Trojan.Win32.FlyStudio_3817971cee

by malwarelabrobot on June 15th, 2015 in Malware Descriptions.

Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.Swrort.3.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)
Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 3817971ceeca534631abef6068e85e6a
SHA1: d52d664b71a749f216e055cbc0ab145e1d3fd76d
SHA256: a074488dcfd74dd30374ce43c197fe180e35e2be64040d640a2266d727d7f9de
SSDeep: 24576:0MY Lv5f7sELpywatMn77A/t75C09mKCAXTbUq5Oz9B7RXCn:0MDLRRk/un77A/t8tKCAjbn5OzX70
Size: 1110528 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-04-25 13:11:39
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:560

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:560 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\rec_subtract[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\home[2].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\plugin[1].php (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lxqq[1].htm (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\noavatar_small[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\thread-17831-1-1[1].html (2000 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sync[1].htm (893 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common[1].js (942 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\base[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\background[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[1].png (637 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common[2].js (3375 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\online_member[1].gif (365 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\plugin[1].htm (76 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery_a4373ccd[1].js (4721 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].js (2680 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA3X5JIE.htm (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\seditor[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\userinfo[1].gif (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\arrow_top[1].gif (51 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\noavatar_middle[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\0f000Q2KxFhCznBO83poas[1].swf (5573 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\arw_l[1].gif (844 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\portal[2].js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\search[1].png (1 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (20248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA45Q97G.htm (7757 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ls_flowbar[1].js (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\medal3[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\06_avatar_middle[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cpro[2].js (1677 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rec_add[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\forumlink[1].gif (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ad[1].gif (997 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\forum_viewthread[2].js (2322 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fav[1].gif (596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\medal1[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\fill_bg[1].jpg (9184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CALSSVD5 (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ls[1].js (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\nosexbg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fastreply[1].gif (608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bd-logo5[1].png (1545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAPGZYR7.htm (3346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qq_share[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\adx[1].gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logging[1].js (274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\nv_a[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA5O2T9R.gif (49 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (439 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\discuz_tips[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qshare[2].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rt[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA892BC9 (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pmto[1].gif (152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\portal[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\seditor[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].php (2784 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (3377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico_jdt[1].png (849 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style_28_forum_viewthread[2].css (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[2].css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\arrow_left_50_ie6_9158e720[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\midavt_shadow[1].gif (79 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\noavatar_middle[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pengyou[1].png (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\arw_r[1].gif (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\25_avatar_middle[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[1].png (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\oshr[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\discuz_tips[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\gpixel[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sync2r[1].htm (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\weibo[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style_28_forum_viewthread[1].css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style_28_common[1].css (654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sync[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style_28_common[2].css (1782 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hot_1[1].gif (680 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qshare[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\arw[1].gif (940 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\forum[2].js (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\arrow_left_60_e700a3bb[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\51_avatar_middle[1].jpg (1617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\post[1].htm (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fj_btn[1].png (217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAAZCTO9.htm (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\core[1].php (762 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (205 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (746 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c[2].js (3108 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\newarow[1].gif (327 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\share_btn[1].png (476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\collection[1].png (1 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (3930 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\qzone[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\0f000Dlh0nJS1Y3OYHhQp0[1].swf (5498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\thread-17831-1-1[1].htm (1256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cpro[1].js (521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[2].js (3324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pn_post[1].png (569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\editor[1].gif (2244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAKDUF4R.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pt_item[1].png (569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic[1].gif (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c[1].js (2200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\noavatar_middle[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\qq_login[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\icon[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\nv[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\thread-prev[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\thread-next[1].png (999 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pn[1].png (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\flw_ico[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qmenu[1].png (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qfcode[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\forum_viewthread[1].js (1106 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[2].txt (441 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\medal2[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logging[2].js (390 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\print[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\home[1].php (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[1].css (934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\forum[1].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\uf[1].js (9631 bytes)
C:\dc.dll (122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo-border-light[1].png (473 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sync_pos[1].htm (1596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\arrwd[1].gif (51 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\scrolltop[1].png (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cpro[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style_28_forum_viewthread[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\plugin[1].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style_28_common[1].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\noavatar_middle[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qshare[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logging[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\discuz_tips[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\forum_viewthread[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\noavatar_middle[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\portal[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\seditor[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\home[1].php (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\forum[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)

Registry activity

The process %original file name%.exe:560 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1429956699"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "15 A6 EE FF 8A 25 D8 30 11 9F 42 2A 05 AD 62 28"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
f803ad370a8649a143429f179af5f3ab	c:\dc.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: QQ424308510
Product Name: ??163?????
Product Version: 1.1.0.0
Legal Copyright: QQ424308510 ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.1.0.0
File Description: 163????
Comments: by??
Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	1400832	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	1404928	1081344	1080832	5.39928	06aede547695b03c99eb62e91b1365d8
.rsrc	2486272	28672	28672	3.73868	451cd23972f61e5f4864696d46c0c5b7

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://www.ltywz.com/data/cache/style_28_common.css?xB2	125.88.190.6
hxxp://www.ltywz.com/api/xmlapi.asmx/GetInfo	125.88.190.6
hxxp://www.ltywz.com/data/cache/common.js?xB2	125.88.190.6
hxxp://www.ltywz.com/data/cache/portal.js?xB2	125.88.190.6
hxxp://www.ltywz.com/data/cache/logging.js?xB2	125.88.190.6
hxxp://www.ltywz.com/static/image/common/background.png	125.88.190.6
hxxp://wmjs.wshifen.com/cpro/ui/c.js
hxxp://www.ltywz.com/static/image/common/nv.png	125.88.190.6
hxxp://cb.e.shifen.com/acom?di=u1991537&dcb=BAIDU_DUP2_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=0&dai=1&dds=&drs=3&dvi=1432188695&ltu=http://www.ltywz.com/thread-17831-1-1.html&liu=&ltr=&lcr=&ps=153x-1&psr=1276x846&par=1276x818&pcs=60x20&pss=960x156&pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=140&tlm=1434271564&tcn=1434271564&tpr=1434271564146&dpt=none&coa=&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&baidu_id=
hxxp://cb.e.shifen.com/acom?adn=0&at=128&aurl=&cad=1&ccd=32&cec=gb2312&cfv=11&ch=0&col=en-us&conBW=0&conOP=1&cpa=1&dai=1&dis=0&ltr=&ltu=http://www.ltywz.com/thread-17831-1-1.html&lu_161=0&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=153x-1&psr=1276x846&pss=960x156&qn=4f4730e82ea33ac9&rad=&rsi0=960&rsi1=60&rsi5=4&rss0=#FFFFFF&rss1=#FFFFFF&rss2=#0000ff&rss3=&rss4=&rss5=&rss6=#e10900&rss7=&scale=&skin=tabcloud_skin_1&stid=5&td_id=1991537&titFF=å®‹ä½“&titFS=12&titTA=left&tn=baiduCustSTagLinkUnit&tpr=1434271564146&ts=1&version=2.0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u1991537&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.172.2203.2203
hxxp://www.ltywz.com/data/cache/forum_viewthread.js?xB2	125.88.190.6
hxxp://www.ltywz.com/static/image/common/print.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/thread-prev.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/hot_1.gif	125.88.190.6
hxxp://common.mail.qq.com/zh_CN/htmledition/js/qf/page/qfcode.js
hxxp://www.ltywz.com/static/image/common/forumlink.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/userinfo.gif	125.88.190.6
hxxp://www.ltywz.com/uc_server/avatar.php?uid=2951&size=middle	125.88.190.6
hxxp://www.ltywz.com/static/image/common/medal1.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/medal2.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/arw_r.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/arw_l.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/online_member.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/nosexbg.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/flw_ico.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/pmto.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/ad.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/qzone.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/qq_share.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/pengyou.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/rt.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/oshr.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/collection.png	125.88.190.6
hxxp://www.ltywz.com/uc_server/avatar.php?uid=21714&size=middle	125.88.190.6
hxxp://wn.pos.e.shifen.com/adx.php?c=d25pZD05Y2QyMWFhNDMwNTRkN2EzAHM9OWNkMjFhYTQzMDU0ZDdhMwB0PTE0MzQyNzE1NzEAc2U9MQBidT00AHByaWNlPVZYMF9Vd0FKbm1GN2pFcGdXNUlBOHIyVkRkb0ZGYURuM1RWMjh3AGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD0AYmNobWQ9MAB2PTEAaT1kM2EzYzZiZg
hxxp://wmjs.wshifen.com/cpro/ui/noexpire/img/2.0.1/logo-border-light.png
hxxp://wmjs.wshifen.com/sync.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1
hxxp://cb.e.shifen.com/sync_pos.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1
hxxp://su.bdimg.jomodns.com/static/dspui/js/uf.js
hxxp://cb.e.shifen.com/sync2r.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1
hxxp://www.ltywz.com/static/image/common/ico_jdt.png	125.88.190.6
hxxp://www.ltywz.com/uc_server/data/avatar/000/00/29/51_avatar_middle.jpg	125.88.190.6
hxxp://www.ltywz.com/uc_server/images/noavatar_small.gif	125.88.190.6
hxxp://www.ltywz.com/uc_server/data/avatar/000/00/73/25_avatar_middle.jpg	125.88.190.6
hxxp://www.ltywz.com/uc_server/images/noavatar_middle.gif	125.88.190.6
hxxp://www.ltywz.com/uc_server/data/avatar/000/02/40/06_avatar_middle.jpg	125.88.190.6
hxxp://su.bdimg.jomodns.com/static/dspui/js/ll/ls.js?dv=559
hxxp://www.ltywz.com/static/image/editor/editor.gif	125.88.190.6
hxxp://su.bdimg.jomodns.com/static/dspui/js/ls_flowbar.js?d=22201
hxxp://wmjs.wshifen.com/cpro/ui/f.js
hxxp://cb.e.shifen.com/acom?di=u2109486&dcb=BAIDU_DUP2_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=0&dai=2&dds=&drs=3&dvi=1432188695&ltu=http://www.ltywz.com/thread-17831-1-1.html&liu=&ltr=&lcr=&ps=5695x-2&psr=1276x846&par=1276x818&pcs=60x20&pss=962x5717&pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=27468&tlm=1434271591&tcn=1434271591&tpr=1434271564146&dpt=none&coa=&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&baidu_id=
hxxp://cb.e.shifen.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3&ltr=&ltu=http://www.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2002&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270
hxxp://www.a.shifen.com/rp/home?type=flowbar&di=u2108193&rsi0=auto&rsi1=50&title=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&ltu=http://www.ltywz.com/thread-17831-1-1.html&ref=&pageWidth=60&pageHeight=20&t=1434271591068&rsi0=60&rsi1=50
hxxp://cb.e.shifen.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3&ltr=&ltu=http://www.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2001&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270
hxxp://su.bdimg.jomodns.com/static/dspui/js/lib/jquery_a4373ccd.js
hxxp://wmjs.wshifen.com/cpro/ui/noexpire/css/1.0.0/base.css
hxxp://wmjs.wshifen.com/cpro/ui/noexpire/js/3.2.0/base.js
hxxp://pagead.l.doubleclick.net/pixel?google_nid=baidu&google_cm
hxxp://pagead.l.doubleclick.net/pixel?google_nid=baidu&google_cm=&google_tc=
hxxp://wn.pos.e.shifen.com/adx.php?c=d25pZD1hYjMxYzAyNjZiMjJlM2EyAHM9YWIzMWMwMjY2YjIyZTNhMgB0PTE0MzQyNzE1ODAAc2U9MQBidT01AHByaWNlPVZYMF9YQUFOcDh0N2pFcGdXNUlBOGlQRFg4QURyRllqSzVVbDhRAGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD1FM0VBRDcxRDFGNjhERTZFREQwQURBRjQ2OEREN0U0OABiY2htZD0wAHY9MQBpPTBjZTMyNDNi&ext=cGxhbmlkPTc2NSZsaW1pdD0xNSZyYz1oeg
hxxp://wmjs.wshifen.com/cpro/ui/noexpire/js/3.1.6/cpro.js
hxxp://click.hm.e.shifen.com/mkt.gif?et=0&ai=ba6dceb3db2dfe732c732f17b61280a9
hxxp://wmjs.wshifen.com/cpro/ui/noexpire/img/2.0.0/bd-logo5.png
hxxp://cm.pos.e.shifen.com/gpixel?google_gid=CAESEJjFx4RhgLnSGfBEJ8AfDVY&google_cver=1
hxxp://wmpic.wshifen.com/media/v1/0f000Q2KxFhCznBO83poas.swf
hxxp://su.bdimg.jomodns.com/static/dspui/img/flowbar/arrow_left_50_ie6_9158e720.png
hxxp://www.ltywz.com/rj/post.htm	125.88.190.6
hxxp://wn.pos.e.shifen.com/adx.php?c=d25pZD0xNTkzNjgzNGQ1ZTFhMjBlAHM9MTU5MzY4MzRkNWUxYTIwZQB0PTE0MzQyNzE1ODQAc2U9MQBidT01AHByaWNlPVZYMF9ZQUFFWDBON2pFcGdXNUlBOHN0TWhoOGpTamtEcFoyaTB3AGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD1FM0VBRDcxRDFGNjhERTZFREQwQURBRjQ2OEREN0U0OABiY2htZD0wAHY9MQBpPTg3ODJlMDIw&ext=cGxhbmlkPTEwMCZsaW1pdD0wJnJjPWh6
hxxp://www.ltywz.com/static/image/common/arrow_top.gif	125.88.190.6
hxxp://wmpic.wshifen.com/media/v1/0f000Dlh0nJS1Y3OYHhQp0.swf
hxxp://click.hm.e.shifen.com/mkt.gif?et=0&ai=8002e2c915c26c3a78b4270c968fe58c
hxxp://su.bdimg.jomodns.com/static/dspui/img/flowbar/arrow_left_60_e700a3bb.png
hxxp://static.n.shifen.com/v.gif?fm=load&r_type=loadsuccess&r_tm=268742530&r_sid=&r_lu=u2108193&r_tpl=flowbar_102&r_qid=bc28cb4eb45d34c4&r_tn=38068079_cpr&r_url=http://www.ltywz.com/thread-17831-1-1.html&pid=201&productline=cun&productsub=cun&pj=ext_hl&tab=query&logactionid=0100100002&mod=cun&r_time=1434271595521&r_ltime=15&r_stime=1434271595506&r_sp=flowbar&r_innerWidth=10&r_innerHeight=50
hxxp://www.ltywz.com/static/js/qshare.js	125.88.190.6
hxxp://www.ltywz.com/static/image/common/fastreply.gif	125.88.190.6
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=5796949&show=pic
hxxp://origin.open.qq.com/apps/qshare/images/icon.gif
hxxp://www.ltywz.com/source/plugin/rsf_logo_fill/template/fill_bg.jpg	125.88.190.6
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=5796949&show=pic&t=z
hxxp://oz.cnzz.com/stat.htm?id=5796949&r=&lg=en-us&ntime=none&cnzz_eid=1877242474-1434271586-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1248773792	198.11.132.200
hxxp://all.cnzz.com.danuoyi.tbcache.com/img/pic.gif
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=36257576	42.120.219.171
hxxp://www.ltywz.com/plugin.php?id=milu_seotool:sitemap&tpl=no&myac=milu_seotool_cron&inajax=1	125.88.190.6
hxxp://www.ltywz.com/home.php?mod=misc&ac=sendmail&rand=1434271536	125.88.190.6
hxxp://www.ltywz.com/static/image/common/scrolltop.png	125.88.190.6
hxxp://x2.tcdn.qq.com/cloud/scripts/discuz_tips.js?v=1
hxxp://www.minnanwl.com/gengxin/qqlx/lxqq.htm	116.255.250.58
hxxp://su.bdimg.com/static/dspui/img/flowbar/arrow_left_50_ie6_9158e720.png	163.177.8.49
hxxp://www.ltywz.com/static/image/common/arrwd.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/qmenu.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/nv_a.png	125.88.190.6
hxxp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3&ltr=&ltu=http://www.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2002&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270	115.239.210.141
hxxp://su.bdimg.com/static/dspui/img/flowbar/arrow_left_60_e700a3bb.png	163.177.8.49
hxxp://cm.g.doubleclick.net/pixel?google_nid=baidu&google_cm	216.58.209.194
hxxp://ubmcmm.baidustatic.com/media/v1/0f000Dlh0nJS1Y3OYHhQp0.swf
hxxp://s13.cnzz.com/stat.php?id=5796949&show=pic	1.99.192.16
hxxp://www.ltywz.com/static/image/common/thread-next.png	125.88.190.6
hxxp://pos.baidu.com/acom?di=u1991537&dcb=BAIDU_DUP2_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=0&dai=1&dds=&drs=3&dvi=1432188695&ltu=http://www.ltywz.com/thread-17831-1-1.html&liu=&ltr=&lcr=&ps=153x-1&psr=1276x846&par=1276x818&pcs=60x20&pss=960x156&pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=140&tlm=1434271564&tcn=1434271564&tpr=1434271564146&dpt=none&coa=&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&baidu_id=	115.239.210.141
hxxp://cpro.baidustatic.com/sync.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1
hxxp://cpro.baidustatic.com/cpro/ui/noexpire/css/1.0.0/base.css
hxxp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3&ltr=&ltu=http://www.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2001&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270	115.239.210.141
hxxp://c.cnzz.com/core.php?web_id=5796949&show=pic&t=z	195.27.31.248
hxxp://www.ltywz.com/thread-17831-1-1.html	125.88.190.6
hxxp://www.ltywz.com/data/cache/forum.js?xB2	125.88.190.6
hxxp://www.ltywz.com/static/image/common/fj_btn.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/newarow.gif	125.88.190.6
hxxp://wn.pos.baidu.com/adx.php?c=d25pZD1hYjMxYzAyNjZiMjJlM2EyAHM9YWIzMWMwMjY2YjIyZTNhMgB0PTE0MzQyNzE1ODAAc2U9MQBidT01AHByaWNlPVZYMF9YQUFOcDh0N2pFcGdXNUlBOGlQRFg4QURyRllqSzVVbDhRAGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD1FM0VBRDcxRDFGNjhERTZFREQwQURBRjQ2OEREN0U0OABiY2htZD0wAHY9MQBpPTBjZTMyNDNi&ext=cGxhbmlkPTc2NSZsaW1pdD0xNSZyYz1oeg	180.149.131.90
hxxp://www.ltywz.com/data/cache/seditor.js?xB2	125.88.190.6
hxxp://www.ltywz.com/static/image/common/pn.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/rec_subtract.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/arw.gif	125.88.190.6
hxxp://cpro.baidustatic.com/cpro/ui/f.js
hxxp://su.bdimg.com/static/dspui/js/uf.js	163.177.8.49
hxxp://su.bdimg.com/static/dspui/js/ll/ls.js?dv=559	163.177.8.49
hxxp://www.ltywz.com/static/image/common/weibo.png	125.88.190.6
hxxp://list.qq.com/zh_CN/htmledition/js/qf/page/qfcode.js	103.7.30.111
hxxp://dj0.baidu.com/v.gif?fm=load&r_type=loadsuccess&r_tm=268742530&r_sid=&r_lu=u2108193&r_tpl=flowbar_102&r_qid=bc28cb4eb45d34c4&r_tn=38068079_cpr&r_url=http://www.ltywz.com/thread-17831-1-1.html&pid=201&productline=cun&productsub=cun&pj=ext_hl&tab=query&logactionid=0100100002&mod=cun&r_time=1434271595521&r_ltime=15&r_stime=1434271595506&r_sp=flowbar&r_innerWidth=10&r_innerHeight=50	115.239.211.92
hxxp://cpro.baidustatic.com/cpro/ui/noexpire/js/3.1.6/cpro.js
hxxp://www.ltywz.com/static/image/common/logo.png	125.88.190.6
hxxp://release.baidu.com/sync2r.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1	115.239.210.141
hxxp://open.t.qq.com/apps/qshare/images/icon.gif	103.7.29.251
hxxp://cpro2.baidustatic.com/cpro/ui/noexpire/img/2.0.1/logo-border-light.png
hxxp://www.ltywz.com/static/image/common/px.png	125.88.190.6
hxxp://ubmcmm.baidustatic.com/media/v1/0f000Q2KxFhCznBO83poas.swf
hxxp://cpro.baidustatic.com/cpro/ui/c.js
hxxp://www.ltywz.com/static/image/common/search.png	125.88.190.6
hxxp://click.hm.baidu.com/mkt.gif?et=0&ai=ba6dceb3db2dfe732c732f17b61280a9	123.125.112.49
hxxp://wn.pos.baidu.com/adx.php?c=d25pZD0xNTkzNjgzNGQ1ZTFhMjBlAHM9MTU5MzY4MzRkNWUxYTIwZQB0PTE0MzQyNzE1ODQAc2U9MQBidT01AHByaWNlPVZYMF9ZQUFFWDBON2pFcGdXNUlBOHN0TWhoOGpTamtEcFoyaTB3AGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD1FM0VBRDcxRDFGNjhERTZFREQwQURBRjQ2OEREN0U0OABiY2htZD0wAHY9MQBpPTg3ODJlMDIw&ext=cGxhbmlkPTEwMCZsaW1pdD0wJnJjPWh6	180.149.131.90
hxxp://www.ltywz.com/uc_server/avatar.php?uid=23776&size=middle	125.88.190.6
hxxp://www.ltywz.com/static/image/common/fav.gif	125.88.190.6
hxxp://click.hm.baidu.com/mkt.gif?et=0&ai=8002e2c915c26c3a78b4270c968fe58c	123.125.112.49
hxxp://cpro.baidustatic.com/cpro/ui/noexpire/js/3.2.0/base.js
hxxp://pos.baidu.com/sync_pos.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1	115.239.210.141
hxxp://www.ltywz.com/uc_server/avatar.php?uid=7325&size=middle	125.88.190.6
hxxp://www.ltywz.com/static/image/common/medal3.gif	125.88.190.6
hxxp://www.ltywz.com/uc_server/avatar.php?uid=21455&size=middle	125.88.190.6
hxxp://www.ltywz.com/static/image/common/pt_item.png	125.88.190.6
hxxp://www.ltywz.com/uc_server/avatar.php?uid=22235&size=small	125.88.190.6
hxxp://www.ltywz.com/static/image/common/qq_login.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/pn_post.png	125.88.190.6
hxxp://w.ltywz.com/api/xmlapi.asmx/GetInfo	125.88.190.6
hxxp://www.ltywz.com/data/cache/style_28_forum_viewthread.css?xB2	125.88.190.6
hxxp://discuz.gtimg.cn/cloud/scripts/discuz_tips.js?v=1	103.7.29.239
hxxp://entry.baidu.com/rp/home?type=flowbar&di=u2108193&rsi0=auto&rsi1=50&title=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&ltu=http://www.ltywz.com/thread-17831-1-1.html&ref=&pageWidth=60&pageHeight=20&t=1434271591068&rsi0=60&rsi1=50
hxxp://su.bdimg.com/static/dspui/js/ls_flowbar.js?d=22201	163.177.8.49
hxxp://www.ltywz.com/static/image/common/midavt_shadow.gif	125.88.190.6
hxxp://wn.pos.baidu.com/adx.php?c=d25pZD05Y2QyMWFhNDMwNTRkN2EzAHM9OWNkMjFhYTQzMDU0ZDdhMwB0PTE0MzQyNzE1NzEAc2U9MQBidT00AHByaWNlPVZYMF9Vd0FKbm1GN2pFcGdXNUlBOHIyVkRkb0ZGYURuM1RWMjh3AGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD0AYmNobWQ9MAB2PTEAaT1kM2EzYzZiZg	180.149.131.90
hxxp://cm.pos.baidu.com/gpixel?google_gid=CAESEJjFx4RhgLnSGfBEJ8AfDVY&google_cver=1	61.135.185.179
hxxp://www.ltywz.com/static/image/common/rec_add.gif	125.88.190.6
hxxp://pos.baidu.com/acom?adn=0&at=128&aurl=&cad=1&ccd=32&cec=gb2312&cfv=11&ch=0&col=en-us&conBW=0&conOP=1&cpa=1&dai=1&dis=0&ltr=&ltu=http://www.ltywz.com/thread-17831-1-1.html&lu_161=0&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=153x-1&psr=1276x846&pss=960x156&qn=4f4730e82ea33ac9&rad=&rsi0=960&rsi1=60&rsi5=4&rss0=#FFFFFF&rss1=#FFFFFF&rss2=#0000ff&rss3=&rss4=&rss5=&rss6=#e10900&rss7=&scale=&skin=tabcloud_skin_1&stid=5&td_id=1991537&titFF=å®‹ä½“&titFS=12&titTA=left&tn=baiduCustSTagLinkUnit&tpr=1434271564146&ts=1&version=2.0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u1991537&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.172.2203.2203	115.239.210.141
hxxp://cm.g.doubleclick.net/pixel?google_nid=baidu&google_cm=&google_tc=	216.58.209.194
hxxp://www.ltywz.com/static/image/common/share_btn.png	125.88.190.6
hxxp://icon.cnzz.com/img/pic.gif	195.27.31.246
hxxp://pos.baidu.com/acom?di=u2109486&dcb=BAIDU_DUP2_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=0&dai=2&dds=&drs=3&dvi=1432188695&ltu=http://www.ltywz.com/thread-17831-1-1.html&liu=&ltr=&lcr=&ps=5695x-2&psr=1276x846&par=1276x818&pcs=60x20&pss=962x5717&pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=27468&tlm=1434271591&tcn=1434271591&tpr=1434271564146&dpt=none&coa=&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&baidu_id=	115.239.210.141
hxxp://www.ltywz.com/uc_server/avatar.php?uid=24006&size=middle	125.88.190.6
hxxp://su.bdimg.com/static/dspui/js/lib/jquery_a4373ccd.js	163.177.8.49
hxxp://cpro.baidustatic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5.png
pcookie.cnzz.com	42.120.219.171

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Outdated Windows Flash Version IE

Traffic

GET /rp/home?type=flowbar&di=u2108193&rsi0=auto&rsi1=50&title=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›<u=http://VVV.ltywz.com/thread-17831-1-1.html&ref=&pageWidth=60&pageHeight=20&t=1434271591068&rsi0=60&rsi1=50 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: entry.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1


HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:20 GMT

Content-Type: text/html;

Transfer-Encoding: chunked

Connection: Keep-Alive

Server: PS-DSP/1.0
10d4..<!doctype html><html><head><meta charset=ut
f-8></head><body> <script src="hXXp://su.bdimg.com/s
tatic/dspui/js/lib/jquery_a4373ccd.js"></script><script>
;..var s_config={"r_tm": "268742530","r_sid" : "","r_lu": "u2108193","
r_tpl":"flowbar_102","r_qid":"bc28cb4eb45d34c4","r_tn":"38068079_cpr",
"r_url":"http:\/\/VVV.ltywz.com\/thread-17831-1-1.html"};..var s_conf 
= {"isMobile":"","fenlei":"mv6quAkxTZn0IZRqIHcknj6krHn0T1dBm1c3mvcYuyc
YPyf1PAnY0ZwV5HcvrjTYnWR1n0KWUMw85Hn3njm3njT4gvPsT6K1TL0q0ZP1Tjcq0ZNzU
jdCIZwsrBtEILILQhkYXgIlQhPEUiqYpZF-myfVnHT3n1DVniYkQh9YUys","r_ref":""
};..var now="1434271580";var s_domain={"clickDomain":"http:\/\/entry.b
aidu.com/","staticUrl":"http:\/\/su.bdimg.com/"};</script><sc
ript>.var ADS = [{"title":"......","displayType":"","recommtype":"1
03","hidehit":"0","rpkey":""},{"title":"............","displayType":""
,"recommtype":"103","hidehit":"0","rpkey":""},{"title":"............",
"displayType":"","recommtype":"103","hidehit":"0","rpkey":""},{"title"
:"...........................","displayType":"","recommtype":"117","hi
dehit":"0","rpkey":""},{"title":"............","displayType":"","recom
mtype":"103","hidehit":"0","rpkey":""},{"title":"............","displa
yType":"","recommtype":"103","hidehit":"0","rpkey":""},{"title":".....
................","displayType":"","recommtype":"117","hidehit":"0","r
pkey":""},{"title":"............","displayType":"","recommtype":"3","h
idehit":"0","rpkey":""},{"title":"......","displayType":"","recomm<<< skipped >>>

GET /sync2r.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://pos.baidu.com/sync_pos.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: release.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1


HTTP/1.1 200 OK

Accept-Ranges: bytes

Connection: keep-alive

Content-Length: 2047

Content-Type: text/html

Date: Sun, 14 Jun 2015 08:46:16 GMT

Etag: "557ba5a3-7ff"

Last-Modified: Sat, 13 Jun 2015 03:38:11 GMT

Server: nginx
<!DOCTYPE html>.<html>.    .    <head></head>.
    .    <body>.        <script type="text/javascript">.  
          var sendByIframe = function (b) {.                    var c 
= document.createElement("iframe");.                    c.style.displa
y = "none";.                    c.setAttribute("src", b);.            
        document.body.insertBefore(c, document.body.firstChild).      
          },.                getCookie = function (b, c) {.           
         var a;.                    c = c || window;.                 
   var d = RegExp("(^| )"   b   "=([^;]*)(;|$)").exec(c.document.cooki
e);.                    d && (a = d[2]);.                    return a.
                },.                setCookie = function (b, c, a) {.  
                  a = a || {};.                    var d = a.expires;.
                    "number" == typeof a.expires && (d = new Date, d.s
etTime(d.getTime()   a.expires));.                    document.cookie 
= b   "="   c   (a.path ? "; path="   a.path : "")   (d ? "; expires="
   d.toGMTString() : "")   (a.domain ? "; domain="   a.domain : "")   
(a.secure ? "; secure" : "").                },.                getUrl
Param = function (b) {.                    b = RegExp("(^|&)"   b   "=
([^&]*)(&|$)", "i");.                    b = window.location.search.su
bstr(1).match(b);.                    return null != b ? decodeURIComp
onent(b[2]) : null.                },.                currentDomain = 
document.domain.toLowerCase(),.                referDomain = (docu<<< skipped >>>

GET /mkt.gif?et=0&ai=ba6dceb3db2dfe732c732f17b61280a9 HTTP/1.1

Accept: */*

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3<r=<u=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2002&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: click.hm.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1


HTTP/1.1 204 No Content

Content-Type: image/gif

Set-Cookie: HMACCOUNT=65BC3D3544E471DE; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Cache-Control: private, max-age=0, no-cache

Pragma: no-cache

Connection: close

Date: Sun, 14 Jun 2015 08:46:22 GMT

Server: apache

GET /static/dspui/js/uf.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: su.bdimg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: JSP3/2.0.6

Date: Sun, 14 Jun 2015 08:46:15 GMT

Content-Type: text/javascript

Content-Length: 37441

Connection: keep-alive

ETag: "3754642794"

Last-Modified: Tue, 09 Jun 2015 12:20:59 GMT

Expires: Sun, 06 Dec 2015 12:38:38 GMT

Age: 418057

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Ohc-Response-Time: 1 0 0 0 0 0
.... .vU.....w.V...W$L.B..%.E.i..%N27..$....&...I.."r~...............E
....K..v.-....FI.P^....bz.7...."..`..-.epp.}i..f..r....*..F>.n..d.O
.............L..ay=...M..................w...X.%{w.$.2w....t. \....|..
P..u1Z...'......4..I^\.."..........X......d......=..!N~h,FeV.c....t.%K
~q........_.H...~...I..._T3i,....rr.o....d......tV........\..I....D...
.....AM....j\N..r..............W.^]|xv<..*._.]E.OT.p.8<.._....."
O....GWe....J...3...dQ..u.;....|..b.........*..Z.....y7}.-.Q... .....u
.8ZN.....=".3Z.d4.a.hVW...)L.b?...F.Z........?..`..w...7.]{.L...Q.{...
..U.e..$jaT...&[......"...-.....zz..Q.d...2.........a......r.f.5.2...S
....i.Ff./....Cj......4.C#..F..~2....@...|[email protected]..]....}.;{G
...i.N_io..q.........A.|R....is8....e.......jc.q..1..E..m]....-f..x._|
.h...X..zp...E...D..Qz....Y...p.zXGi'>......#K... \..k.O.-.NGE2!HLE
....j..f{i.^_.5.] .O.....n....5..F..Q..m~..=..../i......m3X.e..u(.3|@.
..WN..4|(h...5...g).B?..N/.O9.-.y.`_..j<..FI9.-.M.W.Zz....!xG..P.3.
..Z..<...[...8...1..n.\[email protected].!..5C........`..Js....~.........PWa.
.^K...'.......0l...(.....K..A.F...".....Q.t.A.**.4.L.3...#...........p
.........R.V.l"A9... ..P......!..5~..4/.mU.......d.(^...6. ...j<[..
.:.W....e.Si1....gXf....M.U......J...8......i^..o\H...V:^...D.\`D..[..
..C....*..G.._?.x.T{\.1C..A...F..1..|G.\.p....U9;&.:.^...e.\[email protected]
....1........].}J..yi.k?I...."$...wui"'F.4.}.>.m.....jcz.>.eH...
^g.r.t.;...9..j".JgDD..B..5..q1...........D....'.F.........tC......o".
...i.,.e..T)..Tp....C.)>..IO5.).$.F`.......#......',..).A....i.<<< skipped >>>

GET /static/dspui/js/ll/ls.js?dv=559 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: su.bdimg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: JSP3/2.0.6

Date: Sun, 14 Jun 2015 08:46:18 GMT

Content-Type: text/javascript

Content-Length: 945

Connection: keep-alive

ETag: "4020916142"

Last-Modified: Fri, 29 May 2015 06:37:59 GMT

Expires: Sun, 29 Nov 2015 02:44:44 GMT

Age: 1058494

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Ohc-Response-Time: 1 0 0 0 0 0
....G.hU...U[o.6.. ...d.InW..........V......t,1.%.......w(...v/...<
.......>.<)....n.W.Qt.\~].....<...i.r.......3 ..Q{`..FQ..<
.`....4... r.....^.J....=..........<@3............%...<......s.a
..Ve...W@Y v.....m.$...DS.9$......u..(.R.WE..i....;..hU.....t...Tg.1Az
(.QY.].:...L....Sd*.wb.E...c(.B..n>......lQ.a..t.....D.:.......@..~
..6...O]...Yo*$....9.........u[Ci_....7..F.5...KJ(qL,.a.3tO.-!L...C...
r....3e.s.,.....F...R.,..).%...}.z..F..^.H3=......t..Fs.8/,...Z...u..#
.....5.BQ......'................1W...,.,xB-...n'....Zl..\#.%....tc....
..V3....f...s.>..xz..@..!l=......Erp.........0..qV.....7.N..F.8.y.#
. T.p..86.}..f.X.......F/O...8..%..........J..t...O...R.s.T.b.... ...H
.=..'...L.S..............._.S>A..&.0..kP.!........iXX...Gc..q\ty.*.
....'.....O.~2...d...\|...n.......T.N..p..-.~.M..gm... a[....w......&g
t;..\...`........{H.>.........*k.?V.Y....5....=V.IH.../9<.\c.).?
~.87..N.....6M...g...Nr.P..5.3Vq.....O0l...oq..G....v...A.:@.........J
........


GET /static/dspui/js/ls_flowbar.js?d=22201 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: su.bdimg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: JSP3/2.0.6

Date: Sun, 14 Jun 2015 08:46:19 GMT

Content-Type: text/javascript

Content-Length: 3848

Connection: keep-alive

ETag: "3024636204"

Last-Modified: Mon, 08 Jun 2015 12:12:37 GMT

Expires: Sat, 05 Dec 2015 12:13:08 GMT

Age: 505991

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Ohc-Response-Time: 1 0 0 0 0 0
......uU...Z.......]....X,Wv.\R.-....%Y..q.............6$.....0 .<.
R.Zcfzzz.q..)w. .& .7.Co..V. ..qo_.fW..........S7UV$.m\F...M..........
..)o.....r6.....a.g..E.f...{c.i[......f*.8......)......0...g........k}
..9...L^N....O..u.;.7].....^$.o|...\W.. <o4.....$.A.4a..~..n.#.....
M1..r.MV7.......R_....j..........._..K...Yq.1..s...VK..YS=......$l.._9
g.A.6Q.&..5</"p...I.:x...?}d{p.._>.......(...M.w.Vp...([U.....w?
..M.|.Uj....%.n.,........k{...|.......Y...:.N...YS.x....lJ...D8.....M.
mY7oy]..l.#F.\...v...W...?.......k9L.....K!V...l..:...Z:..e.E..i.T:.6$
6.S.[}...)|.H.O.V..p.i....%.......)f/.3.z3Td...b.-.k*(r..R..#.........
.._.x.3q{3}6....nK....e..'G.q......r...J.@."iRZ" .^K.#.....8..../v..WS
.....-\.[[..ja...>.~.....uk..F{.M..h.....|S..,.i,?.(..pr.....a..._.
..89.#.y.z$.Y~.'...!.1.D!.M.8.N.........9.m.......Lt.j[.G.TS;.H.....Wb
.1.......Q.%..a...@o..<..!.X."X,r..e.X.....#U .)E.j......B.Z.....s.
.f>&.h....Y.....To.....p.-..j.:..`.Y.9...m..7.W.8..........Ow....\O
..r(S.l).......?...k~..]..G..;..4.2.]r@@Rn........_.S....W.b:u..D.....
.O;F....B_B....i..^..$..7lMA.o.}o.i.7."..($....vW..^E.....(.: .....K0.
....x.........<_E..i..f..qW.)s.a.)..4...s8.>a.4....}u. .(...}1..
.r..Q...=.....T(H6............'S...N.....*..j..w..K.A..ED......p....d.
........|[email protected].(>.ma.C...26A.Q.2.!J.g...g
G.c..@. .7.......S."F#[email protected] ?O. o.aUs..[.7.......H.....r.`.....
..U.}i..?.......cf.J9.B8..*..WU..a..r.{......F...g.s>..cd.....h....
`$..*..E..>..)..Y._Ky.2....Ow._....U..a!..<K.f..a...Y..S'.5.<<< skipped >>>

GET /static/dspui/js/lib/jquery_a4373ccd.js HTTP/1.1

Accept: */*

Referer: hXXp://entry.baidu.com/rp/home?type=flowbar&di=u2108193&rsi0=auto&rsi1=50&title=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›<u=http://VVV.ltywz.com/thread-17831-1-1.html&ref=&pageWidth=60&pageHeight=20&t=1434271591068&rsi0=60&rsi1=50

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: su.bdimg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: JSP3/2.0.6

Date: Sun, 14 Jun 2015 08:46:21 GMT

Content-Type: text/javascript

Content-Length: 36807

Connection: keep-alive

ETag: "394875758"

Last-Modified: Wed, 13 May 2015 05:53:17 GMT

Expires: Mon, 23 Nov 2015 10:25:08 GMT

Age: 1549273

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Ohc-Response-Time: 1 0 0 0 0 0
......RU.....w.V...W$L.B..%.E.i..%N27..$....&...I.."r~...............E
....K..v.-....FI.P^....bz.7...."..`..-.epp.}i..f..r....*..F>.n..d.O
.............L..ay=...M..................w...X.%{w.$.2w....t. \....|..
P..u1Z...'......4..I^\.."..........X......d......=..!N~h,FeV.c....t.%K
~q........_.H...~...I..._T3i,....rr.o....d......tV........\..I....D...
.....AM....j\N..r..............W.^]|xv<..*._.]E.OT.p.8<.._....."
O....GWe....J...3...dQ..u.;....|..b.........*..Z.....y7}.-.Q... .....u
.8ZN.....=".3Z.d4.a.hVW...)L.b?...F.Z........?..`..w...7.]{.L...Q.{...
..U.e..$jaT...&[......"...-.....zz..Q.d...2.........a......r.f.5.2...S
....i.Ff./....Cj......4.C#..F..~2....@...|[email protected]..]....}.;{G
...i.N_io..q.........A.|R....is8....e.......jc.q..1..E..m]....-f..x._|
.h...X..zp...E...D..Qz....Y...p.zXGi'>......#K... \..k.O.-.NGE2!HLE
....j..f{i.^_.5.] .O.....n....5..F..Q..m~..=..../i......m3X.e..u(.3|@.
..WN..4|(h...5...g).B?..N/.O9.-.y.`_..j<..FI9.-.M.W.Zz....!xG..P.3.
..Z..<...[...8...1..n.\[email protected].!..5C........`..Js....~.........PWa.
.^K...'.......0l...(.....K..A.F...".....Q.t.A.**.4.L.3...#...........p
.........R.V.l"A9... ..P......!..5~..4/.mU.......d.(^...6. ...j<[..
.:.W....e.Si1....gXf....M.U......J...8......i^..o\H...V:^...D.\`D..[..
..C....*..G.._?.x.T{\.1C..A...F..1..|G.\.p....U9;&.:.^...e.\[email protected]
....1........].}J..yi.k?I...."$...wui"'F.4.}.>.m.....jcz.>.eH...
^g.r.t.;...9..j".JgDD..B..5..q1...........D....'.F.........tC......o".
...i.,.e..T)..Tp....C.)>..IO5.).$.F`.......#......',..).A....i.<<< skipped >>>

GET /static/dspui/img/flowbar/arrow_left_50_ie6_9158e720.png HTTP/1.1

Accept: */*

Referer: hXXp://entry.baidu.com/rp/home?type=flowbar&di=u2108193&rsi0=auto&rsi1=50&title=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›<u=http://VVV.ltywz.com/thread-17831-1-1.html&ref=&pageWidth=60&pageHeight=20&t=1434271591068&rsi0=60&rsi1=50

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: su.bdimg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: JSP3/2.0.6

Date: Sun, 14 Jun 2015 08:46:24 GMT

Content-Type: image/png

Content-Length: 1167

Connection: keep-alive

ETag: "1354355363"

Last-Modified: Wed, 13 May 2015 05:53:16 GMT

Expires: Mon, 23 Nov 2015 10:26:27 GMT

Age: 1549197

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Ohc-Response-Time: 1 0 0 0 0 0
.PNG........IHDR.......F.............tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE..M......,...A=^...........4..D...........B........E..{..7.
.8..:......$ .$...G.]!...H....._....3..6.($..4.....1....0,..B......;..
..........wu.......qo.H........40.......hc.......4......F........J..m2
....H..........s*.Q........A.b...[X...~..1..5......C?.0....A........K.
...........a^..............W..<........L.......o(....<..........
..C..6..............E....D..PM....JG....g%.(...Jy............{-....Y .
.>..K...........A..;.j&....V......M..O..L.=9.....9.... .....g.E....
tRNS..................................................................
......................................................................
.....................c....IDATx...Eo.1....n.&efffffffffff.....c......&
gt;~..ol...J..U.kH.k%$k.!YY...0HV<C.: YK....6H.7........."..0.U .v.
.BIT..kK..`,.=...,..."=....j.R..U..P.}3 ...O.j.]....T.1X.j...5........
..U..`..9.Jg,...PEF....j=..X....`.K..zDc.......nM..Fc..T7_p.T....XeID.
...$J..c...0. .F~..X.4...z....c.S.  .....X.].....IFd..0 . ..Y....8....
eaYX..e..Rj....2.)[email protected],..by*B............XUU.X.G..~.C....
9.......[[email protected]:..R.2.-.?.......".:-._....IEND.B`...<<< skipped >>>

GET /stat.htm?id=5796949&r=&lg=en-us&ntime=none&cnzz_eid=1877242474-1434271586-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1248773792 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Sun, 14 Jun 2015 08:46:27 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes

GIF89a.............!.......,...........D..;..

GET /uc_server/avatar.php?uid=21714&size=middle HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Sun, 14 Jun 2015 08:46:15 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Last-Modified: Sun, 14 Jun 2015 08:46:11  0000

Expires: Mon, 15 Jun 2015 08:46:11  0000

Location: hXXp://VVV.ltywz.com/uc_server/images/noavatar_middle.gif

0......

GET /static/image/common/ico_jdt.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:15 GMT

Content-Type: image/png

Content-Length: 849

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0
.PNG........IHDR.............[..-....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx...]..0..=..^...K`m,.7V.R..$....$@"$..q......).f.*ml......
. ...j..........J.U...p.h..|H.....-...7Yj..Sz..G.\......v..9U...i..h@.
..........>..{.G>>.y...e..Q..A........ha.T0....e..c.#..PC`.t.
..bR.,?... ..=......Dc............h.......5..P.../._.(....P......A0lA.
O...-....8..D>..8s.....{......4.9.J..)>..]..Q"R....Q....*..q.*c.
.R"(. .H0dU..nG.A..g...)..P.,..W.DV..D..R#.....Zr...S........].%A.z2.T
V...Hq.R@...!H..x.Z-...~.S...... ..>...R/..2..l........E...Nr...}..
.c...[. Q.E...i$0....F._Q..k&H.T..e.(. K.....^..._F~..(.s.^...1 ..EP.5
[email protected].;....J.,5....a...WU......8.==_..GD:.f.. H.."_~3....\HR.E..TW
_.~...~..=.*.}. J..`.*.1..o..7....(....z..PA Pc......<[email protected]...
.f....p......... ......9..a....jp........*p.a.Up.../........<.....c
..m..../....O...|...........IEND.B`.....


GET /uc_server/data/avatar/000/00/29/51_avatar_middle.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:16 GMT

Content-Type: image/jpeg

Content-Length: 6330

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Thu, 13 Mar 2014 08:52:01 GMT

ETag: "196cbf7f993ecf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
......JFIF............................................................
!........."$".$.......................................................
....................u.x...............................................
............}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:
CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................
......................................................................
..........w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
.............................................?...D....w..4...!...*L.)o
.. ..GA.p=.%5...P.O...>;........x....b.......c#.&.u.#.`;.3P....k.:/
.....v.wr....B..m......F3.P..*9z.......]~'..X..I.... ......B..#..:k..|
;...]F...RrZYO'...{5..T.$_.h..\......$G..O.}"@vB..T...\.t.'.Q.G.4;..xw
V.)G8G1..88?CS...Y.....='.?...4............o^...=.Z...H.k`..>.. .9.
[email protected]..<p<'.Ei`.}j. k.7m.7.....~...S.i....
.]..m.<|..Fh.m.%.P.=.....!..# .<4.=?..#.6...I #.~!..O...q{y;G. f
 ...... `g...X...EGs._.x.R....w..-RF{{rW..9m..l*..0..[F.vj.|...dP1S.v.
,}.&...o..w....P.}V...T.....m.O.L.ci/..z.D.....\.9...x..vHu....HA./.7.
...Ps..{}*d..vfG.<i.|:.N..]..kxy..r......v..C...!'OFqb0...S.= P..t.
5.>u...7.".a.{WRi....\][email protected].|.%#8.....6 ..
Q.....h$}Q.. .OH....X.#*W...C..?.u......4.|..D..=...[.&...K.....).F...
..A<... ..z. ..V.][email protected]....
.......o/.5.0..O.1.@......\..j....I..-.V_......sR.#87O..[r.%c..FK.<<< skipped >>>

GET /uc_server/images/noavatar_small.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:16 GMT

Content-Type: image/gif

Content-Length: 1574

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
GIF89a0.0.............668cde|}~uvw...............IKL..................
......[fi.............................................................
........qtt....................................rlf....................
.............................|p......T@4kc^.................{.rX.....{
.....z..y.....e...................bZ.SJ6 *<21.?:.KH....**.%%...B::H
BB...(''`__[ZZXWW..................SSSOOOAAA>>>111!.......,..
..0.0............................................................!....
.:............#....rong.f..os..........-.......qg..........{...}...p..
{....p..up..M?...D..N...~.....S$M.<0..P...&..../.E....c.P."...4t.q.
O:(!.d..%.6oZ........Z.,.T.U..).5j.M...,...gjO...fU..h.8R.....(.KuT}..
.vh..m.t...... 2.aG..Y.A.n.x.E......tK$c.y.F.<........T....A..-.Xf.
.6q.p.w.c.B..}.$...^..s*.SN8.A.|(....>[email protected]../^(
A..i.. J...L$L..<...?da`.@.......`..%W....gA./.....5... ....6.P..MQ
X.M..w..K.......C.4.....ivBs.....C.`d.6.....28q.....#.B.A..<....8.X
..E.ad.d..B."...RF`YC.`~..._....rf...^...".....B..C.x....J..`.u.1..{.Q
G.2..D.0q.A~....[d,.C.B^.h....C.y...e_b...V.1GGRNi..q.E.....B.6F: ..\:
..........fbKX!E.p......Ic.x.q.....D.Rh...,X *.PD.D........x*.v.....7.
........hQ/......G..C..cp1..Q.....~........#.p..Y.!..W.|p....pn:T@F...
[email protected]]<.....m...#.k..|j..7.....".f.B.-..f......(.
2.....e..6.;..w.n{......t3..Mv.z.]4.H.....2.L". .x..G....V.&.._..BLl.w
.g....[L........X..... .:j..l;.u.b..K....._F3. ._..!....]8.E..U.<..
.>..%..r..^..>.........y......^L.?.].........G>.` .l...HV<<< skipped >>>

GET /uc_server/data/avatar/000/00/73/25_avatar_middle.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:16 GMT

Content-Type: image/jpeg

Content-Length: 2655

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 15 Aug 2014 22:30:59 GMT

ETag: "da753e96d8b8cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
......JFIF.....`.`.....C................................... $.' ",#..(
7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222
222222222222222222222......x.x..".....................................
.......................}........!1A..Qa."q.2....#B...R..$3br........%&
'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...........................
......................................................................
.............................w.......!1..AQ.aq."2...B.....#3R..br...$4
.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................
................................................................?..qP2
.S.O".e9..DE'Jq..Rc.E1..4....H.....Ao`.4.l....j...4.l.....a..T..y0....
..R..=..<W).3B.=.>O..&......5F-...>Y....ue-..dB..EJ...4t...v.
.....|........&..0kkH..7...C..Qf.qGU.4...t.T..........N.........T.....
B..56.k.)0! UK......DS..]#.`..}.)...q..C5....4 ..j%..N.|t.Q...c.J&d.$.
.i.....D......5......^mJ...[..#.Eha\YD$.. .......>.p.......y.t..e.u
..gx......8.C......'..3T.'.... v8.e.A."...[$..@....(.&.M.eZ.l..gD.k./.
.d8.j.s..&;.b.. .]8.W.......(.#..d. .*...pGj....!.......`RcEb8.O...:..
...... . .Q..X...t....B=k*..GN.sN.So:i.m.<.T.....7..$1.Q.].F[[..D..
&.`..y9...5_..P....dd..s..".....;......=....../.G........]E.=2.kt.I.P.
>>[email protected].$..4..-......<C....7.........D.?..\v.kx.t.$.
R..~...V.\Mh...d<.1..)8F/.%..N.C......R?...`U..F..-...e.&...H.zp...
<....w.a<[email protected]..*G........y....U.....$... ....
.=....a.cZ<..:0..&.7...#...N.j..l.w."I..FsSD.4..F.9..[.}[email protected]<<< skipped >>>

GET /uc_server/images/noavatar_middle.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:17 GMT

Content-Type: image/gif

Content-Length: 3972

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
GIF89ax.x.............\\].............................................
..................................................................}..u
ww....................................................................
................mc\..................hJ9...........z........v6$...r...
.....t...........m.hS.[P......`XV.rcA:9.OE<32.pn.......  .((ULL!...
...,,&%%mkk<;;655FEEBAAVUU............cccQQQLLL...!.......,....x.x.
......................................................................
..............................................................J@.H....
........O.#F.(.....)[email protected].(S.\Yr#G..A.rYR...8s.l......d...rg
..H.*....K.A.>lG.&...,d..U...8.>.9....W.VX.....p......g..d..;.2.
W.pQ..L.p\.W........v....B..;c..9..s.6m..P..0..b;F-K....\......m8.....
GN..s.*....D.Z.V.c....Vv.9#.x..vS3...)r.*.8.L..s....?...V.....E0rr.)..
.......=..z....aZ...v..u..r.._...aa..fH....X..o......G.E7=..~.]X..0^.a
g...F...v.ZH.. '...`.,....H&....L6._.oD.F.)....*.xTv.5.Zw(....Er.".J..
...:.!.R....u.. [email protected]&...w....n....R.1........A4.Ro..h.......6.
...6.....x.I.%".j.Q..[w.f$..b.(...:*..5*%..n.j......W.................
(...6.f|.....TT..$5.).fr...|.[..m.....v............@a&7....J(...K/..f 
,.o..j...`W.5$!;0.}......k..K.........)h.1!Mm.. .......\..(_...,.:.icv
k....<3. ....M*...@.]/....o.H...M..L3.P{....M]...6.u.C....~ }e.dS..
 e...Q.....oK ..W.].._....Y..4.~.....n.w..{....Vl....%..MO4...f.!.n'.x
...Nz...q`.....j7.....{.9....u..s....=F....^<B...g..........}..R...
........|...m>....z."P.........>.I.~....J..n..r(!H.n...R....<<< skipped >>>

GET /uc_server/images/noavatar_middle.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:17 GMT

Content-Type: image/gif

Content-Length: 3972

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
GIF89ax.x.............\\].............................................
..................................................................}..u
ww....................................................................
................mc\..................hJ9...........z........v6$...r...
.....t...........m.hS.[P......`XV.rcA:9.OE<32.pn.......  .((ULL!...
...,,&%%mkk<;;655FEEBAAVUU............cccQQQLLL...!.......,....x.x.
......................................................................
..............................................................J@.H....
........O.#F.(.....)[email protected].(S.\Yr#G..A.rYR...8s.l......d...rg
..H.*....K.A.>lG.&...,d..U...8.>.9....W.VX.....p......g..d..;.2.
W.pQ..L.p\.W........v....B..;c..9..s.6m..P..0..b;F-K....\......m8.....
GN..s.*....D.Z.V.c....Vv.9#.x..vS3...)r.*.8.L..s....?...V.....E0rr.)..
.......=..z....aZ...v..u..r.._...aa..fH....X..o......G.E7=..~.]X..0^.a
g...F...v.ZH.. '...`.,....H&....L6._.oD.F.)....*.xTv.5.Zw(....Er.".J..
...:.!.R....u.. [email protected]&...w....n....R.1........A4.Ro..h.......6.
...6.....x.I.%".j.Q..[w.f$..b.(...:*..5*%..n.j......W.................
(...6.f|.....TT..$5.).fr...|.[..m.....v............@a&7....J(...K/..f 
,.o..j...`W.5$!;0.}......k..K.........)h.1!Mm.. .......\..(_...,.:.icv
k....<3. ....M*...@.]/....o.H...M..L3.P{....M]...6.u.C....~ }e.dS..
 e...Q.....oK ..W.].._....Y..4.~.....n.w..{....Vl....%..MO4...f.!.n'.x
...Nz...q`.....j7.....{.9....u..s....=F....^<B...g..........}..R...
........|...m>....z."P.........>.I.~....J..n..r(!H.n...R....<<< skipped >>>

GET /uc_server/data/avatar/000/02/40/06_avatar_middle.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:18 GMT

Content-Type: image/jpeg

Content-Length: 5942

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sat, 18 Apr 2015 07:18:22 GMT

Accept-Ranges: bytes

ETag: "3e6b6fdaa779d01:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0
......JFIF............................................................
!........."$".$.......................................................
....................^.x...............................................
............}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:
CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................
......................................................................
..........w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
.............................................?...C..5..X.Csl.\[G"..|..
w9.9....x.9N>...4q|..s}.Y..........8...<~....4.K..V7:......"....
......>..Rw...V.4ax..C.8..o....j......N,...e....q...V...&..M;....4.
>....l.?g...22..d..u...O.|SPS.f'~m. ..#,3*....U..Xo..Fq..:.q.gG..#h
B0......;?4}...F.].v.*....3.]^.|./i.....IoB....#pFA.....N..?g}.W......
a...[......T.G,.I9<...{..4..IGDX....J..N[.X..chnU..^6\..0.9.sA7.m..
V.f..I..L....Rbv{.2^.Wa.z.F..~.N...y\......o.......}.|..T.(.*z. ..WZ..
....mfG.B.d~.....J.Q.......... .a ..|..tzs..%h.W)_..Ki..7D........w..T
..%..`g....SR...14.............)&.[.f.u[[email protected]....<
_&.._O....jZ...... .w)=G.c..kz........4^k..W..p...?7'<..^..H......j
.......fO1.*..NI>...u!...a'......v..SJf.}..9..b.....k.bi5..T.}[email protected]
]r..Z..b.8.H...s.H...I.0...=..x....JQ1....DO........w@.....\.:.t..^...
.....gE.9#...0.a...S.Ipu.GT{8..6.8..._N;P....E..-V8.8N..<.P.....*..
......k...\..z/sS)(.e)(.~..G........#.er.F......sW.....'c.>..q.<<< skipped >>>

GET /static/image/editor/editor.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:19 GMT

Content-Type: image/gif

Content-Length: 13832

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
GIF89a............dlP(....qU....i5.............j7..E.......S ..L......
TTTfee........f\6......M............FFF...wwwohF......mUJ..n..s.......
.u.....S..U..................UB,......urk..H.......................=..
....\RD...........................777......z......r....w.....Cr.......
""" r...ZX..............k.............3.u^......7....w:.......3.......
...c..3.S......y..m......p...J............^.5f...h..&.u5N....O5.....'J
a.....6..-...,.8..... ....D........./:*.e..z.....H.b...g.........Q2...
.......z......Uz........0V.U..j...........d...Z..........V.].4...&8.I.
...88........f...;[.(?x.....>......,....f.,:~............R...b..4o.
..Y6..%.<...8..F%x.s?...2.Q....O..........W............*...c.......
..'..Y..t....3...)...........v.j...Sdmr..<..4.........g.=nootk]RLF.
........:.(D5(......!.......,...............H......*\......#J.H.....3j
...... C.......(S.\....F0....S....g........)PPh..$..d.H:i....S.p2f...n
.j..S......l*S&.Fjn..s...3....c,a..x.N0.p..1k..~.fU..\.ct../.....u...d
..(3......U^42.m...j.......\.l ..........k#....p.........eU..b...-.f.8
....;.d.....wS$.....R.N'..Rp.....x...X.8.R.7.b...{U.......*o,r.*a.#...
.!.x.U....|[email protected] CR..P.'..s......}....W.
.........5,B..k..$..Y..B.h....<....5.b....P.M..A.....6..D.kg.w....0
O.E.DA. d.@g..@ A)lP....#.......a`....q.f. 61A\...A..u..@`...x!|....r.
..u$.dC.....}.(...Mx.Xg!2:F......n..........f ..M.....y......*..!0....
...YL0.C.N........t.k.....E....O.Z...-.P..?.h....j.C.a^.b.......n..B..
...(.0/C..X'C..z....&..Y.Y............z.A4.YV.%..d...Y...B#@...12.<<< skipped >>>

GET /adx.php?c=d25pZD05Y2QyMWFhNDMwNTRkN2EzAHM9OWNkMjFhYTQzMDU0ZDdhMwB0PTE0MzQyNzE1NzEAc2U9MQBidT00AHByaWNlPVZYMF9Vd0FKbm1GN2pFcGdXNUlBOHIyVkRkb0ZGYURuM1RWMjh3AGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD0AYmNobWQ9MAB2PTEAaT1kM2EzYzZiZg HTTP/1.1

Accept: */*

Referer: hXXp://pos.baidu.com/acom?adn=0&at=128&aurl=&cad=1&ccd=32&cec=gb2312&cfv=11&ch=0&col=en-us&conBW=0&conOP=1&cpa=1&dai=1&dis=0<r=<u=http://VVV.ltywz.com/thread-17831-1-1.html&lu_161=0&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=153x-1&psr=1276x846&pss=960x156&qn=4f4730e82ea33ac9&rad=&rsi0=960&rsi1=60&rsi5=4&rss0=#FFFFFF&rss1=#FFFFFF&rss2=#0000ff&rss3=&rss4=&rss5=&rss6=#e10900&rss7=&scale=&skin=tabcloud_skin_1&stid=5&td_id=1991537&titFF=å®‹ä½“&titFS=12&titTA=left&tn=baiduCustSTagLinkUnit&tpr=1434271564146&ts=1&version=2.0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u1991537&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.172.2203.2203

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wn.pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:12 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

Expires: Mon, 26 Jul 1997 05:00:00 GMT

GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Serv
er: nginx..Date: Sun, 14 Jun 2015 08:46:12 GMT..Content-Type: image/gi
f..Content-Length: 49..Connection: keep-alive..Expires: Mon, 26 Jul 19
97 05:00:00 GMT..GIF89a...................!.......,...........T..;..

GET /data/cache/style_28_common.css?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:41 GMT

Content-Type: text/css

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Wed, 03 Jun 2015 14:51:34 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip
4bfd.............}.o[9.._......K%.....,*..3..`.n`v....lkJ....)#.}..<
;..{..(...[..%......._...i.i;.......6._....._.../....j:8...m=n......~3
.......b.....d..i...........'.,..............6...........|.y........t7
[.&....y?.(/w..~..o...u.Z..=....7.6.l......_................z...N.....
.F......`.^......zq...N........w..?}8;}8?}.8}.<.[o..w..b...O;.-.O^.
...|5.^oF..|u.O_...b.2[n.....b.....O.c q.m...h........h..c.......-....
bv...x.O....~p.E......<...b...w....L.lAX[...-.......~v:....v9Z\....
........l..b.. ..h...4.*..).a.]...Qk......[..x.x.<nw...z....._:...-
.....K..}.r.x<Y.Fw........:.p=..6....x...r..&f....l.......O..|<_
.......t...^~[....>.pv..<.^..{.l@>l_..C...yn...A.....?...z...
.......E....r.z..........n....:..9..nl.z...O.<l;..CA..E.gN..|......
&o..up....y...LG^.-;Pr&F.wk:.=..-. t...V....\)}..v:....6..7.......4.A1
....z1.t.X...Zg..Y#..../Y.B...?..e.G..x]........A..n../>..../"..e..
A..[...Z..=%...h......M*.P...m.w...QJ.R_..}..Vg..q9%(...*..9.xq..e*.@.
.........[......C..4...;......2..E..A{4.....x.......2.......3..g.9`...
..=...^ .....Z.V.y..x..<..UH..//9.9....n..JJ................r.h....
oQ....`.o9y...Lg.....VX......>dc.....T..x......V.c`..j......3~..Ck.
.>O_y..;..c.x.H.JG.?.....j.W. .jC..~2\$V.............. u[....|.....
.D...%.J.l*.74...Z..j$..D}...A.W`O.c......$.....f..,.6...*.:....3.....
u......o..b.lG...n@9.<].R/..m.M...knI..MI..zjjKF........w._..&ysr.2
......{.*.elBDi..T........)6B......H....1...I...F....g..x....(.q.qp@..
(6...8.88$#[email protected].......|..-......#".. ...-~.D..Yz.. ......_O(.:.<<< skipped >>>

GET /data/cache/common.js?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:43 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sat, 13 Jun 2015 21:30:15 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip
[email protected].~.zf.QZ5EMkV.N..{...@.$...4..RK..e..c
...{}........o..>..p._8..p......../..fV.S.~P.......................
.0.......a..f......K....J.....V...g....y..l.:z....C.h.;J......x.o.v. .
..&.cP.l.*.v\Y.l....A...M.[......>...Gu`.J...^[email protected]./..=
....J].uAqu...1...N.xr.".V.!?KK@w.*.g...m.FD4'.....h.=....5#..H.....l|
.1..w. {.I..r2<yQ...n5......d....*..y.Y.x...^.......Q]J..T....r..hY
.?......3...4..u.Em...x....T..N6^"M........rE..GRI.s|.y......HfLP...l.
.n....x..wF...\..:j..t.w.d......x2.k.~..T...Mca....o..s:x....99.......
,.~a..G..qg.Eg4F}.'...18$...IgD.].....n..g.$...I(...Z....on<.....[.
n.....Q.eCc....~$....K...h.H...6..;;.;;...Fm.R...|...'.'..F.f.U.....^.
...*M...........Vl../1..V>.........n........d .gq.k.J..v.^..../imS.
.U .....bN. `J.&Ml#........^#(..9...7M.[*..b.....Q......-3.70.=:...r.&
lt;...o_...*uez...<.........*-h.I....K.......!....Q.I~...9.T.U ?.Y.
.u..g.IJ.O......}.......lT*[email protected];..;..........,...Ub..W;.
..h....M..X.{.......t.5..._.Q./.q..g.R8............$.&.0g1..8....d:..%
..i'4l.`[email protected]..{..N}..3^j\^9f`..?%9$f<.<S...(......4.k;}
Z.....J........=......x....{..W.Y#. ...i$....3|.#L..^Z3..'.....swR.60.
...T..q.r..M....qg.b29......(.....V.>Ud......h..e.. ....&.FN...?.R.
..../..s.Rk6.%2.&-.A^x.... ....\@e....q.rb.(..u./.Q...g..Mw.r........(
...(-.N{tp...Lj..az;..w...O...X..F..........0...Q...hz........../.....
rv...J..Nl.$................&.....7.v.....my..8.].Hs.-...?... .}:l....
.....7gt.......m.q..C.k_mH.e....#.q..k....qw...N^.a2...)6?..a.{...<<< skipped >>>

GET /data/cache/portal.js?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:50 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sat, 13 Jun 2015 21:30:15 GMT

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

Content-Encoding: gzip
e10.............Z.o....W.K...].v*......T$JQ....:....-......E...J .._B.
....R.QK.%...TUT*.V...@..........._*.{.3.<o......b_.Il.........B.0.
.~..y.ME...,Le...A....2k..[....y..q[...v.N.d....$}x..}......g..I......
...l;..)..c. ..T.........c.4.n....0.E6...=.:r...F....Z.}.3..|;..d.lIo.
[email protected].#.......i`d.Q.M..n.w#...<..](.qzU.....:..'.`.(,9...OB...3..G
m...["..}.U.,d8.5C...A....y\....z'.v.."...f.Y<!.=...C......."......
21M......7...^-..j.Y,..g4.Y.%^0G.6)..hO..4.!V........3..Z...l:...9.YO.
.o..J.hwR......Uu..9W..<. U..\~R<..R... [email protected]=...E32...p.
Xm.D...\`.......8.....,;=M..nvi..............,..RL]h.c....a.. .AH.....
[email protected]...\....-.....C0..X?yf...x.@.<...x..N......R.R....*.#vsXn*2..
.b....).F.FY2E"[email protected]^...W.y..W..y...?z.. 7....,...k.V.
((..Q.M].li..,....r.S..q:&..(q..;..(...\A......*........Hp.a.lYG,..R(.
.90V.!<..)`=..A.....q...dv..5.Y4.M?`.Y.. .v...|x...m!=;[email protected](I&
lt;*N..L..y..>.$^.M.\.....t.#C....I.......O./...-.."P.y<!.0c....
...Ak*..../......C.J.r.J..\d..)[email protected]=..7l.C.j[....\....wNy].D.
A....J/.9h(e...YP;..%X.<SU.} .D..n1.....Kjv.8....8..0..............
..u....i......|6.e..w.lk..)6..5"...:QFG.T...[.t.L.Z/x..d0.....8g.w.a..
.SP`.]..x..K...OC.H....V....v.O..qr.e.....D@."....)v.DB.E..L#J.|.Nm...
2....}.....PP.*...GU...L.N..A..........K.)..X..P..V...N....}..=.4.8.8.
MD?Dd..)...V9=..XH..d.p.J...6R!...}..v...Ld.z.(j...(......zU.....5..pA
..^..-...}.......CF...v6h.L..z....).I....p.A...o..d....2!gYl..a..$...e
...zC..l[I.G..I.l...S...`..h...{X....L.$.;.........L.9`.C..0,y;.p.<<< skipped >>>

GET /data/cache/logging.js?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:50 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sat, 13 Jun 2015 21:30:15 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip
112............UPAN.0...VB.DTQ...FQO.....*..4..k.N.j.w6I..by<3.3.;{
..-.......v).O..;(a!..r..,t=.w...fo0......6..T..x..O.<..A..t...V...
UT."\.0.N.......#4..j[q/ ..-....=..5nk.*.]..RMEF(2...*.qyKX>..AL.b.
j..Y}./.!.5...b...........V.-.....{...UK.JB. p. #.........#|..z.=.T..?
>.........0......


GET /static/image/common/background.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:52 GMT

Content-Type: image/png

Content-Length: 1166

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0
.PNG........IHDR...2...Q........w....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:F4E8DFDF4C7211E0A274B8AF
749486A2" xmpMM:DocumentID="xmp.did:F4E8DFE04C7211E0A274B8AF749486A2"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F4E8DFDD4C7211E0A2
74B8AF749486A2" stRef:documentID="xmp.did:F4E8DFDE4C7211E0A274B8AF7494
86A2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.".....lPLTE...............................
......................................................................
.......m.......IDATx...I..P...BEAqB.q...w........3ROL........LI.......
;fJ....X$)..........I..&,.d.)."..3%.Lo....~X.I........MZ,...Hr..a...".
.....-.. ....P.l.W.......IEND.B`.....
<<< skipped >>>

GET /static/image/common/nv.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:53 GMT

Content-Type: image/png

Content-Length: 1939

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
.PNG........IHDR.......B.......O.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:F3E955C6672611E0BB73C54C
B762A343" xmpMM:DocumentID="xmp.did:F3E955C7672611E0BB73C54CB762A343"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:762A0B4D672611E0BB
73C54CB762A343" stRef:documentID="xmp.did:762A0B4E672611E0BB73C54CB762
A343"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>...T....PLTE"g.'p....(s.,|.)u.$j.%m. x.-~.#
f. z.*w.,{.%m.D..#Y.#i.'p.$h.-}.)t.)v.&o."g.#f....-..(t.,{.#h.,}."h."g
.#i.<..6..'n.3..4..;..A..*r.D......x.%k. [email protected]..?.....B..2}.?..
:..7..>../z.=..(o.1|.-w.C..8..B..9..?..-w.>..)p.O'.....#IDATx...
[email protected].................,..*..l......c..Y}Zk.. .g{......e?.B..y...z!.
...B.T..q..b.o9e..M,h>v.|...=.N..T:iH.Ge9....UFXN........#V..7.....
.|..7(.V..y..J...w.....t....K..OOR..&..i.. .......%..5I.W.|Gmi_..T..$.
..G.UW.Q...}..8.OOR..!_.._u....P..i......Z...N.:.....N.L..:...c'.7.|..
....T..J...i .r..Rl...u.r>..\..z>v.|....4.u..J.e)....N....J.<<< skipped >>>

GET /data/cache/forum_viewthread.js?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:55 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sat, 13 Jun 2015 21:30:15 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip
207e.............\....u.WF.r....N.....TBPA)c0._Rw..............q..EUB.
\%ld0_. .oF......r*..H..H%e(.......3.{....!6.v._.~....._...h.L..`o....
...ax$..<.......P2./..'.h..8......I.=.[....\....u.$....E}.....d.~..
e.u..G.f:.'@..J.. .=.t{...A<....dq....zH.v.,V........[...u..|......
I...ERz$HG..d4N..]..h|..:.lF.,.Nz.-R...<.).... .c...8..H.)..<..C
O;..x.^.x..6Z.,.A....-....(OF.0@<.....7...t.O..v..C.r...x..(....,..
..LAc..M...4..d....t.M....S.....b2.`...#%.h,3...../..&.yH..E.k3.......
.-..........~....].\g.G....~'F....2..s.0N.....:I.*:S<[.G..2Ip.\.A..
..l...w$....8.M6........ZV.8.9.hH2......Y.............6.n>.$...d.O.
&....G(..c..m...V-.q...q.YhJ....g......QO..V<H.\.-.NS.:....$.5.^...
.k..O .<..A...W.KE.f..q.J..I....F........CJ/..W'..."...Kv...Z.c....
..F2l.1E..;..l..'....7..,.....^......`...VmM0...~:..t..N.uQ...I..Z....
.q.|j..V....B$k.*$<.L..Rn.".=.|....Vj./.........;H....};..`.7B...s.
n`...$......x..'~...W.";0.....^..lxa.][C7!F..........f8v!....$..'...m.
...$l.0.HA.?..!Vm...................B...a..1.Q...&..\.......}.....E..O
@."S....BY..%.MX_..*(....D..........}.....)...B.....,....^._...X.'[..|
,.iW{t..._.LF.xr..;..{.....a....E0V.8...`P.Y1..t]@...A.....[3...`<.
[email protected].......{.........a.......`.....n.j........)..tk..q..7Zi..}..
./K.S.V.......H....d..r....K~... ..G.6v....o.......}Rw.|&.0..n.^..M...
......y..x.....)[email protected]....!6.M..N.T!E...>l.vv........z.]....{.I
<kX^ .L.}.}z..Q.b8.....*ov..^..1...F.,*s.0...N....[....b.....S...F.
.t.R..p....[..[,J.....|...p...0y..3.v).nhj...W.-Y.5.W>.E.D.9...<<< skipped >>>

GET /static/image/common/print.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:57 GMT

Content-Type: image/png

Content-Length: 1015

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:FB35016B4EA511E0915FA03E
6093E607" xmpMM:DocumentID="xmp.did:FB35016C4EA511E0915FA03E6093E607"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FB3501694EA511E091
5FA03E6093E607" stRef:documentID="xmp.did:FB35016A4EA511E0915FA03E6093
E607"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>i.w.....PLTE.................tRNS......A...
GIDATx.t.I.. ..K..hSPA....e.I.tT`b.".=...r.....GF.h.J<F.K.....8[...
...........S.....IEND.B`.....


GET /static/image/common/thread-prev.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:57 GMT

Content-Type: image/png

Content-Length: 1007

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:FB3501674EA511E0915FA03E
6093E607" xmpMM:DocumentID="xmp.did:FB3501684EA511E0915FA03E6093E607"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3278EDDC4EA511E091
5FA03E6093E607" stRef:documentID="xmp.did:FB3501664EA511E0915FA03E6093
E607"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>2.......PLTE.................tRNS......A...
?IDATx.b`B......P...Q...Q..|[email protected][email protected]@...P,..t).........!..6:
......IEND.B`.....


GET /static/image/common/hot_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:57 GMT

Content-Type: image/gif

Content-Length: 680

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a........................x..V..:..4..............................
......................................................................
......................................................................
.........................................}..z..y..y..z..w..u..v..p..q.
.p..j..k..l..n..k..h..f..c..e..a..^..]..`..X..W..\..V..Y..X..Q..Q..U..
R..P..L..K..M..L..I..G..C..C...................!.......,..............
)..  ..........8...<1%%......HHI.I.]G44''.....Q....iS??22##...Z...c
.oW.K9-$.....e...r.q.bXD2)!....hh..yw..kkUE6.%.....jnsxx...........&:X
x....3m""...N.)I|..QB. .dB.I....._...QC...."m.I...3fHR.b............)U
........."9...L.%A.2.b......|......6..h1c......@....;....

GET /static/image/common/forumlink.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:57 GMT

Content-Type: image/gif

Content-Length: 170

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
GIF89a.......i.....v..x.....f........f.....f.................!.......,
..........Wp.I.T8k|....HJP.E..E0.....:#...t...].q(.k....<*I..q.C(..
...PX..l........f.h...\...7.|%..;....


GET /static/image/common/userinfo.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:58 GMT

Content-Type: image/gif

Content-Length: 248

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a.......k........q...X?d..X..P...............~Nk.............w...
u......................................!.......,..........u.&.di.d%I..
........]...e...!.X2.....D.................60.P.S.U.........T...1.(...
2.v_T8k.;8z.3?9...z......f`.`.(....!.;....

GET /uc_server/avatar.php?uid=2951&size=middle HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Sun, 14 Jun 2015 08:45:58 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Last-Modified: Sun, 14 Jun 2015 08:45:55  0000

Expires: Mon, 15 Jun 2015 08:45:55  0000

Location: hXXp://VVV.ltywz.com/uc_server/./data/avatar/000/00/29/51_avatar_middle.jpg

0......

GET /static/image/common/medal1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:59 GMT

Content-Type: image/gif

Content-Length: 3223

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Wed, 20 May 2009 08:06:55 GMT

ETag: "491a9f021d9c91:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
GIF89a#.7.............................................................
........g.....{....................{........g..Z..5...........R.....B.
.g...........T..F..:........s........)........c..N..:..{..k...........
R..o..B.....-...........,..k.....I.....R........s..:..Z........:..)...
........J..Z..5..Z..s..U..i..)........G..:.....k..R..!..).....1....s).
{..{).f..{J.k!.k..r..g..k..k:.V..Z..J..J..B..1.!..NETSCAPE2.0.....!...
2...,....#.6..........:I.w-5BB......jjrr};c:...........!/C.t.. -......
o..Y/!..1&..?.GGM.w........:g..?T&..(....:.t  55....o.}:W....\@.......
...w..=p....u.vXYP.@.%........&...<....7e........Xn(..I..T..0j4.cA.
Q....$..)K4dc..B..1gN......eF....... YB.0b..;Q.L.....[...12"%..Z.....u
..2.:B.P...?#....W ..8(.......{.4...O.&\...gX.....8~...... ..c.....Yr.
}.....0@H]...' ..f.!..?~....[7.?u~.......:..Qn.yw...d!"]8uH%..x.b....c
.a....)X ...@..%E.PD.f.a..Od.EfK...y..P..HX...OT...T..._.Ax....`..Y...
...'.p.X...KX.T./v&#. X.Y."n0B.6..#..%0....00...!.Y!.$.@..=(.=.....6.`
[email protected].(.=.8p.....E...0../....V..B.W..F..\p..o..$([email protected]..!dJ
C...WA.^.....]Pe.W.p..Z....:....^.`@.L..a..0...Z ...i.a..'.`...9......
...^0....q.......v<...0..B.) [email protected].$.q..*IhB.l....F.!....`..
....... ..lDlF.......p<...P..B.?....=.q..W..C.)....p$...*[email protected]
[email protected]..... ...n.....@..?..A.,0.4}4\a../....T..D.r
>a..X.0..'..F5.21..DhaG.m.0..g....;4A.l*\p..h QQ1G<...nhk...7...
g.......A.F.q.....9.k.1..g..D.P....*E.i.v.....Cq..l.A..]0..5p. ...I...
.k.A........?AD.g.a..%....][email protected].#...Ep.......OK...<<< skipped >>>

GET /static/image/common/medal2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:59 GMT

Content-Type: image/gif

Content-Length: 3081

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Tue, 11 Nov 2014 20:58:01 GMT

ETag: "d325f02df2fdcf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
GIF89a#.7......................................................p......
..}.....c..R.....m.....c..Z...........<..Q..]..)..r........M.....a.
.B..8.....J.....B..1..)..u.....L.....c.....!.....:........!........)..
......Z..!.....J..R.....7........)...........s..:..J..\...........J..k
........:...........1..k..Z..1........M........)....s!../.....B..Z.j..
{..{..s..q.._..n..o-.R..c..c..J..B..J..R..:..1..).!..NETSCAPE2.0.....!
...2...,....".7...................!!&,.99.......XCC?CN.Nb..bh,H%....f.
.......FZZiisv{,K6.....^.......F..n.......Q.....FVZai...... .]......V.
an.{......B4...|......../..m0aN..<{^.k....\.6.`...5;z.......4.$...b
..;[email protected].....&}....g...`...
....].k..iK...v.B.......l...CD......xa...1Y.....O.,7..(... ........<
..A....'J..x.. ...T.(....,<.0.BE....|kJ.....L............`.J..A8D..
.|...Z.e.n..!1...q..6... . ....$......... ..r...P.B..E0....0..c..b..L`
......o...!.d.QG.4....c.0......6.08...8...[.....c.q..*P@...(..........
...o.... ....r..C...Q. .D...x.QB.# ...rX...pP...q....B.G.K..1..=.0..2.
Q....I..@,.../...i.h....0`..=.1..S.QE......7..G.(.P.... ..g0SA.u.0C.2.
.D..4.../[email protected]....:....G.AG.,. E...p..u..........d
..H4....04.F.j....P....U.VA...X........&.0F./....[(.G.38A.U;..D.`.....
h.C.&....0.. ......?.a.UL..........h0S.*T........C8.......L$..u.7$1..J
T...#.avYQg.D.!m.v.E......1..I....f'.D......7...n..!....s.Utl...f....S
....I$qD.Rp.......1,hV.......x.a..q...._p...I .M......N.N..:t/{.c.... 
..................{.M.!....>..%....G. .z0....W7....G.,[email protected]..<<< skipped >>>

GET /static/image/common/arw_r.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:59 GMT

Content-Type: image/gif

Content-Length: 65

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a.......fff...!.......,...................1L..fz .].TY..V..;t>....

GET /static/image/common/arw_l.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:59 GMT

Content-Type: image/gif

Content-Length: 844

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a.......fff......................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........!.......,..........)....H......&..p ....B\(Q.... f.h.... C.
...;....

GET /static/image/common/online_member.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:00 GMT

Content-Type: image/gif

Content-Length: 365

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a..................V.....M..3..M........M..3........q..q.....3...
..K..M........3..M..q.....M........:..:.....<..L..1..q.....V..M....
....................................................................!.
....(.,...........@.`H,....RIjf2..bJ.^".G.*. ...5..z..k.3.Q.h..ja.D.&l
t;...4.vxyg_....C.y..q.. .....%.. .C'..!{... ..C....q_...C.&....C._...
.............BF.C(A.;....

GET /static/image/common/nosexbg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:00 GMT

Content-Type: image/png

Content-Length: 1389

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: EXPIRED

cache-control: max-age=14400

age: 0
.PNG........IHDR...z...N......l.m....tEXtSoftware.Adobe ImageReadyq.e&
lt;...lPLTE...........................................................
..................................................m......IDATx....r.0.
.}.1... G..... ....C.i`w..,%..,..,Xbw../....././....}{..........M.6B.v
.......h..n....h2..^ G?..:..Q9l'3.......7..l......$.aeF._........;....
.[.6)8(<.=......P...0Q......1....."....]8.*j..y...i....|.......O 2F
......8m....^.....Z.E.t..........`..Q.U..Jt.r.6...S...h..H.eY..C.>
;'eh....P..8..]a.Q..p....N.E~.T......O}.O.i0[g...n.....>.$.f..p...4
)..h....q9..<|....p)8.7>NT..:. ...b#.*...KG./........:[email protected].
..G.....B.z{...!..........m..N.h[}.#...:.......Mr5;...K.....=.t..g...o
.p....KBb..E..ya..1.w.3BH.m......YM.=F......[..ov...#4!L..O.......j..r
.Mu....T..Z...K.g........,z.%.L..S..i....u.......,`.8[....C.Ac....P.:~
w.W(.#......C.I..RM.9...........p.%.<P..J.M..`..."l&..h,PK..8R....i
L.J.JKX..h..qJ.r.. [email protected],....M..5EG..C...\..N..`3.4#..%w.0...XZ...
[email protected]@..a.d...Q..........b8.R........P).
c...8....*.(.[..2.H.. ..SB\..9....3#.Fq.....w*R...\..xU.N...f.[..Cb...
....-C.S,..l..#.{M..|.;...>:]...Q...$..Y.o.uzu;.|.N$....2...t@..! .
!.&.l.~..P....DI.p.X....z...m....3....=.=...p....%.U(.....o.2...^.....
......I...}].R_F.....Ek8..KG)..B.....R)...F...A*V....ft.&|ZH...j{.o.M.
..?>o..I......!-.]...s.....{t.'7..mR._....hy.n..3....G.y.&V..`.$w.=
........IEND.B`.....
<<< skipped >>>

GET /static/image/common/flw_ico.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:00 GMT

Content-Type: image/png

Content-Length: 1305

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e&
lt;....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:xmpMM="hXXp://n
s.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sTyp
e/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmp:Cr
eateDate="2011-09-07T10:12:30 08:00" xmp:ModifyDate="2011-10-25T06:28:
48 08:00" xmp:MetadataDate="2011-10-25T06:28:48 08:00" dc:format="imag
e/png" xmpMM:InstanceID="xmp.iid:B79C72DFF6D711E088AB957638E55F95" xmp
MM:DocumentID="xmp.did:B79C72E0F6D711E088AB957638E55F95"> <xmpMM
:DerivedFrom stRef:instanceID="xmp.iid:B79C72DDF6D711E088AB957638E55F9
5" stRef:documentID="xmp.did:B79C72DEF6D711E088AB957638E55F95"/> &l
t;/rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacke
t end="r"?>.......0PLTE...........b.nL....V3l..{.....^.....H~...u.y
U.....w}....tRNS.................#]....pIDATx.\.... ...P1M...8.r....&l
t;.....4.k............m.Al.p.@G.............\]....23#...1[J.?...vP3&..
.....bl.g^.....?..C~Vm.....IEND.B`.....
<<< skipped >>>

GET /static/image/common/pmto.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:01 GMT

Content-Type: image/gif

Content-Length: 152

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0
GIF89a.......T..]..a..\..T..O..N..V..Z..~..b..L.. |..........!.......,
..........E..I.......I(...0#y.g.,...h8.........`....A.Bq0...e2.\..U.'.
..:.)fL..#.;....


GET /static/image/common/ad.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:01 GMT

Content-Type: image/gif

Content-Length: 997

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: EXPIRED

cache-control: max-age=14400

age: 0

GIF89a................. X..W. q..f..r..v..............................
......................................................................
.................................................................|..x.
.y..o..e..f..b.._..`..]..\..S..U..Q..M..`:.B..C..E..@..= .6!.7!.N=.3".
.".-#....)#.&$.'$.??.!%..&..&..&..'..'..)..(..(.$D.....*..-..*.....0..
1..3..6..:..A..B..C..H..L..P..Q..W..Z.._..c..n..p..t..~..~............
w .. .w...............................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........!.......,..............i.&..:x...$...D..`...L.4k...... C.. 
Q..I. \[email protected]...#H..M... ...?0^....F..D.P.....=%L.P...Q...H.@.....
:...`F.!H.h).'.....|.....$P..I......8.H....!K..)`.....0x .".. G.|.0...
..*h...E..E.l...;....

GET /static/image/common/qzone.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:01 GMT

Content-Type: image/gif

Content-Length: 2110

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
GIF89a........K.....S..d..~............!.. .. .......?v:...=r.~.......
.Y.>...:q.......[.............>..*..J.....F.......j..N.....K..2.
.....H......u......I.Y~..K.Z. ..[...CxG....-.Y.../,m.w.....-....">.
....<...t...P,..L..!..>....=.........f.....W.."..... u....4..(a.
.\....B~....I....'k..I....%..".............`.G...X.....X.... z.}.d...a
...~.8..a.........../p...M..?..?[..b..E.......7.....(....}..........C.
....T.......q..."Z.....}.k..0.............UK.....<...b....}qVb.....
..$..&..;......^.......*H.....O....".u....x.....Nz.....c.B`h........6f
..I....Fm....&H...l.... ...r............3.U....0w.-.....|.............
......................................................................
......................................................................
.............................!..XMP DataXMP<?xpacket begin="..." id
="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/
" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00     
   "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-synta
x-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe
.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stR
ef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="A
dobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:C6E56091C07611
DFA3EDC1F9F1E4707B" xmpMM:DocumentID="xmp.did:C6E56092C07611DFA3EDC1F9
F1E4707B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C6E5608F
C07611DFA3EDC1F9F1E4707B" stRef:documentID="xmp.did:C6E56090C07611<<< skipped >>>

GET /static/image/common/qq_share.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:02 GMT

Content-Type: image/png

Content-Length: 3647

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
.PNG........IHDR................a....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V<<< skipped >>>

GET /static/image/common/pengyou.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:02 GMT

Content-Type: image/png

Content-Length: 460

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
.PNG........IHDR.............(-.S....PLTE...c.6&..v.B..\?..w.>1..m.
S..hl.:.u.X.:N.3.....U...{.6...K.%"..[.P[..T.$..oS.En.27..C..Z.*L.!N.#
9..*..W.5&..7..3..Z..U.&G.,p.?..R0..y.VF..(..A.)[email protected].,P....NT.,0..7
..N.,_.*9.. ..9..g.3F. [email protected]@.E.(DsM.%.1
Tz......U&..Ow.u.Y."T#%..7.].m......I.[....^Kba..3'./. $..i.S.q...|z..
'....y,=.k8^[email protected]"...-(..
..."../.!7.P.%z.I;@..9.q..u?.......IEND.B`.....


GET /static/image/common/rt.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:02 GMT

Content-Type: image/png

Content-Length: 1366

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e&
lt;....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:xmpMM="hXXp://n
s.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sTyp
e/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmp:Mo
difyDate="2011-11-01T02:12:30 08:00" xmp:CreateDate="2011-10-31T11:00:
13 08:00" xmp:MetadataDate="2011-11-01T02:12:30 08:00" dc:format="imag
e/png" xmpMM:InstanceID="xmp.iid:8BF3511AFBEC11E0AAAA984829F8A249" xmp
MM:DocumentID="xmp.did:8BF3511BFBEC11E0AAAA984829F8A249"> <xmpMM
:DerivedFrom stRef:instanceID="xmp.iid:8BF35118FBEC11E0AAAA984829F8A24
9" stRef:documentID="xmp.did:8BF35119FBEC11E0AAAA984829F8A249"/> &l
t;/rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacke
t end="r"?>E.O....rPLTE...cw.......^q..........m..g|..........s..z.
.i|........................._r........................................
[email protected].......,.......l`...;.$...\.
M.Y.....Z...Z..k..jm'....g_....B`....).,..i{GQPcCU..,.....SJ.x.s......
"..A...I.......IEND.B`.....
<<< skipped >>>

GET /static/image/common/oshr.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:02 GMT

Content-Type: image/png

Content-Length: 1258

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:FB639F3C8E5E11DF977DADD5
C8EF1534" xmpMM:DocumentID="xmp.did:FB639F3D8E5E11DF977DADD5C8EF1534"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FB639F3A8E5E11DF97
7DADD5C8EF1534" stRef:documentID="xmp.did:FB639F3B8E5E11DF977DADD5C8EF
1534"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>O\......PLTE...............................
........................~~............................................
......................................................................
[email protected][email protected].{.IQ...mz...!\.
....)!...D;MV.........4l.T..VZ...L...W.S.#.........u8..|F......2.....,
..z........0l......R.{..h.}.;.......7..9.#.....IEND.B`.....
<<< skipped >>>

GET /static/image/common/collection.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:04 GMT

Content-Type: image/png

Content-Length: 1327

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e&
lt;....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:xmpMM="hXXp://n
s.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sTyp
e/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmp:Mo
difyDate="2011-11-01T02:10:13 08:00" xmp:CreateDate="2011-10-31T11:00:
13 08:00" xmp:MetadataDate="2011-11-01T02:10:13 08:00" dc:format="imag
e/png" xmpMM:InstanceID="xmp.iid:8BF35116FBEC11E0AAAA984829F8A249" xmp
MM:DocumentID="xmp.did:8BF35117FBEC11E0AAAA984829F8A249"> <xmpMM
:DerivedFrom stRef:instanceID="xmp.iid:8BF35114FBEC11E0AAAA984829F8A24
9" stRef:documentID="xmp.did:8BF35115FBEC11E0AAAA984829F8A249"/> &l
t;/rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacke
t end="r"?>.r.....fPLTE....|n..3..6..4..5..6..3........E.......}l..
9..F..[[email protected]
x.\.... .F..N...{../.....h...9O.<G... ..............A..e..|). &.v&.
hkq.......JC.n............".b.B...%..$-.Gc.r.....IEND.B`.....
<<< skipped >>>

GET /acom?di=u1991537&dcb=BAIDU_DUP2_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=0&dai=1&dds=&drs=3&dvi=1432188695<u=http://VVV.ltywz.com/thread-17831-1-1.html&liu=<r=&lcr=&ps=153x-1&psr=1276x846&par=1276x818&pcs=60x20&pss=960x156&pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=140&tlm=1434271564&tcn=1434271564&tpr=1434271564146&dpt=none&coa=&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&baidu_id= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pos.baidu.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: post-check=0, pre-check=0

Connection: keep-alive

Content-Length: 1322

Content-Type: text/javascript;charset=UTF-8

Date: Sun, 14 Jun 2015 08:45:54 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Sun Jun 14 16:45:54 2015

P3p: CP=" OTI DSP COR IVA OUR IND COM "

P3p: CP=" OTI DSP COR IVA OUR IND COM "

Pragma: no-cache

Server: nginx

Set-Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; expires=Mon, 13-Jun-46 08:45:54 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1
BAIDU_DUP2_define('request!u1991537_0',[],{deps:['nova/painter/inlayFi
xed1392089005'],data:{"id" : "u1991537","_isMlt" : 4,"sw" : 960,"sh" :
 60,"_html" : {"adn":"0", "at":"128", "aurl":"", "cad":"1", "ccd":"32"
, "cec":"gb2312", "cfv":"11", "ch":"0", "col":"en-us", "conBW":"0", "c
onOP":"1", "cpa":"1", "dai":"1", "dis":"0", "ltr":"", "ltu":"hXXp://ww
w.ltywz.com/thread-17831-1-1.html", "lu_161":"0", "lunum":"6", "n":"38
068079_cpr", "pcs":"60x20", "pis":"10000x10000", "ps":"153x-1", "psr":
"1276x846", "pss":"960x156", "qn":"4f4730e82ea33ac9", "rad":"", "rsi0"
:"960", "rsi1":"60", "rsi5":"4", "rss0":"#FFFFFF", "rss1":"#FFFFFF", "
rss2":"#0000ff", "rss3":"", "rss4":"", "rss5":"", "rss6":"#e10900", "r
ss7":"", "scale":"", "skin":"tabcloud_skin_1", "stid":"5", "td_id":"19
91537", "titFF":"......", "titFS":"12", "titTA":"left", "tn":"baiduCus
tSTagLinkUnit", "tpr":"1434271564146", "ts":"1", "version":"2.0", "xua
nting":"0"},"_html_old" : "cpro_template=baiduCustSTagLinkUnit|cpro_st
id=5|cpro_skin=tabcloud_skin_1|cpro_cbd=#FFFFFF|cpro_cbg=#FFFFFF|cpro_
ctitle=#0000ff|cpro_cflush=#e10900|cpro_conOP=1|cpro_lu_161=0|cpro_tit
FS=12|cpro_titFF=......|cpro_titTA=left|cpro_conBW=0|cpro_client=38068
079_cpr|cpro_at=linkunit|cpro_cad=1|cpro_w=960|cpro_h=60|cpro_version=
2.0","qn" : "4f4730e82ea33ac9","_qid" : "4f4730e82ea33ac9"}});.
...
<<< skipped >>>

GET /apps/qshare/images/icon.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: open.t.qq.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx/1.5.7

Date: Sun, 14 Jun 2015 08:46:26 GMT

Content-Type: image/gif

Content-Length: 1010

Connection: keep-alive

Last-Modified: Sun, 09 Oct 2011 08:19:48 GMT

Accept-Ranges: bytes

Cache-Control: max-age=86400

Expires: Mon, 15 Jun 2015 08:46:26 GMT
GIF89a\...............................................................
......................................................................
......................................................................
.......~..|..{..w..x..s..p..m..n..m..i..h..g..e..f..d..b..a..c..]..]..
......................................................................
...............................................!.....Y.,....\.......Y$
78............7$.-...............-....................................
.............;JJ<!....X...X.................2R5  1O6.......8...... 
<80.Bv...[h...........G.....8."A.('.T.....X. 8.2..B.r..1#...=8$p!D.
Q.1e.....A.X....."..N.jUZ..W.P6,.q......|5.....9..*x..)R.u.6......x..=
.......l`....... F.....N.N.|.....=..Mq..B.R...... ID<HAD.m.Xp...;.n
..m....x...Q.6.a....!,Q.[wq.NqS<...A...WO]h.....|. aE....O.........
...?}.....}.....:x...@[email protected].. .8..!....X..........Q..
. .....}...*.Xb.5....B.X..5...O.@&y...T ..E.i..Xf...ZR0..`J.%.(.i..h..
..l....m.)..t.)I......|.Y. .@"......$Y...;HTTP/1.1 200 OK..Server: ngi
nx/1.5.7..Date: Sun, 14 Jun 2015 08:46:26 GMT..Content-Type: image/gif
..Content-Length: 1010..Connection: keep-alive..Last-Modified: Sun, 09
 Oct 2011 08:19:48 GMT..Accept-Ranges: bytes..Cache-Control: max-age=8
6400..Expires: Mon, 15 Jun 2015 08:46:26 GMT..GIF89a\.................
......................................................................
......................................................................
.....................................................~..|..{..w..x<<< skipped >>>

GET /cpro/ui/noexpire/img/2.0.1/logo-border-light.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro2.baidustatic.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:13 GMT

Content-Type: image/png

Content-Length: 473

Connection: close

ETag: "554709f0-1d9"

Last-Modified: Mon, 04 May 2015 05:56:00 GMT

Expires: Thu, 01 May 2025 07:57:22 GMT

Age: 3545331

Cache-Control: max-age=315360000

Accept-Ranges: bytes

Ohc-Content-Crc: 1058936823

Server: hkg01-sys-jorcol10.hkg01.baidu.com
.PNG........IHDR...D...........xX....IDATx..W!o.0.....,.;..<.%.$...
g..K0....%.92...AM N...p...a}K....hi...... ....{....8.8.Xq\s.s.g..c.q5
#...Yr....=B.....6M.|.....eY....M.m..3N.c....=...a.>b2...k...8/..ch
1U..Q!..).........$I.R....UU}.z.c....L8.....z...8~..........b. x. O...
...S.CW!.........R..ej..."[email protected]...,1SC.#.F...r [email protected]"..'1y..
...B....K.K. [email protected][%...T;.1!...a.......\..^.-V.-.h]..J2.....)!&.
Y.......UJ...!z..m...x.j.L1l6.?rGB..h.....'a.B.....IEND.B`...

GET /core.php?web_id=5796949&show=pic&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 762

Connection: keep-alive

Date: Sun, 14 Jun 2015 08:46:27 GMT

Last-Modified: Sun, 14 Jun 2015 08:46:27 GMT

Expires: Sun, 14 Jun 2015 09:01:27 GMT

Via: cache22.l2de1[1208,200-0,M], cache35.l2de1[1222,0], cache8.de1[1221,200-0,M], cache4.de1[1222,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:3:730717315

X-Swift-SaveTime: Sun, 14 Jun 2015 08:46:28 GMT

X-Swift-CacheTime: 899
!function(){var p,q,r,a=encodeURIComponent,b="5796949",c="pic",d="",e=
"online_v3.php",f="z7.cnzz.com",g="1",h="pic",i="z",j="站长
;统计",k=window["_CNZZDbridge_" b]["bobject"],l="http:",m=
"0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h="
 f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k
["callRequest"]([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k["cre
ateScriptIcon"](n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website
.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz
.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'&
gt;<img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="&
lt;a href='" q "' target=_blank title='" j "'>" j "</a>",k["c
reateIcon"]([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: 
application/javascript..Content-Length: 762..Connection: keep-alive..D
ate: Sun, 14 Jun 2015 08:46:27 GMT..Last-Modified: Sun, 14 Jun 2015 08
:46:27 GMT..Expires: Sun, 14 Jun 2015 09:01:27 GMT..Via: cache22.l2de1
[1208,200-0,M], cache35.l2de1[1222,0], cache8.de1[1221,200-0,M], cache
4.de1[1222,0]..X-Cache: MISS TCP_REFRESH_MISS dirn:3:730717315..X-Swif
t-SaveTime: Sun, 14 Jun 2015 08:46:28 GMT..X-Swift-CacheTime: 899..!fu
nction(){var p,q,r,a=encodeURIComponent,b="5796949",c="pic",d="",e="on
line_v3.php",f="z7.cnzz.com",g="1",h="pic",i="z",j="站长&#
32479;计",k=window["_CNZZDbridge_" b]["bobject"],l="http:",m="0"
,n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=<<< skipped >>>

GET /acom?adn=0&at=128&aurl=&cad=1&ccd=32&cec=gb2312&cfv=11&ch=0&col=en-us&conBW=0&conOP=1&cpa=1&dai=1&dis=0<r=<u=http://VVV.ltywz.com/thread-17831-1-1.html&lu_161=0&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=153x-1&psr=1276x846&pss=960x156&qn=4f4730e82ea33ac9&rad=&rsi0=960&rsi1=60&rsi5=4&rss0=#FFFFFF&rss1=#FFFFFF&rss2=#0000ff&rss3=&rss4=&rss5=&rss6=#e10900&rss7=&scale=&skin=tabcloud_skin_1&stid=5&td_id=1991537&titFF=å®‹ä½“&titFS=12&titTA=left&tn=baiduCustSTagLinkUnit&tpr=1434271564146&ts=1&version=2.0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u1991537&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.172.2203.2203 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1


HTTP/1.1 200 OK

Cache-Control: post-check=0, pre-check=0

Connection: keep-alive

Content-Length: 32930

Content-Type: text/html

Date: Sun, 14 Jun 2015 08:46:11 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Sun Jun 14 16:46:11 2015

P3p: CP=" OTI DSP COR IVA OUR IND COM "

Pragma: no-cache

Server: nginx
<!DOCTYPE html>.<html xmlns="hXXp://VVV.w3.org/1999/xhtml">
;  .    <head>...<!-- 0|0 -->...<meta http-equiv="Conte
nt-Type" content="text/html; charset=UTF-8" />.        <title>
;..................</title>.        <style type="text/css">
;....html{color:#000;background-color:transparent;}body,div,dl,dt,dd,u
l,ol,li,h1,h2,h3,h4,h5,h6,pre,code,form,fieldset,legend,input,textarea
,p,blockquote,th,td{margin:0;padding:0}table{border-collapse:collapse;
border-spacing:0}fieldset,img{border:0}address,caption,cite,code,dfn,e
m,strong,th,var{font-style:normal;font-weight:normal}ol,ul{list-style:
none}caption,th{text-align:left}h1,h2,h3,h4,h5,h6{font-size:100%;font-
weight:normal}q:before,q:after{content:''}abbr,acronym{border:0;font-v
ariant:normal}sup{vertical-align:text-top}sub{vertical-align:text-bott
om}input,textarea,select{font-family:inherit;font-size:inherit;font-we
ight:inherit}input,textarea,select{*font-size:100%}legend{color:#000}b
ody{margin:0;padding:0;}          .....bd-logo,.bd-logo2,.bd-logo3,.bd
-logo4{text-decoration:none;cursor:pointer;display:block;overflow:hidd
en;position:absolute;bottom:0;right:0;z-index:2147483647}.bd-logo{heig
ht:18px;width:18px;background:url(hXXp://cpro2.baidustatic.com/cpro/ui
/noexpire/img/2.0.1/bg.png) no-repeat left top;background-position:0 0
;_filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(enabled=tr
ue,src="hXXp://cpro2.baidustatic.com/cpro/ui/noexpire/img/2.0.1/logo-b
order-light.png",sizingMethod="crop");_background:0}.bd-logo:hover<<< skipped >>>

GET /sync_pos.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://cpro.baidustatic.com/sync.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISBID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISUS=1


HTTP/1.1 200 OK

Accept-Ranges: bytes

Connection: keep-alive

Content-Length: 1596

Content-Type: text/html

Date: Sun, 14 Jun 2015 08:46:14 GMT

Etag: "557ba5a3-63c"

Last-Modified: Sat, 13 Jun 2015 03:38:11 GMT

P3p: CP=" OTI DSP COR IVA OUR IND COM "

Server: nginx
<!DOCTYPE html>.<html>.    .    <head></head>.
    .    <body>.        <script type="text/javascript">   
         .            var getCookie=function(b,d){var a;d=d||window;va
r c=RegExp("(^| )" b "=([^;]*)(;|$)").exec(d.document.cookie);c&&(a=c[
2]);return a},setCookie=function(b,d,a){a=a||{};var c=a.expires;"numbe
r"==typeof a.expires&&(c=new Date,c.setTime(c.getTime() a.expires));do
cument.cookie=b "=" d (a.path?"; path=" a.path:"") (c?"; expires=" c.t
oGMTString():"") (a.domain?"; domain=" a.domain:"") (a.secure?"; secur
e":"")},getUrlParam=function(b){b=RegExp("(^|&)" b "=([^&]*)(&|$)","i"
);b=window.location.search.substr(1).match(b);.            return null
!=b?decodeURIComponent(b[2]):null},currentDomain=document.domain.toLow
erCase(),referDomain=(document.referrer?document.referrer.match(/.*\:\
/\/([^\/]*).*/i)[1]:"").toLowerCase(),urlCproId=getUrlParam("CPROID"),
cookieCproId=getCookie("CPROID"),targetCproId;!urlCproId||"pos.baidu.c
om"!==currentDomain||"cpro.baidu.com"!==referDomain&&"cpro.baidustatic
.com"!==referDomain||cookieCproId&&cookieCproId===urlCproId||setCookie
("CPROID",urlCproId,{path:"/",domain:".pos.baidu.com",expires:(new Dat
e).setFullYear(2042)});.            var sendByIframe = function (b) {.
                var c = document.createElement("iframe");.            
    c.style.display = "none";.                c.setAttribute("src", b)
;.                document.body.insertBefore(c, document.body.firstChi
ld).            }.            sendByIframe("hXXp://release.baidu.c<<< skipped >>>

GET /acom?di=u2109486&dcb=BAIDU_DUP2_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=0&dai=2&dds=&drs=3&dvi=1432188695&ltu=http://VVV.ltywz.com/thread-17831-1-1.html&liu=&ltr=&lcr=&ps=5695x-2&psr=1276x846&par=1276x818&pcs=60x20&pss=962x5717&pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=27468&tlm=1434271591&tcn=1434271591&tpr=1434271564146&dpt=none&coa=&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&baidu_id= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISBID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISUS=1; CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1


HTTP/1.1 200 OK

Cache-Control: post-check=0, pre-check=0

Connection: keep-alive

Content-Length: 1144

Content-Type: text/javascript;charset=UTF-8

Date: Sun, 14 Jun 2015 08:46:20 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Sun Jun 14 16:46:20 2015

P3p: CP=" OTI DSP COR IVA OUR IND COM "

Pragma: no-cache

Server: nginx
BAIDU_DUP2_define('request!u2109486_0',[],{deps:['union/floatad'],data
:{"id" : "u2109486","_isMlt" : 4,"sw" : 120,"sh" : 270,"_html" : {"adn
":"1", "at":"6", "aurl":"", "cad":"1", "ccd":"32", "ccw":"1000", "cec"
:"gb2312", "cfv":"11", "ch":"0", "col":"en-us", "conOP":"0", "cpa":"1"
, "ct":"1", "dai":"2", "dis":"0", "fa":"1", "flw":"1", "ls":"3", "ltr"
:"", "ltu":"hXXp://VVV.ltywz.com/thread-17831-1-1.html", "lunum":"6", 
"n":"38068079_cpr", "pcs":"60x20", "pis":"10000x10000", "ps":"5695x-2"
, "psr":"1276x846", "pss":"962x5717", "pt":"1", "qn":"86671a64861f8429
", "rad":"", "rsi0":"120", "rsi1":"270", "rsi5":"4", "rsi6":"-1", "rsi
7":"0", "rss0":"", "rss1":"", "rss2":"", "rss3":"", "rss4":"", "rss5":
"", "rss6":"", "rss7":"", "scale":"", "skin":"", "td_id":"2109486", "t
n":"float_xuanfusld_120_270", "tpr":"1434271564146", "ts":"1", "ww":"0
", "xuanting":"0"},"_html_old" : "cpro_float=1|cpro_template=float_xua
nfusld_120_270|cpro_lunum=6|cpro_contw=1000|cpro_cad=1|cpro_position=1
|cpro_follow=1|cpro_close=1|cpro_clientw=0|cpro_location=3|cpro_client
=38068079_cpr|cpro_h=270|cpro_w=120","qn" : "86671a64861f8429","_qid" 
: "86671a64861f8429"}});....


GET /acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3&ltr=&ltu=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2002&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISBID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISUS=1; CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1


HTTP/1.1 200 OK

Cache-Control: post-check=0, pre-check=0

Connection: keep-alive

Content-Length: 5347

Content-Type: text/html

Date: Sun, 14 Jun 2015 08:46:20 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Sun Jun 14 16:46:20 2015

P3p: CP=" OTI DSP COR IVA OUR IND COM "

Pragma: no-cache

Server: nginx
<!DOCTYPE html>.<html>.    .    <head>.        <m
eta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
.        <title>..................</title>.        <lin
k rel="stylesheet" href="hXXp://cpro.baidustatic.com/cpro/ui/noexpire/
css/1.0.0/base.css"/>...<style  type="text/css">.....containe
r a.bd-logo{.....top:0;.....right:0;.....width:24px;.....height:20px;.
....background:url('hXXp://cpro.baidustatic.com/cpro/ui/noexpire/img/2
.0.0/bd-logo5.png') no-repeat top left;....._filter:progid:DXImageTran
sform.Microsoft.AlphaImageLoader(enabled=true, sizingMethod=none, src=
'hXXp://cpro.baidustatic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5.png')
;....._background:none;.....cursor: default;....}.....container a.bd-l
ogo:hover{.....width:90px;.....height:20px;.....background:url('http:/
/cpro.baidustatic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5-hover.png') 
no-repeat top left;....._filter:progid:DXImageTransform.Microsoft.Alph
aImageLoader(enabled=true, sizingMethod=none, src='hXXp://cpro.baidust
atic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5-hover.png');......._backg
round:none;....}...</style>.        <script type="text/javasc
ript" src="hXXp://cpro.baidustatic.com/cpro/ui/noexpire/js/3.2.0/base.
js"></script>.    </head>.    .    <body><div 
style="display:none;"><img src="hXXp://cm.g.doubleclick.net/pixe
l?google_nid=baidu&google_cm"  height="1px" width="1px" alt="" />&l
t;/div><div style="display:none;"><img src="hXXp://wn.<<< skipped >>>

GET /9.gif?abc=1&rnd=36257576 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive


HTTP/1.1 302 Found

Server: Tengine

Date: Sun, 14 Jun 2015 08:46:35 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=ay0EDmfjxWcCAcGK9OexXmdE; expires=Wed, 11-Jun-25 08:46:35 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=d7f1b3dd; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=91d36749b0488c641c585018_1434271595; expires=Wed, 11-Jun-25 08:46:35 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=ay0EDmfjxWcCAcGK9OexXmdE

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Sun, 14 Jun 2015 08:46:35 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=ay0EDmfjxW
cCAcGK9OexXmdE; expires=Wed, 11-Jun-25 08:46:35 GMT; path=/; domain=.m
mstat.com..Set-Cookie: sca=d7f1b3dd; path=/; domain=.cnzz.mmstat.com..
Set-Cookie: atpsida=91d36749b0488c641c585018_1434271595; expires=Wed, 
11-Jun-25 08:46:35 GMT; path=/; domain=.cnzz.mmstat.com..Location: htt
p://pcookie.cnzz.com/app.gif?&cna=ay0EDmfjxWcCAcGK9OexXmdE..Expires: T
hu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cach
e..GIF89a.............!.......,...........L..;..

GET /gpixel?google_gid=CAESEJjFx4RhgLnSGfBEJ8AfDVY&google_cver=1 HTTP/1.1

Accept: */*

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3<r=<u=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2002&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISBID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISUS=1; CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:24 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: keep-alive

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: ng
inx..Date: Sun, 14 Jun 2015 08:46:24 GMT..Content-Type: image/gif..Con
tent-Length: 43..Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT..Connect
ion: keep-alive..GIF89a.............!.......,...........L..;..

GET /adx.php?c=d25pZD1hYjMxYzAyNjZiMjJlM2EyAHM9YWIzMWMwMjY2YjIyZTNhMgB0PTE0MzQyNzE1ODAAc2U9MQBidT01AHByaWNlPVZYMF9YQUFOcDh0N2pFcGdXNUlBOGlQRFg4QURyRllqSzVVbDhRAGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD1FM0VBRDcxRDFGNjhERTZFREQwQURBRjQ2OEREN0U0OABiY2htZD0wAHY9MQBpPTBjZTMyNDNi&ext=cGxhbmlkPTc2NSZsaW1pdD0xNSZyYz1oeg HTTP/1.1

Accept: */*

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3<r=<u=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2002&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wn.pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISBID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISUS=1; CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:F
HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:22 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

Expires: Mon, 26 Jul 1997 05:00:00 GMT

GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Serv
er: nginx..Date: Sun, 14 Jun 2015 08:46:22 GMT..Content-Type: image/gi
f..Content-Length: 49..Connection: keep-alive..Expires: Mon, 26 Jul 19
97 05:00:00 GMT..GIF89a...................!.......,...........T..;nt>....

GET /adx.php?c=d25pZD0xNTkzNjgzNGQ1ZTFhMjBlAHM9MTU5MzY4MzRkNWUxYTIwZQB0PTE0MzQyNzE1ODQAc2U9MQBidT01AHByaWNlPVZYMF9ZQUFFWDBON2pFcGdXNUlBOHN0TWhoOGpTamtEcFoyaTB3AGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD1FM0VBRDcxRDFGNjhERTZFREQwQURBRjQ2OEREN0U0OABiY2htZD0wAHY9MQBpPTg3ODJlMDIw&ext=cGxhbmlkPTEwMCZsaW1pdD0wJnJjPWh6 HTTP/1.1

Accept: */*

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3<r=<u=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2001&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wn.pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISBID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISUS=1; CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=
HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:24 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

Expires: Mon, 26 Jul 1997 05:00:00 GMT

GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Serv
er: nginx..Date: Sun, 14 Jun 2015 08:46:24 GMT..Content-Type: image/gi
f..Content-Length: 49..Connection: keep-alive..Expires: Mon, 26 Jul 19
97 05:00:00 GMT..GIF89a...................!.......,...........T..;..

GET /cpro/ui/noexpire/js/3.2.0/base.js HTTP/1.1

Accept: */*

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3<r=<u=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2002&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidustatic.com

Connection: Keep-Alive

Cookie: CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1


HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:21 GMT

Content-Type: application/x-javascript

Content-Length: 1308

Connection: close

ETag: "554709f0-51c"

Last-Modified: Mon, 04 May 2015 05:56:00 GMT

Expires: Thu, 01 May 2025 07:55:03 GMT

Age: 3545478

Cache-Control: max-age=315360000

Content-Encoding: gzip

Ohc-Content-Crc: 3435828300

Server: hkg01-sys-jorcol10.hkg01.baidu.com
...........VK..6.. ...6.:.k<B..t.........d.~$.eH.d....R.;.`...%..(.
.G?3.xd.h.e[6.....x.vQ..........Myj.id....F..F...p..&qj.'y.....8....K.
I..c.6...8q>.._.b./.Q.'.Hf.Fo..F.o..b.SJr)..........x.|G...u..2.2@Y
?d..I..6....%.....#.6...6.0$..`.l<_...zHX2e.zN.....5e.q.n-Rt..A0 fw
...^1....eGK&4...n3.......RE....]...=:...g..f....K....Dy.....&.2\. `.a
..k.iH...GV....\0..y....,....v.JI.V,...h....TlOB.".....d.?!.....;e....
Gx. ..$.......h Sg....r....=]7....k.p..C.vJ.\\.6.Zq..I..y...w.6K...ho.
.!.....2.$).[M.....c....>4_E..eG.Y..,..<......l........V.....Dw.
{w.6eJ....(Ou'.....R...1......9.?!S...3x.............O.`.......Y..eKL'
.[....m.. ..C.....1.me. ..g...tnff..gG.z..G.......,..p.x5..6......t.h5
.g..#.....gP......t..=K.L..... ..i..7.ZR...|)#R....a..E.^s..G.%ZU ..".
.,...M....Q..(.../[email protected]...`.k7.!.........g#...v..]i.
~H8"6./..Yn.e.t./P;.a.-$.2.'..........=1.r......-PH~:BkR.O5...........
..kib........<`..r...D...^...*.z....Kf.5....:.....MWU........YF*nFu
=Rp=Q.].[.....k.V...1....W......'..2.....6Q.:.6.....^.H.l.....~..g.9..
....PU7.w#H..mv. .7.#.K$Z.!R..A....p*;.8....U..C..G.f..C.n.gY......../
Dur...._NrT..D._.._.R...........:....x..|.....;.8M.-....>...vR8...N
...6.C.1.u.f>y.v.y..Y....D..C..N\".*...zn.!.l.5...&.-.1O......4.Sj.
}.M.......{.....`.....;..p*...Z......<.Y[D...C.$b......I..O,]..7.._
.......<<< skipped >>>

GET /gengxin/qqlx/lxqq.htm HTTP/1.1

Referer: hXXp://VVV.minnanwl.com/gengxin/qqlx/lxqq.htm

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: VVV.minnanwl.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Length: 11

Content-Type: text/html

Last-Modified: Fri, 08 Aug 2014 12:41:59 GMT

Accept-Ranges: bytes

ETag: "f67520256b3cf1:b16"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Sun, 14 Jun 2015 08:45:36 GMT

QQ424308510HTTP/1.1 200 OK..Content-Length: 11..Content-Type: text/htm
l..Last-Modified: Fri, 08 Aug 2014 12:41:59 GMT..Accept-Ranges: bytes.
.ETag: "f67520256b3cf1:b16"..Server: Microsoft-IIS/6.0..X-Powered-By: 
ASP.NET..Date: Sun, 14 Jun 2015 08:45:36 GMT..QQ424308510..

GET /cloud/scripts/discuz_tips.js?v=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: discuz.gtimg.cn

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: X2_Platform

Connection: keep-alive

Date: Sun, 14 Jun 2015 08:46:36 GMT

Cache-Control: max-age=7200

Expires: Sun, 14 Jun 2015 10:46:36 GMT

Last-Modified: Fri, 30 Aug 2013 01:57:44 GMT

Content-Type: application/x-javascript

Content-Length: 3265

Content-Encoding: gzip

X-Cache-Lookup: Hit From MemCache Gz
...........X[W.:.~._.83.>qMdS..Q. .....Ph.a9.......$D...m.......ix.
>..%..d...h.I.e~.j.....d....._.=}..l....~]_.,..MR..3..tu].i........
..N.....$..1r.F...W.>..=3.r.fo......Z.j&".\Oh...4r..._G~...>..[.
.=.....$.<...z.T........z...........Y8.[C..U.y.."...K1<......5:.
..Q.VuC.p.3cg.U{.6q..?.X#M.2...4k[...sp/..m2[[7.u.W....1..Fv..*>.;.
_..d...j...~.....j........wX.B..h..z.Wm].p~W}....5..J.Fe..k,Z.):......
...4a..}..u....l..L.q.k..-x..n...0..]gT.2-...<2.s,y...5...l.=.a`...
..v..D...D<....r....XscC[sM...~9.....2....c......<ol`....k.C..&.
.k...w..;....n.....i...T?.2#5.I..dg..../....A.....2.`,...R....F.. ).LM
{.5H.Q.[...:_.....{L6..M.rLN........n..>~.$..U...."....C..a..}lz...
./.d.>}>^,4.....M..`...)J,F..<.K..O{.....)..#}.sk.L.......Y.k
...s".j...C...}....A.....J./......C>...w..u0,.......Q~....&p..E.#..
pd.....k..mco.{{o...X'.....T....(...=. .d.b.bY.....c7......w...?l..O..
...9...3..tA52C...a.F..y.:zY.......R.w.d.....}.../<..O..,..ZGw"....
.]..k[.f.:&.-....4]....T..B..P.cN...9V.U..E..)..!.....$.K.m..#.Yc..Z_.
.W...VS....N...mV".>'HT:.i0.`..;5~..7....f...1.~.....k6y.q.#~._fqf.
...6....b........h..pQ.c...$$..C#...(...t.kfp.e}..d7&.eZu...9.d..ZL.n`
..p2.7j..'g....]...ty.......!.V.....k.....).X....l.t.9S.3.....=/....~C
.*...L.....6..j..tR9[=@qv...).`.rJ.....=....Y.Y........w.;.*.y7..9I.\l
aXEf./... O.M ..rOll.lmE?._.......R...... ...(.{..=b...W..W.......d.%.
8,0....VCqJ..X...9.B.....I....K..U..:..j....U.!...>\8P..'cx#[..n.Dy
.o....jg.n....E..U...0H..EW...2....x..^%..l.h..Jj.=......o..9.....<<< skipped >>>

GET /rj/post.htm HTTP/1.1

Referer: hXXp://VVV.ltywz.com/rj/post.htm

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: VVV.ltywz.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:39 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sun, 26 Apr 2015 06:11:52 GMT

Accept-Ranges: bytes

ETag: "861c72e3e77fd01:b16"

X-Powered-By: ASP.NET

9a9......QQ............1.3.5....QQ................VVV.baidu.com.......
...........QQ............2.50....QQ....................hXXp://VVV.ltyw
z.com/rj/....QQ............V2.50.rar..............QQ..............2.8.
...QQ......................hXXp://VVV.ltywz.com/rj/....QQ.............
.....V2.8.rar..............QQ..............3.2.5....QQ................
......hXXp://VVV.ltywz.com/rj/....QQ......................v3.2.5.rar..
............QQ..............2.68....QQ......................hXXp://www
.ltywz.com/rj/....QQ..............V2.68.rar..............QQ...........
.3.25....QQ....................hXXp://VVV.ltywz.com/rj/....QQ.........
.....V2.62.rar..............QQ..............4.36....QQ................
......hXXp://VVV.ltywz.com/rj/....QQ...................rar............
..QQ....................3.52....QQ............................hXXp://w
ww.ltywz.com/rj/....QQ..............V2.62.rar.........................
.........1.1................................hXXp://VVV.ltywz.com/rj/..
..QQ..............V2.62.rar..............QQ..................1.1....QQ
..........................hXXp://VVV.ltywz.com/rj/....QQ..............
V2.62.rar..............QQ..................N1.1....QQ.................
.N........hXXp://VVV.ltywz.com/rj/....QQ..............V2.62.rar.......
.......QQ..............1.1....QQ......................hXXp://VVV.ltywz
.com/rj/....QQ..............V2.62.rar..............QQ..........1.1....
QQ..................hXXp://VVV.ltywz.com/rj/....QQ..............V2.62.
rar..............QQ..........1.1....QQ..................hXXp://www

<<< skipped >>>

GET /thread-17831-1-1.html HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:40 GMT

Content-Type: text/html; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Set-Cookie: 7rjd_2132_saltkey=b51T0zUC; expires=Tue, 14-Jul-2015 08:45:36 GMT; path=/; httponly

Set-Cookie: 7rjd_2132_lastvisit=1434267936; expires=Tue, 14-Jul-2015 08:45:36 GMT; path=/

Set-Cookie: 7rjd_2132_sid=FLA8Y1; expires=Mon, 15-Jun-2015 08:45:36 GMT; path=/

Set-Cookie: 7rjd_2132_lastact=1434271536	forum.php	viewthread; expires=Mon, 15-Jun-2015 08:45:36 GMT; path=/

Set-Cookie: 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; path=/

Set-Cookie: 7rjd_2132_visitedfid=78; expires=Tue, 14-Jul-2015 08:45:36 GMT; path=/

Set-Cookie: 7rjd_2132_viewid=tid_17831; path=/

Set-Cookie: 7rjd_2132_sid=FLA8Y1; expires=Mon, 15-Jun-2015 08:45:36 GMT; path=/

Content-Encoding: gzip
4acc.............}.w.....a-..rgP..._zC...1f.....O...U.]-.tw....a...nf.
....../..B..%@..d.8.d.8..sc........ztWK-,..8A]...g.}...>...Y.f..[.~
.....U.vJE..o?....Z.#.{%.9...s.....|.y-...vV.r.tL...c....h.a...b......
T.U...|9...JPfy...rv..|d.Us..J.r5.RN..._d...=O.J......a...{...V.1.N..Q
..h9q..8.>'F5l.r.z.j8.......B..)......p...sZ.v..S.o.~..6...&...p...
...)&..%:q.e.d.#........jSE..}..F5W1m"./..2h..56f.2.FEw../.......B..Tg
.1.^s.C..4......f.T5...oo..Yc.9....C....d<..H..)7..r..1..;v....S...
X1.bd^............G.a8_..s.(.h..;f.......9g..UC............9...d..fy.V
[email protected].\...R....rzn..q.L./..JV......,S.K.Y.*.Rf.i.8.W......
o..}...F....m...<.u..-.E.}....f....~.yzRu@.\......[...{f..!#&......
......%@[email protected]%....aW.z.[...$..d.}..J.Y...#..0=.&U...Z...
.....3.q..n.]4.r.T.j..Ek.P.t.r.......7...~r..k./].....k4....F....Vtx.e
s^......S.I...xn....T>...... ...{W6....R.h..x-...#/&.{..%.._..T.o.G
......W~......o..........^......w^...n....._..sk.M..}.VY.ONz\.$....gv.
H.8..7..{!X...|.[....|t...`..n....\:. Tr.....i..2.A>)..v.....r..A.d
^\~.....e......z.....,.......q.....5..N{..h......,...X6[.D.... A].B.w.
G3..l..U2..i.U..'..Jn.......t$8J.HN..."[email protected]~T3.
.Hyo....(.U....O.F4..5;o........R'.l..F:..].U..U.ZA/V...o...\4..(.3.^.
R.......M..]....*.4....R/..v.n.rE.\......~.....5oV.l.h.B.3p7.2.y..bC..
G%..D.z4..on.9.0..F..kH./T....{.......Y..6l..~....XG...cwI..z.0......?
..X.1..p.kr^......t.....,....w.........w>?q...KW......*.G....7N{JF.
..?n.v..l-[..a..IjV..>:.....E..9%...h.%.....&.(..3.N...Vw..%.i_<<< skipped >>>

GET /data/cache/style_28_forum_viewthread.css?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:43 GMT

Content-Type: text/css

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Wed, 03 Jun 2015 14:52:33 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip
34a7.............}Ys.I.._.....z...K"43kj.6..kk...O0.$Z..H.R.........LH
..=...LDzxx........i.0......~..,........b:...mG..b};..~}...Vw...g.|7[.
.U.s....`.O.......ov..n0...f.......QW..u........Y.2..3..U..l^.[.v...."
.....8\....=M...r.m0^n&_..la(...f..V.?....w..S5.Zu...f7....`.Y../.H&..
f78...c.....~..w.....ns...N>......=TO..uwB.@..<. ~n...#.........
.n7....`:.*.....3.x..O...lV...:....].G.. .........}.....n6.....o...:.S
.......:....Y.?....1..I..~;Z..\y.K..p....g..9.hp.[.......~{||.-.o...&.
.o..\0.m....~...f.....m...v..:..3.T.f%c.>.....].cR.0.k....u..}..OF*
.......o..I..@.:.h.?.U.....g....Noq..-. ...(r0...x@..............?.'..
s!....D..&$c.w........~.-f...;......#...P.....j..Ff.s..J..Vo. ..U.._.,
.K..?........|...XC..;e@I........]Jx..<.........g.wuN...N1KY4..P...
.DL<[email protected]..@..&..=4.v.XW..6.I......r5.jv.F....S..*..
..^..N.IG.....nw...../..b........u...N|........h1.v.._}J...a...;.J.Nr.
m.6...dSQ1u...k..}....w....f.`Hu.Vu.X.|.....G...z0.gcN.......-h...j.=.
{.Q.7..._.1..pY...7-,..0B......\[email protected]%J[c`...l..^.
l..4I.....O.w..l..}X........<....'....,..)[email protected]
...~p.....g...........}.p.vT..|SrqW...G...{.W....|..Hj..^.'.....*.....
V.5..../.n.r.Q....c1...1.|...`~0V...I..r...`..7.L..f....Y.H.W....AQ|WG
.<.G...S.K98.t..#.|7[.U..*....AH......../....<d..s.0J...d...=..N
5uQ.xK|.[.8\>.5.,.....n...t/nZ:\E...v[7.....Mk...z{..Q....:..w.8z&N
...Zl. ........^...(.*-.$......o....T.....3.G.....1.)...hQ.gd..1.....?
..$%),[email protected]$I.''...=......f...}}........E.<<< skipped >>>

GET /data/cache/forum.js?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:50 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sat, 13 Jun 2015 21:30:15 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip
1b5b.............\.o..u.W....5.%)G...........\.%.v.;K..;..............
..b..k [email protected]...@].0........G.%.M..{...u.=..3...v..YP.......t
 ..I......p7..^K.....Y'..Y...^...%...........A^..|......A.....f.Y.Wn..
..:&47....4;i1.....r........&..Au.n.8..\.Q..p.E..)@.j.Ru`..v.)....I9.f
|/..I.....P!..@......:...".;...PF.../jU........F...Z..~.].{g67.y'..NZv
.vs3..4.,K...x..F.R..ZGA. ...:.........F....}...*..T......]V...C-.#...
....=.Au`..\.........Eb.x]h.ip...LzI?....K..r..33Z.........b.kfq?...b.
h)....Ha^_yb.....X.....7._[.<.....y..(8.....2./-.ilo'.....X.0...X.v
..$.Xs...e..cR.U.. .a.0..k..qY..m.&.....9@.}..{-..p..s.c...<Yr.V..\
....a..#g.5.@TE._!j...d!pI.\...L.QRes....Qm......5..B.Q.)gJ..(.Zdv...0
a0C.....7F.^.whMkaW..5xJjN....j=EI.$..-.R<..\....fw...l.. t3.G3X..q
.R...q"....*:....1#.....8.y...#....b:.DY.1 ..y...x)c.XFS......`..5n...
..La.....F8.M.=z~c.vf.....U...Y.0..x0H.N....2....\......p.j...h...r...
..k....hx.lc..g.;.Q..R.K.N.....D..=... ;1{.....?..!i/............b/-..
.;.q.N...(...?....He..:".P9..m.z_../...Q..X.`.d.;q'..........E. .....4
A.mn...I.M...cFeM.F].w.h)...`....H;.f<.h..^<(...g[. .....:^.|k..
8.P..e0.0?eh.....A.h.{qQ.....x .fc.uoo.gPl.{I<...t..pz.......>..
...l...4.B..wf.....;.<Td;`...E...xf......g..?...XvN?6.-..a.V(..]97.
.g..]o...(....d.B........J..vn!-66{0.~....J...W.....J@."e,.f..(F.jx?..
..#..~....f*..b.^Q....KA..!.i.h........2~..clt...Q...@..`\.A.}.dm.Op.J
.k....<./~..2..>.f.0(.ez..O..-..S...}.. ..dN{q....%@.{..B....$xZ
....BS..w.9....DL[Q..{....0.kc...XC/-0..... ...J,.9....h..N[:..#H.<<< skipped >>>

GET /static/image/common/logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:50 GMT

Content-Type: image/png

Content-Length: 14259

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sun, 19 Oct 2014 11:55:50 GMT

ETag: "ee24c6a093ebcf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a..K.............................................................
...... ..'%./,$:70B?8GEAPMIVTN^[TdaYhfciihjiijjijjhomfuqh|wm.|u.......
.......|..............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........!..NETSCAPE2.0.....!.......,......K.....5..H......*\......#
J.H.....3j...... C..I....(S.\.....0.&1a....$...([email protected].......
..0..BjA$Z........G/dqyc...V.j9.P...*...ZD.@.<.r.......Zj."..^.<
.j......^d.elw...V...auoF....H.V..&0..,.....e...Q.......~*..g..B.u....
.....m. .....Y.[S......Q.......W.!.o......q#.@ .5Y..B.................
@.'.@[..A..4...*`[email protected]..{".&P{n...\HHF.A2.0@P<...v......4
....X..@^U...'.q..Z..V..5a.TM.!.A0x.!mM...e.. ..Z..e..a...;....F.Y..M.
G..^...&'....V.IPk..G..t*..\d"....6..@,.y..%.PYA1.).wv.q....D B....T*.
v`.$L.....lQ..F....H.&.d..5.AV QD}....k..y.N^.....F....HJ..05E.....V..
......f...x;..05....J......BLV.)..\..C... p..PX!.d&lQ... ..?jrBy. l.CL
..A..w..j..e....p...U...0.........1.I.........$E.!U ..D.......P.B.

<<< skipped >>>

GET /static/image/common/px.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:51 GMT

Content-Type: image/png

Content-Length: 210

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR...2...........o.....sBIT.....O.....PLTE.......56.....
tRNS....0J....pHYs...........~.....tEXtCreation Time.12/28/10........t
EXtSoftware.Adobe Fireworks CS5q..6....IDAT..c`........S."....IEND.B`.
....

GET /static/image/common/qq_login.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:51 GMT

Content-Type: image/gif

Content-Length: 3200

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
GIF89a|..........}..o..m..}..~..n.....P..v..b..n.....r..p..z..s..q..|.
.t..y..x..{..v..w..m........i..d.....l.....k..f........e..j...........
...h..............e............................" %$! .m...............
......................*(6...!.&.l....XWa....... .......ui\........V.4%
SSY..............D......EER..........q.....(.....R.......cdl.t..Z.....
...:#..........0-.....R.b..V.....e..b.......". ...............yz..^...
...w..~..R.h..1&...#........).*..N...Z......N:.[<..............8.*.
......................O-.....0..7.....F__d..T........U............9;TY
=*.H,FI`............78N.QB...tvx.....N.&..K-.............F".?....-"%.P
5.....,.....)[email protected].
@...w$.......gN?=H.................7...............33A....$...#....G .
..............!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzr
eSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adob
e XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> <rd
f:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <
rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" 
xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.a
dobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 
CS5 Macintosh" xmpMM:InstanceID="xmp.iid:10EB301D755611E0A920C2ECFDA0A
76D" xmpMM:DocumentID="xmp.did:10EB301E755611E0A920C2ECFDA0A76D"> &
lt;xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6DA81140755511E0A920C2E
CFDA0A76D" stRef:documentID="xmp.did:10EB301C755611E0A920C2ECFDA0A<<< skipped >>>

GET /static/image/common/newarow.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:51 GMT

Content-Type: image/gif

Content-Length: 327

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
GIF89a...................!.......,....................................
.....L................L*......J......j............N...................
..(.#Ph(0.....r...)9.gHy..........*:JZjz.......... ;K[k{..........,.ER
l|..........0<M]m}..........->..nN.Nn..........o9.Om.....{......
..0H0!.p..:.UO....".....EN..;...1...$K.<.2...,[..U..;....


GET /static/image/common/pn.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:52 GMT

Content-Type: image/png

Content-Length: 592

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0
.PNG........IHDR.......`.......pY....sBIT.....O.....PLTE..............
...................................................................Q..
-{.,y.,w. v. t. s.*q.*p.)n.)m.)k.(j.(h.'f.'e.'c.&b.&`.%_.%\.%].%[.$\.$
Z.$Y.$X.#W.#V..o>$....pHYs............Z....tEXtSoftware.Adobe Firew
orks CS5q..6....IDATx....Q.....5..E1G...l..Y..iag..}..........rtX....a
-:...zt.F.........vt.....a/:.G.Qt8....a.....qt8....).P....Tt....]..BE.
*.P....Tt....]..BE.*.P....Tt...q.....Et...W..::.D...0..w..>:<D..
.0..O..9:.D......f..=:|F......~.._t...y.*.P....N....Tt.fX....]...P....
Tt!>.St...1.N....Tt..l|[.S<y.....IEND.B`.....


GET /static/image/common/nv_a.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:52 GMT

Content-Type: image/png

Content-Length: 2076

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
.PNG........IHDR............. ,.?....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:78A850DA537F11E09D8FB02E
D5CE61ED" xmpMM:DocumentID="xmp.did:78A850DB537F11E09D8FB02ED5CE61ED"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:78A850D8537F11E09D
8FB02ED5CE61ED" stRef:documentID="xmp.did:78A850D9537F11E09D8FB02ED5CE
61ED"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>........PLTE#;. N..W..G..\..`..e..]..V..B..
T..b..d..H.(7..N.;..._..U..R..Z..g.#,{ @.!?.">.(C.&8..c..P.(2..h..m
..j..a."K.._..o..X..q..R..].->..u.C...l.$I.%G.'F..C. @..G..J..E..?.
 L..Q..N..T..N..L..e..O..D.#H..q..R..s..X..V..M.....Z.....].M...y.P...
........Q...K..O..Y..E.....z.....WtRNS................................
........................................................c5.....IDATx..
.iS.A...........@4.}.K.1.!.\$....{z..,.f V.....-`[email protected]?.x..
_m.'}..4......h@....._...x..G..c...x......'.Q.<...2x...<j.G.....
..x.....%......u...x..;K.V;....%&....'[email protected]..{=E.......<<< skipped >>>

GET /static/image/common/qmenu.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:52 GMT

Content-Type: image/png

Content-Length: 225

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

.PNG........IHDR...q...5........9....sBIT.....O.....PLTE..........g.Z.
rp....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6.......DIDA
T8.c.Z..8040.......2...O....d....C..F.,..0.Sh*.?..O.xs..\..U...d.<.
q.>K......IEND.B`.HTTP/1.1 200 OK..Server: nginx..Date: Sun, 14 Jun
 2015 08:45:52 GMT..Content-Type: image/png..Content-Length: 225..Conn
ection: keep-alive..X-Powered-By-360WZB: wangzhan.360.cn..Last-Modifie
d: Fri, 28 Feb 2014 06:52:16 GMT..Accept-Ranges: bytes..ETag: "050b69d
5134cf1:b16"..X-Powered-By: ASP.NET..VAR-Cache: MISS..cache-control: m
ax-age=14400..age: 0...PNG........IHDR...q...5........9....sBIT.....O.
....PLTE..........g.Z.rp....pHYs...........~.....tEXtSoftware.Adobe Fi
reworks CS6.......DIDAT8.c.Z..8040.......2...O....d....C..F.,..0.Sh*.?
..O.xs..\..U...d.<.q.>K......IEND.B`.....

GET /static/image/common/search.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:55 GMT

Content-Type: image/png

Content-Length: 1301

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
.PNG........IHDR...=.........%Q......sBIT.....O.....PLTE..............
......................................................................
................................................z..v..n..s..o.....i..`
.._.._..^..d..]..\..Y..[..Z..Y..X..W..U..T..W..Q..T..O..U..S..P..R..Q.
.O..M..O..L..M..L..K..J..I..G..J..=..>..=..<..:..9..?..8..6..5..
4..2..3..6..1..5..2..0.....-..0..,../..-..*..,..)~. }.&}.*|.$|.({.#z.'
y.%x.!y. x.#w."v..v. u..u..t..t..r..q..p..p..o..n..m....K..M....tRNS..
......................................................................
...................................................................M..
....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6.......PIDATh
....S.A...G..:[email protected],..XP.P..D..Q.a...9n..Kn..es.L~.....g.a.l&. ...
3..k.....<......< :..*/..t~mMMm~....:..n(..iu.u.....v...]'e..kp.
w......n...?.|.Y..W_8 ...j.=.....u-..s..........]..$.....]V..T]A......
.....)....a.O.....5.v.!..Bk9.S0......:........m........>}O..^.?P...
7. ....G...z......9..]_.)......a^...u..S1...&......'F....q.....Q^?..5R
|.Z...('S.x.xZTBm..F%r2}..OfD....~....q^?...R...S...........C.2..&9.;.
.....BJt\. *....s.~. .Y ..9....~...Ls...f.;...~.9%..{.y..Kj..w........
z....)...........e.x.iI.u^.- ....K?.-V.:.e....*5N".7.........&e.....hh
hw.E.>v...s7...]x....s^...a...........k.........IEND.B`.....
<<< skipped >>>

GET /static/image/common/pn_post.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:57 GMT

Content-Type: image/png

Content-Length: 3309

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
.PNG........IHDR...P...!.....y.......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:138CC38E7DAA11DF91D0C02D
346E5D42" xmpMM:DocumentID="xmp.did:138CC38F7DAA11DF91D0C02D346E5D42"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:04A15A9B7DAA11DF91
D0C02D346E5D42" stRef:documentID="xmp.did:04A15A9C7DAA11DF91D0C02D346E
5D42"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>j.......PLTEh..M..'p.l..c..d.....Y..q..C..t
..Z..3..=..Q..(r.j.. r.a.....;.....2}.T........w..L.....O..Q.....9....
..........P..>m....)u.D.................;r.(t.n..]..5g.,l.,|....L..
@.....`.._.....R..>[email protected]}.T..c..b..[..d..C..2{.k
..J..D..>}._..B..$e.$c....H..D.....9j.p..{.....b.....^..'h.9..=|.\.
.V..=...z.Ny.x..>[email protected]........%i..........|..Y..=..<
;...../..C..o.....S..0..0c.g..O..w..H..G.....C..f..&l.]..Z..Y..X..V..r
[email protected].....:..B../y.~.....F..e..d..f..i.....\[email protected].
.D..W.....{...r.G.....d..C..W..O..J..N..G..&o.F..@z....%[.k..E...v<<< skipped >>>

GET /static/image/common/thread-next.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:57 GMT

Content-Type: image/png

Content-Length: 999

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:3278EDDA4EA511E0915FA03E
6093E607" xmpMM:DocumentID="xmp.did:3278EDDB4EA511E0915FA03E6093E607"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3278EDD84EA511E091
5FA03E6093E607" stRef:documentID="xmp.did:3278EDD94EA511E0915FA03E6093
E607"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.a6.....PLTE.................tRNS......A...
[email protected]._.?.`...\.$....$....V.....$......._vx.......(.Z.....IE
ND.B`.....


GET /static/image/common/pt_item.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:58 GMT

Content-Type: image/png

Content-Length: 3598

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
.PNG........IHDR...............?.....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......<<< skipped >>>

GET /static/image/common/medal3.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:59 GMT

Content-Type: image/gif

Content-Length: 3457

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Wed, 20 May 2009 08:04:06 GMT

Accept-Ranges: bytes

ETag: "2cb448c21d9c91:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0
GIF89a#.7.................................y.......................J...
..s.....c....................:.....Y........s.....c.....L..-........k.
..........!..X...........J........;..e../..s...........s...........1..
c.....k..R........!..:.....:..O........z..k.....Z..)..1........'.....Z
........k..<...........J..J..).....Z........R.....1.....Z.......{..
[email protected].{.....k.....{..k.._..^..k..k..J..Z..J..B..).!..NETSCAPE2.0.....!
...2...,....#.7..........2%.q//<C......n.s}GY2...........2!.q..'/..
..iin.5V5....(..99EEW#.........}5YPE::9[3.)..)!.q......7V)...KI.......
.q'.<....`.. [email protected]._..h.Q.J..v.....b,0<x.....4.[|[email protected]..
......S..5...G.....&.l..%L.o...#PP..$_a....Q0.`V.yg..?G.L...gT.EJT.3..
......U...W?R....0. .#..........*f"....f.......;..;@..kg.T>...u..&l
t;I..A......8...G....I.(.G.j..a...G....r..1...<^Y?....q6B........5\
..bgF..3..a.}[email protected].[j..W....,[t....D...q....L.....]...T.@`(.I...3
.q..A.8...f......D..........."....#[email protected]@.
[email protected]( ..E..enV.PA.(h....,.@.&xy..(0...G....XV...3.........
[email protected].$....0P....40@..(.B...........*........S.@a..\....&.pE.
(\[email protected]..,D..dW..A.1d.%._..F....IC..z..,.p.hH.......-.cl.B,!0...
O\.......n.......A........h.E.(.....9....h|...h..R..2..r..p@0T......!3
.D....f....P$1...@...>....Z.<..50A..k`[email protected]... ..Csw4......f..
..zTq.7.V......B.P....$...Ce.Q...>2B.G|[email protected]........#
2....E/.-..N...c.../.0.....@..:..@.:d...M~i..h.^.....D.j....J.Q..P....
."...S.........d.,...ST.D...Q...]Q.."....4.pC.r....b.Q.._...R....`<<< skipped >>>

GET /static/image/common/fj_btn.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:01 GMT

Content-Type: image/png

Content-Length: 217

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR.............$=m"....sBIT.....O.....PLTE.../\.n.2.....
tRNS..[.".....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS5q..
6...4IDAT....... ....XP...6q....,-,.....E.S.y...6..v....>.....s....
..IEND.B`.....

GET /static/image/common/midavt_shadow.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:01 GMT

Content-Type: image/gif

Content-Length: 79

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

GIF89a...................!.......,.......... ........0................
........;....

GET /uc_server/avatar.php?uid=22235&size=small HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Sun, 14 Jun 2015 08:46:01 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Last-Modified: Sun, 14 Jun 2015 08:45:58  0000

Expires: Mon, 15 Jun 2015 08:45:58  0000

Location: hXXp://VVV.ltywz.com/uc_server/images/noavatar_small.gif

0......

GET /static/image/common/weibo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:02 GMT

Content-Type: image/png

Content-Length: 3544

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0
.PNG........IHDR................a....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V<<< skipped >>>

GET /static/image/common/fav.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:02 GMT

Content-Type: image/gif

Content-Length: 596

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0
GIF89a.........Q.....M.._..[..\..]..^..\..]..c..E..f..^..c.....Z.....{
..P..>..^.....Y.....K..?.._..X..F..]..[..C..a..[.....D..W..v..C..?.
.B..O........F..H..`..a..9..f....._..`..d..E..J..F..]..a.....f..Y.....
......J..L..o..w..]..0.....c..t.....\..Q..B.....k..L.....b..=.....d...
..e.....W....~;.....g..P..M..f..b..g..].._..>.....T.....]..Q.._....
.b..`[email protected]..`..^..K..Z..a.....[..f..Y..g...!.......,........
..............s....LX.].. pcb`...Zq.|_R..a..)_V!.u..w}JKG$n~2.55.0=^.x
.gAB.S.....d.e.&W.,7C/....: Dz.O'hv....-P<.6....."j1i.Qk{.Iy>FpT
I....&9..`#.H"3..\.2B......(.d......I.cF" m....;....


GET /static/image/common/share_btn.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:03 GMT

Content-Type: image/png

Content-Length: 476

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

[email protected]_U....tEXtSoftware.Adobe ImageReadyq.e&
lt;...$PLTE.....................................,......tRNS...........
........6IDATx.b.....F...\\\..a....@[email protected]`:..>bD.p.1".......X...jX8
.......jj8..&..b`...7.n.~j..F.....X....!..p.a.. .Vv$-...X..5f.......7.
....:.p..Ckc...........%?.1S'3p..3j..1.c..c...R..|c..SOqR..R..cg.NY.9j
..1.......`f.N... @;vn.0..PT..#...,.w...s.=."(.L.o.........0`....F.z..
.....0.PR.UF...4..=l...0`.......).gJ..T...-aalz.......IEND.B`..
...

GET /static/image/common/rec_add.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:03 GMT

Content-Type: image/gif

Content-Length: 1603

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
GIF89a............!................z...........~......................
................................!....|..u...... ........#.}...........
.........x...".............."..!....w.................. .y..o......"..
..y........v..}...........t............... .{..q........r.............
......................................................................
...............................................!..XMP DataXMP<?xpac
ket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns
:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/0
2/12-17:32:00        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/19
99/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xm
p="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/
1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" 
xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.
iid:B76446A58E5F11DF977DADD5C8EF1534" xmpMM:DocumentID="xmp.did:B76446
A68E5F11DF977DADD5C8EF1534"> <xmpMM:DerivedFrom stRef:instanceID
="xmp.iid:B76446A38E5F11DF977DADD5C8EF1534" stRef:documentID="xmp.did:
B76446A48E5F11DF977DADD5C8EF1534"/> </rdf:Description> </r
df:RDF> </x:xmpmeta> <?xpacket end="r"?>...............
......................................................................
.............................................~}|{zyxwvutsrqponmlkjihgf
edcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&
%$#"! .................................!.......,..................<<< skipped >>>

GET /static/image/common/rec_subtract.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:03 GMT

Content-Type: image/gif

Content-Length: 1396

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
GIF89a................................................................
......................................................................
.................................................................!..XM
P DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> &
lt;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060
 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="ht
tp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf
:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:/
/ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sT
ype/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpM
M:InstanceID="xmp.iid:024FAC708E6011DF977DADD5C8EF1534" xmpMM:Document
ID="xmp.did:024FAC718E6011DF977DADD5C8EF1534"> <xmpMM:DerivedFro
m stRef:instanceID="xmp.iid:024FAC6E8E6011DF977DADD5C8EF1534" stRef:do
cumentID="xmp.did:024FAC6F8E6011DF977DADD5C8EF1534"/> </rdf:Desc
ription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&
gt;...................................................................
...............................................................~}|{zyx
wvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:98
76543210/.-, *)('&%$#"! .................................!.......,....
[email protected],.I....0.W..A.p.u......'.M.B...6.&cV0j'C.X.h...M.y.....8bd.
-9......C7jr)&..*.MD,.|02...N/.~...N...1.f...3......^A.;....
<<< skipped >>>

GET /static/image/common/arrwd.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:04 GMT

Content-Type: image/gif

Content-Length: 51

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

GIF89a.............!.......,...................n..;....

GET /uc_server/avatar.php?uid=7325&size=middle HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Sun, 14 Jun 2015 08:46:04 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Last-Modified: Sun, 14 Jun 2015 08:46:00  0000

Expires: Mon, 15 Jun 2015 08:46:00  0000

Location: hXXp://VVV.ltywz.com/uc_server/./data/avatar/000/00/73/25_avatar_middle.jpg

0......

GET /uc_server/avatar.php?uid=21455&size=middle HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Sun, 14 Jun 2015 08:46:12 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Last-Modified: Sun, 14 Jun 2015 08:46:09  0000

Expires: Mon, 15 Jun 2015 08:46:09  0000

Location: hXXp://VVV.ltywz.com/uc_server/images/noavatar_middle.gif

0......

GET /uc_server/avatar.php?uid=23776&size=middle HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Sun, 14 Jun 2015 08:46:13 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Last-Modified: Sun, 14 Jun 2015 08:46:09  0000

Expires: Mon, 15 Jun 2015 08:46:09  0000

Location: hXXp://VVV.ltywz.com/uc_server/images/noavatar_middle.gif

0......

GET /uc_server/avatar.php?uid=24006&size=middle HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Sun, 14 Jun 2015 08:46:13 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Last-Modified: Sun, 14 Jun 2015 08:46:09  0000

Expires: Mon, 15 Jun 2015 08:46:09  0000

Location: hXXp://VVV.ltywz.com/uc_server/./data/avatar/000/02/40/06_avatar_middle.jpg

0......

GET /data/cache/seditor.js?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:13 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sat, 13 Jun 2015 21:30:15 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip
8d0.............X......Wf....*.~t.T..A\...7.....X....c.d..n.......E.-.
.#M..N.6N[g..C."@{Z..[.......$R..K/..8...o..q....B.J.WQr.N.S.z<.af.
..........C..l.6 ......T...X$bz..[...d.!.S.S...[*_....w..mi....'......
..J[.B...?..1o...`...f...Y....f.....a*.....D...M.....A.-.......o.6.. h
....6.e.......()-g6^N.R..L..<e..|.E.J....~/.........LS..A...uqC.D. 
..Y....j...V..f......i..y....5W.._f....H..u..K..l...S......^..6.3....O
..l....L.^...<...1...K...../*E.....$ReI....W%..!..Mi..{T..k...$.t.o
l.........m....=....,.*.!...*....Z.h...P..S.e..*...B}...LlN..u....&..e
<...S|..<9...eVdh.....rR.P....O.8.....?........0..Sg..X.u....*EY
,Ug........v...4..,...H..E.(.v/:..;.WM...V....G.M...x.'...c.9..R.=...0
G..l.>.q.a?............../..........}....<...{w.=......~..v.d.`.
T...A....Y(..k...#..i..y.G.>v.....v.?.u....cb..-p..a.......m...N...
d...o..w..g..l}...Jy.g..%2...4..B...x)...._..fw.......1...>..K...,j
..b....wV~...........I..]..........!}=..D....]..<3Z[....e.Y.t..z*..
....Zc..E.=u..J.Y...F..$ipz=..^...Yt.....C5R<....?....w.|.....9....
..~w.g9..........Z.Z.d....^.Pcj............J.QF ........g.6..l....Q_..
4....Nfq..........j.......>..Hx0".. .El..,l..:..&,.`........jj.....
...o.z..4....(..7b......C..../.lo...(.w..PH.c...HJ.(...X...Mw...q.V..R
..z..Us...8......lH..g...)~.eQ...).D.j^.$>(..H..H.:.92m.!.....)..3.
b.(..|...w.T.=F.0fY<.?..bL.._G..u...2..(.r..B._........0..._..2....
...?....<n............k.I"...5q"R.....]..g?.....-....D...H.G...L.2.
......5oa...b.G..L..-\._n.... L.T.Pw.).Y...F.i....[..../dq...*..x.<<< skipped >>>

GET /static/image/common/arw.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:14 GMT

Content-Type: image/gif

Content-Length: 940

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a..-...............f..3..............f..3..............f..3....f.
.f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3....
..........f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3
............f..3..............f..3..............f..3..............f..3
....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...f..f..f..f.ff
.3f..f..f..f..f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3
ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3..3.f3.33..3..3..3..
3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.........
....f..3..............f..3..............f..3....f..f..f..ff.f3.f..3..3
..3..3f.33.3............f..3..........................................
......................................................................
...........!.......,......-........H..Al..*4. .....><.Q.D..-^D.q
....=r...d..&ONL.r!..._.T(.&..3...9r...0.V.(Te..G...yT.R.Jo..).aU.>
c.t....._..D9..I.K....T...l..%.V.\....;....

GET /media/v1/0f000Q2KxFhCznBO83poas.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ubmcmm.baidustatic.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:24 GMT

Content-Type: application/x-shockwave-flash

Content-Length: 31281

Connection: close

Last-Modified: Sat, 25 Apr 2009 07:04:00 GMT

Expires: Wed, 01 Jun 2016 10:11:16 GMT

Age: 1031708

Cache-Control: max-age=31536000

media: media

Ohc-Content-Crc: 2040261723

Server: hkg01-sys-jorcol02.hkg01.baidu.com
CWS.....x....TU..7...p..n...ni......D..E..A....)A.;%.KD.....{...w.....
{.=.^.5.....k..\{...H%....8 @....R..B.,. ..........`m.d...(.x...<..
....d..^[email protected].@.....,..DL..aV.ui? .........`.
#.737 ..=Y.Y...w..7......OM.I.B.&.FE.M@J.& *....DE.../,,,.;.......D...
.Q.Q..T.....GH.FMH.F..,HOEBN.&$,*)."*DEM.&*...o.)&"$$(,............v..
...d. j.......t..0Q......!..a,.,...oA H..`..6.>...i...1.M.*...."5..
C..X.........1............. .8`l@..:TEQ...W........:..i(.>...Cv/.c.
Xt.N.... ..........=......._....H......;.v...P...1......?o,..m........
..T [email protected]|... 2^<.)..Q.q$..........r:....2X...}F.....#.c....%(.j...
.L.......a.G...g;......S,G...J.\w&.#..V...G... .`.........X....P.@."..
..".....g~.T....TyH....Qx..1(..dI.r.j!....t.X'2.$f1..M8.Q.........[.G.
/;....,...i........~... ..g..oq:..3...8[.J.....]]]7 ...D...~..;uG.D0e7
.....Vvl4,bB4....t.....8..tl..4w....n.add.....4.T.t..........*....88x.
$8..d4..d...D....B<....$x..||\..B\.....<B....;#;..*|...n........
..U......x.X0M.!"B!...0.....%..J}..SR.... &6...?....f....UZ.G..U......
......z.....#...U..vg.A....u.]..h.OX....'.^f..u6....`|.0.kJ(..5.aIGM.@
B..\....E.su.k...Bwvv.....H".(.%4.f4.Y.......[f.....su...I..U-._.....}
...D......~........(....u.t.pF....k.........;.t........|N....K.=].....
...U...d.D......^gZG....'..E....|5...Bu.9.pI...*b.....<.%..J..~..V.
3.._.#./.J.....F.....2.h....|WC.K...8.dw..@=.".C."gMs......fg..l.g....
.Jf..;...........!..K|;.....D.W.Z:E....E.IP.sr5.0.@.'...........2.. .1
.?l..0.......u.........:.S..V.*v@...)..5....x.........!..$....b...<<< skipped >>>

GET /stat.php?id=5796949&show=pic HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s13.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Date: Sun, 14 Jun 2015 08:46:26 GMT

Last-Modified: Sun, 14 Jun 2015 08:46:26 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache47.l2de1[636,200-0,M], cache40.l2de1[637,0], cache10.de1[637,200-0,M], cache2.de1[639,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:2:646636778

X-Swift-SaveTime: Sun, 14 Jun 2015 08:46:27 GMT

X-Swift-CacheTime: 5399
4aa..(function(){function l(){this.c="5796949";this.R="z";this.N="pic"
;this.K="";this.M="";this.r="1434271586";this.P="oz.cnzz.com";this.L="
";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz
_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};thi
s.la()}function g(a,b){try{var c=.[];c.push("siteid=5796949");c.push("
name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer
));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.us
erAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.
random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&"
)}catch(d){}}var h=document,e=window,f=encodeURIComponent,k=decodeURIC
omponent,p=unescape,q=escape;l.prototype={la:function(){try{this.U(),t
his.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),thi
s.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this
.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i fail
ed")}},oa:function(){try{var a=this;e._czc={push:function(){return a.B
.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{va
r a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<
a.length;b  ..b4a..){var c=a[b];switch(c[0]){case "_setAccount":e._cz_
account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.
break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPage
view=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefin
ed"===typeof e._cz_account||e._cz_account===this.c){e._cz_account=<<< skipped >>>

GET /zh_CN/htmledition/js/qf/page/qfcode.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: list.qq.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sun, 14 Jun 2015 08:45:57 GMT

Content-Type: application/x-javascript

Content-Length: 1887

Connection: keep-alive

Expires: Tue, 14 Jul 2015 08:45:57 GMT

Cache-Control: max-age=2592000

Last-Modified: Tue, 22 Mar 2011 16:56:08 GMT
if(typeof(nId)!=null&&typeof(sColor)!=null&&typeof(nWidth)!=null&&type
of(sText)!=null).{.document.write(.[."<style>",.".rssbook{paddin
g:10px 15px;overflow:hidden;zoom:1;background:#f6f6f6;border:3px solid
 #ddd;}",.".light{background:#f6f6f6;border:3px solid #ddd;}",.".dark{
background:#aaa;border:3px solid #666;}",.".mailInput{margin-top:5px;}
",.".rssbook .info{color:#666;font-size:12px;}",.".light .info{color:#
666;}",.".dark .info{color:#fff;}",.".rssbutton{float:left;border:1px 
solid #698ab4; -moz-border-radius:3px;border-radius:3px;-webkit-border
-radius:3px;}",.".dark .rssbutton{border: 1px solid #585858;}",.".rssb
utton input{background: #77a0d1;border: 1px solid #88b3e6; color: #FFF
FFF; cursor: pointer;font-weight: bold;width:90px;display:block;height
:22px;line-height:22px;*line-height:19px;text-align:center;}",.".dark 
.rssbutton input{background:#676767;border: 1px solid #777;}",.".rssbu
tton input:hover{background:#86b4eb;text-decoration:none;}",.".dark .r
ssbutton input:hover{background:#797979;border: 1px solid #939393;}",.
"input.rsstxt{width:100%;height:20px;font-size:14px;padding:2px 3px;-m
oz-border-radius:3px;border-radius:3px;-webkit-border-radius:3px;borde
r:1px solid #ccc;;border-color:#7c7c7c #c3c3c3 #c3c3c3 #9a9a9a;margin-
bottom:5px;}",.".dark input.rsstxt{background:#eee;}",."</style>
",."<div class=\"rssbook ",sColor,." \" style=\"width:",nWidth," \"
><p class=\"info\">",sText,"</p>",."<div class=\"mai
lInput\">",."<form action=\"hXXp://list.qq.com/cgi-bin/qf_co<<< skipped >>>

GET /v.gif?fm=load&r_type=loadsuccess&r_tm=268742530&r_sid=&r_lu=u2108193&r_tpl=flowbar_102&r_qid=bc28cb4eb45d34c4&r_tn=38068079_cpr&r_url=http://VVV.ltywz.com/thread-17831-1-1.html&pid=201&productline=cun&productsub=cun&pj=ext_hl&tab=query&logactionid=0100100002&mod=cun&r_time=1434271595521&r_ltime=15&r_stime=1434271595506&r_sp=flowbar&r_innerWidth=10&r_innerHeight=50 HTTP/1.1

Accept: */*

Referer: hXXp://entry.baidu.com/rp/home?type=flowbar&di=u2108193&rsi0=auto&rsi1=50&title=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›<u=http://VVV.ltywz.com/thread-17831-1-1.html&ref=&pageWidth=60&pageHeight=20&t=1434271591068&rsi0=60&rsi1=50

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dj0.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=0

Content-Length: 0

Content-Type: image/gif

Date: Sun, 14 Jun 2015 08:46:26 GMT

Etag: "4280832337"

Expires: Sun, 14 Jun 2015 08:46:26 GMT

Last-Modified: Fri, 23 Oct 2009 08:06:04 GMT

Pragma: no-cache

Server: BWS/1.0

HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=0..Conte
nt-Length: 0..Content-Type: image/gif..Date: Sun, 14 Jun 2015 08:46:26
 GMT..Etag: "4280832337"..Expires: Sun, 14 Jun 2015 08:46:26 GMT..Last
-Modified: Fri, 23 Oct 2009 08:06:04 GMT..Pragma: no-cache..Server: BW
S/1.0..

GET /img/pic.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: icon.cnzz.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 719

Connection: keep-alive

Date: Sat, 13 Jun 2015 08:47:24 GMT

Last-Modified: Thu, 12 Feb 2015 08:15:09 GMT

Expires: Sun, 14 Jun 2015 08:47:24 GMT

Cache-Control: max-age=86400

Accept-Ranges: bytes

Via: cache1.l2de1[603,200-0,M], cache44.l2de1[604,0], cache1.de1[0,200-0,H], cache10.de1[1,0]

Age: 86344

X-Cache: HIT TCP_MEM_HIT dirn:5:917002530

X-Swift-SaveTime: Sat, 13 Jun 2015 08:47:24 GMT

X-Swift-CacheTime: 86400

GIF89a2.........f..3...33.............................................
.......................................!..NETSCAPE2.0.....!..Powered b
y AFEI.!.......,....2...... !.di.hjBl..p,....x......`P.(...GR.D6...CH.
...,..@8.... -..EQc.8...........`...."....................~"..H.......
.H......"...$....#.........."..........."Z.......*...%!.!.......,....2
...... !.di.hjBl..p,....x..|....p r..H.C.\&.H.tJu...#b......7..W.h....
...7..l..v..-....."....................~"..I........I......"...$....#.
........."..........."\.......*...%!.!.......,....2...... !.di.hjBl..p
,....x..|....p r..H.C.\&.H.tJu...#b......7..W.h.......7..l..v..-....."
....................~"..I........I......"...$....#..........".........
.."\.......*...%!.;HTTP/1.1 200 OK..Server: Tengine..Content-Type: ima
ge/gif..Content-Length: 719..Connection: keep-alive..Date: Sat, 13 Jun
 2015 08:47:24 GMT..Last-Modified: Thu, 12 Feb 2015 08:15:09 GMT..Expi
res: Sun, 14 Jun 2015 08:47:24 GMT..Cache-Control: max-age=86400..Acce
pt-Ranges: bytes..Via: cache1.l2de1[603,200-0,M], cache44.l2de1[604,0]
, cache1.de1[0,200-0,H], cache10.de1[1,0]..Age: 86344..X-Cache: HIT TC
P_MEM_HIT dirn:5:917002530..X-Swift-SaveTime: Sat, 13 Jun 2015 08:47:2
4 GMT..X-Swift-CacheTime: 86400..GIF89a2.........f..3...33............
......................................................................
..!..NETSCAPE2.0.....!..Powered by AFEI.!.......,....2...... !.di.hjBl
..p,....x......`P.(...GR.D6...CH....,..@8.... -..EQc.8...........`....
"....................~"..H........H......"...$....#.........."....

<<< skipped >>>

GET /cpro/ui/noexpire/js/3.1.6/cpro.js HTTP/1.1

Accept: */*

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3<r=<u=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2002&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidustatic.com

Connection: Keep-Alive

Cookie: CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1


HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:22 GMT

Content-Type: application/x-javascript

Content-Length: 18315

Connection: close

ETag: "554709f0-478b"

Last-Modified: Mon, 04 May 2015 05:56:00 GMT

Expires: Thu, 01 May 2025 07:53:34 GMT

Age: 3545568

Cache-Control: max-age=315360000

Content-Encoding: gzip

Ohc-Content-Crc: 586035393

Server: hkg01-sys-jorcol07.hkg01.baidu.com
...........<.w....%....X....Z9j^.&M....&.......m .%G.......$%Q..s{.
w...... .......k..>.= r|..........).I..'..\z.Q...L.....N...h.~.G.4.
..Kt..`.6.gT...D..DK..%J.QF.(@S...[.........w_...F.o....S.v.o...r)Z...
......nH.. =O..G.;......{_9Sx.9.. Z...|....h..Z..f`:v.Ff.X..O[("m.M...
............?......P....z...b.......a`.Ww.jbDAL..8[q.].F_.F...C..  7..
.10..Y.bO..\>.....3..>Q3.r..A...J...........u53..NZD.....P7...."
*}..OP..2.Z...9.M...u...5...o...p.0..Q.:.V... .d.B-[".8.........._Ym.3
...g...._.t..#N......e...7.m.......|..l-.#.....y4..V.'3(...`Q...c..y..
..E..\....m#..t.(s ...3c.....F.b...5.~.}....b...N^..D.....r....d_DE.J.
.8pu.:.....g.c.......$(..,....4.......fe...`Ih@...} ........."....Ii..
1y..aj.p....cGc..}.;..h...~P....z...Ro...C.7n48!.....NIc.............7
........./.n.........]De........m....'.C..t..(..7.i3..|.h,...i.`.W...[
{k...~..{...S3zN....8...~}.N.8..^.u`....N..U..?..^.L/....a..hX."i.....
Sk.1...O.4@.!B..k2{...j)......5...........WV....}T..*|...(2.1....#.$.^
...S3bp0.l\.".0......`......H...`/.,..=.P;.:[email protected]
..ZWv.........Z^....h....:fY..Pi6.6....jm.....Qf... ......&..6...Y....
.r.O..@. .Y. .DW....1<.>..k......o.0,.R.....18..(|[email protected]...
k...W..`.b.bWa.F...s.....1lc".n.......ro...#.~d...~PZ.. .f....G..!.!.s
.,X.;.H..Yc.U.;.=....X.T.p.....f...Q.6[C9._..o...q...5ow..............
{.=........PR<.V..7....0..]..}.n......^..'uh.S..o.(.7Jo..u`..j.;Q.y
....V.a.k.... ....q9...8....._>T..fM..m.75..A..i...m.l.....\...M_.M
..../.'N..b.N(O.>..o4......].C0'/v].VKc..^Wi..Cm..- ...H..q....<<< skipped >>>

GET /mkt.gif?et=0&ai=8002e2c915c26c3a78b4270c968fe58c HTTP/1.1

Accept: */*

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3<r=<u=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2001&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: click.hm.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; HMACCOUNT=65BC3D3544E471DE


HTTP/1.1 204 No Content

Content-Type: image/gif

Cache-Control: private, max-age=0, no-cache

Pragma: no-cache

Connection: close

Date: Sun, 14 Jun 2015 08:46:25 GMT

Server: apache

GET /cpro/ui/f.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidustatic.com

Connection: Keep-Alive

Cookie: CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1


HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:19 GMT

Content-Type: application/x-javascript

Content-Length: 27970

Connection: close

ETag: "557ba5a3-6d42"

Last-Modified: Sat, 13 Jun 2015 03:38:11 GMT

Expires: Sun, 14 Jun 2015 09:03:34 GMT

Age: 2565

Cache-Control: max-age=3600

Content-Encoding: gzip

Ohc-Content-Crc: 524018131

Server: hkg01-sys-jorcol09.hkg01.baidu.com
.....w]U..f.js...y{...8..>......$KN....=..6[..I....WQ.DE....w.g..A.
......{.'..b.`03.e.......r.&...^.......b..$.l..F[o.K..6...Y.v.~.u..b..
.l.....l..;..p....v.M..b4b...sU..E3..f.|1.l..eJ.Za=...y.iM...G|.....e.
.....].....G|.......w...g=8|....G...}.E....q4.[l................|... .
.Ny:.G.]....Y..B..w.b..`.......{....../../.4.8".u....B/9....~z'.|...4.
".4...K..b.zo..-.~..m..;.......N.........y..[..e....(..cL.j%...{.'..v.
.w.N...S../.t.-..l....W..../.fM.#..X.u.. ...I2..q.e....u)...v?.X...>
;.....].v......w.9.{..*....<o`'M..Fy..:.{..B............^...u.r..^.
\V.G.{.L.......Q.".........V.....u..|.i ..H..C#....q..J.........@w.{e.
XG...|5m.....C.. ..3.fc>J.FT...H.I..m..=.-f#..0U$..6,N1-}[email protected]
...X.........d.mU.......9o....;>..<...........Yp.[l.(&. R.2....G
..I....A>.)~..'.....1........F8......u.T.~..b......o..6.w.{..3.u..D
T."..N0. ....H...Y:.[6.:....h.Y.y..gA../'.t..3...../.$......w<y.S.}
.xh..".._:~.^..:.hu. [email protected]:q:.....(.m....,.G.[...[....I.V.z..e.?.. r..
.....D.Fq:.....>.....'.qG......6.......;........6..<.g.K/d..7...
....q.....Wa4......<.:...'..F....pi'....v.........3T....f.......k..
u....7 ...O...L_...$.HB@$!...\...pIr.J.....V..G.....!.#$..f..us_.k....
.T..8Mw......O..vw;sX$.....oE-.3...9..........?..%.hv.7/.8.j.7....i..v
...).9.(..f...6.z.[=....&.=NXtR.....u...(.o=..O,X.......y6..F.yv4.....
....r..&..t.;....`-..t.8.".K.g..f.r.A..">!`.z<.e3...W......I._L.
D.V'..R@.[...|b..... ..*:...Z1...ub.x..#x..G..<..Uk.z..o!.d9.....mX
:K.o..D.........,......\....M.....p.u..yTP.!..i.a....b...6..(m..w.<<< skipped >>>

GET /cpro/ui/noexpire/img/2.0.0/bd-logo5.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidustatic.com

Connection: Keep-Alive

Cookie: CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1


HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:23 GMT

Content-Type: image/png

Content-Length: 1545

Connection: close

ETag: "554709f0-609"

Last-Modified: Mon, 04 May 2015 05:56:00 GMT

Expires: Thu, 01 May 2025 07:54:20 GMT

Age: 3545523

Cache-Control: max-age=315360000

Accept-Ranges: bytes

Ohc-Content-Crc: 1974033671

Server: hkg01-sys-jorcol08.hkg01.baidu.com
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;...siTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:1cd07f07-f14f-4d1b-83a0-43c485539d9c" xmpMM:DocumentID="xmp.did:
52D26256CAB511E3B696F0231D9BB8CB" xmpMM:InstanceID="xmp.iid:52D26255CA
B511E3B696F0231D9BB8CB" xmp:CreatorTool="Adobe Photoshop CC (Macintosh
)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f6314ed7-87ee-4
c03-a7bf-62894da43749" stRef:documentID="xmp.did:1cd07f07-f14f-4d1b-83
a0-43c485539d9c"/> </rdf:Description> </rdf:RDF> </x
:xmpmeta> <?xpacket end="r"?>.......,IDATx.ba``..bc .`..`..w@
|...........hi.........#>...../_..................T...i.......by\..
..Uzzz.@.. V.;;;{...j|......`.6=,h|.>PQQ.........L...._.....\....._
.]..K.jBBB.DDD>..w.<0..FFFn...e..\`...K........w..../..........o
........P!.........-[...o..]...........e..d......0..o..y...&....).7o..
.[%%%....$A......"..|..=<<.....'O.|.hp....6L..$..A.U__........XB
... fE.466...uk.........Ww....;x......."d....#........^`P([email protected]...
.p&....u|.C..}BB.41.............EL$3B.*'......LMM=.I..0......g`...<<< skipped >>>

GET /cpro/ui/c.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidustatic.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:45:52 GMT

Content-Type: application/x-javascript

Content-Length: 27970

Connection: close

ETag: "557ba5a3-6d42"

Last-Modified: Sat, 13 Jun 2015 03:38:11 GMT

Expires: Sun, 14 Jun 2015 09:03:27 GMT

Age: 2545

Cache-Control: max-age=3600

Content-Encoding: gzip

Ohc-Content-Crc: 673261628

Server: hkg01-sys-jorcol01.hkg01.baidu.com
.....w]U..c.js...y{...8..>......$KN....=..6[..I....WQ.DE....w.g..A.
......{.'..b.`03.e.......r.&...^.......b..$.l..F[o.K..6...Y.v.~.u..b..
.l.....l..;..p....v.M..b4b...sU..E3..f.|1.l..eJ.Za=...y.iM...G|.....e.
.....].....G|.......w...g=8|....G...}.E....q4.[l................|... .
.Ny:.G.]....Y..B..w.b..`.......{....../../.4.8".u....B/9....~z'.|...4.
".4...K..b.zo..-.~..m..;.......N.........y..[..e....(..cL.j%...{.'..v.
.w.N...S../.t.-..l....W..../.fM.#..X.u.. ...I2..q.e....u)...v?.X...>
;.....].v......w.9.{..*....<o`'M..Fy..:.{..B............^...u.r..^.
\V.G.{.L.......Q.".........V.....u..|.i ..H..C#....q..J.........@w.{e.
XG...|5m.....C.. ..3.fc>J.FT...H.I..m..=.-f#..0U$..6,N1-}[email protected]
...X.........d.mU.......9o....;>..<...........Yp.[l.(&. R.2....G
..I....A>.)~..'.....1........F8......u.T.~..b......o..6.w.{..3.u..D
T."..N0. ....H...Y:.[6.:....h.Y.y..gA../'.t..3...../.$......w<y.S.}
.xh..".._:~.^..:.hu. [email protected]:q:.....(.m....,.G.[...[....I.V.z..e.?.. r..
.....D.Fq:.....>.....'.qG......6.......;........6..<.g.K/d..7...
....q.....Wa4......<.:...'..F....pi'....v.........3T....f.......k..
u....7 ...O...L_...$.HB@$!...\...pIr.J.....V..G.....!.#$..f..us_.k....
.T..8Mw......O..vw;sX$.....oE-.3...9..........?..%.hv.7/.8.j.7....i..v
...).9.(..f...6.z.[=....&.=NXtR.....u...(.o=..O,X.......y6..F.yv4.....
....r..&..t.;....`-..t.8.".K.g..f.r.A..">!`.z<.e3...W......I._L.
D.V'..R@.[...|b..... ..*:...Z1...ub.x..#x..G..<..Uk.z..o!.d9.....mX
:K.o..D.........,......\....M.....p.u..yTP.!..i.a....b...6..(m..w.<<< skipped >>>

GET /cpro/ui/noexpire/css/1.0.0/base.css HTTP/1.1

Accept: */*

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3<r=<u=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2002&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidustatic.com

Connection: Keep-Alive

Cookie: CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1


HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:21 GMT

Content-Type: text/css

Content-Length: 934

Connection: close

ETag: "554709f0-3a6"

Last-Modified: Mon, 04 May 2015 05:56:00 GMT

Expires: Thu, 01 May 2025 07:54:19 GMT

Age: 3545522

Cache-Control: max-age=315360000

Content-Encoding: gzip

Ohc-Content-Crc: 3052886116

Server: hkg01-sys-jorcol05.hkg01.baidu.com
...........VM..6.. .. ..dYvvS.{(...4.......9...H.E.....C..v.[[email protected]...
....w.l....WI.d9.....b..u......u.f...#b.1..C.DZ")._#.".A|....o....f..m
 T.....$.....4.9.;.. .r...C.. ..cmEl).N2C....I.H....e`Cy........_-....
...?.Q..B]#J..Z!*.X) .....jU.2..m..\T....<.".>..Qr7.:OB#[)..Q..t
..m@..)J.%..{..x.x..N....y.9x2.=`R8..o....7o:......?T3.!..!.....i..:A.
. ..s.....^[email protected]*!.X(.V....,2..c/.{..D7(.D.../.#.Y$u...H..f^m
.^0......W.ml...-<.6c.6..p/.L{[email protected].."...q...
n?nn..sy-.hX.4.l'....8{...-w.............Kc..>.j.Ji..aa...J.$^..26.
|.P:.`..E.....t.g..".>.Bz..'-..?..sEJ.-L~.......u........E......L.;
[email protected] &.'X.z..%.2.....kv..e......S..c...^...&f..@.../...........X
&.m."..w".R......?.R.'Z.X7....7.isU....h.........Ojw|v^b}z9.M8...0...z
A...N..W......t....#..N-..t..w.......l)...f....-.^...!..C...o..o.....i
1Y..<7k.?.d9..-mwrJ...k..`..I{m..8....B........h.,1...._().D...U.L.
Y......u...gi...Nv9|....|...h.<.}..'D.z.....

POST /api/xmlapi.asmx/GetInfo HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://w.ltywz.com/api/xmlapi.asmx/GetInfo

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Content-Type: application/x-www-form-urlencoded

accept-languge: zh-CN

Accept-Encoding: gzip, deflate

Host: w.ltywz.com

Content-Length: 10

Connection: Keep-Alive

Cache-Control: no-cache

AppCode=19
HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:42 GMT

Content-Type: text/xml; charset=utf-8

Content-Length: 252

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: private, max-age=0
<?xml version="1.0" encoding="utf-8"?>..<Server>..  <St
atus>true</Status>..  <Version>1.1</Version>..  &
lt;Name>163............</Name>..  <Upmode>False</Upm
ode>..  <Upaddress>..  </Upaddress>..  <Bulletin>
..  </Bulletin>..  <Vercode>2</Vercode>..</Server
>HTTP/1.1 200 OK..Server: nginx..Date: Sun, 14 Jun 2015 08:45:42 GM
T..Content-Type: text/xml; charset=utf-8..Content-Length: 252..Connect
ion: keep-alive..X-Powered-By-360WZB: wangzhan.360.cn..X-Powered-By: A
SP.NET..X-AspNet-Version: 2.0.50727..Cache-Control: private, max-age=0
..<?xml version="1.0" encoding="utf-8"?>..<Server>..  <
Status>true</Status>..  <Version>1.1</Version>.. 
 <Name>163............</Name>..  <Upmode>False</U
pmode>..  <Upaddress>..  </Upaddress>..  <Bulletin&g
t;..  </Bulletin>..  <Vercode>2</Vercode>..</Serv
er>..

GET /sync.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://pos.baidu.com/acom?adn=0&at=128&aurl=&cad=1&ccd=32&cec=gb2312&cfv=11&ch=0&col=en-us&conBW=0&conOP=1&cpa=1&dai=1&dis=0<r=<u=http://VVV.ltywz.com/thread-17831-1-1.html&lu_161=0&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=153x-1&psr=1276x846&pss=960x156&qn=4f4730e82ea33ac9&rad=&rsi0=960&rsi1=60&rsi5=4&rss0=#FFFFFF&rss1=#FFFFFF&rss2=#0000ff&rss3=&rss4=&rss5=&rss6=#e10900&rss7=&scale=&skin=tabcloud_skin_1&stid=5&td_id=1991537&titFF=å®‹ä½“&titFS=12&titTA=left&tn=baiduCustSTagLinkUnit&tpr=1434271564146&ts=1&version=2.0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u1991537&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.172.2203.2203

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidustatic.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:14 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Last-Modified: Mon, 01 Jun 2015 03:15:37 GMT

Age: 1126386

Content-Encoding: gzip

Ohc-Content-Crc: 327863765

Server: hkg01-sys-jorcol09.hkg01.baidu.com
37d.............VQo.6.~..`.. 3.Z.=.v.......d.C...E.mn.$.T.....QtmI.\..
.lQ....w..9z}.qz....,.*{.j...?..h.2}7..GC...:...V.]:..%...... .. .;=..
*.......s#[email protected]^..."',..[K.i.P5-T....e@:....1.k_....V..u."...........j.
..9......(.....6".........0.T...kc.t.....z..D.p...Ow0..:......(..H.u..
..^....aq.P2..<.N./$./.../......o8...@1%v5........I_.....%..29...c{
......./=....# 1.R......Z%`(..k....E.....=9G.".<.n..X*...GH.6.G.R.S
...5Q.eR..-...!..zg#<#..S0.z.sV...W.......|..lu%.s%u.L.z.t..P..*.A5
.i.>...Lv%.s...I...63.......P.7....." ..'b.....Ub.ao.XI..,9L...2...
dBRPE.../......#).,G0..1h x......I.P.r}(..L.E..........u-7`|.].&.X...f
.,F.g1.(Nb.o...R....d........2:...xyN.1.dnZ.N>d...z.M.........H.N .
...;g..t.A....j.9!..........3..^&.....ZoZ.M....G..H...Jv..o..fz.Q7....
-...W.....,..y.v. ..../.i....1...s..>....[.&.u.?..6...*....3.q.../.
;.I.|.o..>.I..Rv....c.)'.v.2f.Q&.98..L..C.......Uc..kh....ps}.WZ...
...........0..

GET /pixel?google_nid=baidu&google_cm HTTP/1.1

Accept: */*

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3<r=<u=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2002&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.g.doubleclick.net

Connection: Keep-Alive


HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://cm.g.doubleclick.net/pixel?google_nid=baidu&google_cm=&google_tc=

Date: Sun, 14 Jun 2015 08:46:21 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 277

X-XSS-Protection: 1; mode=block

Set-Cookie: test_cookie=CheckForPermission; expires=Sun, 14-Jun-2015 09:01:21 GMT; path=/; domain=.doubleclick.net

Alternate-Protocol: 80:quic,p=1
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://cm.g.doubleclick.net/pixel?google_nid=baidu&
google_cm=&google_tc=">here</A>...</BODY></HTML&
gt;......


GET /pixel?google_nid=baidu&google_cm=&google_tc= HTTP/1.1

Accept: */*

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3<r=<u=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2002&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.g.doubleclick.net

Connection: Keep-Alive

Cookie: test_cookie=CheckForPermission


HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://cm.pos.baidu.com/gpixel?google_gid=CAESEJjFx4RhgLnSGfBEJ8AfDVY&google_cver=1

Date: Sun, 14 Jun 2015 08:46:21 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 284

X-XSS-Protection: 1; mode=block

Set-Cookie: id=2271e9170f0200fe||t=1434271581|et=730|cs=002213fd48f627443f4e4f3c79; expires=Tue, 13-Jun-2017 08:46:21 GMT; path=/; domain=.doubleclick.net

Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT

Alternate-Protocol: 80:quic,p=1
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://cm.pos.baidu.com/gpixel?google_gid=CAESEJjFx4Rhg
LnSGfBEJ8AfDVY&google_cver=1">here</A>...</BODY><
;/HTML>..HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.dou
bleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo O
UR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Location: htt
p://cm.pos.baidu.com/gpixel?google_gid=CAESEJjFx4RhgLnSGfBEJ8AfDVY&goo
gle_cver=1..Date: Sun, 14 Jun 2015 08:46:21 GMT..Pragma: no-cache..Exp
ires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-rev
alidate..Content-Type: text/html; charset=UTF-8..Server: HTTP server (
unknown)..Content-Length: 284..X-XSS-Protection: 1; mode=block..Set-Co
okie: id=2271e9170f0200fe||t=1434271581|et=730|cs=002213fd48f627443f4e
4f3c79; expires=Tue, 13-Jun-2017 08:46:21 GMT; path=/; domain=.doublec
lick.net..Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; M
ax-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT..Alternate-Protocol: 8
0:quic,p=1..<HTML><HEAD><meta http-equiv="content-type"
 content="text/html;charset=utf-8">.<TITLE>302 Moved</TITL
E></HEAD><BODY>.<H1>302 Moved</H1>.The docu
ment has moved.<A HREF="hXXp://cm.pos.baidu.com/gpixel?google_gid=C
AESEJjFx4RhgLnSGfBEJ8AfDVY&google_cver=1">here</A>...<<< skipped >>>

GET /acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3<r=<u=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2001&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISBID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISUS=1; CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1


HTTP/1.1 200 OK

Cache-Control: post-check=0, pre-check=0

Connection: keep-alive

Content-Length: 5205

Content-Type: text/html

Date: Sun, 14 Jun 2015 08:46:24 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Sun Jun 14 16:46:24 2015

P3p: CP=" OTI DSP COR IVA OUR IND COM "

Pragma: no-cache

Server: nginx
<!DOCTYPE html>.<html>.    .    <head>.        <m
eta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
.        <title>..................</title>.        <lin
k rel="stylesheet" href="hXXp://cpro.baidustatic.com/cpro/ui/noexpire/
css/1.0.0/base.css"/>...<style  type="text/css">.....containe
r a.bd-logo{.....top:0;.....right:0;.....width:24px;.....height:20px;.
....background:url('hXXp://cpro.baidustatic.com/cpro/ui/noexpire/img/2
.0.0/bd-logo5.png') no-repeat top left;....._filter:progid:DXImageTran
sform.Microsoft.AlphaImageLoader(enabled=true, sizingMethod=none, src=
'hXXp://cpro.baidustatic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5.png')
;....._background:none;.....cursor: default;....}.....container a.bd-l
ogo:hover{.....width:90px;.....height:20px;.....background:url('http:/
/cpro.baidustatic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5-hover.png') 
no-repeat top left;....._filter:progid:DXImageTransform.Microsoft.Alph
aImageLoader(enabled=true, sizingMethod=none, src='hXXp://cpro.baidust
atic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5-hover.png');......._backg
round:none;....}...</style>.        <script type="text/javasc
ript" src="hXXp://cpro.baidustatic.com/cpro/ui/noexpire/js/3.2.0/base.
js"></script>.    </head>.    .    <body><div 
style="display:none;"><img src="hXXp://wn.pos.baidu.com/adx.php?
c=d25pZD0xNTkzNjgzNGQ1ZTFhMjBlAHM9MTU5MzY4MzRkNWUxYTIwZQB0PTE0MzQyNzE1
ODQAc2U9MQBidT01AHByaWNlPVZYMF9ZQUFFWDBON2pFcGdXNUlBOHN0TWhoOGpTam<<< skipped >>>

GET /static/image/common/arrow_top.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:25 GMT

Content-Type: image/gif

Content-Length: 51

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a.............!.......,............a......t..;....

GET /uc_server/images/noavatar_middle.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:25 GMT

Content-Type: image/gif

Content-Length: 3972

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
GIF89ax.x.............\\].............................................
..................................................................}..u
ww....................................................................
................mc\..................hJ9...........z........v6$...r...
.....t...........m.hS.[P......`XV.rcA:9.OE<32.pn.......  .((ULL!...
...,,&%%mkk<;;655FEEBAAVUU............cccQQQLLL...!.......,....x.x.
......................................................................
..............................................................J@.H....
........O.#F.(.....)[email protected].(S.\Yr#G..A.rYR...8s.l......d...rg
..H.*....K.A.>lG.&...,d..U...8.>.9....W.VX.....p......g..d..;.2.
W.pQ..L.p\.W........v....B..;c..9..s.6m..P..0..b;F-K....\......m8.....
GN..s.*....D.Z.V.c....Vv.9#.x..vS3...)r.*.8.L..s....?...V.....E0rr.)..
.......=..z....aZ...v..u..r.._...aa..fH....X..o......G.E7=..~.]X..0^.a
g...F...v.ZH.. '...`.,....H&....L6._.oD.F.)....*.xTv.5.Zw(....Er.".J..
...:.!.R....u.. [email protected]&...w....n....R.1........A4.Ro..h.......6.
...6.....x.I.%".j.Q..[w.f$..b.(...:*..5*%..n.j......W.................
(...6.f|.....TT..$5.).fr...|.[..m.....v............@a&7....J(...K/..f 
,.o..j...`W.5$!;0.}......k..K.........)h.1!Mm.. .......\..(_...,.:.icv
k....<3. ....M*...@.]/....o.H...M..L3.P{....M]...6.u.C....~ }e.dS..
 e...Q.....oK ..W.].._....Y..4.~.....n.w..{....Vl....%..MO4...f.!.n'.x
...Nz...q`.....j7.....{.9....u..s....=F....^<B...g..........}..R...
........|...m>....z."P.........>.I.~....J..n..r(!H.n...R....<<< skipped >>>

GET /static/js/qshare.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:25 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip
761.............X.O.F..y..?\].N.....a...T...Z...Y.8....s.3.Z..}....I.n
......}.rn={....[.....>s.4v}.... .F.2....8..u1.......,`.... .M.g...
|....).".........#.n..6.?z.... e.l....10.....d]6..P.......#.......m.A.
..,..c..b......r..13..bk..W?y...W..E.I............F..\'p..j....L.#...F
....j7.=.r1.........$.y<..i.N.J:..Lx.)..W/..V.$Y....%f..g-.....q..r
'...`O.....L..:.0.Q...HdI..;....ciK.J/..X.T...:Z\.Y..XF'}.0.....^F.e..
.......%...0....:.7_.u(GsO dRu..2..lVF..p*..{9..9..w._i-...37H'.yYIU..
b0.oA.^.*.8W....Ed.....K.....,.....5m...M....s..4..L..8M.yc)r.ev......
.g..."...o......I........~b.0OS.rc."....4..5A(J...z.}....aN.....r.. B!
Al....rwo.N.W"....g..o.).8.q.cq}.'.9........d.P.y.^.....Tp..<.m....
....Ij..U........M.2.';._.....u....\_.3...^ie.!..Kp.-.C<~e....S.mo.
. .A....<....'...K....Je.../R...}!g..9..2.....E..w/.&.Q0...ml...n.m
$Y...lk.........M%T........w7p.......Z.....F.w...><..\^4].c.O...
..f.B..?iv...,?....`..GA..V.2......*([..........H.xc<j.....7.$^.J%.
HQ.Q.j...I...gTU.......[...0.....k.bG.......J.....S....x.| 3.s...v.1..
.=.4.2RMN...#d<..J....k...p.kcC~..e"[email protected]..{... B..........J\)..."G
V..M..\..E.H]...*...t.t'.V......!.".-........[H.....Z..S3&;.c|.=.%0...
...h..T6........h...c..O.?...zt.].I..8....G.G..."..B&..-... .o...p..)1
[email protected]../.|....h.y....bN.md..>..@].{.&.V....|.......(Z..i0)_
L|....W...q#..D*.Q..k........q$b.3.dx..."....1U`.,...jNr.#|..t...'...L
..3..6.;.G......:\............M2Dg.Za....QWi...Y6........F.9...-c...(T
m$cT....].<. ...31...iY....[4. ........_.....|.....O./.......%.<<< skipped >>>

GET /static/image/common/fastreply.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:26 GMT

Content-Type: image/gif

Content-Length: 608

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a...............p..z..{..|..J..M..X...........%..R..U..^.........
.. ..X..Z................................-..8..R..e..e..e.............
.R..e..e...........!.."..e..............T..X..e...........V..e.."..%..
;..\..e..e........2..R..^..c..d..f....................................
.. ..$..'..9..L..Q..^..c..............................................
...............................................!.....g.,............g.
.......cZQP..PXa.`4..........`.d..............g@ .......!0.."......*).
F%......$E.O#......,O. '&...(2.gR81-.../9.GG753...6>.NSHz..A. ..D..
i2.K.%J"F......g.x.b.J..W.t...c.3b.t1y...*-c..Y(..;....

GET /source/plugin/rsf_logo_fill/template/fill_bg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:27 GMT

Content-Type: image/jpeg

Content-Length: 44277

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sun, 09 Nov 2014 08:43:16 GMT

ETag: "c2155a34f9fbcf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
......JFIF.....^.^......Exif..MM.*.............................b......
.....j.(...........1.........r.2...........i...............5g...'..5g.
..'.Adobe Photoshop CS4 Windows.2014:06:19 19:59:32...................
.....................y...........................................&.(..
.......................................H.......H..........JFIF.....H.H
......Adobe_CM......Adobe.d...........................................
......................................................................
....................................."................?...............
...........................................................3......!.1.
AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'.....
..........Vfv........7GWgw........................5.....!1..AQaq"..2..
...B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............
Vfv........'7GWgw.................?..T.I%)$.IJI$.R.I$...I%)$.IJI$.R.I$
...I%)$.IO...T.I%)$.IJI$.R.I$...I%)$.IJI$.R.I$...I%)$.IO...T.I%)$.IJI$
.R.I$...I%)$.IJI$.R.LH...%)$.IJI$.S...T.I%)$.IJI$.R.I$.......e..).7..0
..9......X.........J|c#;..E.......q.....y..y......u_V...9...p..h...4}.
.}/..].V&.e......?.UcC.~-|......8.~w..9......C..}..{.... }...$..&u....
.."..:wO...A5.c4u...7..mU..7..s.-nt..............;..2.....E..w...[3z..
......h".Zs}.[.....3..%<..M..u<..6.2_I...v4.._...{.sw..'..fbc..c
.s....T.....;.V{7...E.cT.1.m4.C .....,o..%)$.IJI$.S...T.I%)$.IJI$.R.I$
...I%)$.IO.........<a.....v.Y..".....7../g.KWp...._....a.....-..k..
......I%)$.IJI$.S...T.wQ.......5..e.WQ.03qm.C...Y....].....</.8<<< skipped >>>

GET /plugin.php?id=milu_seotool:sitemap&tpl=no&myac=milu_seotool_cron&inajax=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:35 GMT

Content-Type: text/html; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Set-Cookie: 7rjd_2132_lastact=1434271591	plugin.php	; expires=Mon, 15-Jun-2015 08:46:31 GMT; path=/

Content-Encoding: gzip
4c............s,*J....R.............X.[;.C.c.#scCC..tf^rNiJj...Ks..#.M
....y.L.....0......


GET /home.php?mod=misc&ac=sendmail&rand=1434271536 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536	forum.php	viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831; CNZZDATA5796949=cnzz_eid=1877242474-1434271586-&ntime=1434271586


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:35 GMT

Content-Type: text/javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Set-Cookie: 7rjd_2132_lastact=1434271591	home.php	misc; expires=Mon, 15-Jun-2015 08:46:31 GMT; path=/

Set-Cookie: 7rjd_2132_sendmail=1; expires=Sun, 14-Jun-2015 08:51:31 GMT; path=/

Content-Encoding: gzip

14........................0......

GET /static/image/common/scrolltop.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271591	home.php	misc; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831; CNZZDATA5796949=cnzz_eid=1877242474-1434271586-&ntime=1434271586; 7rjd_2132_sendmail=1


HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:36 GMT

Content-Type: image/png

Content-Length: 1383

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0
.PNG........IHDR...P...x.....%7.R....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE............l..j.....~..w.....z.....n.....y..v.....}..{....
....t..r...........p..................................................
n..|..s........k........i........S..l...6tRNS.........................
...............................N1....IDATx.b0...SSFF ...b23.... &..$&.
.  ..&&.[...)..1.@L.<j... ..)@....,3e2%....#...dd4.....Z...A......,
,DY..r# ..)@.!.. e............&S...........!.B .....h..P..G.T6UV..8L98
H..a*!.u.)..&.`E..j.. ......1...v..0.4.M.!oJ.'..#...(...B...Gb@`J..$^.
...G&.8RV.'[email protected]<778W.3&(kb....XrYa...h..E.F.>
;@p..r.._.%e.N.".ZO..&.IFrZ..(o.........&.g..f....G.p..d[.n.R...V.XqO.
......N!...;z..{...a.d....)......u.0.0 ...B.wG.......=... .....F.g...4
.0.4!...E.U...`..u..a <..X..bb.......V...KL#"$....S....:.....<..
}.$X..FZ.h........>&r..p.q8.P^[email protected].'............5.
-...C.....%....r.I.8)_.-`.]R.,.A.\3....k....9....v.:...y...\.......e..
.......Y..7...'.Os#/......b.....G..,.....A....)NR{-}^.P...i......h.l[.
..8n......0(..'...v~..f...-.w.N.B...{..H.$.....0R.....|fG.E..1n......y
a6]b..2.s..E[.....FA^.1..g;.....5.L..h_p....)_.../..S..G.g.Qg...|G..`.
......H.a8q...E...'..'....e3../....o..a..o..b.Mi3.,......nGi/'.....G`.
N(8..U..-...Q....M.(..F..Bg%.....e......v]..hB.N..*....1R/5.J[/....i..
F..{..a...,K.F....ZP.u]#0....7.r/.wAw..y.g..o1.....S......)Sc.....IEND
.B`...<<< skipped >>>

GET /static/dspui/img/flowbar/arrow_left_60_e700a3bb.png HTTP/1.1

Accept: */*

Referer: hXXp://entry.baidu.com/rp/home?type=flowbar&di=u2108193&rsi0=auto&rsi1=50&title=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›<u=http://VVV.ltywz.com/thread-17831-1-1.html&ref=&pageWidth=60&pageHeight=20&t=1434271591068&rsi0=60&rsi1=50

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: su.bdimg.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: JSP3/2.0.6

Date: Sun, 14 Jun 2015 08:46:25 GMT

Content-Type: image/png

Content-Length: 2385

Connection: keep-alive

ETag: "2981745255"

Last-Modified: Wed, 13 May 2015 05:53:16 GMT

Expires: Mon, 23 Nov 2015 10:25:45 GMT

Age: 1549240

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Ohc-Response-Time: 1 0 0 0 0 0
.PNG........IHDR...#...<........%....tEXtSoftware.Adobe ImageReadyq
.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0M
pCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
tk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        ">
; <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"&
gt; <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xa
p/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="htt
p://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Ph
otoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:1726200CC0E511E4B68
AD4BB7D798C78" xmpMM:DocumentID="xmp.did:1726200DC0E511E4B68AD4BB7D798
C78"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FF0A356BC0851
1E4B68AD4BB7D798C78" stRef:documentID="xmp.did:FF0A356CC08511E4B68AD4B
B7D798C78"/> </rdf:Description> </rdf:RDF> </x:xmpme
ta> <?xpacket end="r"?>.a,z....PLTE-..#s. ..,..#r.,..,..$u...
.$v.......k..$u.%v....-..z..o.....}..)u.......N........&s.~.....$t....
-..*...........)..a..k..&x.B..(u....7.....m.....6}....$u..............
.....M..~..:.....'u....[../x................$t....l..$s.......%x....R.
.V..,w. .................'z.=..-w.*..... ..P..............-...........
....../y.$u....... ..j...........s.....a..T........(v.*..Y..,z....$s.S
..%u....#s.......(|.#r.*.....)~.,w...................=................
.............0y.,..`..*..&y....)}.I..'u.f..\..%u.......b..P..~.....E..
R.....$s.,..#r.-.....,...Vjq....IDATx.\U..OE...{..{.......D.J.,.,%<<< skipped >>>

GET /media/v1/0f000Dlh0nJS1Y3OYHhQp0.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ubmcmm.baidustatic.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:25 GMT

Content-Type: application/x-shockwave-flash

Content-Length: 34846

Connection: close

Last-Modified: Sat, 25 Apr 2009 07:04:00 GMT

Expires: Fri, 06 May 2016 10:20:31 GMT

Age: 3277554

Cache-Control: max-age=31536000

media: media

Ohc-Content-Crc: 359767942

Server: hkg01-sys-jorcol08.hkg01.baidu.com
CWS.....x....[....gai...I).T..KJ..n..A:....R....i.K..~....~..........5
..y..{....s..#.........Hb...x.w{{ ./..p2..<svpp...:X:.w?...\.Ll...8
.. ....p.....J..R..2<[email protected].`....H}..C*....)......4.n.
.....`.....~.........*.._......44............4.."b.||..4..|BBB.!.1!>
;vfv~a1.......])............3<..`.&!'g..........!d.....6..........[
WDH.N..t..`#...1<......c.n{.B.......... ..X........O....RI....K#.j.
[email protected].].....]..A6..............'.....s..e[.h;#....y
...$hU..j./s`.......G.mBi..4.....T...".*m.....(...(.R.j..K.......j$...
gO.K.......-...Y.......&a......\d.0.2.be.v.....(?o.............aN.C...
....._.T.4.........I.Q !.1.*..K..M.G.L....-..D2.......])...&.2....~.q 
..;..M..x.V&L..T...n.:)..lK..,'. ......9<6...K. d.......W..wg...~.&
lt;..jK. d.}.....i..7T....D..5...:.h....I............\....2...`AJ.....
`x....Q..._....H.S....b"h.. ........X..........cH..8..4..\.N..x...k.. 
xH91.../q.65'..cXBR.....t1..N\.T.D..S.c#Ua!4".H..)...I....Ey....8QI...
-...-.\..5.....2.....#VZ.....,i.*K...C..Yh......\.T......^$....v....I.
.1...R.V3..3.eT...`X....8q..^.q......IN/.k-]G,q~'.......L...e.=..'..# 
.....e.....l..Qn.hUR~...H......7...g.%.v....)[email protected]
.....'..E..Q....w...'....t9..g..n..j..5......... [email protected]......... a.A.
.Q.2.y.45AK.l.... MI_.....F.0....J...k.5....J..8.8u.....!.Yb...F.n..&l
t;%_.m ......e9..8!'......gx.......C..?...t.T.V.........J...t..4A..@84
]...{!....8...:\.=.l.[...C2..*...}.bf.O..v..QC.G......;.. ......I?*...
...{yD0<......~p..`.?..]..8......._`<.w.]..........].p.;....<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_560:

`.rsrc

t$(SSh

~%UVW

f9z.vk

u$SShe

B~nCB~J!C~.dE~

kernel32.dll

wininet.dll

ole32.dll

UUWiseHelper.dll

user32.dll

rasapi32.dll

ADVAPI32.DLL

advapi32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

uu_loginA

uu_reportError

CreateIoCompletionPort

{B6F7542F-B8FE-46a8-9605-98856A687097}

{B37C9A97-4B7C-4270-837C-1A27515588A8}

hXXp://VVV.ltywz.com/rj/post.htm

.iqW>

"3/%F

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

https

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXp://

Adodb.Stream

hXXp://VVV.minnanwl.com/gengxin/qqlx/lxqq.htm

config.ini

999999999

hXXp://VVV.minnanwl.com/gengxin/qqlx/qq.htm

\dc.dll

.text

`.rdata

@.data

@.reloc

deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly

inflate 1.1.3 Copyright 1995-1998 Mark Adler

MFC42.DLL

KERNEL32.dll

GdiplusShutdown

gdiplus.dll

WSOCK32.dll

MSVCP60.dll

dc.dll

ReportError

ReportError_A

VBYB_ReportError

VB_ReportError

uu_loginW

debug.ini

ReportError:%s

Error:%s

%s|!|%s

\dms.pdb

%u%u,

dclog.txt

port

settimeout:%d

[%d]%s

reg2:%s

checkok:%s %s

check fail:%s %s %s

check:%s %s

getcjfail:%s %s

getcj:%s %s

%s%uout

%s%uin

put img ok:%s

put img fail:%s

put img:%s %s %d

get result ok:%s,%s

get result fail:%s

get result:%s

notifyfail ok:%s

%s\%d-%s.png

notifyfail fail:%s,%s

notifyfail:%s

getimgok:%s,%s

getimg:%s

getinfo fail:%s

getinfo:%s,%s

setresult:%s,%s

HTTP/1.1 200 OK

recv:%d

send:%d

GET /ip.txt HTTP/1.1

Host: %s

User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2

select:%d

ioctlsocket:%d

socket:%d

api.qqchaoren.net

14.17.65.24

14.17.65.23

dama2.qqchaoren.net

dama1.qqchaoren.net

connect total:%s %d

:%s %d

connect discard:%s %d

[d-d-d d:d:d](u)

recv timeout:<%d>

recvfail:<%d>%d

server close:<%d>%d

recv:<%d>%d

send:<%d>%d

sendfail:<%d>%d

connect timeout:<%d>

connectok:<%d>%s %hu

127.0.0.1

1.1.3

\SkinH_EL.dll

\To configure.ini

E23EB210-E964-4807-9865-5FFF8BC100CF

\UUWiseHelper.dll

SSSSh

ByScreen.JPG

operator

GetProcessWindowStation

E:\work\UUWiseHelper

\UUWiseHelper.pdb

RegCloseKey

RegOpenKeyExW

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

SHLWAPI.dll

urlmon.dll

dbghelp.dll

IPHLPAPI.DLL

WS2_32.dll

GetProcessHeap

GetCPInfo

UUWiseHelper.DLL

uu_easyRecognizeUrlA

uu_easyRecognizeUrlW

uu_recognizeByCodeTypeAndUrlA

uu_recognizeByCodeTypeAndUrlW

zcÁ

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

0(1,10141

9 9<9@9`9

32F1C86B-E64C-4EAF-8BC1-C142570008BC

:-1014,URL

:-19011,

TEAKEY

hXXp://api.ruokuai.com/register.xml

hXXp://api.ruokuai.com/info.xml

hXXp://api.ruokuai.com/recharge.xml

hXXp://api.ruokuai.com/create.xml

hXXp://api.ruokuai.com/reporterror.xml

hXXp://reg.email.163.com/unireg/call.do?cmd=register.entrance&from=163mail_right

m = w.length,

b = f.getTime(),

p = z.charAt(q),

for (n = (e   '').length - 1; n >= 0; n--) {

var o = x.charAt(n);

y = i.length,

r = r   i.charAt(j);

v = v   i.charAt(j)

for (t = 0; t < u.length; t  ) {

s = s   u.charAt(t)

b = a.getTime();

hXXp://reg.email.163.com/unireg/call.do?cmd=register.verifyCode&v=common/verifycode/vc_en&env=

@163.com

@163.com

@163.com----

SESSIONkEY

-12027,TEAKEY

hXXp://1111.ip138.com/ic.asp

hXXp://reg.email.163.com/unireg/call.do?cmd=register.verifyCode&v=common/verifycode/vc_zh&vt=grey&env=

Fiddler Web Debugger

The Wireshark Network Analyzer [Wireshark 1.12.0 (v1.12.0-0-g4fab41a from master-1.12)]

hXXp://VVV.uuwise.com/

hXXp://VVV.ruokuai.com/

hXXp://iframe.ip138.com/ic.asp

\Microsoft\Network\Connections\pbk\rasphone.pbk

&password=

application/x-www-form-urlencoded

WinHttp.WinHttpRequest.5.1

&softkey=

Content-Disposition: form-data; name="password"

{pass}

Content-Disposition: form-data; name="softkey"

{softkey}

Content-Disposition: form-data; name="image"; filename="System.Byte[]"

z>type=1&product=urs&url=&url2=http://reg.163.com/UserLogin.do&username=

hXXps://reg.163.com/logins.jsp

?cmd=register.start&reforward=common/reform&targetCmd=register.ctrlTop

hXXps://ssl.mail.163.com/regall/unireg/call.do;jsessionid=

&confirmPassword=

@163.com&password=

@163.com&suspendId=

hXXp://reg.email.163.com/unireg/call.do?cmd=register.resume

hXXps://reg.163.com/account/accountSecQuestionIndex.do

&question3=æ‚¨é…å¶çš„åå—æ˜¯ï¼Ÿ&answer3=

&question2=æ‚¨æ¯äº²çš„åå—æ˜¯ï¼Ÿ&answer2=

noheader=0&lastpath=&isReset=&navitem=nav_item_3&question1=æ‚¨çˆ¶äº²çš„åå—æ˜¯ï¼Ÿ&answer1=

hXXps://reg.163.com/mibao2/step1.do

hXXps://reg.163.com/mibao2/checkAnswer.do

SetClientCertificate

112.15.5.111

hXXp://VVV.ltywz.com/thread-17831-1-1.htmlt

MEs

SgP%c

-cJ}R)uv

%d&&'

123456789

00003333

__MSVCRT_HEAP_SELECT

CreateWindowStationA

MsgWaitForMultipleObjects

pljd.dll

pljd_UserLogin

pljd_UserLogin_A

pljd_UserTrialLogin

pljd_UserTrialLogin_A

?456789:;<=

!"#$%&'()* ,-./0123

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

Broken pipe

Inappropriate I/O control operation

Operation not permitted

iphlpapi.dll

MPR.dll

VERSION.dll

.PAVCException@@

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

VVV.dywt.com.cn

hXXp://VVV.baidu.com

(*.htm;*.html)|*.htm;*.html

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

/api/api.aspx

[email protected]

Microsoft.XMLHTTP

MSXML2.ServerXMLHTTP

MSXML2.ServerXMLHTTP.6.0

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

/api/xmlapi.asmx/GetStaticData

/api/xmlapi.asmx/TrialLogin&Vercode=

IPHlpApi.dll

00-00-00-00-00-00

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

/api/xmlapi.asmx/Login&Mark=

/api/xmlapi.asmx/GetInfoAppCode=

2013-01-01 08:00:00

/api/xmlapi.asmx/Communication&ed=

/api/xmlapi.asmx/Regin&Agent=

/api/xmlapi.asmx/CardReCharge&Referee=

/api/xmlapi.asmx/OrderReCharge&OrderNo=

/api/xmlapi.asmx/UpdatePwd&NewPwd=

/api/xmlapi.asmx/ChangeBinding

/api/xmlapi.asmx/GetGameName

/api/xmlapi.asmx/GetExpireTime

/api/xmlapi.asmx/CheckAgain

/api/xmlapi.asmx/GetVerCode

hXXp://VVV.google.com.hk

hXXp://VVV.sina.com.cn

hXXp://VVV.163.com

hXXp://VVV.sohu.com

hXXp://VVV.sogou.com

hXXp://VVV.soso.com

hXXp://VVV.qq.comHEAD

ntdll.dll

CloseWindowStation

program internal error number is %d.

:"%s"

:"%s".

;3 #>6.&

'2, / 0&7!4-)1#

c:\%original file name%.exe

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

GetWindowsDirectoryA

WinExec

RegOpenKeyExA

RegCreateKeyExA

GetViewportOrgEx

ScaleViewportExtEx

SetViewportExtEx

OffsetViewportOrgEx

SetViewportOrgEx

GetViewportExtEx

ShellExecuteA

GetKeyState

CreateDialogIndirectParamA

SetWindowsHookExA

UnhookWindowsHookEx

EnumChildWindows

InternetOpenUrlA

d4x7V.aCz

/IE.BsCr0S(@S

Keyu

faMsg

pi.ih

#include "l.chs\afxres.rc" // Standard components

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.2.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>PAD

comdlg32.dll

oledlg.dll

RASAPI32.dll

WININET.dll

WINMM.dll

WINSPOOL.DRV

1, 0, 6, 6

- Skin.dll

!"#$%&'()* ,-

25, 0, 0, 1

Windows

CCaptchaRecognizer::recognizeByCodeTypeAndUrl

hXXp://s1.uudati.com:

hXXp://s1.taskok.com:

hXXp://s1.uudama.com:

hXXp://s1.uuwise.com:

/Api/config.aspx

2.0.0.4

WiseClientAPI-2.0.0.4

CCaptchaRecognizer::__UpdateTKEY

CCaptchaRecognizer::_IsNeedLogin

/Api/DecodeImg.aspx

xxxxxxxxxxx

hXXp://p1.uuwise.net:

hXXp://p1.uudama.net:

hXXp://p1.taskok.com:

hXXp://p1.uuwise.com:

hXXp://p1.uudama.com:

CCaptchaRecognizer::easyRecognizeUrl

%d%d%d%d%d

CCaptchaRecognizer::_CalcRandomPort

/Api/VerifyAPIFile.aspx

/Api/UserLogin.aspx

CCaptchaRecognizer::login

/Api/UserReg.aspx

/Api/PayCard.aspx

/Api/ReportError.aspx

CCaptchaRecognizer::reportError

/Api/UserPoint.aspx

|2.0.0.4|

/Api/DecodeResult.aspx

ID/KEY/

ByTypeBytes.JPG

%d-%d-%d

CHttpRequestHelper::_ReadResponse

User-Agent:WiseClient-2.0.0.4;

WiseClient-2.0.0.4

CHttpRequestHelper::_InternalRequest

CHttpRequestHelper::RequestGetImage

CHttpRequestHelper::RequestPost

ServerPort

UUExtConfig.ini

-:-:-.%d

tCRYPTDLL.DLL

3.cn.pool.ntp.org

2.cn.pool.ntp.org

1.cn.pool.ntp.org

0.cn.pool.ntp.org

cn.pool.ntp.org

\\.\PHYSICALDRIVE0

Microsoft Windows Millennium Edition

Microsoft Windows 98

Microsoft Windows 95

%s (Build %d)

Service Pack 6a (Build %d)

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

Web Edition

Service Pack %d (Build %d)

Microsoft Windows NT

Microsoft Windows 2000

Microsoft Windows XP

Microsoft Windows Server 2003,

Microsoft Windows XP Professional x64 Edition

Microsoft Windows Server 2003 "R2"

Windows Server 2008

Windows Vista

Windows Server 2008 R2

Windows 7

ox-x-x-x-x-x

\Tencent\Users\*.*

nKERNEL32.DLL

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

!"#$%&'()* ,-.

uuwise.com

2, 0, 0, 4

1.0.0.1

(*.*)

1.1.0.0

%original file name%.exe_560_rwx_00401000_0025D000:

t$(SSh

~%UVW

f9z.vk

u$SShe

B~nCB~J!C~.dE~

kernel32.dll

wininet.dll

ole32.dll

UUWiseHelper.dll

user32.dll

rasapi32.dll

ADVAPI32.DLL

advapi32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

uu_loginA

uu_reportError

CreateIoCompletionPort

{B6F7542F-B8FE-46a8-9605-98856A687097}

{B37C9A97-4B7C-4270-837C-1A27515588A8}

hXXp://VVV.ltywz.com/rj/post.htm

.iqW>

"3/%F

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

https

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXp://

Adodb.Stream

hXXp://VVV.minnanwl.com/gengxin/qqlx/lxqq.htm

config.ini

999999999

hXXp://VVV.minnanwl.com/gengxin/qqlx/qq.htm

\dc.dll

.text

`.rdata

@.data

@.reloc

deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly

inflate 1.1.3 Copyright 1995-1998 Mark Adler

MFC42.DLL

KERNEL32.dll

GdiplusShutdown

gdiplus.dll

WSOCK32.dll

MSVCP60.dll

dc.dll

ReportError

ReportError_A

VBYB_ReportError

VB_ReportError

uu_loginW

debug.ini

ReportError:%s

Error:%s

%s|!|%s

\dms.pdb

%u%u,

dclog.txt

port

settimeout:%d

[%d]%s

reg2:%s

checkok:%s %s

check fail:%s %s %s

check:%s %s

getcjfail:%s %s

getcj:%s %s

%s%uout

%s%uin

put img ok:%s

put img fail:%s

put img:%s %s %d

get result ok:%s,%s

get result fail:%s

get result:%s

notifyfail ok:%s

%s\%d-%s.png

notifyfail fail:%s,%s

notifyfail:%s

getimgok:%s,%s

getimg:%s

getinfo fail:%s

getinfo:%s,%s

setresult:%s,%s

HTTP/1.1 200 OK

recv:%d

send:%d

GET /ip.txt HTTP/1.1

Host: %s

User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2

select:%d

ioctlsocket:%d

socket:%d

api.qqchaoren.net

14.17.65.24

14.17.65.23

dama2.qqchaoren.net

dama1.qqchaoren.net

connect total:%s %d

:%s %d

connect discard:%s %d

[d-d-d d:d:d](u)

recv timeout:<%d>

recvfail:<%d>%d

server close:<%d>%d

recv:<%d>%d

send:<%d>%d

sendfail:<%d>%d

connect timeout:<%d>

connectok:<%d>%s %hu

127.0.0.1

1.1.3

\SkinH_EL.dll

\To configure.ini

E23EB210-E964-4807-9865-5FFF8BC100CF

\UUWiseHelper.dll

SSSSh

ByScreen.JPG

operator

GetProcessWindowStation

E:\work\UUWiseHelper

\UUWiseHelper.pdb

RegCloseKey

RegOpenKeyExW

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

SHLWAPI.dll

urlmon.dll

dbghelp.dll

IPHLPAPI.DLL

WS2_32.dll

GetProcessHeap

GetCPInfo

UUWiseHelper.DLL

uu_easyRecognizeUrlA

uu_easyRecognizeUrlW

uu_recognizeByCodeTypeAndUrlA

uu_recognizeByCodeTypeAndUrlW

zcÁ

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

0(1,10141

9 9<9@9`9

32F1C86B-E64C-4EAF-8BC1-C142570008BC

:-1014,URL

:-19011,

TEAKEY

hXXp://api.ruokuai.com/register.xml

hXXp://api.ruokuai.com/info.xml

hXXp://api.ruokuai.com/recharge.xml

hXXp://api.ruokuai.com/create.xml

hXXp://api.ruokuai.com/reporterror.xml

hXXp://reg.email.163.com/unireg/call.do?cmd=register.entrance&from=163mail_right

m = w.length,

b = f.getTime(),

p = z.charAt(q),

for (n = (e   '').length - 1; n >= 0; n--) {

var o = x.charAt(n);

y = i.length,

r = r   i.charAt(j);

v = v   i.charAt(j)

for (t = 0; t < u.length; t  ) {

s = s   u.charAt(t)

b = a.getTime();

hXXp://reg.email.163.com/unireg/call.do?cmd=register.verifyCode&v=common/verifycode/vc_en&env=

@163.com

@163.com

@163.com----

SESSIONkEY

-12027,TEAKEY

hXXp://1111.ip138.com/ic.asp

hXXp://reg.email.163.com/unireg/call.do?cmd=register.verifyCode&v=common/verifycode/vc_zh&vt=grey&env=

Fiddler Web Debugger

The Wireshark Network Analyzer [Wireshark 1.12.0 (v1.12.0-0-g4fab41a from master-1.12)]

hXXp://VVV.uuwise.com/

hXXp://VVV.ruokuai.com/

hXXp://iframe.ip138.com/ic.asp

\Microsoft\Network\Connections\pbk\rasphone.pbk

&password=

application/x-www-form-urlencoded

WinHttp.WinHttpRequest.5.1

&softkey=

Content-Disposition: form-data; name="password"

{pass}

Content-Disposition: form-data; name="softkey"

{softkey}

Content-Disposition: form-data; name="image"; filename="System.Byte[]"

z>type=1&product=urs&url=&url2=http://reg.163.com/UserLogin.do&username=

hXXps://reg.163.com/logins.jsp

?cmd=register.start&reforward=common/reform&targetCmd=register.ctrlTop

hXXps://ssl.mail.163.com/regall/unireg/call.do;jsessionid=

&confirmPassword=

@163.com&password=

@163.com&suspendId=

hXXp://reg.email.163.com/unireg/call.do?cmd=register.resume

hXXps://reg.163.com/account/accountSecQuestionIndex.do

&question3=æ‚¨é…å¶çš„åå—æ˜¯ï¼Ÿ&answer3=

&question2=æ‚¨æ¯äº²çš„åå—æ˜¯ï¼Ÿ&answer2=

noheader=0&lastpath=&isReset=&navitem=nav_item_3&question1=æ‚¨çˆ¶äº²çš„åå—æ˜¯ï¼Ÿ&answer1=

hXXps://reg.163.com/mibao2/step1.do

hXXps://reg.163.com/mibao2/checkAnswer.do

SetClientCertificate

112.15.5.111

hXXp://VVV.ltywz.com/thread-17831-1-1.htmlt

MEs

SgP%c

-cJ}R)uv

%d&&'

123456789

00003333

__MSVCRT_HEAP_SELECT

CreateWindowStationA

MsgWaitForMultipleObjects

pljd.dll

pljd_UserLogin

pljd_UserLogin_A

pljd_UserTrialLogin

pljd_UserTrialLogin_A

?456789:;<=

!"#$%&'()* ,-./0123

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

Broken pipe

Inappropriate I/O control operation

Operation not permitted

iphlpapi.dll

MPR.dll

VERSION.dll

.PAVCException@@

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

VVV.dywt.com.cn

hXXp://VVV.baidu.com

(*.htm;*.html)|*.htm;*.html

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

/api/api.aspx

[email protected]

Microsoft.XMLHTTP

MSXML2.ServerXMLHTTP

MSXML2.ServerXMLHTTP.6.0

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

/api/xmlapi.asmx/GetStaticData

/api/xmlapi.asmx/TrialLogin&Vercode=

IPHlpApi.dll

00-00-00-00-00-00

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

/api/xmlapi.asmx/Login&Mark=

/api/xmlapi.asmx/GetInfoAppCode=

2013-01-01 08:00:00

/api/xmlapi.asmx/Communication&ed=

/api/xmlapi.asmx/Regin&Agent=

/api/xmlapi.asmx/CardReCharge&Referee=

/api/xmlapi.asmx/OrderReCharge&OrderNo=

/api/xmlapi.asmx/UpdatePwd&NewPwd=

/api/xmlapi.asmx/ChangeBinding

/api/xmlapi.asmx/GetGameName

/api/xmlapi.asmx/GetExpireTime

/api/xmlapi.asmx/CheckAgain

/api/xmlapi.asmx/GetVerCode

hXXp://VVV.google.com.hk

hXXp://VVV.sina.com.cn

hXXp://VVV.163.com

hXXp://VVV.sohu.com

hXXp://VVV.sogou.com

hXXp://VVV.soso.com

hXXp://VVV.qq.comHEAD

ntdll.dll

CloseWindowStation

program internal error number is %d.

:"%s"

:"%s".

;3 #>6.&

'2, / 0&7!4-)1#

c:\%original file name%.exe

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

GetWindowsDirectoryA

WinExec

RegOpenKeyExA

RegCreateKeyExA

GetViewportOrgEx

ScaleViewportExtEx

SetViewportExtEx

OffsetViewportOrgEx

SetViewportOrgEx

GetViewportExtEx

ShellExecuteA

GetKeyState

CreateDialogIndirectParamA

SetWindowsHookExA

UnhookWindowsHookEx

EnumChildWindows

InternetOpenUrlA

d4x7V.aCz

/IE.BsCr0S(@S

Keyu

1, 0, 6, 6

- Skin.dll

!"#$%&'()* ,-

25, 0, 0, 1

Windows

CCaptchaRecognizer::recognizeByCodeTypeAndUrl

hXXp://s1.uudati.com:

hXXp://s1.taskok.com:

hXXp://s1.uudama.com:

hXXp://s1.uuwise.com:

/Api/config.aspx

2.0.0.4

WiseClientAPI-2.0.0.4

CCaptchaRecognizer::__UpdateTKEY

CCaptchaRecognizer::_IsNeedLogin

/Api/DecodeImg.aspx

xxxxxxxxxxx

hXXp://p1.uuwise.net:

hXXp://p1.uudama.net:

hXXp://p1.taskok.com:

hXXp://p1.uuwise.com:

hXXp://p1.uudama.com:

CCaptchaRecognizer::easyRecognizeUrl

%d%d%d%d%d

CCaptchaRecognizer::_CalcRandomPort

/Api/VerifyAPIFile.aspx

/Api/UserLogin.aspx

CCaptchaRecognizer::login

/Api/UserReg.aspx

/Api/PayCard.aspx

/Api/ReportError.aspx

CCaptchaRecognizer::reportError

/Api/UserPoint.aspx

|2.0.0.4|

/Api/DecodeResult.aspx

ID/KEY/

ByTypeBytes.JPG

%d-%d-%d

CHttpRequestHelper::_ReadResponse

User-Agent:WiseClient-2.0.0.4;

WiseClient-2.0.0.4

CHttpRequestHelper::_InternalRequest

CHttpRequestHelper::RequestGetImage

CHttpRequestHelper::RequestPost

ServerPort

UUExtConfig.ini

-:-:-.%d

tCRYPTDLL.DLL

3.cn.pool.ntp.org

2.cn.pool.ntp.org

1.cn.pool.ntp.org

0.cn.pool.ntp.org

cn.pool.ntp.org

\\.\PHYSICALDRIVE0

Microsoft Windows Millennium Edition

Microsoft Windows 98

Microsoft Windows 95

%s (Build %d)

Service Pack 6a (Build %d)

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

Web Edition

Service Pack %d (Build %d)

Microsoft Windows NT

Microsoft Windows 2000

Microsoft Windows XP

Microsoft Windows Server 2003,

Microsoft Windows XP Professional x64 Edition

Microsoft Windows Server 2003 "R2"

Windows Server 2008

Windows Vista

Windows Server 2008 R2

Windows 7

ox-x-x-x-x-x

\Tencent\Users\*.*

nKERNEL32.DLL

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

!"#$%&'()* ,-.

uuwise.com

2, 0, 0, 4

1.0.0.1

%original file name%.exe_560_rwx_10028000_00015000:

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ð<

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$<#$#=

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\rec_subtract[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\home[2].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\plugin[1].php (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lxqq[1].htm (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\noavatar_small[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\thread-17831-1-1[1].html (2000 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sync[1].htm (893 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common[1].js (942 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\base[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\background[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[1].png (637 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common[2].js (3375 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\online_member[1].gif (365 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\plugin[1].htm (76 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery_a4373ccd[1].js (4721 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].js (2680 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA3X5JIE.htm (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\seditor[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\userinfo[1].gif (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\arrow_top[1].gif (51 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\noavatar_middle[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\0f000Q2KxFhCznBO83poas[1].swf (5573 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\arw_l[1].gif (844 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\portal[2].js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\search[1].png (1 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (20248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA45Q97G.htm (7757 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ls_flowbar[1].js (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\medal3[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\06_avatar_middle[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cpro[2].js (1677 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rec_add[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\forumlink[1].gif (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ad[1].gif (997 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\forum_viewthread[2].js (2322 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fav[1].gif (596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\medal1[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\fill_bg[1].jpg (9184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CALSSVD5 (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ls[1].js (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\nosexbg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fastreply[1].gif (608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bd-logo5[1].png (1545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAPGZYR7.htm (3346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qq_share[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\adx[1].gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logging[1].js (274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\nv_a[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA5O2T9R.gif (49 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (439 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\discuz_tips[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qshare[2].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rt[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA892BC9 (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pmto[1].gif (152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\portal[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\seditor[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].php (2784 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (3377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico_jdt[1].png (849 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style_28_forum_viewthread[2].css (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[2].css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\arrow_left_50_ie6_9158e720[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\midavt_shadow[1].gif (79 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\noavatar_middle[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pengyou[1].png (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\arw_r[1].gif (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\25_avatar_middle[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[1].png (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\oshr[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\discuz_tips[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\gpixel[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sync2r[1].htm (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\weibo[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style_28_forum_viewthread[1].css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style_28_common[1].css (654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sync[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style_28_common[2].css (1782 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hot_1[1].gif (680 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qshare[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\arw[1].gif (940 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\forum[2].js (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\arrow_left_60_e700a3bb[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\51_avatar_middle[1].jpg (1617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\post[1].htm (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fj_btn[1].png (217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAAZCTO9.htm (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\core[1].php (762 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (205 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (746 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c[2].js (3108 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\newarow[1].gif (327 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\share_btn[1].png (476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\collection[1].png (1 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (3930 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\qzone[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\0f000Dlh0nJS1Y3OYHhQp0[1].swf (5498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cpro[1].js (521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[2].js (3324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pn_post[1].png (569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\editor[1].gif (2244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAKDUF4R.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pt_item[1].png (569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic[1].gif (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c[1].js (2200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\noavatar_middle[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\qq_login[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\icon[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\nv[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\thread-prev[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\thread-next[1].png (999 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pn[1].png (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\flw_ico[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qmenu[1].png (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qfcode[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\forum_viewthread[1].js (1106 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[2].txt (441 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\medal2[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logging[2].js (390 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\print[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\home[1].php (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[1].css (934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\forum[1].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\uf[1].js (9631 bytes)
C:\dc.dll (122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo-border-light[1].png (473 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sync_pos[1].htm (1596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\arrwd[1].gif (51 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\scrolltop[1].png (1 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.