6...u ....:N..q.6)#-.f...9
=...".|L..<c...U...E..p,[."..G..0C....Vx..........3........<...V
..|&P..2.N/r.b....oB4...*.fI....[.Aj9.<.*.......2DKP$..v..m.R...-UK
5w e. ...1....$.....B!9.v...,......L.....K..... F...1m.9I.......I.d.Y-
o.3.h$.%Q.........<.jf.x..{.z.6w]...H4......44...L....E.....\.....S
.......1.X"H..cU].XVj.)......&.k..?...G....u..........jx.;q.c.N w.....
.n......%..6..C.......N....~..D.4......`Z.a....8...-..'I:...(5..U.fh.`
d`40.8.q...1.{..!.....Q.x...o6.Vh..6?....J..._^....3#....[.>Z.,....
o.i|v... fi~R`P..B..7....E....~.j..E.....\..U{.Q...4.....Gw\.\_@..
<<< skipped >>>

GET /event/promimg/proLiveInfo.php HTTP/1.1


x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v.6.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Expires: Sun, 18 May 2014 08:09:25 GMT
Date: Sun, 18 May 2014 08:01:05 GMT
Server: ngx_openresty
Content-Type: text/html
Content-Length: 45983
Last-Modified: Sun, 18 May 2014 07:53:43 GMT
Cache-Control: max-age=500
Content-Encoding: gzip
Accept-Ranges: bytes
X-HITS: 23
Age: 401
X-Via: 1.1 zw11:88 (Cdn Cache Server V2.0), 1.1 yfdx32:5 (Cdn Cache Server V2.0)
Connection: keep-alive
............[.$9r.._.a.Z..v.]jdd.2. ...........i..dWe...I.....)`f...ss
X.....zFX ......G..a.....7..,....../.._~.......?}.x.mJ.f.S....g...kQ..
....r^....k..3.E.|...:.6.........'~.._~...Oo..~.X...|z.......?......?}
.}...c....?..q......?.6.z..OoE..M5.RM..c...X.s_fU...Rv..?........?.?|.
.._>......y...?...-_._......_..[.BUy!k^._?.....yw..../....:.O/.....
..?..l...B..oQs..o........?T..d....n};o......?~|?..u..=.../..........r
.}{X.w_....r.9c..._XN..|...............or..e.....73(...o....T..7..Z..r
.g...2W.....O.oy....-/>..Y^.KU.c..Y.EU.K>.....S*a...R]..8c.....q
6.'..M...;/............|. [....^..._...F/G....%[.u..ni ..)...l...Em.?.
w>./\...Y. .g....y..R..|.........|z..Oo..,.......S...1..].......}..
_>......r.._.;../...e..&]g....s......X.)5E.'V....M].'>K.o~Yl...c
..o.Cf^b.9.mP...];,U...... .q..ln.1.......]..=^-.cM..r56..j.:65..._.f.
..Yy.tl7...Vk........n....vV..........=[.-.m..^UW..Vs6d.........~7!..-
.d\..2..P/...Wm....[..R.y.~.UY....w.5Ep..Qa.m1:7....J.@...#.....7m.[.k
...._...<SE....[o..Q;...X....~=.l...VW..V..[.....R5.s(..W..|.z...RE
1-...,..<<....s.Z..Z.0gS....<r.O..z,...=.....V.rO.K....>,6
i.....w...h......J^[email protected];.=....q.|.o...%..g.sY.m>.<..u7.
K6......o.....^......6z....OW..|..W..W].....Xg..L.k.]..k..q...C,x.....
.CWJ.(.c..E..."U._(.Zy..h.Q...<K[...f.......t`,....i&..i.U.L3.z6TeJ
.[aUY...T..]..2L.n......<....M.l..R.Z.[Z......}...G.`9.d1Y.._...Q..
1...u../.....P.W.$...}>...5.\.E3.E9.y?VyW....._............N....^.&
.i.Y........g...:vp../.V.v...% .A.u..Be....w....G~.......J.n....[.
<<< skipped >>>

GET /api/liveInfoCk.php HTTP/1.1


Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: v.6.cn
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:48 GMT
Server: ngx_openresty
Content-Type: text/html
Content-Length: 20
Expires: Sun, 18 May 2014 08:06:08 GMT
Last-Modified: Sun, 18 May 2014 08:07:48 GMT
Cache-Control: no-cache
Set-Cookie: _LiveGuestUser=1043996620|游客zbv4a3; expires=Tue, 17-Jun-2014 08:07:48 GMT; path=/
Content-Encoding: gzip
Accept-Ranges: bytes
X-HITS: 0
X-Via: 1.1 zw11:88 (Cdn Cache Server V2.0), 1.1 yfdx32:5 (Cdn Cache Server V2.0)
Connection: keep-alive
....................HTTP/1.1 200 OK..Date: Sun, 18 May 2014 08:07:48 G
MT..Server: ngx_openresty..Content-Type: text/html..Content-Length: 20
..Expires: Sun, 18 May 2014 08:06:08 GMT..Last-Modified: Sun, 18 May 2
014 08:07:48 GMT..Cache-Control: no-cache..Set-Cookie: _LiveGuestUser=
1043996620|游客zbv4a3; expires=Tue, 17-Jun-2014 08:07:
48 GMT; path=/..Content-Encoding: gzip..Accept-Ranges: bytes..X-HITS: 
0..X-Via: 1.1 zw11:88 (Cdn Cache Server V2.0), 1.1 yfdx32:5 (Cdn Cache
 Server V2.0)..Connection: keep-alive..HTTP/1.1 200 OK..Date: Sun, 18 
May 2014 08:07:48 GMT..Server: ngx_openresty..Content-Type: text/html.
.Content-Length: 20..Expires: Sun, 18 May 2014 08:06:08 GMT..Last-Modi
fied: Sun, 18 May 2014 08:07:48 GMT..Cache-Control: no-cache..Set-Cook
ie: _LiveGuestUser=1043996620|游客zbv4a3; expires=Tue,
 17-Jun-2014 08:07:48 GMT; path=/..Content-Encoding: gzip..Accept-Rang
es: bytes..X-HITS: 0..X-Via: 1.1 zw11:88 (Cdn Cache Server V2.0), 1.1 
yfdx32:5 (Cdn Cache Server V2.0)..Connection: keep-alive..HTTP/1.1 200
 OK..Date: Sun, 18 May 2014 08:07:48 GMT..Server: ngx_openresty..Conte
nt-Type: text/html..Content-Length: 20..Expires: Sun, 18 May 2014 08:0
6:08 GMT..Last-Modified: Sun, 18 May 2014 08:07:48 GMT..Cache-Control:
 no-cache..Set-Cookie: _LiveGuestUser=1043996620|游客z
bv4a3; expires=Tue, 17-Jun-2014 08:07:48 GMT; path=/..Content-Encoding
: gzip..Accept-Ranges: bytes..X-HITS: 0..X-Via: 1.1 zw11:88 (Cdn Cache
 Server V2.0), 1.1 yfdx32:5 (Cdn Cache Server V2.0)..Connection: k
<<< skipped >>>


GET /twell/cookie/allocateCookie.jsp HTTP/1.1
Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:42 GMT
Content-Type: text/html;charset=utf-8
Connection: keep-alive
P3P: CP="NON DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa HISa TELa OTPa OUR UNRa IND UNI COM NAV INT DEM CNT PRE LOC"
Set-Cookie: QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; Domain=.qunar.com; Expires=Fri, 05-Jun-2082 11:21:49 GMT; Path=/
Set-Cookie: _q=""; Domain=.qunar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: _v=""; Domain=.qunar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: _t=""; Domain=.qunar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: QN21=""; Domain=.qunar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: QN15=""; Domain=.qunar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: QN16=""; Domain=.qunar.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Content-Length: 4
Server: QWS/1.0
........


GET /vataframe/b.html?_=20120830&rnd=flight_float_layer HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 15 May 2014 10:35:28 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /vataframe/b.html?_=20120830&rnd=flight_active_dynamic HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 15 May 2014 10:35:28 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /vataframe/b.html?_=20120830&rnd=couplet_load HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:54 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 15 May 2014 10:35:28 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /vataframe/b.html?_=20120830&rnd=ad_home_leftAD_bottom HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:55 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 15 May 2014 10:35:28 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /vataframe/b.html?_=20120830&rnd=ad_home_rightAD_top2 HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:55 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 15 May 2014 10:35:28 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /vataframe/b.html?_=20120830&rnd=topicLinkL HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=; QN6=auto_52283dc6


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:55 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 15 May 2014 10:35:28 GMT
Content-Encoding: gzip
Server: QWS/1.0
48a.............Vko.6..._..[..z.MS,[email protected]].m_.P"e..H....E...)Y....a
..y...{I..........Ej.H......9'Q.e...g......../o.<..KC..NhEe..z.= ./
..k.,.l6..0.f.]~.n...W2....!e.Eg.N...F*{z.....q/.....`......O......\ .
.K.o[....;...q.._....rw..*.)..E..J~6R.........uLlKULh.J.b....D/*C...z.
.....9.......!uy.....5xP....Y..n...3.Z`.2&...R3<.....e..h.,.......^
.O.X....Zg.5..V........]SX.D.-...pL0o...*5....z%.d.....uI....K..u...O.
.D.........9Bg...cj.(.....I...stTH.)..y........ ..z.._..Y5\...H..\....
..a.. i....;&|.0..........|..K.....H.PK?,..)?.PD...x>..~..s.jn.[.5.
..L..K...r)._./c1.e>2.P...o..9x..m%..C........$..X..........r..s..n
.W...0.....G.....i.....U?.}....h1..*.U.l....R...|;..)..,...I...xH.....
......6..{.#..3.._&.g.M6O..[Ae.h...[.k.E]T....>u........6......./..
pIo.A.k.<U...J..0.....P...n..........p.DaW.!!.....qI.$.f....r.*74..
z.d..^..-5...DA..i..}^ ..2T*.x.......q.o..W.&.0W.b..u3-......zW.{.....
'kaE!.p../c......|oWz...hZm.R;q....W...8...i..J#ZG....f.Hq...hw.1]v85\
.P.B.S..:EMZ.&Z.0....3.. .....A..Kkj..p.).A...,~...T....-..........s3.
 ........C.."...g'..j...".L......{UI.0@&s;/F..83......}..cP`aJz`.P.$&g
t;3..;..o.t.#....`......N...Eu...S2'O?O..........n_&f.'.......rA......
0......


GET /suggest/livesearch2.jsp?lang=zh&q=北京&sa=true&callback=top.XQS_1400382952605 HTTP/1.1


Accept: */*
Referer: hXXp://flight.qunar.com/?ex_track=auto_52283dc6
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.qunar.com
Connection: Keep-Alive
Cookie: QN99=6547; csrfToken=oz97I4W61BIWeospoZb67UWazGuHGAXv; QunarGlobal=192.168.6.236_-4b4f433c_1460e4bd4f2_-2076|1400400462094; QN1=wKgZEVN4alhJ4y5ZDPhTAg==; RT=


HTTP/1.1 200 OK
Date: Sun, 18 May 2014 08:07:56 GMT
Content-Type: application/x-javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: QWS/1.0
84..top.XQS_1400382952605({"userInput":"......","c":0,"result":[{"type
":3,"country":"......","key":"......","display":"......(BJ)"}]}.);..0.
.



GET /live/61/34/1ea2323ba908e33a81b5eae7269d6f0b.jpg HTTP/1.1
Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi4.6rooms.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/1.2.3
Date: Sat, 12 Apr 2014 18:05:46 GMT
Content-Type: image/jpeg
Content-Length: 18696
Expires: Tue, 07 Apr 2015 18:05:46 GMT
Cache-Control: max-age=31104000
ETag: "4159252273"
Last-Modified: Thu, 31 Oct 2013 10:35:14 GMT
Powered-By-ChinaCache: HIT from 06047113L7
Age: 3074523
Powered-By-ChinaCache: HIT from 060531B33F
......JFIF.....H.H.....<CREATOR: gd-jpeg v1.0 (using IJG JPEG v62),
 quality = 100....C...................................................
.................C....................................................
........................"..........................................F..
.......................!..1A..Qa."2q..#BR....b..Cr.....$3Sc...M.....
.............................,........................!1A..Q."a#2q...B
3.............?.........$9..z.)@lh.......p..;..&.....Q0..'5.C.^......z
h.}@`@u...[..t..-..O....WE....R..V..Ky..:K...k..u.r4...ugs..&..3.M"$..
.6........=.JXH...g.UA..p-pmw9......]R.H.s.d...K.....K...F.Q...E.k.-..
. ...q.=.kX.bX.7..mlI.....ry_...L.NN.......IJ=.E<..........sC.%.9.P
..~;T...'GU.7......C~j.y...F.4..... B..].2b.\V......{.`......g.@~<&
..Tv....VW....r6..}Qht...o....xP...[...,h.|.I....b*`...Dmv.@a-.! v..x.
..jT.E...G.X..d..N".C.=.4mk.IQ $o.M .............jS.vt....s..)...yo.%.
..8<..j..}9=.t.Ta^"..2...H...U.cl<m..U.s~d..Q......<_..H.Q.}.
.zM.0......mY.<. ......5.E..Q/C.c9.0.#..`.'8.cj....N..'/...~.{e[pL.
....y.Xo1o...-.:...^I.=Gm........F.e..c..U^....n.\tD.....o..0y$Bi..:..
............V..(X1.(.:.............U..0|.:.........I.......pG.!Ouq....
.y...)=q.4$e.6.b.nn1..Q\.l.2...Z..(...q..x....0..s..........O.'qDM0..]
........=Fk.V...7..xFk......e1.9.:......%.QP.F..!I..Q........=<B...
Q/[email protected]..<d.C..^.....d.<.[..8.N......4T..
.>T....e.!E...en,!#.'......vE..8.[^o.Rp........"...py......\.JG.}i.
8.g......U.....I....;`v.....#[email protected])
<<< skipped >>>

GET /live/52/51/5b5c3b1db777d118dda54fde2ca0b435.jpg HTTP/1.1


Accept: */*
Referer: hXXp://v.6.cn/event/promimg/?src=pming393
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi4.6rooms.com
Connection: Keep-Alive



 [email protected].;..U....w......^p.....N....Y.X..6h.w.Eh...Aa<...jm.
[email protected]).0.U 9...8#..=.d}[email protected].\.....
.g....=...3V%dT.#)s#.z.G..7W..QL.)..)*.$...lw..Juxf.VN..}.n.t......K..
0..d,.'9I=.w...n.F.j....s..D.`?.X...H(y#.6A..Z.|A.......R.G3N.......k.
#Z...`..i..U6v.N\#\!4.U6ZZB... ..cjp.Kj...........w...]S.R.F.T.S....t.
Vb.h.=U.....z..$.....W.)...\[.l3.............p@T)..............(s.c.=)
2..R....Ul.R\..(..|.<;.i.It.W6..6..BZU.A*.c.C.C...|......|..2.l.-C}
...5.5...m..2....sBS...._...S&..7...-.!(BR...t....mJ...P.........)I...
..|#;,...w(..Q5[.$N.C.0.)m.dehN....\d.J.K..>S...W...Ag.(W*z:.rI$.==
*(...Lx:^%.T.sn-<....=....ED..QH..V.NO..D.>.-..cLS..AR.q..7..\.V
..c.G.....Ip58...9..... Jx...2[.J.......OQ.0_.....z...5d.~!..<.e...
.....u.r.06.....MW...q..3.Y.$........A..N.=9~.v9.f.7.?.........:k...M.
q..}C.s[.....6...v....:....}J....... ..u......#@f<.Kwe.............
.j@.~._.|Y.j..,D.e.1qC.O:.-........ASCl.....N.O.....(eO.(..x#o..7Di.q.
.eE.2.m..........1....&.-.AFSM4.)m...F1.....K.:[email protected]..^.}
.'.T.2./{Y...m,.h.L!...O-.D.,.tJ.Pq....s.s.'..e....rG<.......nB}@.&
gt;..u..D(..N3QG.#&M.Cj...Tu$.E.%,.........[..C.O.w9.I.U.....M.$......
I8...........s...GS.....c..~.[.W...)...M....(..`.(....[..e;...........
L[.f....j.........(l?J8.........z.;.NO.......%xeG...j...Ww|...r:P.(ZA(
XW... w..r.c.&...n7C...$ DC..uM.I%x! N. `.w.t5......F<..1. T._(1.Z.
.Y..%..g..m.(m.H...z..s....-.S.....jbKeHY;.....q.WCC?.g...).R..]q..iq@
....>..qg.}...K.i.9...







The Trojan connects to the servers at the folowing location(s):







%original file name%.exe_992:




t$(SSh
~%UVW
u$SShe
kernel32.dll
user32.dll
imm32.dll
imedllhost09.ime
GetAsyncKeyState
EnumWindows
UnloadKeyboardLayout
RegOpenKeyExA
RegCloseKey
www.cfmogu.com
API.dll
.text
`.rdata
@.data
.rsrc
@.reloc
winmm.dll
crossfire.exe
[email protected]
smtp.126.com
[email protected]
http://open.baidu.com/special/time/
window.baidu_time(
?user32.dll
F%*.*f
CNotSupportedException
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
COMCTL32.DLL
CCmdTarget
__MSVCRT_HEAP_SELECT
iphlpapi.dll
SHLWAPI.dll
MPR.dll
WINMM.dll
WS2_32.dll
VERSION.dll
RASAPI32.dll
GetProcessHeap
WinExec
GetWindowsDirectoryA
KERNEL32.dll
GetKeyState
USER32.dll
GetViewportOrgEx
GDI32.dll
WINSPOOL.DRV
RegDeleteKeyA
RegCreateKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
OLEAUT32.dll
COMCTL32.dll
WSOCK32.dll
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCanonicalizeUrlA
WININET.dll
GetCPInfo
CreateDialogIndirectParamA
UnhookWindowsHookEx
SetWindowsHookExA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
comdlg32.dll
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.*)|*.*||
Shell32.dll
Mpr.dll
Advapi32.dll
User32.dll
Gdi32.dll
Kernel32.dll
(&07-034/)7 '
?? / %d]
%d / %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
%s:%d
windows
out.prn
%d.%d
%d / %d
%d/%d
Bogus message code %d
(%d-%d):
%ld%c
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
%s <%s>
Reply-To: %s
From: %s
To: %s
Subject: %s
Date: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
HELO %s
SMTP
AUTH LOGIN
LOGIN
AUTH=LOGIN
EHLO %s
Content-Type: application/octet-stream; name=%s
Content-Disposition: attachment; filename=%s
MAIL FROM:<%s>
RCPT TO:<%s>
.PAVCObject@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
zcÁ
#include "l.chs\afxres.rc" // Standard components
;!;&; ;2;9;?;
11D1[1a1m1
3044484<4@4
4B4C4Y4y4
11D1P1]1j1x1
4%4X4w4
>"?(?,?0?4?
http://www.cfmogu.com/index.html
www.cfmogu.cc
Y@http://www.cfmogu.com/0.htm
%System%\drivers\etc\hosts
127.0.0.1 www.cfyuanji.com
127.0.0.1 www.cfyuanji.net
127.0.0.1 www.cfyuanji.cc
127.0.0.1 cfyuanji.com
127.0.0.1 cfyuanji.net
127.0.0.1 cfyuanji.cc
127.0.0.1 www.cfyalan.com
127.0.0.1 www.cfyalan.net
127.0.0.1 www.cfyalan.cc
127.0.0.1 yy.cfyalan.com
127.0.0.1 cc.cfyalan.com
127.0.0.1 cfyalan.com
127.0.0.1 cfyalan.net
127.0.0.1 cfyalan.cc
127.0.0.1 www.cftianyue.com
127.0.0.1 www.cftianyue.net
127.0.0.1 www.cftianyue.cc
127.0.0.1 cftianyue.com
127.0.0.1 cftianyue.net
127.0.0.1 cftianyue.cc
%System%\drivers\etc\
^}•D
IMM32.dll
imehost.dll
ImeProcessKey
Windows
:):3:9:|:
= =$=(=,=0=4=8=
? ?$?(?,?
Keyboard Layout\Preload\
Keyboard Layout\Preload\1
Keyboard Layout\Preload\2
Keyboard Layout\Preload\3
Keyboard Layout\Preload\4
Keyboard Layout\Preload\5
Keyboard Layout\Preload\6
Keyboard Layout\Preload\7
Keyboard Layout\Preload\8
Keyboard Layout\Preload\9
Keyboard Layout\Preload\10
Keyboard Layout\Preload\11
Keyboard Layout\Preload\12
Keyboard Layout\Preload\13
Keyboard Layout\Preload\14
Keyboard Layout\Preload\15
Keyboard Layout\Preload\16
Keyboard Layout\Preload\17
Keyboard Layout\Preload\18
Keyboard Layout\Preload\19
Keyboard Layout\Preload\20
%*.*f
www.dywt.com.cn
(*.htm;*.html)|*.htm;*.html
.PAVCOleException@@
.PAVCOleDispatchException@@
c:\%original file name%.exe
RegCreateKeyA
oledlg.dll
L.DRV
.irR8)UZ1
~Z3%FO
.HxY"
-F}//
L..PG
0~.VA.x
.zk#{
IJ!b%x
.yr8T
a|ny%s
#e.mlV
"%ug{
F.xa,
.hb'<3
uRLS
\c.MX
?.lt{G
Wv%S 
%f}DZ
]O.HQ
bB%d)
.hs,r<2(
8903?<7-
[T.uR2
5.AOu
.JVFE
S|.qp
jj%f}
].gOp
.TJ!w
y{=e%c
I_.qE7
(*.*)
1.0.0.0
(http://www.eyuyan.com)
1, 0, 0, 1

iexplore.exe_1668:




%?9-*09,*19}*09
.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
USER32.dll
SHLWAPI.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
rsabase.dll
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
watson.microsoft.com
IEWatsonURL
%s -h %u
iedw.exe
Iexplore.XPExceptionFilter
jscript.DLL
mshtml.dll
mlang.dll
urlmon.dll
wininet.dll
shdocvw.DLL
browseui.DLL
comctl32.DLL
IEXPLORE.EXE
iexplore.pdb
ADVAPI32.dll
MsgWaitForMultipleObjects
IExplorer.EXE
IIIIIB(II<.Fg
7?_____ZZSSH%
)z.UUUUUUUU
,....Qym
````2```
{.QLQIIIKGKGKGKGKGKG
;33;33;0
8888880
8887080
browseui.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
Windows
Operating System
6.00.2900.5512






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
    2. 

  2. Delete the original Trojan file.
    3. 

  3. Delete or disinfect the following files created/modified by the Trojan:
    

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\wt_js[1].htm (58 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lock[1].gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2[1].swf (13689 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\vshow_player_woxiu.14.04.24.a[1].swf (9283 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\liver[2].js (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lpisearchd[1] (458 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\postmk_dc[1].png (819 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xiu_base_v.2[2].css (570 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_big_avatar[1].jpg (5 bytes)
    %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\irs01.net\mt_adtracker.sxx (102 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\24h[1].png (244 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\girlfall_5[1].js (392 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@woxiu[1].txt (3597 bytes)
    %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\www.56.com\flashApp\56_vshow_live.sxx (57 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\blank[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\rev_gift[2].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\livesearch2[1].jsp (132 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@qunar[2].txt (376 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (137 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lmx2369295492_56.com_[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\z_MIN_14.64[2].js (6748 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (130 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\chat_v.7[1].js (3974 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[2].html (1162 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sns_daytask_v.2[1].js (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\base_MIN_11.03[1].css (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ps[1].swf (5439 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gift_v.1[1].css (797 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ico_arr_ad[1].png (247 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\broadcast_v.1[1].js (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\player_woxiu[1].png (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\holidayService[1].xml (7741 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\vataplan[1].ifmRightFlightExt&ab=b&tile=14003829506057166236&city=北京 (880 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rev_icon[1].png (3856 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (145 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (249 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bg_tabsel[1].png (944 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (146 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-1.5.2.min[2].js (2575 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\56Ubbface[1].js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-1.4.4.min[2].js (1859 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\iwt-min[1].js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\common_v.1[1].css (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qq-29210884_b_56.com_[1].jpg (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\timer_bg[1].gif (241 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\xiu_login_v.2[1].css (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\shafa_v_1[1].js (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\vataplan[1].topicLinkL&ab=b&tile=14003829506057166236&city=北京 (951 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[5].html (1162 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ico_arrsel[1].png (249 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lmx2369295492_b_56.com_[1].jpg (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\QN1CS1[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b[1].htm (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ph_flower[1].png (4087 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_activity[1].css (2338 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\peihua[1].png (11620 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b[2].html (1162 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ico_la_v2_0508[1].png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\3[1].swf (3527 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cy[1].htm (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\2[1].swf (21178 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b[2].htm (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\footer_v10[1].png (392 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (302 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bg_bd_rex[1].jpg (443 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\qq-29210884_56.com_[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\SC[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\game_v.5[2].js (271 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pv_stat[4].htm (39 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\20140509_zx_728x90_4485_banner[1].gif (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cfmogu[1].htm (5461 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_guide_v.8[1].css (31 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lothario_v.1[1].js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\rev_uhd[1].png (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lowerPrice[1].jcp (714 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\rev_icon[1].png (1928 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\8efd23b6f7157a5825ca1383a6f311ca[1].jpg (532 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\crossdomain[1].xml (476 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\5b5c3b1db777d118dda54fde2ca0b435[1].jpg (3601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b[1].html (1162 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\spacegif[1].gif (60 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\vataplan[1].topicLinkR&ab=b&tile=14003829506057166236&city=北京 (958 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\xiu_small_avatar[1].jpg (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sns_v.5[1].js (2073 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@irs01[1].txt (167 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico_la_ie6[1].png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\framId=flight_float_layer&chan=flight&pg=home&pos=top&site=qunar&type=floating_layer&tile=14003829506057166236&city=北京[1] (74 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vataplan[2].ifmRightTextlink&ab=b&tile=14003829506057166236&city=北京 (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\mootools_MIN_1.4.5[2].js (1019 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\rev_uhd[1].png (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\iwt-min[1].js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\AClick[1].aspx (372 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sns_v.5[1].js (1928 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\seabed_treasure.11.07.29.a[1].swf (7169 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1003v1400080135920524999[1].jpg (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\framId=homeadSy&chan=flight&pg=home&pos=right_top&site=qunar&size=230x200&type=Tear_angle&tile=14003829506057166236&city=北京[1] (74 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cy[1].htm (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\btn_normal[1].png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lpisearchd[2] (494 bytes)
    %Documents and Settings%\%current user%\UserData\2Z89WTQV\www.woxiu[1].xml (238 bytes)
    %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (1075 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\no_userhead_s[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\game_v.5[1].js (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].php (1121 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (40384 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1003v1389132341757446858[1].jpg (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Header0428[1].png (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\framId=ad_home_leftAD_bottom&chan=flight&pg=home&pos=mid&site=qunar&size=728x90&tile=14003829506057166236&city=北京[1] (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[4].html (1162 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pv_stat[3].htm (39 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\3bbae0f3b3dc18c86886324a[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\public_v.1[1].js (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lock[2].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\livesearch2[1].jsp (132 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\e6u5-min[1].js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\newhistory[1].html (1317 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b[4].htm (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\wtcookie[1].htm (0 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bg_car[1].jpg (3783 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\xiu_guide_v.8[1].css (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\56Ubbface[1].js (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\520_Entrance[1].png (4673 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logo[1].png (1499 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\index[1].php (719 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1[2].swf (2581 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\3[1].swf (5831 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[3].html (1162 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1ea2323ba908e33a81b5eae7269d6f0b[1].jpg (3401 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-1.5.2.min[1].js (3707 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\public_v.1[1].js (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\qn1cs1_disable[1].gif (97 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b[1].htm (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sns_daytask_v.2[1].js (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xiu_activity[1].css (3235 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b[1].html (1162 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\framId=ad_home_rightAD_top2&chan=flight&pg=home&pos=top&site=qunar&size=230x90&tile=14003829506057166236&city=北京[1] (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\park[2].js (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lowerPrice[1].jcp (1031 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b[5].htm (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\js_flow_cookie[1].htm (0 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\home-2014051615190002[2].css (1875 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ips[1].jcp (36 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_login_v.2[1].css (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\swfobject[1].js (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\airCoPromote[1].jsp (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xiu_v.12[1].css (4497 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\play_flv_v.8[1].js (5214 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1003v1394650357861917005[1].jpg (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\hd[2].js (2025 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\main_play_v.7[1].js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common_v.1[1].css (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lock[2].gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\shafa_v_1[1].js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\counts[1] (384 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lothario_v.1[1].js (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\proLiveInfo[1].php (5138 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swfobject[2].js (10 bytes)
    %System%\d3d9caps.tmp (1324 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\b[1].html (1162 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\201403181447095327ebeda78ee_1290[2].swf (1813 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\wtcookie[1].htm (0 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@serving-sys[1].txt (214 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ico_la_v2_0508ie6[1].png (2 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (378 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\66Iba26Dsd1_IiKO6720[1].jpg (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vataplan[1].ifmRightTextlink&ab=b&tile=14003829506057166236&city=北京 (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_v.12[1].css (2696 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lmx2369295492_b_56.com_[1].jpg (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\rev_uhd[1].png (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ico_a[1].png (552 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (156 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\core[1].php (802 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\5711d2fac10ecb246886324a[1].png (12076 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@51[2].txt (124 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\arc[1].png (153 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\dy_rkxin1[1].png (4085 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_big_avatar[2].jpg (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\e0122f43fc759e56244ef1dbc5c2f955[1].jpg (921 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\e6u5-min[1].js (969 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\index[1].htm (2 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (321 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bg_bd[1].jpg (5016 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (196 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\js_flow_cookie[1].htm (0 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\liver[1].js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\proLiveInfo[1].htm (2883 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\xiu_sns_v.1[1].css (952 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2[1].swf (19737 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jump[1].html (1427 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\newhistory[1].htm (1482 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-1.8.2_v4[1].js (3399 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@51[1].txt (248 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAQFMNIP.swf (4546 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\crossdomain[1].xml (120 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1003v1395300869395285901[1].jpg (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\hd[1].js (2696 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\e0eaeaf8276dc5556886324a[1].gif (2 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\login_3[1].js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logo_foot_v1[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\56get[1].txt (254 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\spacegif[1].gif (60 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\20140430_728x90_4245_dfs_new[1].jpg (5208 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pv_stat[1].htm (39 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\airCoPromote[1].jsp (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\201403181447095327ebeda78ee_1290[1].swf (1813 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\chat_v.7[1].js (2020 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\no_userhead_s[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\6cf4565a9b319e36561b4af95c4522df[1].gif (8457 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\f1f51d8b645559506886324a[1].png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dy_rkxin1[1].png (4130 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\close[1].png (286 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b[3].htm (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\swfobject[2].js (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\LAB_0.1[2].js (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\header_v10[1].png (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\park[1].js (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\play_flv_v.8[1].js (3808 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\signin_v.1[1].js (3 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@woxiu[2].txt (2926 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (205 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1003v1392141486221499555[1].jpg (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rev_sprite[1].png (3670 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\wtcookie[2].htm (0 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lock[1].gif (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\img_qnkhd[1].png (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rev_icon[2].png (3856 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (490 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\oneway_index_config-2014051615190002[1].js (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ps[1].swf (2067 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rev_sprite[2].png (2821 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\shequ[1].htm (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\adServer[1].gif (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery-1.8.2_v4[1].js (2294 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\base_MIN_11.03[2].css (41 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\v627061383118550[1].png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\broadcast_v.1[1].js (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\framId=ad_home_rightAD_top&chan=flight&pg=home&pos=top&site=qunar&size=230x200&tile=14003829506057166236&city=北京[1] (73 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\global[1].js (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\b5adf698bf4292a509a926ce6c0e72ca[1].jpg (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1644498437263f636886324a[1].png (8409 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\promimg[1].htm (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\home_pack-2014051615190002[2].js (10565 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lpisearchd[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\channel_20140504104628_44039[1].jpg (9508 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\framId=couplet_load&chan=flight&pg=home&pos=right&site=qunar&size=120x300&type=couplet&tile=14003829506057166236&city=北京[1] (59 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\oneway_index_config-2014051615190002[1].js (522 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ips[1].jcp (56 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h199941397100951[1].jpg (2667 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pv_stat[2].htm (39 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\home_pack-2014051615190002[1].js (10543 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\rev_marquee[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\98d9e829bcb252a26886324a[1].jpg (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\xiu_base_v.2[1].css (1258 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\common[2].js (2181 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\framId=ad_home_leftAD_middle&chan=flight&pg=home&pos=top&site=qunar&size=728x90&tile=14003829506057166236&city=北京[1] (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CABUI0JY.htm (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\base_head_v24[1].png (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bg_sephuan[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\main_play_v.7[2].js (7 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1[1].swf (2297 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f1f51d8b645559506886324a[1].png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index[1].php (281 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tb.bg[1].gif (268 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\z5n6_psmall[1].jpg (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pic1[1].gif (428 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\201403181447095327ebeda78ee_1290[1].swf (1821 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAE34567.htm (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\vataplan[1].ifmRightFlightOwner&ab=b&tile=14003829506057166236&city=北京 (920 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\520_Entrance[1].png (776 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\gift_v.1[1].css (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lnt_bg1[1].png (865 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ph_flower[2].png (4087 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\z_MIN_14.64[1].js (5314 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pv_stat[3].htm (39 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pv_stat[1].htm (38 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\LAB_0.1[1].js (2 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\rev_gift[1].png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[1].html (1162 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[1].jpg (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\qq-zfwvflhdxq_b_56.com_[1].jpg (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\home-2014051615190002[1].css (1998 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\b[6].html (1162 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\main[1].swf (5786 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (374 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\framId=flight_active_dynamic&chan=flight&pg=home&site=qunar&type=dynamic_skinned&tile=14003829506057166236&city=北京[1] (59 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\global[1].js (14 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\80928328[1].htm (2011 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\520_z5n6_bg[1].jpg (3782 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\mootools_MIN_1.4.5[1].js (2583 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (147 bytes)
    %Documents and Settings%\%current user%\UserData\YJM90VAL\www.woxiu[1].xml (238 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\airing_sprite[1].gif (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\signin_v.1[1].js (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-1.4.4.min[1].js (1928 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\Satyr_Game_icon[1].png (4437 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2013.11.261[1].gif (7842 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pv_stat[1].htm (38 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\3[1].swf (4517 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\postmk_wf[1].png (818 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\base_head_search[1].png (928 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (146 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\rev_h[1].png (3783 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1[1].swf (5439 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lpisearchd[1] (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b[6].htm (2 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (130 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\a0f28380bff75d736886324a[1].jpg (5 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@qunar[1].txt (670 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lock[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\wt_js[1].htm (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\gift.13.10.18.a[1].swf (3430 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\login_3[1].js (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\MTFlashStore[1].swf (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\xiu_sns_v.1[1].css (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ps[2].swf (1821 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b[7].htm (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\promimg[1] (621 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\allocateCookie[1].htm (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ga.min[1].js (73 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\n5_ledbean[1].png (3 bytes)
    %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#irs01.net\settings.sxx (190 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\pv_stat[2].htm (39 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pv_stat[1].htm (38 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\u327191383286771[1].png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\MTFlashStore[1].swf (1 bytes)
    %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.56.com\settings.sxx (193 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bg[1].png (2822 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swfobject[1].js (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CZ[1].gif (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\js_flow_cookie[1].htm (0 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\girlfall_5[2].js (1998 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\vataplan[1].ifrCataAd&ab=b&tile=14003829506057166236&city=北京 (138 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\b[2].htm (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tyxbvk_b_56.com_[1].jpg (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\car_ivaca[1].png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\57b557081c37a4c63ea3044817f3925a[1].jpg (392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\timetrack[1].htm (0 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\common[1].js (2897 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].gif (43 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (205 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@cnzz[2].txt (165 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (492 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (321 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\stat[1].gif (43 bytes)
    %System%\drivers\etc\hosts (1 bytes)
    

    4. 

  4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
    
    127.0.0.1       localhost
    5. 

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    6. 

  6. Reboot the computer.
    7. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now