MD5: d9018d11d0df65cf544a80d75f92df26
SHA1: e37260c6da85df40d021835a33c83facd18c0d8f
SHA256: ecdf8c67f187c58f67d34ddb60bea1cb1f4443c9862b3db9a1a60cc723d4cd10
SSDeep: 12288:dY20AljdZgBPfKfYn45R2Vyl0ZhGGIctH3yRkEk H4H8hcVO:y20gPgFKAnFVjf7HCRkcYH8hL
Size: 653069 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: KLWUT
Created at: 2014-12-02 12:07:30
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

mkra.exe:188
windowsten.exe:1772
AVTO.exe:1752
%original file name%.exe:860
gamest0rage.exe:228

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process AVTO.exe:1752 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AVTOVISTREL.exe (238276 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M3XRF1PW\AVTOVISTREL[1].exe (123588 bytes)

The process %original file name%.exe:860 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gamest0rage.exe (5431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AVTO.exe (5105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mkra.exe (5431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\windowsten.exe (5431 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\__tmp_rar_sfx_access_check_466750 (0 bytes)

The process gamest0rage.exe:228 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1090EJ2L\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z8CRBF4X\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M3XRF1PW\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YPP4GHMZ\desktop.ini (67 bytes)

Registry activity

The process mkra.exe:188 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 FF 44 DE EA 65 F4 12 8B 51 45 F6 5D C5 3A EA"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process windowsten.exe:1772 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 35 70 D3 64 6E 1B DC DA 74 ED 71 14 AF C1 1E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process AVTO.exe:1752 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "06 A1 23 10 50 4F 8C 16 D8 34 5E 2E B9 79 8B 7F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"AVTOVISTREL.exe" = "AVTOVISTREL"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:860 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 BA 68 AA E6 3A 22 50 6A 76 E8 2B DA EE 06 7E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"windowsten.exe" = "windowsten"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"mkra.exe" = "mkra"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"AVTO.exe" = "AVTO"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\WinRAR SFX]
"C%%DOCUME~1­m%LOCALS~1%Temp" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"gamest0rage.exe" = "gamest0rage"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process gamest0rage.exe:228 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 E3 A8 FA 07 F6 60 1A D5 50 8A 63 B5 39 49 02"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3
b58cfb8c866c11d5e800e4cdac49abb8
f4885968bd7ffb4ae7c6efa0b2b3a868
c287dff6a0bfd949e6f47cdb16b918af

URLs

URL	IP
hxxp://windowsten.su/	37.140.192.32
hxxp://www.iammaddog.ru/mywork/AVTOVISTREL.exe	83.243.73.222
hxxp://windowsten.su/wp-content/themes/mesocolumn/style.css	37.140.192.32
hxxp://windowsten.su/wp-content/themes/mesocolumn/lib/scripts/superfish-menu/css/superfish.css?ver=10.5.6	37.140.192.32
hxxp://windowsten.su/wp-content/themes/mesocolumn/lib/scripts/tabber/tabber.css?ver=10.5.6	37.140.192.32
hxxp://windowsten.su/wp-content/themes/mesocolumn/lib/scripts/fontawesome/css/font-awesome.css?ver=10.5.6	37.140.192.32
hxxp://windowsten.su/wp-content/themes/mesocolumn/lib/scripts/fontawesome/css/font-awesome-ie7.css?ver=10.5.6	37.140.192.32
hxxp://googleadapis.l.google.com/css?family=Open Sans:400,400italic,600,600italic,700,700italic,300,300italic&ver=4.1.8
hxxp://windowsten.su/wp-includes/js/jquery/jquery.js?ver=1.11.1	37.140.192.32
hxxp://windowsten.su/wp-content/themes/mesocolumn/lib/scripts/fontawesome/font/fontawesome-webfont.eot?	37.140.192.32
hxxp://gstaticadssl.l.google.com/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE.eot
hxxp://windowsten.su/engine/classes/js/jquery.js	37.140.192.32
hxxp://windowsten.su/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1	37.140.192.32
hxxp://googlecode.l.googleusercontent.com/svn/trunk/html5.js?ver=10.5.6
hxxp://windowsten.su/engine/classes/js/jqueryui.js	37.140.192.32
hxxp://windowsten.su/index.html	37.140.192.32
hxxp://windowsten.su/engine/classes/js/dle_js.js	37.140.192.32
hxxp://windowsten.su/engine/classes/highslide/highslide.js	37.140.192.32
hxxp://windowsten.su/style/css/bootstrap.min.css	37.140.192.32
hxxp://windowsten.su/wp-content/plugins/generalstats/vendor/jshashtable/hashtable.js?ver=3.0	37.140.192.32
hxxp://windowsten.su/style/css/styles.css	37.140.192.32
hxxp://windowsten.su/style/css/rgba-fallback.css	37.140.192.32
hxxp://windowsten.su/style/js/html5shiv.js	37.140.192.32
hxxp://windowsten.su/style/fonts/glyphicons-halflings-regulard41d.eot?	37.140.192.32
hxxp://windowsten.su/wp-content/plugins/generalstats/js/refresh.js?ver=3.20	37.140.192.32
hxxp://googleapis.l.google.com/ajax/libs/webfont/1/webfont.js
hxxp://windowsten.su/style/js/respond.min.js	37.140.192.32
hxxp://windowsten.su/wp-content/uploads/2015/09/1e214f20f9cca2943fdcb3954f1e14a8.jpg	37.140.192.32
hxxp://windowsten.su/wp-content/uploads/2015/09/a20aa272156d62a57edefdd48da62f48.jpg	37.140.192.32
hxxp://windowsten.su/wp-content/uploads/2015/09/ada9a46040f3022a8488c48b974afda0.jpg	37.140.192.32
hxxp://windowsten.su/engine/editor/scripts/webfont.js	37.140.192.32
hxxp://windowsten.su/wp-content/uploads/2015/08/dakota-fanning-dakota-fanning-6727.jpg	37.140.192.32
hxxp://windowsten.su/style/bg/blurred-background-1.jpg	37.140.192.32
hxxp://pagead46.l.doubleclick.net/pagead/js/adsbygoogle.js
hxxp://windowsten.su/wp-content/uploads/2015/09/4192eab47979fb89f376c7641263ceb6.jpg	37.140.192.32
hxxp://windowsten.su/engine/editor/css/default.css	37.140.192.32
hxxp://windowsten.su/wp-content/uploads/2015/09/4bd07d7f0ead211d9bf4f4e05b0ce5a4.jpg	37.140.192.32
hxxp://j.contema.ru/Contema.js	89.249.21.7
hxxp://windowsten.su/templates/torrent-windows/style/engine.css	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/style/styles.css	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/js/scripts.js	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/websymbols/websymbols-regular-webfont.eot?	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/js/slider.js	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/spacer.gif	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/header_h_bg.png	37.140.192.32
hxxp://windowsten.su/style/images/webmoney.png	37.140.192.32
hxxp://windowsten.su/style/images/warface.png	37.140.192.32
hxxp://j.contema.ru/get.ashx?cid=5209&format=block&items=3&width=300&height=500&ilogo=1&font_family=arial&link_color=2063e8&border=1&border_color=141bf7	89.249.21.7
hxxp://informers.sinoptik.ua/informers_js.php?title=4&wind=2&cities=100524901&lang=ru	212.42.76.150
hxxp://informers.sinoptik.ua/img/t.gif	212.42.76.150
hxxp://windowsten.su/templates/torrent-windows/images/sep_15.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/sep_24.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/logo_bg.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/sep_25.png	37.140.192.32
hxxp://counter.yadro.ru/hit?t57.11;r;s1276*846*32;uhttp://gamest0rage.ru/index.html;0.25825136608109023	88.212.196.104
hxxp://s019.radikal.ru/i640/1508/b0/729c4064319d.png	81.176.238.131
hxxp://s020.radikal.ru/i701/1505/be/f4528c2cfd19.png	81.176.238.163
hxxp://s019.radikal.ru/i615/1505/80/0cc3a7c6f208.png	81.176.238.131
hxxp://s011.radikal.ru/i318/1508/5c/fa3c206624a1.png	81.176.238.129
hxxp://s017.radikal.ru/i422/1508/15/de18c106edda.png	81.176.238.140
hxxp://s017.radikal.ru/i443/1505/45/cc7ce6aea5ef.png	81.176.238.140
hxxp://s020.radikal.ru/i712/1508/f7/cd706a18ba56.png	81.176.238.163
hxxp://windowsten.su/style/images/crossfire.png	37.140.192.32
hxxp://windowsten.su/style/images/steam.png	37.140.192.32
hxxp://s011.radikal.ru/i309/1508/6a/58a5f3409156.png	81.176.238.129
hxxp://counter.yadro.ru/hit?q;t57.11;r;s1276*846*32;uhttp://gamest0rage.ru/index.html;0.25825136608109023	88.212.196.104
hxxp://windowsten.su/style/images/other.png	37.140.192.32
hxxp://s011.radikal.ru/i304/1508/ac/e4d1dcc22d86.png	81.176.238.129
hxxp://informers.sinoptik.ua/img/informers/logo-t2.png	212.42.76.150
hxxp://windowsten.su/engine/data/emoticons/lol.gif	37.140.192.32
hxxp://informers.sinoptik.ua/img/informers/hlc-t2.png	212.42.76.150
hxxp://windowsten.su/engine/data/emoticons/bully.gif	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/arrow_13.png	37.140.192.32
hxxp://informers.sinoptik.ua/img/informers/s-informers-t2.png	212.42.76.150
hxxp://informers.sinoptik.ua/img/informers/term-t2.png	212.42.76.150
hxxp://windowsten.su/engine/skins/default.js	37.140.192.32
hxxp://informers.sinoptik.ua/img/informers/flc-t1.png	212.42.76.150
hxxp://windowsten.su/templates/torrent-windows/images/arrow_15.png	37.140.192.32
hxxp://informers.sinoptik.ua/img/informers/frc-t1.png	212.42.76.150
hxxp://windowsten.su/style/js/easypiechart-data.js	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/block_comm.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/sep_21.png	37.140.192.32
hxxp://windowsten.su/wp-includes/js/hoverIntent.min.js?ver=r7	37.140.192.32
hxxp://counter.yadro.ru/hit?t58.10;r;s1276*846*32;uhttp://mkra.ru/;0.990526831055492	88.212.196.104
hxxp://j.contema.ru/agcb.css	89.249.21.7
hxxp://counter.yadro.ru/hit?q;t58.10;r;s1276*846*32;uhttp://mkra.ru/;0.990526831055492	88.212.196.104
hxxp://j.contema.ru/getimage.ashx?imgfolder=72733171-0542-43d6-871b-3d3f96c5af37&id=31&extension=1&adv=banner	89.249.21.7
hxxp://windowsten.su/templates/torrent-windows/images/usr.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/sep_14.png	37.140.192.32
hxxp://windowsten.su/style/js/bootstrap-datepicker.js	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/ico.png	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-08/thumbs/1440585354_1440520435_0_11e929_4957bdf0_orig.jpeg	37.140.192.32
hxxp://windowsten.su/wp-content/themes/mesocolumn/lib/scripts/modernizr/modernizr.js?ver=10.5.6	37.140.192.32
hxxp://windowsten.su/style/js/custom.js	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1442251471_1442249429_6844934.jpg	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1441381750_1441302355_0_11e929_4957bdf0_orig.jpeg	37.140.192.32
hxxp://counter.yadro.ru/hit?t22.7;r;s1276*846*32;uhttp://windowsten.su/;0.5596613285630375	88.212.196.104
hxxp://bs.yandex.ru/informer/27094649/3_1_20B8CDFF_0098ADFF_0_pageviews	93.158.134.90
hxxp://windowsten.su/uploads/posts/2015-08/thumbs/1440853024_1440769987_blue-wallpaper_windows_10_hd_2880x1800.jpg	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-08/thumbs/1440090822_1439933104_microsoft-reveals-the-official-windows-10-wallpaper-485311-4.jpg	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/bar-bg.png	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1441533569_1441388150_goj269d.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/bar-blue.png	37.140.192.32
hxxp://j.contema.ru/img/ilogo3.png	89.249.21.7
hxxp://windowsten.su/uploads/posts/2015-08/thumbs/1440090926_1439919959_windows-10-update-10525.jpg	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/link_bg.png	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-08/thumbs/1440768500_1440712240_edge-logo-full-02_story.jpg	37.140.192.32
hxxp://windowsten.su/wp-content/themes/mesocolumn/lib/scripts/tabber/tabber.js?ver=10.5.6	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-08/thumbs/1440768374_1440707035_1_win10fulldesktop1-780x445.png	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-08/thumbs/1440853310_1440774442_01-xao3kkc.jpg	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1442334318_1442251094_357557_original.jpg	37.140.192.32
hxxp://148.251.81.141/topick?uid_zxcv=258cc02055fa2da7a95b1963030c8402
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1442334267_1442245312_vp9-microsoft-edge.png	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1442238138_1442229256_co2gmaqwsaaiwoq.png	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1442238241_1442230719_co1pj_dueael5ln.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/user.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/comm.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/view.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/sep_13.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/sep.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/arrow_3.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/arrow_2.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/short_img.png	37.140.192.32
hxxp://148.251.81.141/topick?uid_zxcv=258cc02055fa2da69df618df030d1302
hxxp://mc.yandex.ru/metrika/watch.js	87.250.250.119
hxxp://windowsten.su/templates/torrent-windows/images/arrow_6.png	37.140.192.32
hxxp://sync.security.pp.regruhosting.ru/topick?uid_zxcv=258cc02055fa2da7a95b1963030c8402
hxxp://mkra.ru/wp-content/uploads/2015/09/ada9a46040f3022a8488c48b974afda0.jpg	37.140.192.32
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/custom.js?ver=10.5.6	37.140.192.32
hxxp://gamest0rage.ru/style/images/steam.png	37.140.192.32
hxxp://sinst.fwdcdn.com/img/informers/flc-t1.png	212.42.76.150
hxxp://sinst.fwdcdn.com/img/informers/term-t2.png	212.42.76.150
hxxp://gamest0rage.ru/style/images/other.png	37.140.192.32
hxxp://gamest0rage.ru/style/css/bootstrap.min.css	37.140.192.32
hxxp://gamest0rage.ru/style/css/rgba-fallback.css	37.140.192.32
hxxp://gamest0rage.ru/style/js/custom.js	37.140.192.32
hxxp://gamest0rage.ru/style/fonts/glyphicons-halflings-regulard41d.eot?	37.140.192.32
hxxp://gamest0rage.ru/style/images/warface.png	37.140.192.32
hxxp://windowsten.su/engine/data/emoticons/recourse.gif	37.140.192.32
hxxp://s008.radikal.ru/i304/1508/ac/e4d1dcc22d86.png	81.176.238.129
hxxp://gamest0rage.ru/style/js/html5shiv.js	37.140.192.32
hxxp://gamest0rage.ru/style/js/easypiechart-data.js	37.140.192.32
hxxp://fonts.gstatic.com/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE.eot	173.194.113.223
hxxp://css.contema.ru/img/ilogo3.png	89.249.21.7
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/superfish-menu/css/superfish.css?ver=10.5.6	37.140.192.32
hxxp://sinst.fwdcdn.com/img/informers/logo-t2.png	212.42.76.150
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/tabber/tabber.css?ver=10.5.6	37.140.192.32
hxxp://mkra.ru/wp-includes/js/jquery/jquery.js?ver=1.11.1	37.140.192.32
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/fontawesome/css/font-awesome-ie7.css?ver=10.5.6	37.140.192.32
hxxp://html5shiv.googlecode.com/svn/trunk/html5.js?ver=10.5.6	74.125.133.82
hxxp://mkra.ru/wp-content/uploads/2015/09/1e214f20f9cca2943fdcb3954f1e14a8.jpg	37.140.192.32
hxxp://gamest0rage.ru/style/bg/blurred-background-1.jpg	37.140.192.32
hxxp://mkra.ru/wp-content/uploads/2015/09/4192eab47979fb89f376c7641263ceb6.jpg	37.140.192.32
hxxp://mkra.ru/wp-content/plugins/generalstats/vendor/jshashtable/hashtable.js?ver=3.0	37.140.192.32
hxxp://gamest0rage.ru/style/images/webmoney.png	37.140.192.32
hxxp://mkra.ru/wp-content/plugins/generalstats/js/refresh.js?ver=3.20	37.140.192.32
hxxp://css.contema.ru/agcb.css	89.249.21.7
hxxp://gamest0rage.ru/style/js/respond.min.js	37.140.192.32
hxxp://sinoptik.com.ru/informers_js.php?title=4&wind=2&cities=100524901&lang=ru	212.42.76.150
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/tabber/tabber.js?ver=10.5.6	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/all_votes_bg.png	37.140.192.32
hxxp://mkra.ru/wp-content/uploads/2015/08/dakota-fanning-dakota-fanning-6727.jpg	37.140.192.32
hxxp://gamest0rage.ru/style/css/styles.css	37.140.192.32
hxxp://s009.radikal.ru/i309/1508/6a/58a5f3409156.png	81.176.238.129
hxxp://mkra.ru/wp-content/themes/mesocolumn/style.css	37.140.192.32
hxxp://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js	216.58.209.202
hxxp://mkra.ru/wp-includes/js/hoverIntent.min.js?ver=r7	37.140.192.32
hxxp://sinst.fwdcdn.com/img/informers/s-informers-t2.png	212.42.76.150
hxxp://sinst.fwdcdn.com/img/informers/hlc-t2.png	212.42.76.150
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/fontawesome/font/fontawesome-webfont.eot?	37.140.192.32
hxxp://gamest0rage.ru/style/js/easypiechart.js	37.140.192.32
hxxp://mkra.ru/	37.140.192.32
hxxp://fonts.googleapis.com/css?family=Open Sans:400,400italic,600,600italic,700,700italic,300,300italic&ver=4.1.8	74.125.71.95
hxxp://img.contema.ru/getimage.ashx?imgfolder=72733171-0542-43d6-871b-3d3f96c5af37&id=31&extension=1&adv=banner	89.249.21.7
hxxp://mkra.ru/wp-content/uploads/2015/09/4bd07d7f0ead211d9bf4f4e05b0ce5a4.jpg	37.140.192.32
hxxp://sync.security.pp.regruhosting.ru/topick?uid_zxcv=258cc02055fa2da69df618df030d1302
hxxp://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js	173.194.113.217
hxxp://sinst.fwdcdn.com/img/informers/frc-t1.png	212.42.76.150
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/modernizr/modernizr.js?ver=10.5.6	37.140.192.32
hxxp://gamest0rage.ru/style/js/bootstrap-datepicker.js	37.140.192.32
hxxp://gamest0rage.ru/style/images/crossfire.png	37.140.192.32
hxxp://mkra.ru/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1442334487_1442257655_ceaokoxueaidjte.jpg-large.jpg	37.140.192.32
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/fontawesome/css/font-awesome.css?ver=10.5.6	37.140.192.32
hxxp://mkra.ru/wp-content/uploads/2015/09/a20aa272156d62a57edefdd48da62f48.jpg	37.140.192.32
hxxp://gamest0rage.ru/index.html	37.140.192.32
tpc.googlesyndication.com	216.58.209.161
encrypted-tbn1.gstatic.com	173.194.113.192
www.gstatic.com	173.194.113.207
www.megapol.ru	89.249.18.99
www.youtube.com	173.194.113.194
static.doubleclick.net	173.194.113.220
acg.contema.ru	89.249.21.7
www.google.com	173.194.113.210
img2.goodfon.ru

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
SURICATA STREAM ESTABLISHED packet out of window
SURICATA STREAM Packet with invalid ack
SURICATA STREAM ESTABLISHED invalid ack
SURICATA STREAM SHUTDOWN RST invalid ack

Traffic

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:06 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.28

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; path=/; domain=.windowsten.su; HttpOnly

Set-Cookie: dle_user_id=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.windowsten.su; httponly

Set-Cookie: dle_password=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.windowsten.su; httponly

Set-Cookie: dle_hash=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.windowsten.su; httponly

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da69df618df030d1302; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip
2a5d.............}{[email protected].....)......{
....(..cG....L....d....Ij2IJ.hO7@.$!.E=.....F?N.>....&............9
ijh......'.u...y..Q....5E.....Ky....4..xV....(..U...3.,(3...C...P.....
..J.r.E..F..4..{?..Z..@.[..&.V~.....IF.ZJ.......{j.....2_.k..*f....J.Q
..;...rT>.K3.*h...... [email protected].{....d.t}../....a.j.jc..............
....k...Mc........I..o........sF..s6...j..f...Z...x....).l.\..e4....Z/
..gw.&g;...`[email protected].....:...6.....Dd...8
...q&.. ..Q..9S....Vw.3..g..X.][email protected]}..v...5jAk..H.q* .)^By..E<.
...X.[.....QR.I n.....r.\.l...{..K....U..<..._...v.....%<...ci2X
.*...05.y..%.1.!gD...bv.^. aV.3.G-.Z.I.<.T,M2...T.A:X.I...%.-1.^%.e
...d.=....Uqz..k.iYc.V.b....'..C..........J^..*.:v#T.4..#7...P..VJ...o
7M.....[.....$..xJ.5.k.;......<w4fj.ke>a].q0..@$.h..  f..$......
.....g=.E.H....'..h.W...w.'. .^.....cA....j.UH./.yyP........zR.......{
.7...>[...$.e1.{t0..z..#1....q./..k^.....z.....4_$.<........DY.k
...d-Y.;tK......I...8...^".jW.C.^.z....H*B...$.N....A,"Q.....,c...Q..d
fT0pXu...aW`.X$... 3-.V...S.LN2..:.2.....g..'.h..W...(..M.dEA .kcg.AE^
*.....XH $-...".?v].M......z. [email protected]./..xp... ENJ.u...#z.L.Ufrx
x.9....1<NjI ...[M.r.-.j.R...g%..=;.D}.q....R7....~[UR;p....B..)...
.vmw.K$.K.. qt..z..Kr.iI.a.r...in.'.-QM..............h..a..z../M......
$...wC]....f..:)X..`..<....Z9v.:.......f.,m...O.W .h. [..fe..f.`.\.
..F3D.O.....gx.....f>..........=.v{.Z...k.;.j...S.,....kS.!.=9.....
.G....)).......nE $.F..z7=..v....t...d......*@..Q.G.Gl.G.i..r...1.
<<< skipped >>>

GET /engine/classes/js/jquery.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/javascript

Last-Modified: Sun, 09 Aug 2015 14:38:56 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55c76600-176bb"

X-Powered-By: PleskLin

Content-Encoding: gzip
81ee..............iw...........w.E...{.P..-...O.....{...IL.@Q4.....]CW
...s.......=T..kO.............7..p..vv8.....`......../.w.,....8.j.....
-.......H...?{z.....*E9?.I.....<.{R..6.zz.\gw...=........]T..q?[.w.
|.....3..........H..o..g......v..==.m~{Wl..Y|v_.2*s_..tg....6..mWg.Jp.
......i..3.c.....O...;Q...x{...Dd2..0C"..t.J......n7.3..:...O.\>.E!
.....~[.f..n.........&......-.....KYmW..._.. ......X.._.W.../>.....
..&.C....L....rw~!6...._e.....bV............x...q........kL.|T....M.n.
.K..m...|[email protected]...............}...........e...8.........$
.V..x....J.X..F............K....o.g..............(.8...S.....$..-.M.(.
J.i...o.*.&"..c5Xz.J...a.e.k.g.x.Y<..mg.Ov.`Zlw.S......,.w.9.R...e.
......=.....;..~..r..&.i4..N'.p<A....(........i...bGh(..L?b....;..%
"<..v$.8}...!.b..g".S..v"....@;[email protected].....^
/...;;...b....,8......Z....f.p........P..V.....R.._.Y.:..X....V*...#e.
.u..A.?,.b...(.5.]U.x... ....O.%..w...8.b.dh..u.[.2..f..k.d.4|........
....f....DhbB..&.^._.........~....f....q.........=....3.9.M...D(..^.7.
0.......=......u.j.....L...RA.7...RT.4..vcI4WQ7|..-..H[>.. E..o....
b...8.!mKT..r..Pk...... ).t.C.J...Y.........;.h....Zg.k.U...N......p..
......B.....^..q?(.........W.t$.O..bezB......o.Q..i8.}H.w... ...M....Q
..S.K ..=.........y.....<..........$^|.&^...MK._..Y..m..v[..J..f.@ 
..7..3...(.x./.S..%..r-<bW.r.n.-o.,..jh'.......^.#....02.......".8$
...@^.w.$6=.3e.u.<b.G..|. ..Q.......g@..$..$.<.9..b..M....~q.-5.
.0...c... ....X.wA..... Wj.<...&..|..M.=...........a.R...wv...^
<<< skipped >>>

GET /engine/classes/js/jqueryui.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/javascript

Last-Modified: Sun, 09 Aug 2015 14:38:56 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55c76600-16ac9"

X-Powered-By: PleskLin

Content-Encoding: gzip
651c..............iw...(...........H.O.`.K..c..A..O.K!ZM.Av.v#=.R.....
.}5.....#.k.%..<..i..:=9>............G7...G.......p2.>~..'GWU
..OO..O,X..E~......^&ex..#.)..?J.}.o>...UEM.N...l.Wi.....(....h.gU.
^.U^.....E......Wo.NN.._...k......:J.Jd..&.....\.Q5..e.C|......6)..e..
."..".."..(..._@..|g..PE.Q1...8.FWE........i.8...x...'..G......u.@b.;o
..........8..... .B.4.6u. .u..vU.....`[email protected]....:Y.....\.
f..[.{.......%.......u....&-Sh..<zt....K?..6.I. ....r[.-Jh.*-.GM...
...0$.*]......u.]VW{..,..":.{......r...i....?..v?MW>........{....$[
R.....#.../....!...g..........$..........$^........../~........./.'_..
./..'O..7...~.>.O.......|%.{........~........x.N..........]8..u...~
..%.LT.l}.'......}....A.W*..._........g.....|Oc|.G...u...x...W?...<
.?...oa`..<.'...g_...X.O.} ..*S..}...u.R.............&.WG..^V__$.7.
..%....}:Y.fM..z.^'y]......;?...G.h.........Bj..6.7..G.........\.(...5
Ac....j..HI.G.N...........$.<............`.;./.|]W..b...h....p..~w.
..*..,.0..b.......x.].s...:...AW..c_..h.._.O...~........:.....c.Y./.T.
2`&{..W.2.`.....F.....$.&...P.....U...%[email protected]...,.."
.S...v...B}...`[F..e.*....f &cj.8-....KD...XM....?.....2y..u...}...h..
.Sb...|. .. {... ...."......-....K../q0...UU.t.... |.Q;..s/[email protected]..
bX%...^...4..!t6tp..q2.V....`!....U.....9...)$.aG?.l..JF1N..^._.......
..U..aW. ..^...........#...uk..JC.."_~..p2.]ai..P/......\'..{....:.F.j
......3.1...>....N3...;.o.X].O......e.].cq.....K....1mrYo6yQ.t.....
.h.*........<.>.4;.M..$'.. .5....@..,.h........H.!..`...n.0.
<<< skipped >>>

GET /engine/classes/js/dle_js.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/javascript

Last-Modified: Sun, 09 Aug 2015 14:38:56 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55c76600-60eb"

X-Powered-By: PleskLin

Content-Encoding: gzip
17f8.............<kw..... d.W" ...8mD.>i...n.d.....G.$A.1E.$e.u.
.w..I.".p....6...7f....i.s..u....4....8...q.<(...u..A......h.p..k.f
{..^.(7.,..2.........G..t5'CG7<.5...........&..|mrl...p..;. )..a..c
....L...4.....?sM&....E.|i...X...*/.K..G. &..0........v......_....^..^
...;z.....Pv.....q...t.%....)..idm.....0c=...u....&....4..7...j.0.r.[o
....1l0Zh.~.m&q.k8k.....|....w.....L..1."v...o....xJ..e7,.2....gWA4.q.
..(.A...O..j.j. h9..G........^.s.t<...w_k.2.ts........._E.Z..?.....
......V.A.B...3 .c.% ....`.4...d..i...7.g........R..|....8;...o3..g...
H*.:..m.....<M.....2.sMG.>...t..!....3YgK...#..,6[....X..1S...e.
..]..Y....x6...!..H/.oC8.^.A..i.G."g..ly6....dH%(..<.g...W...!..6..
e..w......[..M....c...Y....2.=m.[...,..y.=....p.n.,.o.$a.'....p.s&...X
)[email protected].<E2.?...5...1..Q/;.2..P.9......r.z.......V....
...".,.r.]..H.h..W.4.....&..%z........sX....vu1..M...r............l..-
.......).m...$.......Q.....f....y...!E..i......itE..CgHf'...h.u......A
.U....*[email protected]..%].........c.*H......~.c.....3z....9..................
.f.........|N.%{4..n.G... ....K.0.X..-L.!we /5<w872Q~.2..4..b.[....
[email protected]."..~.B......Qy..8...guJXXx|3w.9...J.Y...m..$.S..[T`g...!..&Y;
...-.Q.F>p.f#,.h..9.1l.MF......}.GU..[ms....)N........&H..0QXlH.Cw.
x#...".?....,E".A.....&7...:...#.....$...n.g...tw....._......%.U).G..'
.&..h.(..0.98.4.A...q.......z.P.....<.......P......{....mW..T.D..\.
..W 1.........;PB..qZ)#..PQ:[email protected]$\...B...p..../.....'...a."G.....
..z.B....|!=?x.<.....7.z!.s.q.x.r......zK.,.y....."...7.}...g..
<<< skipped >>>

GET /engine/classes/highslide/highslide.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/javascript

Last-Modified: Sun, 09 Aug 2015 14:38:54 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55c765fe-b7b0"

X-Powered-By: PleskLin

Content-Encoding: gzip
38e7.............}kw....w...7U..|)v.....'.}.]gb....t.E..E..d...i..|..c
......r.....y?........n......:......bY..,......k. ..:.>........h<
;..G...=...Y...T..y|......_m..X/..%4....|]....z.T.....w{.I...v{.MYT..V
.U.x..P.s..n7..{...Znv.......b.}......_P.s?.l.`.....,.$...zXr..z[.....
J.......S...e....w.e.....".O...b..8..YU;..3...U...?....(.U.8....n....:
.W.?..7e=3......n.....j...6^g.$.`.8.n.U.,..w......................KsK/
..K].[...[........:.....aG?......r.5|s....._o>....~A7.M).^.O."....n
^.0.].S.9?.......O.%...&t5...6N.$.AS..F..#..).".>Q..&*......vPv.. O
L.K..e.....i.8....F..8.C#7.I...7........y.w....f.7......>|`*BB...`.
.A./P..r....|...X.....9..].].).s..S0..C..i..nv%.8._..u...7;5>3ksSq.
...f....x1.....x.(.oa1...............6U......Yg..........Fcy......>
...~....... .b.......]...|...X..[....5,g.u...#2>T..z?..y.|.p.}.. ..
 .j......Q...Iht...^...}..W|.p......sX.............H....j.....U._..m..
p.K.S......Qx.L............Yq}m..LP...,.b]'..6..l.X...F.s..9..O..`...u
N[.....x1...9.7~.f}...S..0j...q..S..6.~.......W..P1 ..fU._^f.g8.qYF...
2.yyy.zy.*.E..."qw...9..t <x.s.,.....J8BY.....l8g..!e^.c...8.-.....
h..;.........R...3.H......;S....$%O.....])$..JR..u........k....M...;..
...$..t.}*...n..b.....G..3.^...,.n...Nz.tv.(...u.1t.#t.*..~......s...b
ko2..G)....x...=.......T.....M..oYA.P....R."....eB.J...........D].[ ..
|..w.1oW...Bo...N$.w"....@ .{U<..v..m7.K......<..|......u..vUT..
u<.!.<.V.I..h.......@^...yM....{.....U./....=...8.....^.Y..O.q..
X.[gv.&.. .?...c..o.R........(..e.)..j#~m.?A.{,w.K)d...r].2|..`4.T
<<< skipped >>>

GET /engine/editor/scripts/webfont.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/javascript

Last-Modified: Sun, 09 Aug 2015 14:39:08 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55c7660c-bcb"

X-Powered-By: PleskLin

Content-Encoding: gzip
424.............V.O.8.....X'HDI.^.........eW.....L.w.;..........I.....
..o...3i.cM.GsA...u....RPV....!.vH.d.0...........l{.T.........<8;..
N...`a.E.x.^3!2.....QP....s.'.F4.....1....:[email protected]
D"".c.,Y..z..(I.....8W.1....,Q.\...b..2....M.....&.)...8.E.Uh..qxA..rK
".....-^...dB.7 ..di\Cc...r.q....s.3....p.Z...s..P.Z%)H.}......u.3"I!x
..k.H..~...n"F.%H...lL.c.l....?O.t.?.....WN.<#O6.MD\.&qQ{.f..). ...
.0...3hu..o.[..n.G%.g...Q....p.U_N........O...6......p."...6..>.T{.
T..*S..a..pshd"...|J.G.....V........}.$.......g#..-w.G..QpCi1.z[.]..#-
i.8.....1d.....Z5...L.?IIjo1.b.^@^..A8.. D....}...}j|4.}....:h;..C.:hq
.x{[t.....)._5e...x.)......b9...}.P-.......o.`EX.ire|...y.v...n...H.AN
V4#..).{R..h.?.....X.%RmB>.M^..&.. .D.7.q....k.`....~e._.....M .<
;.....tw;..........#..x.j... .[....]6.]v........GG.:g._o...A.w.....{..
...v.-..H.btz.v.~..b4.e..?l..bQ..........0.....f....q9.j......>,.[.
....E...x......5[.>...{{.....1.o..>.L.~.l...k]N..>*.. )..L...
R..R3...>7.......lg/....'{..|-c3O44.Z........nU.\Bj.bb..J`....s.s..
../..8.,.7-..><.I.<......;.......4......m......0......


GET /engine/editor/css/default.css HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/css

Last-Modified: Sun, 09 Aug 2015 14:39:07 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55c7660b-24f6"

X-Powered-By: PleskLin

Content-Encoding: gzip
655.............Y[o.8.~n~...j.Q @B.P.......]i..j.o.Lb.`d.....}m..!\r.[
...s.w>..O...9A. ...3.l.........V.o./".p#.?..\.V#.c......g...O3.pt.
D.J(.......U-..9bF...'3.t\..60..>..c[k..'..#<.s..._.4mg...o..m..
 ....B..9$8...^P~$.v u..wI.&....'0x...=.(.P.UN...b..D.K.'7M;.lh..U..o.
....Ke..$.p.L5.~..9.p.\..g...{.I.0.?P..J.".......p/.!!F.....;..&.=....
..2.1M.E."&...>.Dc.vl...-..Z.....a.|GC..24cTX.._%.g5..iY......YyG..
#..B.....Al.h{i.me|.0.......P..o...3x.>[email protected]..'. ...p..S&<m....
C..77.........N.AF..oj.....`...%.w......0.q..Z.JWm..c.5.....y..b....-.
..A.......K...wm.z..... .....[. ..*.8.T)xg..M..SK"g....h.-=.#..%].....
x/.......^,..<.;..X.3.....][Bv.w-....}.\.....jSo5....lz.... ..j....
>.\ .8.3..#.?.i.2C..!F.?.S.............b..G....n... .}.V. ..A.h|^X.
.....J.......a..).3.z_...a...."qF......F.\.e.2~'[email protected] 3..;F..
....3v...]|. ...E...E-..J!....U......Wf....~..T.....d.*]..P..T.Nq.....
*UY(*...{.6.<B.*...Qf.].=.v..f...RW..[.jj.W.?.q,.....C..M....&.....
.k.lD...-..O3......A..D.P..q....~.0.3xn..|.U.......sv... .1... ..i...s
.f{x.ot...{.u....cf..Y.kf......].[.;../R.R_.(.1.....$.K.....~.`.....~.
...........h.\........GP.!h.\^[email protected]......,......p.....'
..4...q..`......>!F...&...P. 7../8N).0.7`...,....I.<|B.....{@.,`
..^.m.*. O.f..;. ...e.'''.;. _...............*.z..-4.*.O....-....F6.!]
z@5.....?.....^...x..q.j....!.....nX....nK.....s.!"...5......K)...].h.
(.Ui.e....U..e...E.z[[email protected]........;<.. ....!./..]Cz......#.~.&R]
..T..7..1. ....NwR...Y\.L..N..N...B(..U.Kc-...~hMk...Zp.!.&Sh95..,
<<< skipped >>>

GET /templates/torrent-windows/style/engine.css HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/css

Last-Modified: Sun, 09 Aug 2015 15:07:12 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55c76ca0-7a10"

X-Powered-By: PleskLin

Content-Encoding: gzip
1c11.............=k..Fr...b".JZ.....n..-.wN.....sU*...`./H..p.v..%.|H%
....hY<Q.^jW...J.;=/`...X.|.......czzzzzz...i6.;...?.".|.}..._..~..
...Nv..~v....0.G.....k...Q..}.s?Iq.........=....O~........kl7.?..q.F..
..N.c N......|`..v....~.........<.i%8.N:.....h../w..xAh..(.....-.X.
.?m....~tv..dg.E...........~8.(R|.6..z ....I/....W....w...Z-...j.....~
..b.....>c...&\.z...s.s...D.y.M.)f.y.4..~.B0M..).-..(.gSw..5...F.K0
BECT..t..8f.N..u..y^../ga......R.:}..~C.p.e..8xp..z.O.#.<.M...Gwv..
f.#l.....^t.GA...n.....h...C..=..0v1...GI....jc..J.L.....#..2P|d[.....
.5Z..nAPC....a.........o..L].-...q....7........Q...T.4..V..`"r.T..U..z
.^o@ .~...*...=.y%a&8:.ry2a6.x....4..m..}{0...k..V.7O}7..JL...lu......
s.L....(Rm..Ius...[....M...%[email protected]..>u.0.......'8...=4.].O
....k....e.]...9..QtT...'.....hJ.;V ,..Z..=`F......f..v.;.J..L..[.....
a..\....I.-(..1T.....bj...b..0.r3&})OHzt.j.a.8d...:...o.Y.Z...bO..F...
Vj..R"....s Oy.................J6.=..{.^>M.....g.k.p..\IiU.......G.
,..._..;.....\..4....][email protected]...'\N.!.J..9.F.)..n.ZR...M..E
.w..fm.......H.....F8@.>.\\=._... ..x.Z.[ay...s.....6 .4..2g....Y:o
..9........=... V...P....h.).-v...........^.I...0&u..y......L.u....9.2
.|(.......[g....j...k.L...`(.W.......q.@/W..=_=..Z\.yo...'`kYoF.......
D.?....Q.!y....I1I.r.....DT......fE.8.^.m.#.....k...d....A...Ydt1y.]@.
;,|....u..{..Mf....]z...R]l..~.Th.~m&.y....@.(...e...S...F>...Z.{J.
..l8}0.S.........B......*.D%.M..Au...!e........)...a\.R\n..uej......[.
1.'R..(..Z..$.B.6.S.SDY.h.1...C...!:e......L=D..|}U...P.. #__U.|..
<<< skipped >>>

GET /templates/torrent-windows/js/scripts.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/javascript

Last-Modified: Mon, 17 Nov 2014 17:14:56 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"546a2d10-4c9"

X-Powered-By: PleskLin

Content-Encoding: gzip
1ed.............T]o. .}[email protected]...=v...#.`........Mb'^....q.=.~.X
".5.u}...a..Vt.DkhP....S...kKI:.,Q...X.s...P...HBp.J..,....:.......z.D
....&..q.^.....2.b........7Vi.P.......m;.....DQbi_.O......N.C..5a.Q...
.\s.8.......hu$..6(..W }?....?lgP!...$.P}>.K._..o..x...A}.~w.(.`...
^....t..9l........j'C.|..>Z.#..TU...wK./z.aB ..Ik)O.... ....s.a..V.
w{......,..ZU`...}......b.}.j,....8.E.4.......{.4.....b....e.......2..
......`w;=W.6.O8...x..S.y:L.F.8....R.......&r....Y\Z........s]..:>.
....G.^..'._.......0......


GET /templates/torrent-windows/websymbols/websymbols-regular-webfont.eot? HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 403 Forbidden

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Sat, 12 Jan 2013 13:47:45 GMT

ETag: W/"1fc28b1-3ce-4d317a81ca240"

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da69df618df030d1302; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip
238............m.Ao.0.....\..$N.u..F.....-:4.........AIu..GYI...$....&
gt;.....O..x.<..o..?mVw.....A.%.b.^f..\..e..%..?..){..J..zh.;B..*..
5.-.).9..r\%C...Y.#.z.....u...._x...;.....~.\...N.cNXSh....9..u...s.yb
..O.Y..3.i*K>..Q.SxV...U..@[email protected]
#. ....-....i'.Zp..z2...T...4$.Nca...%...n....9.qI.......^9..Hn. c....
&.!x.q..;..<)y."\.L..W^6.say..g&........[..s.......2...~.. ...1L..P
b%....u.................N"46.MDh...3.Ft...c.....l`^u..Sm.. t..7:.....y
6...A.L......q<f...kx.Id...F....a.H,.......bh.Qmh../.9...&<....}
..l.atBQ..=........l....He\......0..HTTP/1.1 403 Forbidden..Server: ng
inx..Date: Thu, 17 Sep 2015 03:04:08 GMT..Content-Type: text/html..Tra
nsfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding
..Last-Modified: Sat, 12 Jan 2013 13:47:45 GMT..ETag: W/"1fc28b1-3ce-4
d317a81ca240"..X-Powered-By: PleskLin..Set-Cookie: uid_zxcv=258cc02055
fa2da69df618df030d1302; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/..C
ontent-Encoding: gzip..238............m.Ao.0.....\..$N.u..F.....-:4...
......AIu..GYI...$....>.....O..x.<..o..?mVw.....A.%.b.^f..\..e..
%..?..){..J..zh.;B..*..5.-.).9..r\%C...Y.#.z.....u...._x...;.....~.\..
.N.cNXSh....9..u...s.yb..O.Y..3.i*K>..Q.SxV...U..@[email protected]
..5.........r.V......VI#. ....-....i'.Zp..z2...T...4$.Nca...%...n....9
.qI.......^9..Hn. c....&.!x.q..;..<)y."\.L..W^6.say..g&........[..s
.......2...~.. ...1L..Pb%....u.................N"46.MDh...3.Ft...c....
.l`^u..Sm.. t..7:.....y6...A.L......q<f...kx.Id...F....a.H,....
<<< skipped >>>

GET /templates/torrent-windows/images/spacer.gif HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

X-Accel-Version: 0.01

Last-Modified: Mon, 17 Nov 2014 17:14:54 GMT

ETag: "796efa-2b-508111e076eaf"

Accept-Ranges: bytes

X-Powered-By: PleskLin
GIF89a.............!.......,...........D..;....


GET /templates/torrent-windows/images/sep_15.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/png

Content-Length: 2818

Last-Modified: Mon, 17 Nov 2014 17:14:52 GMT

Connection: keep-alive

ETag: "546a2d0c-b02"

X-Powered-By: PleskLin

Accept-Ranges: bytes
.PNG........IHDR..............]......pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /templates/torrent-windows/images/logo_bg.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/png

Content-Length: 5053

Last-Modified: Mon, 17 Nov 2014 21:31:53 GMT

Connection: keep-alive

ETag: "546a6949-13bd"

X-Powered-By: PleskLin

Accept-Ranges: bytes
.PNG........IHDR...0...0.....W.......IDATx..Y.t.....tuUW....Y.%......l
..01K`[email protected]..&..M.`bv0.....0..6...a$.e...U......A".'g...
....w.....^.........ia.. Q..;.e../.BP...Cm...c|....0I@%.............cg
G.......y$._i...f.;..."Ck....I~.P.0^....Dah....U.Fe-..M.h. ...... k...
........z..(.t....hD]..sX....@.~tr .........]..d..".p.F}L....J.0F.9d..
. .._"_..P.X...E..V.*. ...1 .....~ a=.]..X.$.7..%.IYE.....$,..*,...baf
Jb.h...C!OQ(J,.g.U.;Z}........G_X;*.9A.=...j2*U....Hd<-E..v.L4.<
...f.......b#`v..%.....Vy b....."o...=.x..J&-nx..22.. .6..531.a..Z....
....w.....(._:N.h...U..z.....*..~.....&......Cc...-.......{..h.af.2..u
..{.}.-...Q*Q......&QH..T.[.S.L`..e.Y..cw............,:.I.>R..t]..h
.t..`...C..!...\......XL..y.U.Z......k.y* R..h.Ad.>..G......Qx,..Y.
..K.../......F.....dZ..u.<.>....h<|>.f.@Tr=O...L.pHV....``
t.Y.V......L.-..Q(g.....].....q..h..>.......U}.........[Z..R.:.y...
A......mt(.!......\.Y. [email protected]..;$.W............ ..avnp.K.......g.
4..Q..=S.....|...../yi... \]...O........!Il. ...../.p....S.P#..."@.%.^
<.....D.x......EZ{>.z...... l......&`..`.-p.*yI%..N..z@.=......w
`CO.1..}[email protected]...!....E.3.......k....n..@......$.
ku/..`..4."...J......F..T..,.v..-.4n.u..i.#.f# ..G..(p....C.wr.rJk....
.%.t..s..m.c#......&.......@7.?...y.C%P..?..*...q..C.."...6.=.c......6
.........c.`{..c9....eJ..........G..0...6.S...'[email protected] ..;@.
j$...%.I...-......."X.;.J.......e..Q..9H...L.,.~..j?...;"..jq......'.T
.D;.......N....$.....D....r............J.F=r....o....02.h.........
<<< skipped >>>

GET /templates/torrent-windows/images/all_votes_bg.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 3058

Last-Modified: Mon, 17 Nov 2014 17:14:47 GMT

Connection: keep-alive

ETag: "546a2d07-bf2"

X-Powered-By: PleskLin

Accept-Ranges: bytes
.PNG........IHDR.......T.....s.L.....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /engine/data/emoticons/recourse.gif HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/gif

Content-Length: 689

Connection: keep-alive

X-Accel-Version: 0.01

Last-Modified: Sun, 09 Aug 2015 14:39:03 GMT

ETag: "7951eb-2b1-51ce1d49d52cf"

Accept-Ranges: bytes

X-Powered-By: PleskLin
GIF89a.....w.C4............".................... s`2..zbL.............
...........................|j>.....!eP...".."...`J...f......{h<.
.!.u...e......jU..e.oT................{i=wd6kO...........n..s.....|...
..y..........jN......y..{...kN.hR.........ikQ...........n...|.....~...
............iT.......qX........n....aK.......hL..........xe8.........n
T....zh;hR..............o............................!.....w.,........
....w........"...."......nWAYQ ,N.....2r....l<....[0........T-...$P
.......@M`..^t....&37e.Go.......)U.js......:i5..g.......\..cm.........
..!..."p....1..2.C... .h$.....9..."......,@."....p=!.$. .*.$..A.)...`)
!...A_....E....".).#./B.v.00a...L..`u....k..Y....Iw..i81b......5...;HT
TP/1.1 200 OK..Server: nginx..Date: Thu, 17 Sep 2015 03:04:10 GMT..Con
tent-Type: image/gif..Content-Length: 689..Connection: keep-alive..X-A
ccel-Version: 0.01..Last-Modified: Sun, 09 Aug 2015 14:39:03 GMT..ETag
: "7951eb-2b1-51ce1d49d52cf"..Accept-Ranges: bytes..X-Powered-By: Ples
kLin..GIF89a.....w.C4............".................... s`2..zbL.......
.................................|j>.....!eP...".."...`J...f......{
h<..!.u...e......jU..e.oT................{i=wd6kO...........n..s...
..|.....y..........jN......y..{...kN.hR.........ikQ...........n...|...
..~...............iT.......qX........n....aK.......hL..........xe8....
.....nT....zh;hR..............o............................!.....w.,..
..........w........"...."......nWAYQ ,N.....2r....l<....[0........T
-...$P.......@M`..^t....&37e.Go.......)U.js......:i5..g.......\..c
<<< skipped >>>

GET /engine/data/emoticons/bully.gif HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/gif

Content-Length: 702

Connection: keep-alive

X-Accel-Version: 0.01

Last-Modified: Sun, 09 Aug 2015 14:39:01 GMT

ETag: "7951e3-2be-51ce1d480454f"

Accept-Ranges: bytes

X-Powered-By: PleskLin
GIF89a.....p....C4._I.lN.hK.iM.bM.jP.lS.oT.oV.eP.fP.gS.iU r_1sa3uc6wf:
xf;xg<zi?{[email protected]..~..}.............................
.c..z..{..|..~........................................................
......................................................................
.............. ..!..!.."..".."........................................
..................................................!..NETSCAPE2.0.....!
.....p.,............p.pogc....bfo...l,.$>RP5!.,l..j..SY[[YWTH..j.k.
4Y\^__^\Y....n... ......... .p ...YQC.*.p.?[_aa...._[UE....O[.....1..K
Y...^.D/...z`..&_.0\..91....U..(..L..Irph..L.%V...e..D&<d....M..L.\
.@.&.!66.h.K...%.4.R.J.'Gv...`..4.0..b... 8`\x... I.:..1.D.....zS.....
.$.(..S ..;....


GET /engine/skins/default.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Sat, 12 Jan 2013 13:47:45 GMT

ETag: W/"1fc28b6-3cf-4d317a81ca240"

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da69df618df030d1302; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip
236............mS.n.0...).\zI.4..-.......uh2.=*6m..%O....GYN..........
....:.....~.v...z.X.7C..x][email protected]..,.....(L.....p.....`4P
-.8..h.$...^.....n..u.....~. ....r..K[.N.....8..J.gWWX6...c.$.4.%.0...
4..........q.$...(..  W.$5v.4)Q..8.2...V#...*c.9.JN.@x&0e...h..7..tNT.
.uB..k.R.)..sY.....R\.T..|..cO.......F.....t..E .7.!g.P.(..r.!GO.cg-3Q
.de~.C.R.`\').!..b..{......p.....>M......2...|....9j.a.N.... J#n...
P...%....9.(...Bm|U...8..zV....a.......".k#.lZ....b...../C...."GYq.fXk
%YqXe.o.....d....R.#.,.........#.Fj..f..r......g......{.ol.^....VV5...
".l.............0..HTTP/1.1 404 Not Found..Server: nginx..Date: Thu, 1
7 Sep 2015 03:04:10 GMT..Content-Type: text/html..Transfer-Encoding: c
hunked..Connection: keep-alive..Vary: Accept-Encoding..Last-Modified: 
Sat, 12 Jan 2013 13:47:45 GMT..ETag: W/"1fc28b6-3cf-4d317a81ca240"..X-
Powered-By: PleskLin..Set-Cookie: uid_zxcv=258cc02055fa2da69df618df030
d1302; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/..Content-Encoding: 
gzip..236............mS.n.0...).\zI.4..-.......uh2.=*6m..%O....GYN....
..........:.....~.v...z.X.7C..x][email protected]..,.....(L.....p..
...`4P-.8..h.$...^.....n..u.....~. ....r..K[.N.....8..J.gWWX6...c.$.4.
%.0...4..........q.$...(..  W.$5v.4)Q..8.2...V#...*c.9.JN.@x&0e...h..7
..tNT..uB..k.R.)..sY.....R\.T..|..cO.......F.....t..E .7.!g.P.(..r.!GO
.cg-3Q.de~.C.R.`\').!..b..{......p.....>M......2...|....9j.a.N.... 
J#n...P...%....9.(...Bm|U...8..zV....a.......".k#.lZ....b...../C...."G
Yq.fXk%YqXe.o.....d....R.#.,.........#.Fj..f..r......g......{.ol.^
<<< skipped >>>

GET /templates/torrent-windows/images/block_comm.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 3046

Last-Modified: Mon, 17 Nov 2014 17:14:49 GMT

Connection: keep-alive

ETag: "546a2d09-be6"

X-Powered-By: PleskLin

Accept-Ranges: bytes
.PNG........IHDR.............oU.t....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /templates/torrent-windows/images/sep_14.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/png

Content-Length: 2796

Last-Modified: Mon, 17 Nov 2014 17:14:52 GMT

Connection: keep-alive

ETag: "546a2d0c-aec"

X-Powered-By: PleskLin

Accept-Ranges: bytes
.PNG........IHDR.............R.e.....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /uploads/posts/2015-08/thumbs/1440585354_1440520435_0_11e929_4957bdf0_orig.jpeg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/jpeg

Content-Length: 15823

Last-Modified: Wed, 26 Aug 2015 10:35:23 GMT

Connection: keep-alive

ETag: "55dd966b-3dcf"

X-Powered-By: PleskLin

Accept-Ranges: bytes
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 85....C..............................................!........
."$".$.......C........................................................
....................".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?..(.....H(...(...
(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.
..(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...
(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.
..(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...
(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.
..(...(...(...(...(...(...(...(...(...(..`.QE .(...(...(...(...(...(..
.(...(...(...(...(...(...(...(...(...(...(.......J...t..1./.K...i.7.s.
<......S...y..=`i{W....p/.W.)Y.=`.I]/...|[email protected]...?...Q].
z..8...\..JTjJ..N.F{dV..4..|].. ...Q_......_M.F.u..|.......^%.xe......
....c..x*..%~o......6....'..R....-{......Q.....g.n..h....i.....P......
$g...W..i:`...k..[.ZZ..H.*..N.~.J........).........8.K..s.:6..k%...wso
..."........?..._.._...5......"X.y...\......P...}g..o=.....Rx..8..
<<< skipped >>>

GET /uploads/posts/2015-09/thumbs/1441381750_1441302355_0_11e929_4957bdf0_orig.jpeg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/jpeg

Content-Length: 17699

Last-Modified: Fri, 04 Sep 2015 15:48:18 GMT

Connection: keep-alive

ETag: "55e9bd42-4523"

X-Powered-By: PleskLin

Accept-Ranges: bytes
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 85....C..............................................!........
."$".$.......C........................................................
....................".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?..(.....H(...(...
(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.
..(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...
(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.
..(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...
(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.
..(...(...(...(...(...(...(...(...(...(..`.QE .(...(...(...(...(...(..
.(...(...(...(...(...(...(...(...(...(...(.......J...t..1./.K...i.7.s.
<......S...y..=`i{W....p/.W.)Y.=`.I]/...|[email protected]...?...Q].
z..8...\..JTjJ..N.F{dV..4..|].. ...Q_......_M.F.u..|.......^%.xe......
....c..x*..%~o......6....'..R....-{......Q.....g.n..h....i.....P......
$g...W..i:`...k..[.ZZ..H.*..N.~.J........).........8.K..s.:6..k%...wso
..."........?..._.._...5......"X.y...\......P...}g..o=.....Rx..8..
<<< skipped >>>

GET /templates/torrent-windows/images/bar-bg.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/png

Content-Length: 313

Connection: keep-alive

X-Accel-Version: 0.01

Last-Modified: Mon, 13 Jul 2015 16:35:27 GMT

ETag: "78e89b-139-51ac44f2a697c"

Accept-Ranges: bytes

X-Powered-By: PleskLin
.PNG........IHDR...............0.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx...9..0.D.Ef..3p..p.Z.....|.Q..8E.,K..$..(..m.<.J.eY...
.eY]...k..8..a...I..FH.F1..........e..K...#u?.I........ ....;.m..m...4
..EQ..z9B*.%.xE.:......ziM..z\!.......H....e...{vB*.e[H....j...].. .q.
y..].i..O9:A...}.0...]. J->....IEND.B`.....


GET /templates/torrent-windows/images/bar-blue.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/png

Content-Length: 253

Connection: keep-alive

X-Accel-Version: 0.01

Last-Modified: Mon, 13 Jul 2015 16:35:28 GMT

ETag: "78e89d-fd-51ac44f32d9a4"

Accept-Ranges: bytes

X-Powered-By: PleskLin
.PNG........IHDR.............{.8.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx.b,.p...x......_..J0.....?0..L...21....,..r(...w@.........
.?.".....|...]..wp....>..0|..r..G.P.<z...Rb....ea`fAH<|....C.
.J.00.......]...zHBm.......5eL1.....E/..x......IEND.B`.....


GET /uploads/posts/2015-08/thumbs/1440090926_1439919959_windows-10-update-10525.jpg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/jpeg

Content-Length: 28811

Last-Modified: Thu, 20 Aug 2015 17:15:11 GMT

Connection: keep-alive

ETag: "55d60b1f-708b"

X-Powered-By: PleskLin

Accept-Ranges: bytes
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 85....C..............................................!........
."$".$.......C........................................................
...............,....".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?.....`.....y.x...
&(.".#.s.5.......|.)".8S....qQ\.'..9..Q..[..4.7NjH.....5I..X....#by...
.*.....>.(C......#w...C.z}.,...vR*..2.....x.y--...&.x.>......../
....X4s.`...n.......YG=....GVG............./....-.k.rYr..=.*..Q...O...
.)..5...../B../....;...._........Y\i...|.0.;..?...5..ldc"2.9.."._kWw.G
syp.......z..ZW...|.mT...ih.v.....z...7) .a.&.85.i...Sy..e.Aa..J......
.d.L..0.mp..;.r.....$.M...=.......p.. ..R.Z...A....\....d.b.4..m.....B
>b.g..G.Fi.W....!...p..`.z.?.Y..sar.N.i.#.....Ewi$.Z.b$.@......%..q
...G.HS...A........u{y$.V.#]...*.3.A$..rj..........gh.D..n$.;t.I-o..X.
....n..NB.Lm>.....h~....(`Nq]G.'..M.x.=...q...Y...Jk...t...O..yP. .
Y......L.\.....R.. .R..e... ....t~2h..X.H...y.|..2..*.V6.......c'..~.p
mYNz/....*...U3..Tq.e.q.2......w...w...UI....#>.......> ........
.w.r..[....(.d.f..k..X..pgbA..l.......o.h..5....T....$..c.9./.E...
<<< skipped >>>

GET /uploads/posts/2015-08/thumbs/1440768500_1440712240_edge-logo-full-02_story.jpg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Content-Type: image/jpeg

Content-Length: 9503

Last-Modified: Fri, 28 Aug 2015 13:28:08 GMT

Connection: keep-alive

ETag: "55e061e8-251f"

X-Powered-By: PleskLin

Accept-Ranges: bytes
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 85....C..............................................!........
."$".$.......C........................................................
....................".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?...R.(..O...(..E.
....([email protected]..(...(...(...QE..(...(...(...)qF=...R....sE--.q
.sKK@\o>.~..6....EH#s.4...........`ZH{T.b..2. ).Z.....]={.......i@'
.l-...m#..{D5I..[....$?.[...jp.....hW.0..C..[).Pkkh...~... .#!t.=EJ.x.
Zx.....4P[.."...V.F)s2.Q\[F;S.(;....Wc.....E..h..dr.QEt..E.)h.......QJ
....K..v...(...(...(...(...(...R.'.8F....n(...J...[9Oj..fV...]M>S.5
*ilz..2.#3h....z.t..E/h...0.{.P....B.... ....O.C.L....E5".....!.c.E<
;"..){R...-...J.c.....JFlT.VR.....9.i..5.... `..cT.U[(.=m...e ..s2.Q..
...........d7h...-..LQ.ZJ.1KE..(.......m.......**q.8F(....(SVB.P.v...3
N.T...!.....G.KE..r........(..c.....E4.`.T.k1...,&=...2....d..jd..z\.|
....c[...z.t..j^......c...R..k.[(.j.m...*}.*G6.......S..F".tQJB.aI. .#
.t..\....9.m..Fr){F?d.....S......T....3S..P..c..*E....V......nIv '..3.
*.C...N......iE....q.....;U9n...m....h.....P.E.P.E.P.Q.3RQ...x\UyW
<<< skipped >>>

GET /uploads/posts/2015-08/thumbs/1440853310_1440774442_01-xao3kkc.jpg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Content-Type: image/jpeg

Content-Length: 24647

Last-Modified: Sat, 29 Aug 2015 13:00:17 GMT

Connection: keep-alive

ETag: "55e1ace1-6047"

X-Powered-By: PleskLin

Accept-Ranges: bytes
....


GET /uploads/posts/2015-09/thumbs/1442334487_1442257655_ceaokoxueaidjte.jpg-large.jpg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Content-Type: image/jpeg

Content-Length: 19266

Last-Modified: Tue, 15 Sep 2015 16:26:44 GMT

Connection: keep-alive

ETag: "55f846c4-4b42"

X-Powered-By: PleskLin

Accept-Ranges: bytes
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 85....C..............................................!........
."$".$.......C........................................................
...............8....".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?..*.ZJ.(...(...(.
..)i(......(.....ZL..E..4.QE..QFi..FI...Eg^.Zm....H{....5K;.....C.:...
..n..y.][email protected]%.P.KIE..QE..QE..QE...)
...1|i...g.W.....6.3.q...~v...5o..J..5..h.s..O..g.......1.x|..........
.._*.zS.......*..h.4.|..s.C...R..H...f....&.].s^U7uc.....8.qEg....Zr..
3.... .>|J(...)i(...(...Z.J(......J.M.w._......[D.....,.....K!....5
.......{u3e....`N.y..*T .7g......~.h..~>.Y..[....tz.....X.G..n.?)?Z
.KX.c5,.l....yt...n.......J..1.g. ............];R|s.)..5..W......8XbB.
}.{.q...d|v .W.W.I..2<m.8.....K.N.c.S...W....Z..K....H.;T{qY...>
.....1.....5..[..P..y5.2.6..>........4....'.[.....fV^.......3.{..`N
...[Sy][email protected]..;...'q...H W.n.....W.iSy.}...<j.J..ue4............
[..u.....(........(...))h.;R.E....P.E.P.E.P.QKE.%[email protected]......(........
o$T..|.N7?` .r..N...?m....~#O.....X.....s.....&O....u...x..W....2.
<<< skipped >>>

GET /uploads/posts/2015-09/thumbs/1442334267_1442245312_vp9-microsoft-edge.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Content-Type: image/png

Content-Length: 125705

Last-Modified: Tue, 15 Sep 2015 16:23:16 GMT

Connection: keep-alive

ETag: "55f845f4-1eb09"

X-Powered-By: PleskLin

Accept-Ranges: bytes
.PNG........IHDR....... .....MS.... .IDATx...m..Gu...z.>...o..aw...
......Q....1Q..G.i..C......3.g...])..t...&..F...I.$`[email protected].....
.......G..jU...9m.`P.}z.....jU.zj..ZEx.{.D..,...j<k...%...\>. ..
..3.u...UX]tH.....bI.1..2..E.T.G.....$1..hc..8.5...4...3KT.xEQ. .S..BP
[email protected]. J..\9l.%.....u"...ue.w;.c!('..).I. 
..eH:...3..#3.....x..G 2.A...........'[email protected].. ..U.&H...Q.X
....r.w|]X7_...Ev.a u.e.E..q7v<.^TqRz.....).I..3.|.........q...qY..
/v.......D.s<`FS~./;.r.....X..4.]..B...5..../)..<.g.vQ.j!...4.O.
....Q...;.^.x/.Z.G/j....u..~........^."L....%i....~c.........}.....g%.
.S.l.`o...2.H.......cz.*....%.*......p..C....f.}..cH..Y...8t.~.u!NB...
...< ..,@..0.QZ.BF..WU...Q2..3.!9^.HC.p].7.f.;eA........g...B-.....
...-~.I..E..}.".......:.... [email protected]..(.e. ?DFq.....>A...........?....
.....w..:...........>..3.q.B......x...B.4.......(....x..N..*['...$9
.e....QV..\FB.W....^.....[....D8..."-.Y...#..v%P$O.[=k h....w4$.....}.
..<...._.....Fj...".(.M..a..j.n.q......>...nl...2;9.......J. ...
..J........rD.b}..W8.....b....(5..O.B...b..(#.~..F...g..'5...g.pe.(6.s
.."_......P(.^...V...E.CY?h..g%(.....6#.....J....D..VG.8.nX6S.Z..m.A4M
..r|2..E,W.b...2F.b.. ..K......d.B.....Nvk?(..Z@e.'T,...[..V..Bf9)..A.
...f..%.t.9.d.$.. _....6F.....!"}.......R.n..*#.m..3[.3s3......@...(..
.J.......]?.......H...r;...........ug..C......... ..r>.y.yJ..`K .j.
..d....:.}][email protected].:.#f..iA..]..5.....s..
%s..c.<.B..c....4...\?..............#.Q.,..h....^.!..j.Y?FNS.I.
<<< skipped >>>

GET /uploads/posts/2015-09/thumbs/1442238241_1442230719_co1pj_dueael5ln.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

GET /templates/torrent-windows/images/user.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:13 GMT

Content-Type: image/png

Content-Length: 2960

Last-Modified: Mon, 17 Nov 2014 17:14:55 GMT

Connection: keep-alive

ETag: "546a2d0f-b90"

X-Powered-By: PleskLin

Accept-Ranges: bytes
.PNG........IHDR...............7.....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /templates/torrent-windows/images/view.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:13 GMT

Content-Type: image/png

Content-Length: 3155

Last-Modified: Mon, 17 Nov 2014 17:14:55 GMT

Connection: keep-alive

ETag: "546a2d0f-c53"

X-Powered-By: PleskLin

Accept-Ranges: bytes
.PNG........IHDR.............Oy......pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /templates/torrent-windows/images/sep.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:13 GMT

Content-Type: image/png

Content-Length: 2796

Last-Modified: Mon, 17 Nov 2014 17:14:51 GMT

Connection: keep-alive

ETag: "546a2d0b-aec"

X-Powered-By: PleskLin

Accept-Ranges: bytes
.PNG........IHDR.............R.e.....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /templates/torrent-windows/images/arrow_2.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:13 GMT

Content-Type: image/png

Content-Length: 2892

Last-Modified: Mon, 17 Nov 2014 17:14:47 GMT

Connection: keep-alive

ETag: "546a2d07-b4c"

X-Powered-By: PleskLin

Accept-Ranges: bytes
.PNG........IHDR..............X6.....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /templates/torrent-windows/images/short_img.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:14 GMT

Content-Type: image/png

Content-Length: 4823

Last-Modified: Mon, 17 Nov 2014 17:14:54 GMT

Connection: keep-alive

ETag: "546a2d0e-12d7"

X-Powered-By: PleskLin

Accept-Ranges: bytes
.PNG........IHDR...8...8.......;.....pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /img/informers/term-t2.png HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sinst.fwdcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 454

Last-Modified: Thu, 23 Oct 2014 10:32:26 GMT

Connection: keep-alive

ETag: "5448d93a-1c6"

Expires: Fri, 16 Sep 2016 03:04:10 GMT

Cache-Control: max-age=31536000

X-Server-By: sinfe3

Cache-Control: public

Accept-Ranges: bytes
.PNG........IHDR..............5......tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE...................h!................qz.:=.................
........|'....{.................e ................&..;B....IO.........
...............x.........kw.............n#.....................f.X....
.IDATx......1.........m...........6...n.!.......O.}.............q..o..
.M..........;%.9.......W.}..|.'c.^.8.. _..C.r7......xu..)....U...03...
..f......$Z>.......H.q.......IEND.B`.....


GET /img/informers/flc-t1.png HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sinst.fwdcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 167

Last-Modified: Wed, 05 Nov 2014 09:28:02 GMT

Connection: keep-alive

ETag: "5459eda2-a7"

Expires: Fri, 16 Sep 2016 03:04:10 GMT

Cache-Control: max-age=31536000

X-Server-By: sinfe3

Cache-Control: public

Accept-Ranges: bytes
[email protected] ImageReadyq.e&
lt;...IIDATx.bX.....O..G.L...5......./..`...?..8v....go......x..}..../
..T.......2p)-........IEND.B`.HTTP/1.1 200 OK..Server: nginx..Date: Th
u, 17 Sep 2015 03:04:10 GMT..Content-Type: image/png..Content-Length: 
167..Last-Modified: Wed, 05 Nov 2014 09:28:02 GMT..Connection: keep-al
ive..ETag: "5459eda2-a7"..Expires: Fri, 16 Sep 2016 03:04:10 GMT..Cach
e-Control: max-age=31536000..X-Server-By: sinfe3..Cache-Control: publi
c..Accept-Ranges: [email protected]
ware.Adobe ImageReadyq.e<...IIDATx.bX.....O..G.L...5......./..`...?
..8v....go......x..}..../..T.......2p)-........IEND.B`...

GET /topick?uid_zxcv=258cc02055fa2da69df618df030d1302 HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sync.security.pp.regruhosting.ru

Connection: Keep-Alive

Cookie: aureid=lPtRjVX6Law9Py94mJOUAg==

HTTP/1.1 204 No Content

Server: nginx

Date: Thu, 17 Sep 2015 03:04:14 GMT

Connection: keep-alive

Set-Cookie: regruid=258cc02055fa2da69df618df030d1302; Max-Age=62899200; Domain=.security.pp.regruhosting.ru;
HTTP/1.1 204 No Content..Server: nginx..Date: Thu, 17 Sep 2015 03:04:1
4 GMT..Connection: keep-alive..Set-Cookie: regruid=258cc02055fa2da69df
618df030d1302; Max-Age=62899200; Domain=.security.pp.regruhosting.ru;.
.

GET /i701/1505/be/f4528c2cfd19.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s020.radikal.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Sun, 17 May 2015 19:41:22 GMT

Accept-Ranges: bytes

ETag: "90104f74d990d01:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Set-Cookie: __RADVUID=0d81767bc94b45ec; expires=Mon, 16-Sep-2030 21:04:11 GMT; path=/; domain=.radikal.ru

Date: Thu, 17 Sep 2015 03:04:10 GMT

Connection: close

Content-Length: 153761
.PNG........IHDR................x....sRGB.........gAMA......a.... cHRM
..z&..............u0...`..:....p..Q<....IDATx^...x\..%.....$.."..#.
..A. .0...9..)R..%J.r.Y..%..l.m[.v..t..tpO......y......u.n.....J.%.;.M
...p.....{..s...g..|..............a..!aa.C.....BF...._...7...?..u,<
<......zu......N.aa!.........Xa....>........q.N..i.W.......n./Q/
>'....3.?7.D.g....-Z.`. [email protected]~._...uo.\........
....!..._......s...|.....3....~.__._..tC........9...|.>b.F....-....
.....3....c.......o.QQ.X.~=::;Q]Sm.qbAfV.........9..[.o5...FeU...X....
..a.Fs^l.x._..3:.QPX.. 1)...w........Z..N..o.W..U.Wc..}..s.v.....x..6.
.{....8......1....U..qo..u...u.>z.....\...;d.P.M....o......a.3:..~.
.>.=..4... DD.......m.s-CB#0(b..c. ?v4B..}.|.j...2h0...q].Z.OH.k..X
..i..u....0..}.......e=.....s>..}...o..[...w......oG.}$...M:.w.z.k.
.].....X.......>u..F.FRr.y.zn.....g.U.e..z.....;{....{..O.6........
.............>.............E..B...j.:..s.x...=....2w..[...1..}x..*.
s.k.Z...O?.4?....1..=.(.w/..!C...>.w....,\..................w......
.........=....|..'..y.^~.e......g..l/\..'.{......;o...Ax...q..Y<...
x........a.yj3~...p..A<..sx...p..U..3..M.......ZLnl.%c........c....
..4.gd..tZ[.....u.....0.>.-.....8.l.........5..EE.Y4..mLd..t.bbc.;~
..8......7.W.......& ;'.|3-.-f..i...,.....8}...<...G....Q8U<.w..
...Q..>............0L..G..pD..`7&.9...(!..."P96......w.o..ps...=l..
...b..--|^...T.ljzV}...g...u....................N..i_............w.o.)
\.........AD.C...S}......N......;(c?..u..s.......a.$...Q.....^u?..
<<< skipped >>>

GET /img/ilogo3.png HTTP/1.1

Accept: */*

Referer: hXXp://acg.contema.ru/getbanner.ashx?cid=5199&size=3

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: css.contema.ru

Connection: Keep-Alive

Cookie: contemauid=11883737594766; contema_info=psISDYwYkaiUd5b7753qGwOSVddFOlV6

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: image/png

Last-Modified: Fri, 27 Mar 2015 21:09:41 GMT

Accept-Ranges: bytes

ETag: "ce906357d268d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 17 Sep 2015 03:04:06 GMT

Content-Length: 3675
.PNG........IHDR...U.........^.Pn....tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:BF97E4AC176CE411AF95C86A9B672A8C" xmpMM:DocumentID="xmp.did:5931
9B65982E11E48DC7D04817E11D40" xmpMM:InstanceID="xmp.iid:59319B64982E11
E48DC7D04817E11D40" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BF97E4AC176CE411AF95
C86A9B672A8C" stRef:documentID="xmp.did:BF97E4AC176CE411AF95C86A9B672A
8C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>T/<.....IDATx..Xkl...~..?.c'[email protected].#
ZVh.e.....Z..M.Q..@ ..i...!D.....`b...:.U...M...ZBJ...i..V.q.......8..
..!m.v*.|.=..<.s...@)......7...C.Qbxl......EQ.5k..^.....A.\c..)...&
.........}.-- .!hr(d.b....[Vy...'.b.........7]k..........y.c.%.M..###m
.~.!..<...SJ....W./..Tg.Z....,.H..P..........9hE.ib..qy.`lq7..a3hxy
......(drh.gQcP....L.|,.X{_BD.f.-e.....`=VV....|.1...k0.Q..t...|.|.W..
..I2...r...p..d.,...4...j.......d..h ..K....0._...u..P.. Qv.".....6./l
.......<\...~;....mu.<.E...f..'.K5......1...4T. .Q..P.......
<<< skipped >>>

GET /img/ilogo3.png HTTP/1.1

Accept: */*

Referer: hXXp://acg.contema.ru/getbanner.ashx?cid=5199&size=3

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: css.contema.ru

Connection: Keep-Alive

Cookie: contemauid=11883737594766; contema_info=psISDYwYkaiUd5b7753qGwOSVddFOlV6

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: image/png

Last-Modified: Fri, 27 Mar 2015 21:09:41 GMT

Accept-Ranges: bytes

ETag: "ce906357d268d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 17 Sep 2015 03:04:06 GMT

Content-Length: 3675
.PNG........IHDR...U.........^.Pn....tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:BF97E4AC176CE411AF95C86A9B672A8C" xmpMM:DocumentID="xmp.did:5931
9B65982E11E48DC7D04817E11D40" xmpMM:InstanceID="xmp.iid:59319B64982E11
E48DC7D04817E11D40" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BF97E4AC176CE411AF95
C86A9B672A8C" stRef:documentID="xmp.did:BF97E4AC176CE411AF95C86A9B672A
8C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>T/<.....IDATx..Xkl...~..?.c'[email protected].#
ZVh.e.....Z..M.Q..@ ..i...!D.....`b...:.U...M...ZBJ...i..V.q.......8..
..!m.v*.|.=..<.s...@)......7...C.Qbxl......EQ.5k..^.....A.\c..)...&
.........}.-- .!hr(d.b....[Vy...'.b.........7]k..........y.c.%.M..###m
.~.!..<...SJ....W./..Tg.Z....,.H..P..........9hE.ib..qy.`lq7..a3hxy
......(drh.gQcP....L.|,.X{_BD.f.-e.....`=VV....|.1...k0.Q..t...|.|.W..
..I2...r...p..d.,...4...j.......d..h ..K....0._...u..P.. Qv.".....6./l
.......<\...~;....mu.<.E...f..'.K5......1...4T. .Q..P.......
<<< skipped >>>

GET /i309/1508/6a/58a5f3409156.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s009.radikal.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Sun, 16 Aug 2015 03:31:38 GMT

Accept-Ranges: bytes

ETag: "86b739fd4d7d01:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Set-Cookie: __RADVUID=b4365b2c4a6dfa80; expires=Mon, 16-Sep-2030 21:04:14 GMT; path=/; domain=.radikal.ru

Date: Thu, 17 Sep 2015 03:04:13 GMT

Connection: close

Content-Length: 369396
.PNG........IHDR.......t......f.R....sRGB.........gAMA......a.... cHRM
..z&..............u0...`..:....p..Q<....IDATx^....g.u.............f
fV3...V...,Y.d.-Y....v..q.8...f23.wso..H2Y....u...Z.....>.>:.S..
.{W.ZU..^Xk].c....?.w....^.x.....O................^ff.].~.k..._.......
..6.~.}..W.....o%.W^y......?..eW\q.l........r.=........^u..p]..l...P..
!.s8.v.77.0.....9..5....."......\y.U...y.. @.....c...\.8=..l....0g..9.
.G.3..>.....sx~a..?.K...9..W....._.._f.DX.W\.....s..%.....EX...u...
....e.........;v<s...Zg....B...._.TkZ.................6j.q.k;.q.UW.
{....uX.. <...c.]..8..wn........*.>.N.....}.^.V....._....}..z.}.
..#x.Yi..kX.....#..`.....\xQ..L5..F.~..;..C....h\......X..S,..1..W.G.u
....Zs.......|.}/.F..X5....1.o.........&.....~....kn.}...g..a.um.....s
..9.....sX...t.C}...{.........}.k..K.7<..?..5..?^........an........
.'wO8........f....sT......>5..w..J._.....3s.PkR.........zQ.o....h..
Wx.c......o.-z...............e...m...?..?\._........r[.t....[~^....[FF
. iii.........%[rR2.U......<.T/99.]..~1<..u.,>>....\.m...f
a'$.[Jj...e.:.q..pM}.......Y\..G..~.>.?...G..Op......I....9....s...
...h.|..U.RRR\...~h...Z...>v>........{z......#.9.<...).4...
Z..2..['.V.kN..v.effZ.%--.RY.Z.......3..,33..WQ[.v0Y..VX.......q.....h
.. .....)..4...{*kS0C?nl..G.=.....;..s.....U..g.,...y...{j......Jvv.l?
YY...~VV&u.....\.....OOO....y..z...n.)...6i.....|........<..p.o....
Y|22..........)||..K.\...Ec...q....&......S.....u..).....[......e..s..
..k'<..N../.Y.3.u<..sv....." ))1}.   ....jjj.........Jee..W\
<<< skipped >>>

GET /css?family=Open Sans:400,400italic,600,600italic,700,700italic,300,300italic&ver=4.1.8 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Expires: Thu, 17 Sep 2015 03:04:07 GMT

Date: Thu, 17 Sep 2015 03:04:07 GMT

Cache-Control: private, max-age=86400

Content-Length: 186

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE
@font-face {.  font-family: 'Open Sans';.  font-style: normal;.  font-
weight: 400;.  src: url(hXXp://fonts.gstatic.com/s/opensans/v13/cJZKeO
uBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE.eot);.}.HTTP/1.1 200 OK..Content
-Type: text/css..Access-Control-Allow-Origin: *..Timing-Allow-Origin: 
*..Expires: Thu, 17 Sep 2015 03:04:07 GMT..Date: Thu, 17 Sep 2015 03:0
4:07 GMT..Cache-Control: private, max-age=86400..Content-Length: 186..
X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGIN..X-XSS-Pr
otection: 1; mode=block..Server: GSE..@font-face {.  font-family: 'Ope
n Sans';.  font-style: normal;.  font-weight: 400;.  src: url(hXXp://f
onts.gstatic.com/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvx
aG2iE.eot);.}...

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:06 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.28

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

X-Pingback: hXXp://mkra.ru/xmlrpc.php

Set-Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; path=/

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da69df618df030d1502; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip
700a...............v.....;X...B.Qr.A..LY.Qd....aYJ'..,..$(...6.J....DR
.[.h.r.#[email protected]{......I...N'"..zk...g?.........y..Z(-fO.S
........W..z...P.=..W.#..r.N..s.j6.....r...E.I...V..._.....o.q..i...&z
.0.O...Z......-...N..O.......?..i..>w.,,.....&.....\[email protected]..
....B!=.j`.TZ...^........,....t.4.....s..T"96.................nh1....0
N..........rI.Ow...t)P..A...........<..$.,..]...,......N.\....N..u.
.8....2.L...g.l.Trp1.0...h^/...|..........(......S.....l.\~q)(e.....8.
*=w)=8.P..Q%.B..y..[Hg.^ d..e.:?-....uor.......M....KC......s..$.J...)
e..........x.Y.q..W..m...8..........?.Q......m .... -....a...l>....
...f.C......x]\H.K......a...i3.g.U6?.g2.......]..f?...>\...f.....q.
O..8...LN..K....V..fTj(541.T3W......Yu1_.I.J*?........ZF.*=.^M.3.r.:99
289..-..[..tq..Y....LI..._..m.W/F.........v.]m?o...v.../[. ....j......
.....vm.Z.....z. }.J.0Wt....~?m... zO...n...f.........m.&...{..n...D&l
t;. < |...*|]....be.v.....W........~W............~.F.X......_..../.
e...G.._.&[.....[..=k.!....on..dF.....;.DN.....N.v..%-..N.N."..9......
.].'..{q8.........%....lkA.....RZ.N...........S.v...f...qc.l...Fx.....
./.O...4W..".zf>..P...M.w2(......7t.z_. =G;._\.[...... .N.....s..`9
[z......E'..............`)S.....:3.,f.WO.......A......D...9...R.gB.=..
.;.L.;..;#........#.'/...F..C.'hrO..<...s.....mN..h.e-..3.....K.g33
.$....5=..0...H.30.dbhlh......h.{$#....#."..xpEw..>..B.......q.[...
>v....O.._{?....'T.0.5.Ln6..........r.p...z.{.J..?q.....w._.\*hi8..
..NS/...0(.c...e.;...4........s..WL74....d.....2....t.]...R....VK.
<<< skipped >>>

GET /wp-content/themes/mesocolumn/style.css HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/css

Last-Modified: Tue, 01 Sep 2015 11:09:06 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55e58752-1231a"

X-Powered-By: PleskLin

Content-Encoding: gzip
39e4.............}is.H..g9...F.m...y.......x.3.}......H."F.A..d.B..e.}
d..l...gY6.TeeUe.UYY/.}...Uv........!..7.zw.Q.................E...i...
....E...YU%5..^.o1.._<..6..e...b#..7,.X......<e.f........ ....o.
..1.....`.n.-....-.w.`..~-j ......uV.3....*v.. ..f._.u.-.......uvY....
|.sV.....`...wEq...........^gs.I..........*...u1.......b}..Y._B?....M.
|..y...&..f..*c0@Wu..._R(P.Xu...l.*6Y........Q|E.^m.e./..T..?.........
i....W.zU....|..3...V......?.R..........6Y......:.3.N.. .[x\.`..Ey.b-.
U/...D~.oW[ ....`3.BN5....K..-.A.U.^.Y......N.|.....\g.p$..|Q...U.....
-..(...[g.......:...gYL~.......m..e...2[$.uz.U..n..m$uv.]..#.bRpb.X...
 .4.....tSAIx........B....#...T.Q...........a./.?{.`?..........*.\f...
.... ......x.? .|s..9t2E..:-.`9,.n...I..X.E...c.....`.ma...I6...N..W..
..7...X..g.}{W..)x.A...5...uO....!.Y.}[email protected].
.xOa:r....I..."[.....p.P1.^.9..d....X...,.,.4..m..;.....K"l\..I.P ....
......x.*n..56_...7E......J..m...4...C..y.?.%....Ib...M..,.9...1`...*.
....a..r,U...`..c;[email protected].....|..(7.O.oa
..h.B#...b...,.. .......}; ....Ga..]B......".p.>@....;...\).X..b...
 .YV..TY...... [email protected]....?..~.~|.T....W.}..".."X.
.pE...Y..F.C......CZ.e>....x.U}.......1N..5>guZ....eq..i........
..`8K.3[...u.r6r.e.%...w9L/..b)..(.:.89....p.'9B................e..M..
...V8.)0..D..:..U^.j.U.'b..f.q.._..$......z...s.e`.7, K..Y......]`..:G
.<B.....mp.].....F."C\...r.U.^.d.6....V..........I.$u........D{[.s[
.......f.8.%.GH..x....A7..|..a..|..s.BN.....r...W...'Y)......l.q..
<<< skipped >>>

GET /wp-content/themes/mesocolumn/lib/scripts/tabber/tabber.css?ver=10.5.6 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/css

Last-Modified: Fri, 21 Aug 2015 20:31:14 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d78a92-bdf"

X-Powered-By: PleskLin

Content-Encoding: gzip
343.............V.n.0.}._1U.i.*)a..!.C.M.>n....M....8....;.........
f.9s|f<-C..iw....X8.xg......;[email protected]
O.8..._..../`.$..L.@*..........I.A.........G.e> .\...\.,a.\.....n.N
.....{.......T.y. s....\..!d..E.....tL".<.........#..m.O....5.....!
G.x....P..p..$.B...~C...u.8Vju.U\.X......=Z............8...E.4e...b...
.K>[email protected]#.:.<<;....,...Tj........"3h(xiXfaa[....
ji>L....T..VJ.u1.=.v....bKj}....J..T...F9.I.1.j,..).p.[w.O..vS....,
....YB..Z....n....(...(2m.Z...r....'.....1.....S.....-.....<T.n.5lf
\........H.....!R.D.E./AY.4)8-!/[email protected].>..........
.z=|w......C.O..B;..s..iPH...6ny>.....v.~.......K..F.-.ei,*c#Sw....
...4J........h0..V....j.`....E..J..Q..|[;....F.6...V.J...e...^W._...n.
.D.d...S.&hF!..b..;..#}....t....`FF..0.qf]..oy[j..<..f...P$K4..^4.d
............}.."......dl....1.........0......


GET /wp-content/themes/mesocolumn/lib/scripts/fontawesome/css/font-awesome-ie7.css?ver=10.5.6 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/css

Last-Modified: Fri, 21 Aug 2015 20:31:21 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d78a99-9396"

X-Powered-By: PleskLin

Content-Encoding: gzip
cb8.............].......W.&.8..u5%J...>.d...&U p)....H.......n[..&Y
..n..9$.....;.}.r*..k..a../.!..D.I....d.......{..)cl{<............W
^?... a.Z..r..~h.1N>...].........|...T?.....?}....._#.....@z.......
@]y..o...Zo......:..O......[.`....]ybg[Y.b......F.]D..MGs...<..[.C.
.I7:.rR.?_..........y.....k....]..2...]....<r..........C.....v.0?..
/..{_....1...H.[....P.....`.........w.........._.`.V..........OO......
.......L......t..__.K. .w2M..$.\...;P.s..A.&.6._I...L..%......K.......
....-K$8 ..Z..n{..,/...../..4..:...~.' .2.%..#s.30.....`.;.(.....P.c..
......;...%F.!..i.2p".o.;*.FF..`3p!..f....^.&8....[7.....D.$.g2vlx.%.-
.....I...J...u..tY.(.....A......D...i..`..p....`[email protected]
..5.....F..}.[......X..;&.X.....i).`[email protected]...@%.....R-
[.A.j$(".........p..3r.....r....cry.^..L.<.x..Z....?.1..Q&....2.%.$
EJ...6.......b..6.8.b. ...4.....8.s...RZf...5..4..:..10]..}...2 .9..U.
.}.u..`...7..~..=...`..X*8..kE]89.m].5...d...y....M..>=..t......R..
%....*.P0..Rwj....q.=3......=..,.>..>..7 ..-.E3..v........v.D..)
.9n..?.A0..h7.....= .s.x.G..2.(S..z..d9`.Zy:...^....=u....M/aou4.|.,..
...`.U...m.v.)..J....Z...S.r.v.IBcr...c.c..< .Lp.....13..v..o..d.{&
gt;&x.8=&:.d..*......M..v.Q..G;..G..L.'.(....k1.....3...|'.q..@;OM..p.
..j.VV..).(Ql...a.r..j.K..!..xf.^.c.O....T`d...P.wK...........{.f..p..
.....y.in.m........(.H.......[G;..,..>./...L...O .;.{0.......m..Y|.
1.K.Y.....)...e...$...>......6......C..`_d=6e?y.r../.Xf....'w.j..A.
..\.._w.........(..'1.....ir....$....i...r..a.H<...8...... ..a.
<<< skipped >>>

GET /wp-content/themes/mesocolumn/lib/scripts/fontawesome/font/fontawesome-webfont.eot? HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: application/vnd.ms-fontobject

Content-Length: 37405

Last-Modified: Fri, 21 Aug 2015 20:31:23 GMT

Connection: keep-alive

ETag: "55d78a9b-921d"

X-Powered-By: PleskLin

Accept-Ranges: bytes
....7.............................LP........................B5f.......
..............F.o.n.t.A.w.e.s.o.m.e.....R.e.g.u.l.a.r...$.V.e.r.s.i.o.
n. .3...2...0. .2.0.1.3...&.F.o.n.t.A.w.e.s.o.m.e. .R.e.g.u.l.a.r.....
BSGP....................../..3.{........Y.D.M.F..x...>..........)[.
.1..H....-A)F....1..../.d..U.'.&a./....s.%.%.<.........O%p.V. "..u.
..Kupp^c.RB`\.}T..W. ...............z..5.*....LzSq>...?..T....3.5(.
..}............aKP.'.........2..45..$[GVzi...<.QA..2# ..%a^.V.P...=
.G..,.....'........*........S.k....6>.\......:...^..C....=P.O*...-&
lt;....@a.(0...L......".gmL.%...iC.........a.A^.........h..Q%../."}...
.......J..D..pb('.0E1..........hQ...Q.J.......Dp7.Hk..3L4.K.4d...S..*.
?...e.[!....=8.g...F"bT.....*.?.G.W..0..Q..'.^xn.?..[....(.."...w.Z.hM
z".z..h.,j.....D. ....&%X..5....g..".`h....l..78.K'.......m....F......
........{b|.......-4.H..f.P[...1..<.... ...-w..E..:..h.K.u...OTRT;.
)/.-....9..L2 ..%3LU.2.....8....Y.%..)G.....5.u................:Ab.65W
{..D.!d.N....z.K...E..<..U.E.qU...*5Z-...}Sq..*..(Y..!.`.;0..AGCF|.
.y..)[email protected]`-.....a6.................m|>.d..;-xP...KL.H .*K
.G..%E.F9B..H.i.0z.u..1Tp..`.F.U.....cc U....^........4x..(..F4x....X.
......z(R6L..V..?.S...G..c."W/B]......O.5.!......u._w...Q..C\.U..`...v
=...M..H...S..7.]\..b.B....-.A.j]...zx.W .Wp_.5MQ..Tw.".A..q..[M...<
;..c.....v..C..G.&aYG....%.d2....$.t.tB&...D...{.0RPu......0.?,...j..:
..Q..Q."..0...87F.........A......]...H..P..<.!..o.n..'|..3.r.K...&g
t;]..R.....n. (..Zw)........up[2.b.g...8...@W)..k...Y.8..L.<'s.
<<< skipped >>>

GET /wp-content/plugins/generalstats/vendor/jshashtable/hashtable.js?ver=3.0 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/javascript

Last-Modified: Sun, 23 Aug 2015 16:36:37 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d9f695-1175"

X-Powered-By: PleskLin

Content-Encoding: gzip
782.............W[s...~?3.? |..."K.Cg.A}TG.......NG....$.........?. ..
.....H....o......./...'..P. _...[..SA.'..'>O..,..,.;.,.R ..p.......
...nE...T.T.D..."...u.....4. ..g..HE.V.M..yJ.Dgb."Nlkm._].........A...
.W_................;. w.=....... &..C...B. ...1..@~)......ZfeE....!.d&
lt;....z...`HB.... .;..]..?..-) .v s.......L,.DCr%W. {i..Qe...GeD?Z...
4....%I.....V..C=.fsUU:..uv3..O..-...>.T.91.k!...x <.h. R...*.7F
....}o..bS....s#........vr..B....=.H0...< ?M..9uV~.=.|....>..qr.
0....Grs..~.0.....dr.......D@........."e.X.)......%.<..\...S..o...I
..A.L.....@jUr6.;Y.@~..s.T|..!7...m.\..{2.............A...ZN...3....i.
.p.W...uhX.".h%dP.."4Q.#....-U.O.....T.B#.{._..i.!.Q....X2..Z....... .
..j..]....$.....b...FW..f.N.=.u..4.a....{...L..8.<A.a.q..S."A_Ec..4
1{.......u*...x-.X.....c TP.=c7/.Kf)~..x4R.l.,..j5.W...#.x^1f0.x..v..K
{.P.n.R.k.....kj.v.(T..d....[*..<....y3.\R.......C.Q..dJ..>..>
;..D.j8v...3.....ya@..\. .Q ..?....o...P...........}..'.f.$ _.e......%
....#V.%......V...--.0.B-.....yr....._.......B.H.|.P .Y....p...[q._...
.X..7J[T3n6.^.H?.[.......uX43A..7..b........1bIY#L......Y..H...uV..T.n
?o..t.-.........."..1l.J.#j.C..#$6..m b....B6.i..44.!J....c...B.b.~..y
.)...t. ..0..\.%........g.c\V....p53.A..9n<75g...M....Cx}.........m
]...G]..yZto..Z=o..........Q..u.V~R.M{:y{.1............ /.t.v.p:..#.z.
4.].....l>C.cI.?.!g.0.. *1=al.m........r..............p..f.z......L
W6N.]].E.7d .....>a...l.....#h-.....B..q..\.%...Y..i.m...'....x,..x
s..X.[.......].\..o.....>.n`...l3...21..pnX..U$x....?~..m.vW.w/
<<< skipped >>>

GET /wp-content/uploads/2015/09/1e214f20f9cca2943fdcb3954f1e14a8.jpg HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/jpeg

Content-Length: 11843

Last-Modified: Wed, 16 Sep 2015 14:55:32 GMT

Connection: keep-alive

ETag: "55f982e4-2e43"

X-Powered-By: PleskLin

Accept-Ranges: bytes
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), qu
ality = 80....C.....................................%...#... , #&')*).
.-0-(0%()(...C...........(...(((((((((((((((((((((((((((((((((((((((((
(((((((((...........".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?..X..x..'....z...
4.Y|>...Q.a.=.#...pT..W7...gM..O....|=}ws6.8.p....w.o..:..f........
@...t.kk.."...5...$.s.I...Wr...t.........l{[email protected].(...o........J
......LM...j.~"..)A..u...3......u.o.T..X...i....&........`..~|..^...4.
...k.#.Ms...t.A...\..."9R.,.E..e5..9Ta.Xt..].r....?...Epb.--&...>Ae
=..........2|A.'....\..`..s<.....R...........[....u..\isk.a........
sJ...f'.VE...M.Q}d.?.H.....Y........o.-d|Csn...A.4...7B... .......g.{.
..'...y.1Y...m..!.......`.\I..#<~Uv....H.d..g..z....,#x.u .....G.].
._D......i..y.........X.3..=.6..5.#..]...'.....RR..(8n.%.QL. ........I
isc.H...8.........(.....................a...x.K..^).]N.....G.\_....l..
.i.m=.'..U.......Z.yv.......r.......>..!.:......q.~3...Z..$.Zz0QgG/
.....\..=$'.T....?.=....m......8..O.=.Y.fq..B.....JN@....).S..H.)..O.-
...!.A.{.Q....4y(q...-.#.....Q........F#.......j....I.# .....p1]c.
<<< skipped >>>

GET /wp-content/uploads/2015/09/ada9a46040f3022a8488c48b974afda0.jpg HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/jpeg

Content-Length: 12367

Last-Modified: Wed, 16 Sep 2015 14:55:28 GMT

Connection: keep-alive

ETag: "55f982e0-304f"

X-Powered-By: PleskLin

Accept-Ranges: bytes
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), qu
ality = 80....C.....................................%...#... , #&')*).
.-0-(0%()(...C...........(...(((((((((((((((((((((((((((((((((((((((((
(((((((((...........".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?..L...f.I....9.&.
.F.,..i....E...)7.B.X.....'...F.j,..s.L....r\..z..P^..q.J)...E.u..Sw.u
..N.W..%7}&..z,.$..i*=.._.G ....3P....(...dz....[.<.9Erl..T...O.9..
.2*...e.P.'....=MW..F..z9C..>[email protected]}.....I..r
M.....?J.<...3?JR.J...P^.-M&.$..F..4...}&..<Q.P..Rn..3Fh....'.i.
...qb(....I.v...Z3Q.A4...Q...)3H.wRg..{..N.q.....sK..E....._}..Er}....
[email protected]...(.X.:....cu&..0# ..iwP.$.(.Q..4..3F..4.......u".u...g8
..n.7S.=E.....I...B..f....$.f....m..4....4..}....M.......b.!jM..i..z..
7Rn..j$...x.E2'.s...W,.4..9dHc2L..9,.....I.Y.bn...L!C... c..\..c=x....
I..-.n.5~#x\.5<...'...W..>.tV....Fp....=...}G.!.U.#>`...To.].
..c... .....P..)....9==..0...j............V...E..}..U..I..?..N...}....
.u...s.......<.].f''su.fF`.0.9.....S.c.4.....C.*FL...U..n........8n
..|T..1.....3u5K..<....R..p:.?....W.8.q.....`.:..f.N...1....mO.
<<< skipped >>>

GET /wp-content/uploads/2015/09/4192eab47979fb89f376c7641263ceb6.jpg HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/jpeg

Content-Length: 13321

Last-Modified: Wed, 16 Sep 2015 14:55:26 GMT

Connection: keep-alive

ETag: "55f982de-3409"

X-Powered-By: PleskLin

Accept-Ranges: bytes
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), qu
ality = 80....C.....................................%...#... , #&')*).
.-0-(0%()(...C...........(...(((((((((((((((((((((((((((((((((((((((((
(((((((((...........".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?.....-`..6..>a
cr...B?P f..H..cG.\...o\pA<..V,..._.?..M..)".*AN..:..^.I...V}....Sz
=...... .0..=s......!......8.f..8}...Nq...h&V.u4{.S...e..9.v.......z.8
5...=..<K........4. {.....N.k...K..Q..F]Tt..sS.....w.|6. ......V...
{ .4.=WM{../.j\R........2x..8.^(......q..$.69...pp@..:.=KP.WD..;A...0.
p. .0..N.)Rl...9.#."...G&...O..U...c.y.c=(..B% ......Q...E4..n.....c.\
R.]A....JGj.$.qkq..4.s..3E;.7........\.{b......(Z...$W7.MoK..{}T..L..8
p.8 ........:.Z...,.b.[H..[.0..J....d.l..>...{.7.JV....NHn..st.I...
.j..rX.L.....=.2xv3..k.....<...Q........,". ..k..l.....O...(.....j.
.6......q....k..Y=.......V>..`jh.x.F.._..{r1.#.k...s....:...k..?...
.....Gw.h.s.x..,(.2F.F.#...c.;....t.7........`.>.\g...yL.(...Ex...T
...*..a...F...4q....).....Q'.../2.......#.UE....$.....K...............
Y.7:.8......GNkt...[....N.Kt.O?.o.:.G.'..........p.t..;...dV......
<<< skipped >>>

GET /wp-content/uploads/2015/09/4bd07d7f0ead211d9bf4f4e05b0ce5a4.jpg HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/jpeg

Content-Length: 11987

Last-Modified: Wed, 16 Sep 2015 14:55:24 GMT

Connection: keep-alive

ETag: "55f982dc-2ed3"

X-Powered-By: PleskLin

Accept-Ranges: bytes
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), qu
ality = 80....C.....................................%...#... , #&')*).
.-0-(0%()(...C...........(...(((((((((((((((((((((((((((((((((((((((((
(((((((((...........".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?..$..T...XH...2G.
......]"...R.~.eb..*...K.\.a.=......V..x.R,U-.....5*.#.jq..?..*....M..
..?c..D.......>.-...G...X...U8.OU..m.).*z..S..T.}s...T64...........
.......lW.=.(A...!...p..J..XG.).1V.`b...hw....lS.>..!...F0([email protected]
.9..i6.sE...........Ni.*.%....m.8..m..5.`..cH.nz..Q.....9.....p2Fh..Eo
,v.l....Z....-h.g....V=....P/..s.....i..5X.}..\9,....<....>.A...
...z.'.#.....8.P.~'..=.M.Qz[*..*.......X.....W........B.|......d...0_.
D.u.. ..]!.>..K....:...^....&.CZ...Lu...Pq..T.....3....G..ZDK..jd.`
b.X.sR.{..2....<b.Bz`...... .....X.i..M.z..?..]..<.N.{b........{
..=.)..J.h.=.q.......U..j....X.L...c.g......<......T.X...n."d.,... 
.....Q[[.&I.Ip......Tv..sVv..E.`....4....6.B..Twb......;Q.{..'.T....?.
.0..8.ua...3o.)S.i..........P.%N).=z...g.})......E......H[..0...HV# ..
.L...B..../.}....<s..U....U.v.@E<.........{........1c<}..
<<< skipped >>>

GET /wp-content/themes/mesocolumn/lib/scripts/modernizr/modernizr.js?ver=10.5.6 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: text/javascript

Last-Modified: Fri, 21 Aug 2015 20:31:11 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d78a8f-2fb2"

X-Powered-By: PleskLin

Content-Encoding: gzip
1372.............Zk{.6.....Brd..(9..-UT.;i.........{...%J....m......."
J...s........af..W..4.Y.}..g._.g..\.E....Q....z.......^.....u.YQ...`Y.
u.t9...$NU0x............,]'A.}B7.."Z.i..T..st.....~..;.....*....../.q.
.b.M.~.R~Tl...S.B...r?.U...(Mr..i.^.9...T........).....4...uE..<L..
Q.y....X.Vq...}..t.W.....D[?..T%A....L.3....`.......A..o.@..(.........
(...J..8.UL .}.4/...E;.."....^....sQ.c..By*73.i..Y._~4..U...`^..&.. ".
.*............;....i.......nA.z.4Z%.ub.....o..}.. .~....`.T.f.5.......
.%.<....F..qo.e....o...Wih))..........g..l.p.}.....KPH......(.@*..T
..z............'..#.oW.xR.Ux.....w...{.?.V...tk.Pz...f...6..:.c.t..P..
!.....$<.n=..O...f.9.T.40{U......V .]B...)'.2k~n.-.....J....{...P..
SoT...{..*.d....ta.P.D. .{p.......q......d.#...cla.Q~KHr.z}'......o.(.
..b.C^..~..EMn..0.n.....x..i..7.^B.9#..9.p....>...5.~.X.d.b..Z.)...
R.-.....-Zk.b8.Y........ ..b.J.......u.....X..# .go.-K::...LD.js...~..
.xU@*......&B..$..C#.1FN....,.......V.Ch.......*....G7Q.y.....(.t2bb.G
F....!..C.......Q..........O.8P...3\-|a....h......[.:s......ipE....c|!
.u....1'.#....I....AG.Y....:.^.7.&.v...........?.v.1....^..=3&......Cs
.p..:...1b. ..;2....2j...ZCshV....-.g..,.....6.k..lf.j...Aj.w.....T.H.
.M.f... U.......;.G.. [email protected]. e.XXs.3.....l1.Q)j.x0..&..c.\..%6...2>C
$.Yt;An}..L?.7.V...$.T.R..\>Y..e..J.m.......m......1...~.rr-n...z.V
../,_.BW~YDb.......n.x../.68..n........W*..[...|h...8..~..?.z.D..c..qg
=.L8...j..#...u....9L...#...Y~..q..=.J.o.f.[v]zaFb.Mf./......p.|^O."9.
,.aa.Ie...O2&.Q.R....d.g`P.....>.|....H$}.........?..:..m..&yl2
<<< skipped >>>

GET /wp-content/themes/mesocolumn/lib/scripts/custom.js?ver=10.5.6 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Content-Type: text/javascript

Last-Modified: Fri, 21 Aug 2015 20:30:53 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d78a7d-528"

X-Powered-By: PleskLin

Content-Encoding: gzip
[email protected].=.;...J....K...#k....]Y6......&..-.AH
..v.{..'w.....8..#T......r..c...6J.kEek;*..P......n.Q.5.....D...z..V.4
_M..No.PDH........B'n..m..(..:..g.......av......P.)...:M.<........v
.o.X.....^<..<d....y.........T.YoJ....~......}.....<...Z.v...
....XD.........x.$...:.Y......@..[.X.3.j..h..05. {.....!e9..e...._..`w
..._x..z.`...0p.g.y.J7.9.Zp.....h...0A...6..Y..q2...bC...s.-1L.s.UD.`.
AG.k......J..l.`...P* ..p.....R.i\.h.....Z.B..\..H.....,..\&.1.Sr.f.U.
Hf..........i...~v[.."..4.....b4..9I.7....|.....ka'K..N.X......M.N.4..
u..ZBp=..q...^6a........?.......sKh.x.RW.....d6.:e.....]%.D7...e.-....
x..z..9.4.2hVv(..dO..s.......(.....0..

GET /i443/1505/45/cc7ce6aea5ef.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s017.radikal.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Mon, 18 May 2015 20:40:54 GMT

Accept-Ranges: bytes

ETag: "66986cefaa91d01:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Set-Cookie: __RADVUID=5352f1d1cca1748f; expires=Mon, 16-Sep-2030 21:04:16 GMT; path=/; domain=.radikal.ru

Date: Thu, 17 Sep 2015 03:04:16 GMT

Connection: close

Content-Length: 364393
.PNG........IHDR.......x........)....sRGB.........gAMA......a.... cHRM
..z&..............u0...`..:....p..Q<....IDATx^....f....Z..7/33333'3
3g*.R*S).R.L.%...2.$3.]..."W.......tW....~...9.~....3].VM.[ .9'N......
.c....l.b.../[email protected]..|.......
W.k.-W]..?.........ZVZ..f.YNV.K.Y....f...s)/'.|....L.........C}]...l..
. ...;...)e...-p.<...sH....ji.I..nJ....)8.y.>/.<`......o...4.
].H.A.(....T.......v.F...;.w76...<....s.........p.*........W}... ..
.....bp*-....< ......y..;....RuI.A].N..\.r...%r.....`....>......
.7.YX.. ..//)...B........U.]_Hn....I}T...U...TV.O.\...........b.,.....
{...K....0n....l.u..2.........r..a.......WW....7.G........`...2...Q]..
x)....j.J...gp..!.....N.WEi..K<<...Nu...U.\.K.._j..6. K.........
}~-......8..T..S.5G.L.G....V.w.oIs.........rk..tW..|.....Z.k.........b
7....>.q................Mp..........[.p........t...uU.J..u........k
...Zn.....cX...8|........7..U.{...o..(.s..T..r....V..80VjC....W.4.*..]
..f^Z.k..........Z._7....2.-.M.k[[email protected]..
........]`5Q..qm..z.]......kn...^0.....j_.H..i..H...u..;.;..r..0O.....
....jotm.;o..\V.6...V.7................{..h...h^4.].V.-......X..&.O.z.
.........h.=m6..a..][email protected]..^.?.....Z/.......f(....H..
.8............C..kS..jq..b..e...._.ExC.....^.a{..2...sX......N@.......
...a..,[email protected].,...[p.3.!..)..L:,..2"a?r.2...............W....l
..~.xx"...U..1.c<.<7vbF..%....q...b.....@........&2..7..)......"
........`.Bf. /r."..1J._?...'..w]]..;..Na;E|xj[....5..w....W?.<
<<< skipped >>>

GET /i304/1508/ac/e4d1dcc22d86.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s008.radikal.ru

Connection: Keep-Alive

.......ibbT;h.nw...`D..Xt~. .MS.......k..f.......PX."..,n..X..Zm..w=.D
..........c.%]...p........S.M&....)..... [email protected]/..6i.4.....L..R...&g
t;y....K...........I.4.p*H!.f....3I....q..........y.....9.<d..w.qk.
......S....k........5...q...*...f.PpG.2../.V..G.. =...f....N)....Gt.,.
....>....s`v..s.@[email protected].,p..6.R.{......;:d.*],$X..@.
...o.Eh.N.Eh.,.4d.,.X2...>.!7J.}.f9..-B.V-r!.*.-$Z..@f.....[l-.f..f
.MH.p..I.B*f.2..-..5....:..ocq.<.Hg......t.4.w.D=...|!_...y.-R.7...
E.MD......\[email protected]_...._NJh....F...}.z.v..0...o&Id.#cK*H.p..s.0E..c
...0.....L.....0.1...n..r.."s.P...s..O$.....-..HOmz..K.]2lf...9XPr..".
7n..T...sBE...;..m.P/..XGe...............Nk..T.!. ....w.Guv.f.jv......
......g.....^{.Q9..NK....I..#.l.z.bm.....v......r. .5d:X........,D`y%w
.Pp...!{...!L.NyY/..:....2...h.l.....".?$../.......\[email protected].
.d.3.....S............5.<....I.y.W."...r..._.......~/.Ss...n^..e...
[email protected][s..v..)..|>.I....5..).;G .x...C1.2Pe  ..s.0....iS.
..'/..{F.`.=y..E.^nH,$....e?.ee....C...%.5O.w.N|J.\p.P&s.J.Ic...YB....
.!...1..1;.f.........>..^-c...uu.m..C.Z.j.[$.\k`YN\f............v..
..,g...2..:X..^.".`aE(.-rt.....1.....; q..{!A...H..Jy....mI.)O.g.y^"Qp
[email protected]...@^v?..1.u.s.gyp....&.E=....>.M..5K.\)...!....
9.a...U..7.5....7.p..0..Q?.L....|....3..T.Z..?...[..l.i..........Ye...
2..<_......|II.m....Es".C..rN.......(P.Y:......R8..w.....,\).......
..$?0;.5$.8.~&..r.....i..f.........9....q..(.oRr.h.z%_d..,^...........
,.h.....V.D..q.0$XH.@j.&....,._./..;...j[.....6.h..U...I&.......H.
<<< skipped >>>

GET /img/informers/logo-t2.png HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sinst.fwdcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 2444

Last-Modified: Wed, 05 Nov 2014 09:28:02 GMT

Connection: keep-alive

ETag: "5459eda2-98c"

Expires: Fri, 16 Sep 2016 03:04:10 GMT

Cache-Control: max-age=31536000

X-Server-By: sinfe3

Cache-Control: public

Accept-Ranges: bytes
.PNG........IHDR...].........i.C.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..Y.PT......,.E..*/......(.Q...H&...h.......51..Ct..US..M.
6...1m...1..D.......,...<.e....w....A..i...s.y.......\._?.h... ....
..7?>..V ....V...g..b....gV.k...`.......J8...B............ztv.. ...
.]|6[.@g.`.....m}...;..g.J.3..\....3...O.....<].(....%e.VO..0...7.P
r..B.EJ..J...e}..l.3..S9.)d.v..x^..x.7.y.._..........c...u.X...<..W
).......6Qk{...f...n*.t.1.}E. .a....J.m....ew.9...t. 7..............M.
.t2i...q<.....9.}.,IR...m.tg.M.6lY......ec..{...pA.-.&v..P(X.;*....
q$G.[tD[:z.8..................n..S.'"H.FvQ..U...... /nG.oNk........w.B
.....N...{.d...rlZ../..p...5.....A..`<....}..(.R...e1|..'.h.3V<.
[email protected][email protected]...!..D.=._.....[.`...t
.lk...BI#.........hcY....hsM..z..Z|.../=.......k[{P...S.5..../...2=...
...__.....Hfx.8..F...........c>..=.|*....ara.....k.]..oX.....p.`..m
[email protected]{/./..'eH.....9.}w.._...R..z..KU..z.p..|..0\..0o..c&....-m...
%.... .Z=.z&.7....w......D.>/...N..X.........~j.....4....^..|...<
;.].K.G.t6.w2!. ..=.C.....9....Je..:.......'..Hd>.....7...........M
0K.r.0Rp....v.j.&w.V....M."-....Y.o....a.nW.. G..P...)..xn.:.fI..:....
....?..|.....2..."..3...XV$.vq.G.....%Um<.j.V..S..P....f..G.......f
.....A].\....Gg.....v,.....`_...kwZ$c.-J8..C.Y.!P..l.K..#~....L..k:.;.
......8..=by1=.SA...y..p .O..=.W=b.3XY.Ax.?/[email protected].=#~
..G.....VR..O....s..w..x.{.d_...U.....].s....}.4..Q..k.j.I)....,......
.....S...#..o.J..{..3aD......(.d..qr......9r.b....'hruS..z}.P...P.
<<< skipped >>>

GET /img/informers/hlc-t2.png HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sinst.fwdcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 181

Last-Modified: Wed, 05 Nov 2014 09:28:02 GMT

Connection: keep-alive

ETag: "5459eda2-b5"

Expires: Fri, 16 Sep 2016 03:04:10 GMT

Cache-Control: max-age=31536000

X-Server-By: sinfe3

Cache-Control: public

Accept-Ranges: bytes
.PNG........IHDR..............q.u....tEXtSoftware.Adobe ImageReadyq.e&
lt;...WIDATx.b...>.......H...1.T.B\..]MN.AT.......J_........$`k....
...J..0 .. ? .3. ..... @...dg."fG......IEND.B`.....


GET /img/informers/s-informers-t2.png HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sinst.fwdcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 36708

Last-Modified: Wed, 05 Nov 2014 09:28:02 GMT

Connection: keep-alive

ETag: "5459eda2-8f64"

Expires: Fri, 16 Sep 2016 03:04:10 GMT

Cache-Control: max-age=31536000

X-Server-By: sinfe3

Cache-Control: public

Accept-Ranges: bytes
.PNG........IHDR.......D......W.,....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE................. ..............^..........................
..........o....o.................n.....U.........Q.....o..........0...
x..m..............N....................{..............................
.........................................5.................}..........
..............................................<{...................
...................................................M..................
..........4........................y......................7...........
...................................................o..................
..K\..i..........................F..Q..............p....R.............
............................;...................................F.....
........................................}....B.........e..~...........
............/.?.....IDATx....|S....HBh,...X:.....X.p .X". ..'[....pKb.
Z...Lc..50(].n.Q.kZ.?......y.....6.v...'.{N.l......k.....$'...a...w.t.
..^....9...'ob...g.Z...L.....e..Q.x..2.;~Z>.F6N..\..Np....2.u..0km.
3 .0..a...u,-. ....O....Z...p......\..Np....j.....k.._..bY..k.../N.Ych
[email protected] .6..k.....\.c.ee.'^f....4[J,.Z...^K...w..<,
..6.*.....v....O../8..@Z.!M|.....^.t...q.:...Y..ik.. z..E..w...i.q.*.|
..qmQ.q.k'...y......}...{sQ.......?.."....}.=...x *...]...0..Gc.e..jc&
lt;W.:.....44..|...3..r..w..]V.fLW...h......1."..,)(.pOCC.....8..;:UdZ
...B...]A.i.ij6\9Q....[.UG.6....j..._@v.].g.2.yf...gf..J. ...*gNr6[S.f
.[.!>.@....!C}=.xr.*..l.).....{..___..(mQ.n.&Z9..k...~...1]Q..u
<<< skipped >>>

GET /img/informers/frc-t1.png HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sinst.fwdcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 168

Last-Modified: Wed, 05 Nov 2014 09:28:02 GMT

Connection: keep-alive

ETag: "5459eda2-a8"

Expires: Fri, 16 Sep 2016 03:04:10 GMT

Cache-Control: max-age=31536000

X-Server-By: sinfe3

Cache-Control: public

Accept-Ranges: bytes
[email protected] ImageReadyq.e&
lt;...JIDATx.b....?}.......A.. ......}.....,[email protected].
...(p.$..`.23,....i....IEND.B`.HTTP/1.1 200 OK..Server: nginx..Date: T
hu, 17 Sep 2015 03:04:10 GMT..Content-Type: image/png..Content-Length:
 168..Last-Modified: Wed, 05 Nov 2014 09:28:02 GMT..Connection: keep-a
live..ETag: "5459eda2-a8"..Expires: Fri, 16 Sep 2016 03:04:10 GMT..Cac
he-Control: max-age=31536000..X-Server-By: sinfe3..Cache-Control: publ
ic..Accept-Ranges: [email protected]
tware.Adobe ImageReadyq.e<...JIDATx.b....?}.......A.. ......}.....,
[email protected]....(p.$..`.23,....i....IEND.B`...

GET /pagead/js/adsbygoogle.js HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 3361183559695965719

Date: Thu, 17 Sep 2015 02:12:49 GMT

Expires: Thu, 17 Sep 2015 03:12:49 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 13547

X-XSS-Protection: 1; mode=block

Age: 3079

Cache-Control: public, max-age=3600
...........}iW.8..w~E......IX.lD.[..4...G...8N:v 4...UZ.........&.v.jW
I6.....qhZ..lZ.I.. "..$..........0g.5..{............ .b.r,v2..{k...ih0
|1.b....U..:...2.6...1.Y....t..j....%...#.|......#..75.\11.Qj.0.......
.T.....76.Y...A.{.z..M.......N.i|.2....)s.(.^.a..1.Z.M2.g..z..."0....M
... o,. . *5.A.gM$.X.R...a.......{I.eH...p.4... E8....\..o17?....k.2.!
;.%..6D\...5t9...L.{..\@@..=.g.G...Wk...........t:[email protected]
.._W!M..J.......b.Y....XM../...4..qk.\.v.\."K2].%.H...A....X.,3a..U.W.
..01d.......T..a.P/te.....[. .F..~.p.....R7}vX.. $..C...!.y.mN..:.8.LO
..Y\...E..t...p.j.....f.&y....Q:.6.h.$=..`.#FM..9.}....O.....yq.T..Q1:
).U...i4....p..a.=.....f..~.O[.I....7,............p..*6*;...sz/.......
,..Z0.L`M..w-f..1.hw<..(\w....05(..&.{...e..d......d.h.....bG......
..%~l...L.8.,.,..x4...w...~k5.j` .)>.N.,"yI..."k1..[..oY..M..kdZ...
.T..?r....'3.L,...h7.....4K.:.8rV?Y.r...<.............x...(....3?2.
...v......./..........6]!]E\.T...V..>.......SL..kc../...W...x....{.
....l...k..5.?.&.D.VK&>4.N}iA.I..j......P.z1.}'.....A....'...'.e-@.
.....E.*k7:.....".....ip=`.M.P...G.#._,X.R.F.(.c...1.7..^-...d.u......
X.b..:gf.../t.TK..--.Y..5@..\'.!{.s..*.^f.Ujl.U.jP.....?.|..1..%(...XZ
......?k...........S.'.[.-..#9..........`...>......~4...A;....9..3.
..^..............g.&.!.y~...^....k.M7>j.......7.. j....W..Y  .)..y.
...,B"...lUZ..Q..........(...(..|.$l..L.u..k...6G~..Ht..A..c#_...L...%
A.r....,.&..].).KA-Px....P.;G....@..!.i.....KB..............A...yx....
..........$....Q.....Ku.].%.`..3.H*.. .xQ.X{.....`...tk|...<...
<<< skipped >>>

GET /svn/trunk/html5.js?ver=10.5.6 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: html5shiv.googlecode.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 17 Sep 2015 03:04:07 GMT

Server: Apache

Last-Modified: Thu, 26 Sep 2013 10:05:28 GMT

ETag: "32//trunk/html5.js"

Accept-Ranges: bytes

Expires: Thu, 17 Sep 2015 03:07:07 GMT

Cache-Control: public, max-age=180

Content-Length: 2429

Content-Type: text/javascript
/*. HTML5 Shiv v3.7.0 | @afarkas @jdalton @jon_neal @rem | MIT/GPL2 Li
censed.*/.(function(l,f){function m(){var a=e.elements;return"string"=
=typeof a?a.split(" "):a}function i(a){var b=n[a[o]];b||(b={},h  ,a[o]
=h,n[h]=b);return b}function p(a,b,c){b||(b=f);if(g)return b.createEle
ment(a);c||(c=i(b));b=c.cache[a]?c.cache[a].cloneNode():r.test(a)?(c.c
ache[a]=c.createElem(a)).cloneNode():c.createElem(a);return b.canHaveC
hildren&&!s.test(a)?c.frag.appendChild(b):b}function t(a,b){if(!b.cach
e)b.cache={},b.createElem=a.createElement,b.createFrag=a.createDocumen
tFragment,b.frag=b.createFrag();.a.createElement=function(c){return!e.
shivMethods?b.createElem(c):p(c,a,b)};a.createDocumentFragment=Functio
n("h,f","return function(){var n=f.cloneNode(),c=n.createElement;h.shi
vMethods&&(" m().join().replace(/[\w\-] /g,function(a){b.createElem(a)
;b.frag.createElement(a);return'c("' a '")'}) ");return n}")(e,b.frag)
}function q(a){a||(a=f);var b=i(a);if(e.shivCSS&&!j&&!b.hasCSS){var c,
d=a;c=d.createElement("p");d=d.getElementsByTagName("head")[0]||d.docu
mentElement;c.innerHTML="x<style>article,aside,dialog,figcaption
,figure,footer,header,hgroup,main,nav,section{display:block}mark{backg
round:#FF0;color:#000}template{display:none}</style>";.c=d.inser
tBefore(c.lastChild,d.firstChild);b.hasCSS=!!c}g||t(a,b);return a}var 
k=l.html5||{},s=/^<|^(?:button|map|select|textarea|object|iframe|op
tion|optgroup)$/i,r=/^(?:a|b|code|div|fieldset|h1|h2|h3|h4|h5|h6|i|lab
el|li|ol|p|q|span|strong|style|table|tbody|td|th|tr|ul)$/i,j,o="_h
<<< skipped >>>

GET /hit?t58.10;r;s1276*846*32;uhttp://mkra.ru/;0.990526831055492 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: counter.yadro.ru

Connection: Keep-Alive

Cookie: FTID=1L-Yse1A9jLN1L-Yse; VID=2SGon72LkB5N1L-Ysf

HTTP/1.1 302 Moved Temporarily

Date: Thu, 17 Sep 2015 03:04:10 GMT

Server: 0W/0.8c

Content-Type: text/html

Location: hXXp://counter.yadro.ru/hit?q;t58.10;r;s1276*846*32;uhttp://mkra.ru/;0.990526831055492

Content-Length: 32

Expires: Tue, 16 Sep 2014 21:00:00 GMT

Pragma: no-cache

Cache-control: no-cache

P3P: policyref="/w3c/p3p.xml", CP="UNI"

Set-Cookie: FTID=0; path=/; expires=Sat, 01 Jan 2000 00:00:00 GMT; domain=.yadro.ru
<html><body>Moved</body></html>.HTTP/1.1 302 M
oved Temporarily..Date: Thu, 17 Sep 2015 03:04:10 GMT..Server: 0W/0.8c
..Content-Type: text/html..Location: hXXp://counter.yadro.ru/hit?q;t58
.10;r;s1276*846*32;uhttp://mkra.ru/;0.990526831055492..Content-Lengt
h: 32..Expires: Tue, 16 Sep 2014 21:00:00 GMT..Pragma: no-cache..Cache
-control: no-cache..P3P: policyref="/w3c/p3p.xml", CP="UNI"..Set-Cooki
e: FTID=0; path=/; expires=Sat, 01 Jan 2000 00:00:00 GMT; domain=.yadr
o.ru..<html><body>Moved</body></html>..
...


GET /hit?q;t58.10;r;s1276*846*32;uhttp://mkra.ru/;0.990526831055492 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: counter.yadro.ru

Connection: Keep-Alive

Cookie: VID=2SGon72LkB5N1L-Ysf

HTTP/1.1 200 OK

Date: Thu, 17 Sep 2015 03:04:11 GMT

Server: 0W/0.8c

Connection: Close

Content-Type: image/gif

Content-Length: 435

Expires: Tue, 16 Sep 2014 21:00:00 GMT

Pragma: no-cache

Cache-control: no-cache
GIF87aX............333.f.W_k.f.lv............................,....X...
.....I..8....`(.di.hZJj..0..tm.3q..........f..I.b....1z....O.......7L.
O...z..d.Y..<g...|}..%.......mqt.zw{J.|rM....~].e.Xiq..X.....}....}
.l........pwgk.c`...krS....W...........KV.........xn..........~.......
...................o..z..-....?E....u.K.:.3^."P.(uiM.....M.."Q"...b...
.V.X...\.Q....c5-0A.L.R...9["-....Cp.pB3q.M\.T..x....`.&.G%........6..
.....Qv..qx......;..

GET /metrika/watch.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mc.yandex.ru

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx/1.6.3

Date: Thu, 17 Sep 2015 03:04:14 GMT

Content-Type: text/html

Content-Length: 184

Connection: keep-alive

Location: hXXps://mc.yandex.ru/metrika/watch.js
<html>..<head><title>301 Moved Permanently</title
></head>..<body bgcolor="white">..<center><h1&
gt;301 Moved Permanently</h1></center>..<hr><cent
er>nginx/1.6.3</center>..</body>..</html>..HTTP/1
.1 301 Moved Permanently..Server: nginx/1.6.3..Date: Thu, 17 Sep 2015 
03:04:14 GMT..Content-Type: text/html..Content-Length: 184..Connection
: keep-alive..Location: hXXps://mc.yandex.ru/metrika/watch.js..<htm
l>..<head><title>301 Moved Permanently</title><
;/head>..<body bgcolor="white">..<center><h1>301 
Moved Permanently</h1></center>..<hr><center>n
ginx/1.6.3</center>..</body>..</html>....

GET /hit?t57.11;r;s1276*846*32;uhttp://gamest0rage.ru/index.html;0.25825136608109023 HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: counter.yadro.ru

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Date: Thu, 17 Sep 2015 03:04:08 GMT

Server: 0W/0.8c

Content-Type: text/html

Location: hXXp://counter.yadro.ru/hit?q;t57.11;r;s1276*846*32;uhttp://gamest0rage.ru/index.html;0.25825136608109023

Content-Length: 32

Expires: Tue, 16 Sep 2014 21:00:00 GMT

Pragma: no-cache

Cache-control: no-cache

P3P: policyref="/w3c/p3p.xml", CP="UNI"

Set-Cookie: FTID=1L-Yse1A9jLN1L-Yse; path=/; expires=Thu, 15 Sep 2016 21:00:00 GMT; domain=.yadro.ru
<html><body>Moved</body></html>.....


GET /hit?q;t57.11;r;s1276*846*32;uhttp://gamest0rage.ru/index.html;0.25825136608109023 HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: counter.yadro.ru

Connection: Keep-Alive

Cookie: FTID=1L-Yse1A9jLN1L-Yse

HTTP/1.1 200 OK

Date: Thu, 17 Sep 2015 03:04:09 GMT

Server: 0W/0.8c

Connection: Close

Content-Type: image/gif

Content-Length: 918

Expires: Tue, 16 Sep 2014 21:00:00 GMT

Pragma: no-cache

Cache-control: no-cache

P3P: policyref="/w3c/p3p.xml", CP="UNI"

Set-Cookie: VID=2SGon72LkB5N1L-Ysf; path=/; expires=Thu, 15 Sep 2016 21:00:00 GMT; domain=.yadro.ru
GIF89aX....y..........................................................
......................................................................
..k..@S{...d..AT}BU~...CV.............c........?Qx...c..=Nt...b..;Lq..
.b~.9Im...a~.6Fh...a}.4Cc...a}.2A`...`|./=Z..._{.-:U..._{.*6P..._z.'3K
...^z.%0G...#-B...^y.!*>...]y..(:...]x..&8....$5...]x.."2...."1c}.a
{._z.]w.e... .>CM05?(,7. *KOY.....................,....X...........
...........5.............;;"..."$.$(....).*............ ,. ...........
..0.*.............2..33...............24...........25.V.#GP\....&<.
.......k.P....3b.x..G..9F.........\..e...6~.9.$..)..T.....1=..g....;r.
u.R$:.M.A-..*..I.q......^.J.*... "..[.m..!.$.......#9...........I.D...
..0)...."O..vL9Y.)S&W.L.J...C....J^.<..[].,[email protected].... 
.:8p... /..J...Q7\h.*....'g]... `..f.U.....g....y....9M].P....7.5{....
1.......f.Q........2...i.....b...o..!.q.(..$.h..(..b.r....0.(#.u.X..8.
q..<....@.)..D..G .;..

GET /Contema.js HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j.contema.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: application/x-javascript

Content-Encoding: gzip

Last-Modified: Fri, 24 Jul 2015 14:46:21 GMT

Accept-Ranges: bytes

ETag: "801c57811fc6d01:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 17 Sep 2015 03:04:00 GMT

Content-Length: 2046
...........Z.n.F..~....E..V$..%...4.q..=..|(`....$..I. .ij.M.8.r@.....
.4n.$N^.|..@_.....KR2....pB...3.........o..a..rlbL1ZC...'.. ... .h4.5b
:6....;z.9.....$.P.].....dR...;.Ju K8...A@(b.......>.....BL{.St..j.
3Z[C.......C.........,C...9.!..#T..u.....o..eT\.'..H~.(..N&....0......
\.k.r.0q<.k..[.a..~.}.h.A.7.6.%.G......!..".*Z..d~. ...M.n. ..N.W..
n.[.D..R[m....z...p.........Vd..r..}1L.>u>"z.......HL..I7Fxf....
R...2........#y(skX.......?1q.R...9..6.t.a.....]..b4.i.1...L..f:.OR..:
%.:.......P.$b..^D..$.<...`.r..yxj S_.R....C].'.N4.....R..d.@IQ..@r
B...h`m....Y.L.E........h`.....-.. q.C.....Zb.......s....?....b.)..>
;.#].k..PLp.....%.....#......M.2............q.p.....b...L.U..D.I).`{ .
G.. .....|.E..^\..k.cY4......=.....*.L........^,..C.N...;[email protected]
`&.f.G....x...7q5k.(.,...~....#.f..r.Z.....pP... K...!...}. ......V3..
.^...Z}..]Q..W.T...5..Q..B]\7$.v^zY.n..yC....p......M..t.v..G.....[=..
....n_..W......g.9...p@.\....x....?b..N.F..[......r....R...$SGU.P>m
....$.A............7:.Z.Q\.T..r5..v].9b"g.%.c9c.w..j..P..F.#@N..b.._..
9....xH65.,........i....hv.S....q.l...C9.,...E:X.\:..kW..z{..........J
./..?(d.F.O.y......|4.77.B<Kl.V..&...o.......&.g6..P....9.El>...
r}E..dm...mam.>.SE<..Z...p\......K..e.,.e'8...3...q..........-..
h.)...EX..zy.......@5..^.....&m.o......?.?*l...}..p%R... .:b...o...'..
.<.T2....,.uQ.....Gx''..e,E#..4.r.$..`....Sc.[.gnz_...c..F...WC).;T
.y...A(.6|.<.N.......O.'..(<......Ix.bE...5..m..)...!......SC.Q\
...M..m..)>@.T:.J........TS...K*.....R.!.3.....U>..<..{..
<<< skipped >>>

GET /i615/1505/80/0cc3a7c6f208.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s019.radikal.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Sun, 24 May 2015 13:06:08 GMT

Accept-Ranges: bytes

ETag: "8ae66b662296d01:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Set-Cookie: __RADVUID=94903310adaa0f74; expires=Mon, 16-Sep-2030 21:04:11 GMT; path=/; domain=.radikal.ru

Date: Thu, 17 Sep 2015 03:04:10 GMT

Connection: close

Content-Length: 163517
.PNG........IHDR.......%.............sRGB.........gAMA......a.... cHRM
..z&..............u0...`..:....p..Q<....IDATx^...x.W.-,[f.[.....e.I
.,.....vbH..q.r8q8...;..........y3.{3..}._...{.^. ].r.N..;_..:u.Tu....
..w.>|......?........3......\.....e..q.#G.r.1.[......].....e...o.#.
;.....b.\.6}.....w.....1..8..k.........=.{O...(- .......u.0..;.A.>.
.<.#......b.C......|x..`.P.o......a.wZ.....q....Q_.v.X.....~....~{w
..u..vo>.C.....S.....#G.....Q......^....@t|.Rrk.....~i.&.o....x....
H.&....{...:.......W...........I.......X.N.Fdp.""...R...l..9.C]].`j..L
.T..........O.....j>..x.._S.q...%..[#.....o.f.k.F......e{.m..]9...0
..|M... ....~?.9.v.#.....0..w....~......{0....C..q....e;O....u..[....'
N....pD......!.~...Eva5...0..S..........srr.........\/...|...P\R......
.........!......_P...7...#.UTV.c}|&....e.eHMK....;z..u....U.... <"B
.....qq..3...-DgW'V.^...`..?.<......X..}.....e..a..u.F.f5...:...?e_
}[email protected]..=..x..s..<;.<x.>..[...s...|]G .c<.'O....
....p!.....g..P...!.u.W.!...0...w.6...0......~....'......\..........@.
..o....Hh6o....].Z.....c9#L.}.7................T2..6.S<.Q...g......
k....y..~.7..o{.S..y. **...f.=r4..<...f....{..............(....m..&
...V.........~8#..0...?.^...l....7v...........^.^...x...8t..<...y..
|..'....1....O<.#.......w..]|....... '.S'O..g.....q......R...c;.y..
.?.....{.../.f...o...x...p..i......... ... ..#8a.w..1E ihhP....O.4IM$.
..j{Hh(.O.....!;'GM0rlTt../.erJ....k.S|...s..@uu5....@..;`l2.z........
.{.mr.QQQJ..g....&.P...1..*;;.^...<.9...M.....sR.$Ay...h.......
<<< skipped >>>

GET /index.html HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.28

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; path=/

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da7a95b1963030c8402; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip
10a2.............][s...~.T.?4........K3....SV....ly]...3.........J.u..
....'....U.LS.E."U._...=...`.3.%....$.@_O....;..@g.........&..Cg....J.
!.)..#.}4.7.....27.....DLq..Bv5T0.ys@.......(.$,.Qk#))...aO..`..YW....
...\.[.......M&....v.......a].....a....a.0..=..F.$..... h'...L.m..p.?.
o`0...$:[email protected]...?@.]L..?.v.....k8..~......>...."d..9
.{..|..JA8q.b..bx^..>.U..[.....IR...Bl..."..<...,.`......$......
.*.......T....QH..L.^.x.....Y..H..E$Z..g..s-......0..{..2..$#.....[.&.
..4.. m.R...m.R.!Ye!..d.]..T... ..k......Yc3........m..V~SZY.{k..V~%./
.3P.:.b.l......:.vI..\V.L  dA.,xm.<D3'`.R..1..JS..V:..$.C.. ..A}"~.
...`...=.*....A?y0.1....Bl..WWR...P..\...x.L..LT8.E.J....>u-).8.o..
.....@w..>L..E.....HMv.u........<dt.S).._..w...cP...QhR........ 
.........Db.YHG-.]...a....6.......e..]([email protected]..].=.U....Q.0...Pg
(W.^8}Y'IR.......g....6......_.L\SL.E..zPK..=...p....]\1.a..s.Z.1....)
Y&}.E.b.Fprul7H....p&...jWJ..9... I.EC*SK6....I....k-....5....5.6.:p&l
t;[email protected].....].......[......8....w0...w.D....;
k3 .&.........P..;M.w&.....dW.E...Q....QK....a.. ......(.-..._.....l..
C....Iz.....P...nx.....S........c..~gC.Y..L...k............ ......zc..
E0..J.8..14..\..^.......]..r.bq.G.1.....7eX..P..=G.P.....j.....v.L.E..
......./.|{H.I..<<E.'....yr`....x".....6q.(...V..4.3..x.p..Z. ..
.E.../...._....78U.........X.c.m m.-.<Z.o.1'.A.....j...y?..)..Rp.#.
.:....4.......|...........?%(..1#......F|3...Y.W.<=.......2..o&J ..
.Y.n..m....h..A......W...C...NB..R.&4....m#G......^..&..p!...pO..6
<<< skipped >>>

GET /style/css/bootstrap.min.css HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/css

Last-Modified: Sun, 17 May 2015 18:57:42 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"5558e4a6-1abea"

X-Powered-By: PleskLin

Content-Encoding: gzip
4679.............}k..8..........)[%...............a#...dKNkZ.<.\...
~..M..$...q...1].$...H...~.........Q.M.T.i.i.M.x.v.4......f...myx...\.
.V....L..x..3...s.4Y5.....8.....Xg..|L.j....M".9....7.......`...)...CR
3T.../........]~...?..euH...,..5'4....-0..._.u....,k.o..eW....9....:9.
.:...z.9...7.&...j.?J.....q....G....n.....T...1.&U.o.l..y....I......mr
j....=W.p...x......\........1.4..........%..S.|}d<..rM.i^....SR.OU.
\eu=..:,.d~,.c6....2NUR.........x.D.x,..?m.S...?.3(..1[.3.]6...y.f...&
;..&s...e.l...8....1.1ac..8../......N9.6...&o...eSV...M.4..q|.2H..Yz..
....g)....e._..Q...."{..6..u?.2....0....I.q........,....8.....v..Z3.Q.
!.<0..gF..t9.u...Xel.lL..r..ZpZ3.d6.....Q4g.0..5.Q4.%..Yq.....,..X1
=yw......G)..T"=.1..,>}....!C.....)....\..Q.1}.........h.I.My..L...
.L..a..N..:...>%.lh~..cD_7g...0?....<5r.0~1.....TYb..h..{..k...T
.)L..Oy.o.L. Q^..f.....EA*... [email protected]....(.?.A..eY..0!....E.:9.....f...z
{.jF..... ..Ol.$...#...^T.4.%.B...Q.lWn..(?...!....S..\xL..>...TT.,
^.h..l....;[email protected]...|.d.G6 .....>......../....BU.....{t
L/.!kD......H..,..`..M.d.T.4..U..&L..~........l..D...g....3l09}.:....,
.tP...V."{..).\f.........p=. ?_. ....Er..G...I...v|..!K.dp............
.j.c...z......P..~........8....j...w|.a&L.7VD.......}..>>&;....B
.o.o........w.7..@[IB.j........=a....O.P...........}(.....kr.....j.&.3
s*...a...8...2O..wd.G .<...H...a..3pT{^wH..>.i..~...i.....KY..L^
..5. ?._...`[email protected]_k.T.'....L..o{.b...C.i.O..)R3...<.OO.L.:3
.#L[.Q.l...9.S.]....H.KH.o7.aP."..i..\....6s....Z|=.s.2....b.4...a
<<< skipped >>>

GET /style/js/html5shiv.js HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Sat, 12 Jan 2013 13:47:45 GMT

ETag: W/"1fc28b6-3cf-4d317a81ca240"

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da7a95b1963030c8402; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip
236............mS.n.0...).\zI.4..-.......uh2.=*6m..%O....GYN..........
....:.....~.v...z.X.7C..x][email protected]..,.....(L.....p.....`4P
-.8..h.$...^.....n..u.....~. ....r..K[.N.....8..J.gWWX6...c.$.4.%.0...
4..........q.$...(..  W.$5v.4)Q..8.2...V#...*c.9.JN.@x&0e...h..7..tNT.
.uB..k.R.)..sY.....R\.T..|..cO.......F.....t..E .7.!g.P.(..r.!GO.cg-3Q
.de~.C.R.`\').!..b..{......p.....>M......2...|....9j.a.N.... J#n...
P...%....9.(...Bm|U...8..zV....a.......".k#.lZ....b...../C...."GYq.fXk
%YqXe.o.....d....R.#.,.........#.Fj..f..r......g......{.ol.^....VV5...
".l.............0..HTTP/1.1 404 Not Found..Server: nginx..Date: Thu, 1
7 Sep 2015 03:04:08 GMT..Content-Type: text/html..Transfer-Encoding: c
hunked..Connection: keep-alive..Vary: Accept-Encoding..Last-Modified: 
Sat, 12 Jan 2013 13:47:45 GMT..ETag: W/"1fc28b6-3cf-4d317a81ca240"..X-
Powered-By: PleskLin..Set-Cookie: uid_zxcv=258cc02055fa2da7a95b1963030
c8402; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/..Content-Encoding: 
gzip..236............mS.n.0...).\zI.4..-.......uh2.=*6m..%O....GYN....
..........:.....~.v...z.X.7C..x][email protected]..,.....(L.....p..
...`4P-.8..h.$...^.....n..u.....~. ....r..K[.N.....8..J.gWWX6...c.$.4.
%.0...4..........q.$...(..  W.$5v.4)Q..8.2...V#...*c.9.JN.@x&0e...h..7
..tNT..uB..k.R.)..sY.....R\.T..|..cO.......F.....t..E .7.!g.P.(..r.!GO
.cg-3Q.de~.C.R.`\').!..b..{......p.....>M......2...|....9j.a.N.... 
J#n...P...%....9.(...Bm|U...8..zV....a.......".k#.lZ....b...../C...."G
Yq.fXk%YqXe.o.....d....R.#.,.........#.Fj..f..r......g......{.ol.^
<<< skipped >>>

GET /style/js/respond.min.js HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Sat, 12 Jan 2013 13:47:45 GMT

ETag: W/"1fc28b6-3cf-4d317a81ca240"

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da7a95b1963030c8402; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip
236............mS.n.0...).\zI.4..-.......uh2.=*6m..%O....GYN..........
....:.....~.v...z.X.7C..x][email protected]..,.....(L.....p.....`4P
-.8..h.$...^.....n..u.....~. ....r..K[.N.....8..J.gWWX6...c.$.4.%.0...
4..........q.$...(..  W.$5v.4)Q..8.2...V#...*c.9.JN.@x&0e...h..7..tNT.
.uB..k.R.)..sY.....R\.T..|..cO.......F.....t..E .7.!g.P.(..r.!GO.cg-3Q
.de~.C.R.`\').!..b..{......p.....>M......2...|....9j.a.N.... J#n...
P...%....9.(...Bm|U...8..zV....a.......".k#.lZ....b...../C...."GYq.fXk
%YqXe.o.....d....R.#.,.........#.Fj..f..r......g......{.ol.^....VV5...
".l.............0..HTTP/1.1 404 Not Found..Server: nginx..Date: Thu, 1
7 Sep 2015 03:04:08 GMT..Content-Type: text/html..Transfer-Encoding: c
hunked..Connection: keep-alive..Vary: Accept-Encoding..Last-Modified: 
Sat, 12 Jan 2013 13:47:45 GMT..ETag: W/"1fc28b6-3cf-4d317a81ca240"..X-
Powered-By: PleskLin..Set-Cookie: uid_zxcv=258cc02055fa2da7a95b1963030
c8402; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/..Content-Encoding: 
gzip..236............mS.n.0...).\zI.4..-.......uh2.=*6m..%O....GYN....
..........:.....~.v...z.X.7C..x][email protected]..,.....(L.....p..
...`4P-.8..h.$...^.....n..u.....~. ....r..K[.N.....8..J.gWWX6...c.$.4.
%.0...4..........q.$...(..  W.$5v.4)Q..8.2...V#...*c.9.JN.@x&0e...h..7
..tNT..uB..k.R.)..sY.....R\.T..|..cO.......F.....t..E .7.!g.P.(..r.!GO
.cg-3Q.de~.C.R.`\').!..b..{......p.....>M......2...|....9j.a.N.... 
J#n...P...%....9.(...Bm|U...8..zV....a.......".k#.lZ....b...../C...."G
Yq.fXk%YqXe.o.....d....R.#.,.........#.Fj..f..r......g......{.ol.^
<<< skipped >>>

GET /style/images/webmoney.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/png

Content-Length: 2378

Last-Modified: Sun, 24 May 2015 17:58:30 GMT

Connection: keep-alive

ETag: "55621146-94a"

X-Powered-By: PleskLin

Accept-Ranges: bytes
.PNG........IHDR...V.........t.......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:38D6E72FE32411E3B37184B7
1279972C" xmpMM:DocumentID="xmp.did:38D6E730E32411E3B37184B71279972C"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:38D6E72DE32411E3B3
7184B71279972C" stRef:documentID="xmp.did:38D6E72EE32411E3B37184B71279
972C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>........IDATx...oH.g....../..t.N. ......X..
C...2h..(.V/../.{..3."m."7HaA4..Al......N...5..0.t{..tp...cgO..7..X...
..s~.s.s..{.....:..z..*...V p..L....;.7_...w.adF...v..C.z/~\X..a.p}...
..M/..._.&Y4..|.\.p....m...}?\z...,/.U........U....L'...Z$...-.....X`.
!.....k~P.tx......[_......7t...d.o<2...p...&.*K6.KK..pz...w.....hd.
.3M........{.M...V..a.....a...^.m.H.....8I.i%......r..x.........B.mvFT
..g....w.....e..7X.,.5(sp..'a....&.ox.....D$.9Y...D..K.AC. ,.......N-.
..p.........C"/.......0......=.L$....-a.^.r(.......V.F....g......{G..$
.!..-k...x.V/.....O4....]yk/...3S.........%....7k..d.>x.....E..
<<< skipped >>>

GET /style/images/crossfire.png HTTP/1.1