Trojan.Win32.FlyStudio_3817971cee – Adaware

Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.Swrort.3.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 3817971ceeca534631abef6068e85e6a

SHA1: d52d664b71a749f216e055cbc0ab145e1d3fd76d

SHA256: a074488dcfd74dd30374ce43c197fe180e35e2be64040d640a2266d727d7f9de

SSDeep: 24576:0MY Lv5f7sELpywatMn77A/t75C09mKCAXTbUq5Oz9B7RXCn:0MDLRRk/un77A/t8tKCAjbn5OzX70

Size: 1110528 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2015-04-25 13:11:39

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:560

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:560 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\rec_subtract[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\home[2].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\plugin[1].php (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lxqq[1].htm (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\noavatar_small[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\thread-17831-1-1[1].html (2000 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sync[1].htm (893 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@release.baidu[1].txt (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common[1].js (942 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\base[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\background[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[1].png (637 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common[2].js (3375 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\online_member[1].gif (365 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hm.baidu[1].txt (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\plugin[1].htm (76 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery_a4373ccd[1].js (4721 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].js (2680 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA3X5JIE.htm (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\seditor[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\userinfo[1].gif (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\arrow_top[1].gif (51 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\noavatar_middle[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\0f000Q2KxFhCznBO83poas[1].swf (5573 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\arw_l[1].gif (844 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\portal[2].js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\search[1].png (1 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (20248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA45Q97G.htm (7757 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ls_flowbar[1].js (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\medal3[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\06_avatar_middle[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cpro[2].js (1677 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rec_add[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\forumlink[1].gif (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ad[1].gif (997 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\forum_viewthread[2].js (2322 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fav[1].gif (596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\medal1[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\fill_bg[1].jpg (9184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CALSSVD5 (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ls[1].js (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\nosexbg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fastreply[1].gif (608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bd-logo5[1].png (1545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAPGZYR7.htm (3346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qq_share[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\adx[1].gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logging[1].js (274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\nv_a[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA5O2T9R.gif (49 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (439 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\discuz_tips[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qshare[2].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rt[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA892BC9 (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pmto[1].gif (152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\portal[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\seditor[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].php (2784 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.ltywz[2].txt (3377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico_jdt[1].png (849 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style_28_forum_viewthread[2].css (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[2].css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\arrow_left_50_ie6_9158e720[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\midavt_shadow[1].gif (79 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\noavatar_middle[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pengyou[1].png (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\arw_r[1].gif (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\25_avatar_middle[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[1].png (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\oshr[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\discuz_tips[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\gpixel[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cpro.baidustatic[1].txt (218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sync2r[1].htm (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\weibo[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style_28_forum_viewthread[1].css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style_28_common[1].css (654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sync[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style_28_common[2].css (1782 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hot_1[1].gif (680 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qshare[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\arw[1].gif (940 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\forum[2].js (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\arrow_left_60_e700a3bb[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\51_avatar_middle[1].jpg (1617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\post[1].htm (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fj_btn[1].png (217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAAZCTO9.htm (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\core[1].php (762 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (205 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@pos.baidu[1].txt (746 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c[2].js (3108 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\newarow[1].gif (327 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\share_btn[1].png (476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\collection[1].png (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.ltywz[1].txt (3930 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\qzone[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\0f000Dlh0nJS1Y3OYHhQp0[1].swf (5498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\thread-17831-1-1[1].htm (1256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cpro[1].js (521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[2].js (3324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pn_post[1].png (569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\editor[1].gif (2244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAKDUF4R.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pt_item[1].png (569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic[1].gif (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c[1].js (2200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\noavatar_middle[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\qq_login[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\icon[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\nv[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\thread-prev[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\thread-next[1].png (999 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pn[1].png (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\flw_ico[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qmenu[1].png (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qfcode[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\forum_viewthread[1].js (1106 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[2].txt (441 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@pos.baidu[2].txt (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\medal2[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logging[2].js (390 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\print[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\home[1].php (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[1].css (934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\forum[1].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\uf[1].js (9631 bytes)
C:\dc.dll (122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo-border-light[1].png (473 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sync_pos[1].htm (1596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\arrwd[1].gif (51 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\scrolltop[1].png (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cpro[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style_28_forum_viewthread[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\plugin[1].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style_28_common[1].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@pos.baidu[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\noavatar_middle[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qshare[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logging[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\discuz_tips[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\forum_viewthread[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\noavatar_middle[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\portal[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\seditor[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.ltywz[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\home[1].php (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@pos.baidu[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\forum[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.ltywz[1].txt (0 bytes)

Registry activity

The process %original file name%.exe:560 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1429956699"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "15 A6 EE FF 8A 25 D8 30 11 9F 42 2A 05 AD 62 28"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
f803ad370a8649a143429f179af5f3ab	c:\dc.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\rec_subtract[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\home[2].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\plugin[1].php (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lxqq[1].htm (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\noavatar_small[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\thread-17831-1-1[1].html (2000 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sync[1].htm (893 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@release.baidu[1].txt (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common[1].js (942 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\base[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\background[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo[1].png (637 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\common[2].js (3375 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\online_member[1].gif (365 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hm.baidu[1].txt (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\plugin[1].htm (76 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery_a4373ccd[1].js (4721 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].js (2680 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA3X5JIE.htm (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\seditor[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\userinfo[1].gif (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\arrow_top[1].gif (51 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\noavatar_middle[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\0f000Q2KxFhCznBO83poas[1].swf (5573 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\arw_l[1].gif (844 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\portal[2].js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\search[1].png (1 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (20248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA45Q97G.htm (7757 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ls_flowbar[1].js (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\medal3[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\06_avatar_middle[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cpro[2].js (1677 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rec_add[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\forumlink[1].gif (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ad[1].gif (997 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\forum_viewthread[2].js (2322 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fav[1].gif (596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\medal1[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\fill_bg[1].jpg (9184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CALSSVD5 (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ls[1].js (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\nosexbg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fastreply[1].gif (608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bd-logo5[1].png (1545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAPGZYR7.htm (3346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qq_share[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\adx[1].gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logging[1].js (274 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\nv_a[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA5O2T9R.gif (49 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (439 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\discuz_tips[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qshare[2].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\rt[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA892BC9 (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pmto[1].gif (152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\portal[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\seditor[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].php (2784 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.ltywz[2].txt (3377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico_jdt[1].png (849 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style_28_forum_viewthread[2].css (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[2].css (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\arrow_left_50_ie6_9158e720[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\midavt_shadow[1].gif (79 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\noavatar_middle[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pengyou[1].png (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\arw_r[1].gif (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\25_avatar_middle[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[1].png (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\oshr[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\discuz_tips[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\gpixel[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cpro.baidustatic[1].txt (218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sync2r[1].htm (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\weibo[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\style_28_forum_viewthread[1].css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style_28_common[1].css (654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sync[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style_28_common[2].css (1782 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hot_1[1].gif (680 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qshare[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\arw[1].gif (940 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\forum[2].js (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\arrow_left_60_e700a3bb[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\51_avatar_middle[1].jpg (1617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\post[1].htm (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fj_btn[1].png (217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAAZCTO9.htm (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\core[1].php (762 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (205 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@pos.baidu[1].txt (746 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c[2].js (3108 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\newarow[1].gif (327 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\share_btn[1].png (476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\collection[1].png (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.ltywz[1].txt (3930 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\qzone[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\0f000Dlh0nJS1Y3OYHhQp0[1].swf (5498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cpro[1].js (521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[2].js (3324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pn_post[1].png (569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\editor[1].gif (2244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAKDUF4R.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pt_item[1].png (569 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic[1].gif (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c[1].js (2200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\noavatar_middle[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\qq_login[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\icon[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\nv[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\thread-prev[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\thread-next[1].png (999 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pn[1].png (592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\flw_ico[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\qmenu[1].png (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qfcode[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\forum_viewthread[1].js (1106 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[2].txt (441 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@pos.baidu[2].txt (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\medal2[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logging[2].js (390 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\print[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\home[1].php (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\base[1].css (934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\forum[1].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\uf[1].js (9631 bytes)
C:\dc.dll (122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\logo-border-light[1].png (473 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sync_pos[1].htm (1596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\arrwd[1].gif (51 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\scrolltop[1].png (1 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: QQ424308510
Product Name: ??163?????
Product Version: 1.1.0.0
Legal Copyright: QQ424308510 ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.1.0.0
File Description: 163????
Comments: by??
Language: Language Neutral

Company Name: QQ424308510Product Name: ??163?????Product Version: 1.1.0.0Legal Copyright: QQ424308510 ????Legal Trademarks: Original Filename: Internal Name: File Version: 1.1.0.0File Description: 163????Comments: by??Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	1400832	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	1404928	1081344	1080832	5.39928	06aede547695b03c99eb62e91b1365d8
.rsrc	2486272	28672	28672	3.73868	451cd23972f61e5f4864696d46c0c5b7

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.ltywz.com/data/cache/style_28_common.css?xB2	125.88.190.6
hxxp://www.ltywz.com/api/xmlapi.asmx/GetInfo	125.88.190.6
hxxp://www.ltywz.com/data/cache/common.js?xB2	125.88.190.6
hxxp://www.ltywz.com/data/cache/portal.js?xB2	125.88.190.6
hxxp://www.ltywz.com/data/cache/logging.js?xB2	125.88.190.6
hxxp://www.ltywz.com/static/image/common/background.png	125.88.190.6
hxxp://wmjs.wshifen.com/cpro/ui/c.js
hxxp://www.ltywz.com/static/image/common/nv.png	125.88.190.6
hxxp://cb.e.shifen.com/acom?di=u1991537&dcb=BAIDU_DUP2_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=0&dai=1&dds=&drs=3&dvi=1432188695&ltu=http://www.ltywz.com/thread-17831-1-1.html&liu=&ltr=&lcr=&ps=153x-1&psr=1276x846&par=1276x818&pcs=60x20&pss=960x156&pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=140&tlm=1434271564&tcn=1434271564&tpr=1434271564146&dpt=none&coa=&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&baidu_id=
hxxp://cb.e.shifen.com/acom?adn=0&at=128&aurl=&cad=1&ccd=32&cec=gb2312&cfv=11&ch=0&col=en-us&conBW=0&conOP=1&cpa=1&dai=1&dis=0&ltr=&ltu=http://www.ltywz.com/thread-17831-1-1.html&lu_161=0&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=153x-1&psr=1276x846&pss=960x156&qn=4f4730e82ea33ac9&rad=&rsi0=960&rsi1=60&rsi5=4&rss0=#FFFFFF&rss1=#FFFFFF&rss2=#0000ff&rss3=&rss4=&rss5=&rss6=#e10900&rss7=&scale=&skin=tabcloud_skin_1&stid=5&td_id=1991537&titFF=å®‹ä½“&titFS=12&titTA=left&tn=baiduCustSTagLinkUnit&tpr=1434271564146&ts=1&version=2.0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u1991537&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.172.2203.2203
hxxp://www.ltywz.com/data/cache/forum_viewthread.js?xB2	125.88.190.6
hxxp://www.ltywz.com/static/image/common/print.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/thread-prev.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/hot_1.gif	125.88.190.6
hxxp://common.mail.qq.com/zh_CN/htmledition/js/qf/page/qfcode.js
hxxp://www.ltywz.com/static/image/common/forumlink.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/userinfo.gif	125.88.190.6
hxxp://www.ltywz.com/uc_server/avatar.php?uid=2951&size=middle	125.88.190.6
hxxp://www.ltywz.com/static/image/common/medal1.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/medal2.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/arw_r.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/arw_l.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/online_member.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/nosexbg.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/flw_ico.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/pmto.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/ad.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/qzone.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/qq_share.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/pengyou.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/rt.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/oshr.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/collection.png	125.88.190.6
hxxp://www.ltywz.com/uc_server/avatar.php?uid=21714&size=middle	125.88.190.6
hxxp://wn.pos.e.shifen.com/adx.php?c=d25pZD05Y2QyMWFhNDMwNTRkN2EzAHM9OWNkMjFhYTQzMDU0ZDdhMwB0PTE0MzQyNzE1NzEAc2U9MQBidT00AHByaWNlPVZYMF9Vd0FKbm1GN2pFcGdXNUlBOHIyVkRkb0ZGYURuM1RWMjh3AGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD0AYmNobWQ9MAB2PTEAaT1kM2EzYzZiZg
hxxp://wmjs.wshifen.com/cpro/ui/noexpire/img/2.0.1/logo-border-light.png
hxxp://wmjs.wshifen.com/sync.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1
hxxp://cb.e.shifen.com/sync_pos.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1
hxxp://su.bdimg.jomodns.com/static/dspui/js/uf.js
hxxp://cb.e.shifen.com/sync2r.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1
hxxp://www.ltywz.com/static/image/common/ico_jdt.png	125.88.190.6
hxxp://www.ltywz.com/uc_server/data/avatar/000/00/29/51_avatar_middle.jpg	125.88.190.6
hxxp://www.ltywz.com/uc_server/images/noavatar_small.gif	125.88.190.6
hxxp://www.ltywz.com/uc_server/data/avatar/000/00/73/25_avatar_middle.jpg	125.88.190.6
hxxp://www.ltywz.com/uc_server/images/noavatar_middle.gif	125.88.190.6
hxxp://www.ltywz.com/uc_server/data/avatar/000/02/40/06_avatar_middle.jpg	125.88.190.6
hxxp://su.bdimg.jomodns.com/static/dspui/js/ll/ls.js?dv=559
hxxp://www.ltywz.com/static/image/editor/editor.gif	125.88.190.6
hxxp://su.bdimg.jomodns.com/static/dspui/js/ls_flowbar.js?d=22201
hxxp://wmjs.wshifen.com/cpro/ui/f.js
hxxp://cb.e.shifen.com/acom?di=u2109486&dcb=BAIDU_DUP2_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=0&dai=2&dds=&drs=3&dvi=1432188695&ltu=http://www.ltywz.com/thread-17831-1-1.html&liu=&ltr=&lcr=&ps=5695x-2&psr=1276x846&par=1276x818&pcs=60x20&pss=962x5717&pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=27468&tlm=1434271591&tcn=1434271591&tpr=1434271564146&dpt=none&coa=&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&baidu_id=
hxxp://cb.e.shifen.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3&ltr=&ltu=http://www.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2002&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270
hxxp://www.a.shifen.com/rp/home?type=flowbar&di=u2108193&rsi0=auto&rsi1=50&title=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&ltu=http://www.ltywz.com/thread-17831-1-1.html&ref=&pageWidth=60&pageHeight=20&t=1434271591068&rsi0=60&rsi1=50
hxxp://cb.e.shifen.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3&ltr=&ltu=http://www.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2001&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270
hxxp://su.bdimg.jomodns.com/static/dspui/js/lib/jquery_a4373ccd.js
hxxp://wmjs.wshifen.com/cpro/ui/noexpire/css/1.0.0/base.css
hxxp://wmjs.wshifen.com/cpro/ui/noexpire/js/3.2.0/base.js
hxxp://pagead.l.doubleclick.net/pixel?google_nid=baidu&google_cm
hxxp://pagead.l.doubleclick.net/pixel?google_nid=baidu&google_cm=&google_tc=
hxxp://wn.pos.e.shifen.com/adx.php?c=d25pZD1hYjMxYzAyNjZiMjJlM2EyAHM9YWIzMWMwMjY2YjIyZTNhMgB0PTE0MzQyNzE1ODAAc2U9MQBidT01AHByaWNlPVZYMF9YQUFOcDh0N2pFcGdXNUlBOGlQRFg4QURyRllqSzVVbDhRAGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD1FM0VBRDcxRDFGNjhERTZFREQwQURBRjQ2OEREN0U0OABiY2htZD0wAHY9MQBpPTBjZTMyNDNi&ext=cGxhbmlkPTc2NSZsaW1pdD0xNSZyYz1oeg
hxxp://wmjs.wshifen.com/cpro/ui/noexpire/js/3.1.6/cpro.js
hxxp://click.hm.e.shifen.com/mkt.gif?et=0&ai=ba6dceb3db2dfe732c732f17b61280a9
hxxp://wmjs.wshifen.com/cpro/ui/noexpire/img/2.0.0/bd-logo5.png
hxxp://cm.pos.e.shifen.com/gpixel?google_gid=CAESEJjFx4RhgLnSGfBEJ8AfDVY&google_cver=1
hxxp://wmpic.wshifen.com/media/v1/0f000Q2KxFhCznBO83poas.swf
hxxp://su.bdimg.jomodns.com/static/dspui/img/flowbar/arrow_left_50_ie6_9158e720.png
hxxp://www.ltywz.com/rj/post.htm	125.88.190.6
hxxp://wn.pos.e.shifen.com/adx.php?c=d25pZD0xNTkzNjgzNGQ1ZTFhMjBlAHM9MTU5MzY4MzRkNWUxYTIwZQB0PTE0MzQyNzE1ODQAc2U9MQBidT01AHByaWNlPVZYMF9ZQUFFWDBON2pFcGdXNUlBOHN0TWhoOGpTamtEcFoyaTB3AGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD1FM0VBRDcxRDFGNjhERTZFREQwQURBRjQ2OEREN0U0OABiY2htZD0wAHY9MQBpPTg3ODJlMDIw&ext=cGxhbmlkPTEwMCZsaW1pdD0wJnJjPWh6
hxxp://www.ltywz.com/static/image/common/arrow_top.gif	125.88.190.6
hxxp://wmpic.wshifen.com/media/v1/0f000Dlh0nJS1Y3OYHhQp0.swf
hxxp://click.hm.e.shifen.com/mkt.gif?et=0&ai=8002e2c915c26c3a78b4270c968fe58c
hxxp://su.bdimg.jomodns.com/static/dspui/img/flowbar/arrow_left_60_e700a3bb.png
hxxp://static.n.shifen.com/v.gif?fm=load&r_type=loadsuccess&r_tm=268742530&r_sid=&r_lu=u2108193&r_tpl=flowbar_102&r_qid=bc28cb4eb45d34c4&r_tn=38068079_cpr&r_url=http://www.ltywz.com/thread-17831-1-1.html&pid=201&productline=cun&productsub=cun&pj=ext_hl&tab=query&logactionid=0100100002&mod=cun&r_time=1434271595521&r_ltime=15&r_stime=1434271595506&r_sp=flowbar&r_innerWidth=10&r_innerHeight=50
hxxp://www.ltywz.com/static/js/qshare.js	125.88.190.6
hxxp://www.ltywz.com/static/image/common/fastreply.gif	125.88.190.6
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=5796949&show=pic
hxxp://origin.open.qq.com/apps/qshare/images/icon.gif
hxxp://www.ltywz.com/source/plugin/rsf_logo_fill/template/fill_bg.jpg	125.88.190.6
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=5796949&show=pic&t=z
hxxp://oz.cnzz.com/stat.htm?id=5796949&r=&lg=en-us&ntime=none&cnzz_eid=1877242474-1434271586-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1248773792	198.11.132.200
hxxp://all.cnzz.com.danuoyi.tbcache.com/img/pic.gif
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=36257576	42.120.219.171
hxxp://www.ltywz.com/plugin.php?id=milu_seotool:sitemap&tpl=no&myac=milu_seotool_cron&inajax=1	125.88.190.6
hxxp://www.ltywz.com/home.php?mod=misc&ac=sendmail&rand=1434271536	125.88.190.6
hxxp://www.ltywz.com/static/image/common/scrolltop.png	125.88.190.6
hxxp://x2.tcdn.qq.com/cloud/scripts/discuz_tips.js?v=1
hxxp://www.minnanwl.com/gengxin/qqlx/lxqq.htm	116.255.250.58
hxxp://su.bdimg.com/static/dspui/img/flowbar/arrow_left_50_ie6_9158e720.png	163.177.8.49
hxxp://www.ltywz.com/static/image/common/arrwd.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/qmenu.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/nv_a.png	125.88.190.6
hxxp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3&ltr=&ltu=http://www.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2002&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270	115.239.210.141
hxxp://su.bdimg.com/static/dspui/img/flowbar/arrow_left_60_e700a3bb.png	163.177.8.49
hxxp://cm.g.doubleclick.net/pixel?google_nid=baidu&google_cm	216.58.209.194
hxxp://ubmcmm.baidustatic.com/media/v1/0f000Dlh0nJS1Y3OYHhQp0.swf
hxxp://s13.cnzz.com/stat.php?id=5796949&show=pic	1.99.192.16
hxxp://www.ltywz.com/static/image/common/thread-next.png	125.88.190.6
hxxp://pos.baidu.com/acom?di=u1991537&dcb=BAIDU_DUP2_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=0&dai=1&dds=&drs=3&dvi=1432188695&ltu=http://www.ltywz.com/thread-17831-1-1.html&liu=&ltr=&lcr=&ps=153x-1&psr=1276x846&par=1276x818&pcs=60x20&pss=960x156&pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=140&tlm=1434271564&tcn=1434271564&tpr=1434271564146&dpt=none&coa=&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&baidu_id=	115.239.210.141
hxxp://cpro.baidustatic.com/sync.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1
hxxp://cpro.baidustatic.com/cpro/ui/noexpire/css/1.0.0/base.css
hxxp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3&ltr=&ltu=http://www.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2001&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270	115.239.210.141
hxxp://c.cnzz.com/core.php?web_id=5796949&show=pic&t=z	195.27.31.248
hxxp://www.ltywz.com/thread-17831-1-1.html	125.88.190.6
hxxp://www.ltywz.com/data/cache/forum.js?xB2	125.88.190.6
hxxp://www.ltywz.com/static/image/common/fj_btn.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/newarow.gif	125.88.190.6
hxxp://wn.pos.baidu.com/adx.php?c=d25pZD1hYjMxYzAyNjZiMjJlM2EyAHM9YWIzMWMwMjY2YjIyZTNhMgB0PTE0MzQyNzE1ODAAc2U9MQBidT01AHByaWNlPVZYMF9YQUFOcDh0N2pFcGdXNUlBOGlQRFg4QURyRllqSzVVbDhRAGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD1FM0VBRDcxRDFGNjhERTZFREQwQURBRjQ2OEREN0U0OABiY2htZD0wAHY9MQBpPTBjZTMyNDNi&ext=cGxhbmlkPTc2NSZsaW1pdD0xNSZyYz1oeg	180.149.131.90
hxxp://www.ltywz.com/data/cache/seditor.js?xB2	125.88.190.6
hxxp://www.ltywz.com/static/image/common/pn.png	125.88.190.6
hxxp://www.ltywz.com/static/image/common/rec_subtract.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/arw.gif	125.88.190.6
hxxp://cpro.baidustatic.com/cpro/ui/f.js
hxxp://su.bdimg.com/static/dspui/js/uf.js	163.177.8.49
hxxp://su.bdimg.com/static/dspui/js/ll/ls.js?dv=559	163.177.8.49
hxxp://www.ltywz.com/static/image/common/weibo.png	125.88.190.6
hxxp://list.qq.com/zh_CN/htmledition/js/qf/page/qfcode.js	103.7.30.111
hxxp://dj0.baidu.com/v.gif?fm=load&r_type=loadsuccess&r_tm=268742530&r_sid=&r_lu=u2108193&r_tpl=flowbar_102&r_qid=bc28cb4eb45d34c4&r_tn=38068079_cpr&r_url=http://www.ltywz.com/thread-17831-1-1.html&pid=201&productline=cun&productsub=cun&pj=ext_hl&tab=query&logactionid=0100100002&mod=cun&r_time=1434271595521&r_ltime=15&r_stime=1434271595506&r_sp=flowbar&r_innerWidth=10&r_innerHeight=50	115.239.211.92
hxxp://cpro.baidustatic.com/cpro/ui/noexpire/js/3.1.6/cpro.js
hxxp://www.ltywz.com/static/image/common/logo.png	125.88.190.6
hxxp://release.baidu.com/sync2r.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1	115.239.210.141
hxxp://open.t.qq.com/apps/qshare/images/icon.gif	103.7.29.251
hxxp://cpro2.baidustatic.com/cpro/ui/noexpire/img/2.0.1/logo-border-light.png
hxxp://www.ltywz.com/static/image/common/px.png	125.88.190.6
hxxp://ubmcmm.baidustatic.com/media/v1/0f000Q2KxFhCznBO83poas.swf
hxxp://cpro.baidustatic.com/cpro/ui/c.js
hxxp://www.ltywz.com/static/image/common/search.png	125.88.190.6
hxxp://click.hm.baidu.com/mkt.gif?et=0&ai=ba6dceb3db2dfe732c732f17b61280a9	123.125.112.49
hxxp://wn.pos.baidu.com/adx.php?c=d25pZD0xNTkzNjgzNGQ1ZTFhMjBlAHM9MTU5MzY4MzRkNWUxYTIwZQB0PTE0MzQyNzE1ODQAc2U9MQBidT01AHByaWNlPVZYMF9ZQUFFWDBON2pFcGdXNUlBOHN0TWhoOGpTamtEcFoyaTB3AGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD1FM0VBRDcxRDFGNjhERTZFREQwQURBRjQ2OEREN0U0OABiY2htZD0wAHY9MQBpPTg3ODJlMDIw&ext=cGxhbmlkPTEwMCZsaW1pdD0wJnJjPWh6	180.149.131.90
hxxp://www.ltywz.com/uc_server/avatar.php?uid=23776&size=middle	125.88.190.6
hxxp://www.ltywz.com/static/image/common/fav.gif	125.88.190.6
hxxp://click.hm.baidu.com/mkt.gif?et=0&ai=8002e2c915c26c3a78b4270c968fe58c	123.125.112.49
hxxp://cpro.baidustatic.com/cpro/ui/noexpire/js/3.2.0/base.js
hxxp://pos.baidu.com/sync_pos.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1	115.239.210.141
hxxp://www.ltywz.com/uc_server/avatar.php?uid=7325&size=middle	125.88.190.6
hxxp://www.ltywz.com/static/image/common/medal3.gif	125.88.190.6
hxxp://www.ltywz.com/uc_server/avatar.php?uid=21455&size=middle	125.88.190.6
hxxp://www.ltywz.com/static/image/common/pt_item.png	125.88.190.6
hxxp://www.ltywz.com/uc_server/avatar.php?uid=22235&size=small	125.88.190.6
hxxp://www.ltywz.com/static/image/common/qq_login.gif	125.88.190.6
hxxp://www.ltywz.com/static/image/common/pn_post.png	125.88.190.6
hxxp://w.ltywz.com/api/xmlapi.asmx/GetInfo	125.88.190.6
hxxp://www.ltywz.com/data/cache/style_28_forum_viewthread.css?xB2	125.88.190.6
hxxp://discuz.gtimg.cn/cloud/scripts/discuz_tips.js?v=1	103.7.29.239
hxxp://entry.baidu.com/rp/home?type=flowbar&di=u2108193&rsi0=auto&rsi1=50&title=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&ltu=http://www.ltywz.com/thread-17831-1-1.html&ref=&pageWidth=60&pageHeight=20&t=1434271591068&rsi0=60&rsi1=50
hxxp://su.bdimg.com/static/dspui/js/ls_flowbar.js?d=22201	163.177.8.49
hxxp://www.ltywz.com/static/image/common/midavt_shadow.gif	125.88.190.6
hxxp://wn.pos.baidu.com/adx.php?c=d25pZD05Y2QyMWFhNDMwNTRkN2EzAHM9OWNkMjFhYTQzMDU0ZDdhMwB0PTE0MzQyNzE1NzEAc2U9MQBidT00AHByaWNlPVZYMF9Vd0FKbm1GN2pFcGdXNUlBOHIyVkRkb0ZGYURuM1RWMjh3AGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD0AYmNobWQ9MAB2PTEAaT1kM2EzYzZiZg	180.149.131.90
hxxp://cm.pos.baidu.com/gpixel?google_gid=CAESEJjFx4RhgLnSGfBEJ8AfDVY&google_cver=1	61.135.185.179
hxxp://www.ltywz.com/static/image/common/rec_add.gif	125.88.190.6
hxxp://pos.baidu.com/acom?adn=0&at=128&aurl=&cad=1&ccd=32&cec=gb2312&cfv=11&ch=0&col=en-us&conBW=0&conOP=1&cpa=1&dai=1&dis=0&ltr=&ltu=http://www.ltywz.com/thread-17831-1-1.html&lu_161=0&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=153x-1&psr=1276x846&pss=960x156&qn=4f4730e82ea33ac9&rad=&rsi0=960&rsi1=60&rsi5=4&rss0=#FFFFFF&rss1=#FFFFFF&rss2=#0000ff&rss3=&rss4=&rss5=&rss6=#e10900&rss7=&scale=&skin=tabcloud_skin_1&stid=5&td_id=1991537&titFF=å®‹ä½“&titFS=12&titTA=left&tn=baiduCustSTagLinkUnit&tpr=1434271564146&ts=1&version=2.0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u1991537&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.172.2203.2203	115.239.210.141
hxxp://cm.g.doubleclick.net/pixel?google_nid=baidu&google_cm=&google_tc=	216.58.209.194
hxxp://www.ltywz.com/static/image/common/share_btn.png	125.88.190.6
hxxp://icon.cnzz.com/img/pic.gif	195.27.31.246
hxxp://pos.baidu.com/acom?di=u2109486&dcb=BAIDU_DUP2_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=0&dai=2&dds=&drs=3&dvi=1432188695&ltu=http://www.ltywz.com/thread-17831-1-1.html&liu=&ltr=&lcr=&ps=5695x-2&psr=1276x846&par=1276x818&pcs=60x20&pss=962x5717&pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=27468&tlm=1434271591&tcn=1434271591&tpr=1434271564146&dpt=none&coa=&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&baidu_id=	115.239.210.141
hxxp://www.ltywz.com/uc_server/avatar.php?uid=24006&size=middle	125.88.190.6
hxxp://su.bdimg.com/static/dspui/js/lib/jquery_a4373ccd.js	163.177.8.49
hxxp://cpro.baidustatic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5.png
pcookie.cnzz.com	42.120.219.171

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /rp/home?type=flowbar&di=u2108193&rsi0=auto&rsi1=50&title=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&ltu=http://VVV.ltywz.com/thread-17831-1-1.html&ref=&pageWidth=60&pageHeight=20&t=1434271591068&rsi0=60&rsi1=50 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: entry.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:20 GMT

Content-Type: text/html;

Transfer-Encoding: chunked

Connection: Keep-Alive

Server: PS-DSP/1.0

10d4..<!doctype html><html><head><meta charset=utf-8></head><body> <script src="hXXp://su.bdimg.com/static/dspui/js/lib/jquery_a4373ccd.js"></script><script>..var s_config={"r_tm": "268742530","r_sid" : "","r_lu": "u2108193","r_tpl":"flowbar_102","r_qid":"bc28cb4eb45d34c4","r_tn":"38068079_cpr","r_url":"http:\/\/VVV.ltywz.com\/thread-17831-1-1.html"};..var s_conf = {"isMobile":"","fenlei":"mv6quAkxTZn0IZRqIHcknj6krHn0T1dBm1c3mvcYuycYPyf1PAnY0ZwV5HcvrjTYnWR1n0KWUMw85Hn3njm3njT4gvPsT6K1TL0q0ZP1Tjcq0ZNzUjdCIZwsrBtEILILQhkYXgIlQhPEUiqYpZF-myfVnHT3n1DVniYkQh9YUys","r_ref":""};..var now="1434271580";var s_domain={"clickDomain":"http:\/\/entry.baidu.com/","staticUrl":"http:\/\/su.bdimg.com/"};</script><script>.var ADS = [{"title":"......","displayType":"","recommtype":"103","hidehit":"0","rpkey":""},{"title":"............","displayType":"","recommtype":"103","hidehit":"0","rpkey":""},{"title":"............","displayType":"","recommtype":"103","hidehit":"0","rpkey":""},{"title":"...........................","displayType":"","recommtype":"117","hidehit":"0","rpkey":""},{"title":"............","displayType":"","recommtype":"103","hidehit":"0","rpkey":""},{"title":"............","displayType":"","recommtype":"103","hidehit":"0","rpkey":""},{"title":".....................","displayType":"","recommtype":"117","hidehit":"0","rpkey":""},{"title":"............","displayType":"","recommtype":"3","hidehit":"0","rpkey":""},{"title":"......","displayType":"","recomm

<<< skipped >>>

GET /sync2r.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1 HTTP/1.1

Referer: hXXp://pos.baidu.com/sync_pos.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: release.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

HTTP/1.1 200 OK

Accept-Ranges: bytes

Connection: keep-alive

Content-Length: 2047

Content-Type: text/html

Date: Sun, 14 Jun 2015 08:46:16 GMT

Etag: "557ba5a3-7ff"

Last-Modified: Sat, 13 Jun 2015 03:38:11 GMT

Server: nginx

<!DOCTYPE html>.<html>. . <head></head>. . <body>. <script type="text/javascript">. var sendByIframe = function (b) {. var c = document.createElement("iframe");. c.style.display = "none";. c.setAttribute("src", b);. document.body.insertBefore(c, document.body.firstChild). },. getCookie = function (b, c) {. var a;. c = c || window;. var d = RegExp("(^| )" b "=([^;]*)(;|$)").exec(c.document.cookie);. d && (a = d[2]);. return a. },. setCookie = function (b, c, a) {. a = a || {};. var d = a.expires;. "number" == typeof a.expires && (d = new Date, d.setTime(d.getTime() a.expires));. document.cookie = b "=" c (a.path ? "; path=" a.path : "") (d ? "; expires=" d.toGMTString() : "") (a.domain ? "; domain=" a.domain : "") (a.secure ? "; secure" : ""). },. getUrlParam = function (b) {. b = RegExp("(^|&)" b "=([^&]*)(&|$)", "i");. b = window.location.search.substr(1).match(b);. return null != b ? decodeURIComponent(b[2]) : null. },. currentDomain = document.domain.toLowerCase(),. referDomain = (docu

<<< skipped >>>

GET /mkt.gif?et=0&ai=ba6dceb3db2dfe732c732f17b61280a9 HTTP/1.1

Accept: */*

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3&ltr=&ltu=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2002&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: click.hm.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

HTTP/1.1 204 No Content

Content-Type: image/gif

Set-Cookie: HMACCOUNT=65BC3D3544E471DE; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Cache-Control: private, max-age=0, no-cache

Pragma: no-cache

Connection: close

Date: Sun, 14 Jun 2015 08:46:22 GMT

Server: apache

GET /static/dspui/js/uf.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: su.bdimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.6

Date: Sun, 14 Jun 2015 08:46:15 GMT

Content-Type: text/javascript

Content-Length: 37441

Connection: keep-alive

ETag: "3754642794"

Last-Modified: Tue, 09 Jun 2015 12:20:59 GMT

Expires: Sun, 06 Dec 2015 12:38:38 GMT

Age: 418057

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Ohc-Response-Time: 1 0 0 0 0 0

.... .vU.....w.V...W$L.B..%.E.i..%N27..$....&...I.."r~...............E....K..v.-....FI.P^....bz.7...."..`..-.epp.}i..f..r....*..F>.n..d.O.............L..ay=...M..................w...X.%{w.$.2w....t. \....|..P..u1Z...'......4..I^\.."..........X......d......=..!N~h,FeV.c....t.%K~q........_.H...~...I..._T3i,....rr.o....d......tV........\..I....D........AM....j\N..r..............W.^]|xv<..*._.]E.OT.p.8<.._....."O....GWe....J...3...dQ..u.;....|..b.........*..Z.....y7}.-.Q... .....u.8ZN.....=".3Z.d4.a.hVW...)L.b?...F.Z........?..`..w...7.]{.L...Q.{.....U.e..$jaT...&[......"...-.....zz..Q.d...2.........a......r.f.5.2...S....i.Ff./....Cj......4.C#..F..~2....@...|...@..vLeF.G...P..]....}.;{G...i.N_io..q.........A.|R....is8....e.......jc.q..1..E..m]....-f..x._|.h...X..zp...E...D..Qz....Y...p.zXGi'>......#K... \..k.O.-.NGE2!HLE....j..f{i.^_.5.] .O.....n....5..F..Q..m~..=..../i......m3X.e..u(.3|@...WN..4|(h...5...g).B?..N/.O9.-.y.`_..j<..FI9.-.M.W.Zz....!xG..P.3...Z..<...[...8...1..n.\.V@...-.!..5C........`..Js....~.........PWa..^K...'.......0l...(.....K..A.F...".....Q.t.A.**.4.L.3...#...........p.........R.V.l"A9... ..P......!..5~..4/.mU.......d.(^...6. ...j<[...:.W....e.Si1....gXf....M.U......J...8......i^..o\H...V:^...D.\`D..[....C....*..G.._?.x.T{\.1C..A...F..1..|G.\.p....U9;&.:.^...e.\.....a@..R....1........].}J..yi.k?I...."$...wui"'F.4.}.>.m.....jcz.>.eH...^g.r.t.;...9..j".JgDD..B..5..q1...........D....'.F.........tC......o"....i.,.e..T)..Tp....C.)>..IO5.).$.F`.......#......',..).A....i.

<<< skipped >>>

GET /static/dspui/js/ll/ls.js?dv=559 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: su.bdimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.6

Date: Sun, 14 Jun 2015 08:46:18 GMT

Content-Type: text/javascript

Content-Length: 945

Connection: keep-alive

ETag: "4020916142"

Last-Modified: Fri, 29 May 2015 06:37:59 GMT

Expires: Sun, 29 Nov 2015 02:44:44 GMT

Age: 1058494

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Ohc-Response-Time: 1 0 0 0 0 0

....G.hU...U[o.6.. ...d.InW..........V......t,1.%.......w(...v/...<.......>.<)....n.W.Qt.\~].....<...i.r.......3 ..Q{`..FQ..<.`....4... r.....^.J....=..........<@3............%...<......s.a..Ve...W@Y v.....m.$...DS.9$......u..(.R.WE..i....;..hU.....t...Tg.1Az(.QY.].:...L....Sd*.wb.E...c(.B..n>......lQ.a..t.....D.:.......@..~..6...O]...Yo*$....9.........u[Ci_....7..F.5...KJ(qL,.a.3tO.-!L...C...r....3e.s.,.....F...R.,..).%...}.z..F..^.H3=......t..Fs.8/,...Z...u..#.....5.BQ......'................1W...,.,xB-...n'....Zl..\#.%....tc......V3....f...s.>..xz..@..!l=......Erp.........0..qV.....7.N..F.8.y.#. T.p..86.}..f.X.......F/O...8..%..........J..t...O...R.s.T.b.... ...H.=..'...L.S..............._.S>A..&.0..kP.!........iXX...Gc..q\ty.*.....'.....O.~2...d...\|...n.......T.N..p..-.~.M..gm... a[....w......>..\...`........{H.>.........*k.?V.Y....5....=V.IH.../9<.\c.).?~.87..N.....6M...g...Nr.P..5.3Vq.....O0l...oq..G....v...A.:@.........J........

GET /static/dspui/js/ls_flowbar.js?d=22201 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: su.bdimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.6

Date: Sun, 14 Jun 2015 08:46:19 GMT

Content-Type: text/javascript

Content-Length: 3848

Connection: keep-alive

ETag: "3024636204"

Last-Modified: Mon, 08 Jun 2015 12:12:37 GMT

Expires: Sat, 05 Dec 2015 12:13:08 GMT

Age: 505991

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Ohc-Response-Time: 1 0 0 0 0 0

......uU...Z.......]....X,Wv.\R.-....%Y..q.............6$.....0 .<.R.Zcfzzz.q..)w. .& .7.Co..V. ..qo_.fW..........S7UV$.m\F...M............)o.....r6.....a.g..E.f...{c.i[......f*.8......)......0...g........k}..9...L^N....O..u.;.7].....^$.o|...\W.. <o4.....$.A.4a..~..n.#.....M1..r.MV7.......R_....j..........._..K...Yq.1..s...VK..YS=......$l.._9g.A.6Q.&..5</"p...I.:x...?}d{p.._>.......(...M.w.Vp...([U.....w?..M.|.Uj....%.n.,........k{...|.......Y...:.N...YS.x....lJ...D8.....M.mY7oy]..l.#F.\...v...W...?.......k9L.....K!V...l..:...Z:..e.E..i.T:.6$6.S.[}...)|.H.O.V..p.i....%.......)f/.3.z3Td...b.-.k*(r..R..#..........._.x.3q{3}6....nK....e..'G.q......r...J.@."iRZ" .^K.#.....8..../v..WS.....-\.[[..ja...>.~.....uk..F{.M..h.....|S..,.i,?.(..pr.....a..._...89.#.y.z$.Y~.'...!.1.D!.M.8.N.........9.m.......Lt.j[.G.TS;.H.....Wb.1.......Q.%..a...@o..<..!.X."X,r..e.X.....#U .)E.j......B.Z.....s..f>&.h....Y.....To.....p.-..j.:..`.Y.9...m..7.W.8..........Ow....\O..r(S.l).......?...k~..]..G..;..4.2.]r@@Rn........_.S....W.b:u..D......O;F....B_B....i..^..$..7lMA.o.}o.i.7."..($....vW..^E.....(.: .....K0.....x.........<_E..i..f..qW.)s.a.)..4...s8.>a.4....}u. .(...}1...r..Q...=.....T(H6............'S...N.....*..j..w..K.A..ED......p....d.........|.0g.D.....2....1t....@6uF...B.2.(>.ma.C...26A.Q.2.!J.g...gG.c..@. .7.......S."F#aCW...BV@..9 ?O. o.aUs..[.7.......H.....r.`.......U.}i..?.......cf.J9.B8..*..WU..a..r.{......F...g.s>..cd.....h....`$..*..E..>..)..Y._Ky.2....Ow._....U..a!..<K.f..a...Y..S'.5.

<<< skipped >>>

GET /static/dspui/js/lib/jquery_a4373ccd.js HTTP/1.1

Accept: */*

Referer: hXXp://entry.baidu.com/rp/home?type=flowbar&di=u2108193&rsi0=auto&rsi1=50&title=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&ltu=http://VVV.ltywz.com/thread-17831-1-1.html&ref=&pageWidth=60&pageHeight=20&t=1434271591068&rsi0=60&rsi1=50

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: su.bdimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.6

Date: Sun, 14 Jun 2015 08:46:21 GMT

Content-Type: text/javascript

Content-Length: 36807

Connection: keep-alive

ETag: "394875758"

Last-Modified: Wed, 13 May 2015 05:53:17 GMT

Expires: Mon, 23 Nov 2015 10:25:08 GMT

Age: 1549273

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Ohc-Response-Time: 1 0 0 0 0 0

......RU.....w.V...W$L.B..%.E.i..%N27..$....&...I.."r~...............E....K..v.-....FI.P^....bz.7...."..`..-.epp.}i..f..r....*..F>.n..d.O.............L..ay=...M..................w...X.%{w.$.2w....t. \....|..P..u1Z...'......4..I^\.."..........X......d......=..!N~h,FeV.c....t.%K~q........_.H...~...I..._T3i,....rr.o....d......tV........\..I....D........AM....j\N..r..............W.^]|xv<..*._.]E.OT.p.8<.._....."O....GWe....J...3...dQ..u.;....|..b.........*..Z.....y7}.-.Q... .....u.8ZN.....=".3Z.d4.a.hVW...)L.b?...F.Z........?..`..w...7.]{.L...Q.{.....U.e..$jaT...&[......"...-.....zz..Q.d...2.........a......r.f.5.2...S....i.Ff./....Cj......4.C#..F..~2....@...|...@..vLeF.G...P..]....}.;{G...i.N_io..q.........A.|R....is8....e.......jc.q..1..E..m]....-f..x._|.h...X..zp...E...D..Qz....Y...p.zXGi'>......#K... \..k.O.-.NGE2!HLE....j..f{i.^_.5.] .O.....n....5..F..Q..m~..=..../i......m3X.e..u(.3|@...WN..4|(h...5...g).B?..N/.O9.-.y.`_..j<..FI9.-.M.W.Zz....!xG..P.3...Z..<...[...8...1..n.\.V@...-.!..5C........`..Js....~.........PWa..^K...'.......0l...(.....K..A.F...".....Q.t.A.**.4.L.3...#...........p.........R.V.l"A9... ..P......!..5~..4/.mU.......d.(^...6. ...j<[...:.W....e.Si1....gXf....M.U......J...8......i^..o\H...V:^...D.\`D..[....C....*..G.._?.x.T{\.1C..A...F..1..|G.\.p....U9;&.:.^...e.\.....a@..R....1........].}J..yi.k?I...."$...wui"'F.4.}.>.m.....jcz.>.eH...^g.r.t.;...9..j".JgDD..B..5..q1...........D....'.F.........tC......o"....i.,.e..T)..Tp....C.)>..IO5.).$.F`.......#......',..).A....i.

<<< skipped >>>

GET /static/dspui/img/flowbar/arrow_left_50_ie6_9158e720.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: su.bdimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.6

Date: Sun, 14 Jun 2015 08:46:24 GMT

Content-Type: image/png

Content-Length: 1167

Connection: keep-alive

ETag: "1354355363"

Last-Modified: Wed, 13 May 2015 05:53:16 GMT

Expires: Mon, 23 Nov 2015 10:26:27 GMT

Age: 1549197

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Ohc-Response-Time: 1 0 0 0 0 0

.PNG........IHDR.......F.............tEXtSoftware.Adobe ImageReadyq.e<....PLTE..M......,...A=^...........4..D...........B........E..{..7..8..:......$ .$...G.]!...H....._....3..6.($..4.....1....0,..B......;............wu.......qo.H........40.......hc.......4......F........J..m2....H..........s*.Q........A.b...[X...~..1..5......C?.0....A........K............a^..............W..<........L.......o(....<............C..6..............E....D..PM....JG....g%.(...Jy............{-....Y ..>..K...........A..;.j&....V......M..O..L.=9.....9.... .....g.E....tRNS.............................................................................................................................................................c....IDATx...Eo.1....n.&efffffffffff.....c......>~..ol...J..U.kH.k%$k.!YY...0HV<C.: YK....6H.7........."..0.U .v..BIT..kK..`,.=...,..."=....j.R..U..P.}3 ...O.j.]....T.1X.j...5..........U..`..9.Jg,...PEF....j=..X....`.K..zDc.......nM..Fc..T7_p.T....XeID....$J..c...0. .F~..X.4...z....c.S. .....X.].....IFd..0 . ..Y....8....eaYX..e..Rj....2.)V......@.FwGk.r.o,..by*B............XUU.X.G..~.C....9.......[.-.&..Dc.V...@.h.b..W:..R.2.-.?.......".:-._....IEND.B`...

<<< skipped >>>

GET /stat.htm?id=5796949&r=&lg=en-us&ntime=none&cnzz_eid=1877242474-1434271586-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1248773792 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Sun, 14 Jun 2015 08:46:27 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes

GIF89a.............!.......,...........D..;..

GET /uc_server/avatar.php?uid=21714&size=middle HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271536 forum.php viewthread; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831

HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Sun, 14 Jun 2015 08:46:15 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Last-Modified: Sun, 14 Jun 2015 08:46:11 0000

Expires: Mon, 15 Jun 2015 08:46:11 0000

Location: hXXp://VVV.ltywz.com/uc_server/images/noavatar_middle.gif

0......

GET /static/image/common/ico_jdt.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:15 GMT

Content-Type: image/png

Content-Length: 849

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

.PNG........IHDR.............[..-....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...]..0..=..^...K`m,.7V.R..$....$@"$..q......).f.*ml....... ...j..........J.U...p.h..|H.....-...7Yj..Sz..G.\......v..9U...i..h@...........>..{.G>>.y...e..Q..A........ha.T0....e..c.#..PC`.t...bR.,?... ..=......Dc............h.......5..P.../._.(....P......A0lA.O...-....8..D>..8s.....{......4.9.J..)>..]..Q"R....Q....*..q.*c..R"(. .H0dU..nG.A..g...)..P.,..W.DV..D..R#.....Zr...S........].%A.z2.TV...Hq.R@...!H..x.Z-...~.S...... ..>...R/..2..l........E...Nr...}...c...[. Q.E...i$0....F._Q..k&H.T..e.(. K.....^..._F~..(.s.^...1 ..EP.5.@s...P.n.;....J.,5....a...WU......8.==_..GD:.f.. H.."_~3....\HR.E..TW_.~...~..=.*.}. J..`.*.1..o..7....(....z..PA Pc......<...G..@..R....f....p......... ......9..a....jp........*p.a.Up.../........<.....c..m..../....O...|...........IEND.B`.....

GET /uc_server/data/avatar/000/00/29/51_avatar_middle.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:16 GMT

Content-Type: image/jpeg

Content-Length: 6330

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Thu, 13 Mar 2014 08:52:01 GMT

ETag: "196cbf7f993ecf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

......JFIF............................................................!........."$".$...........................................................................u.x...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...D....w..4...!...*L.)o.. ..GA.p=.%5...P.O...>;........x....b.......c#.&.u.#.`;.3P....k.:/.....v.wr....B..m......F3.P..*9z.......]~'..X..I.... ......B..#..:k..|;...]F...RrZYO'...{5..T.$_.h..\......$G..O.}"@vB..T...\.t.'.Q.G.4;..xwV.)G8G1..88?CS...Y.....='.?...4............o^...=.Z...H.k`..>.. .9.I..$..et9V.......j...P.@..p..<p<'.Ei`.}j. k.7m.7.....~...S.i.....]..m.<|..Fh.m.%.P.=.....!..# .<4.=?..#.6...I #.~!..O...q{y;G. f ...... `g...X...EGs._.x.R....w..-RF{{rW..9m..l*..0..[F.vj.|...dP1S.v.,}.&...o..w....P.}V...T.....m.O.L.ci/..z.D.....\.9...x..vHu....HA./.7....Ps..{}*d..vfG.<i.|:.N..]..kxy..r......v..C...!'OFqb0...S.= P..t.5.>u...7.".a.{WRi....\].j.!@..yo.KF.o............-RA.|.%#8.....6 ..Q.....h$}Q.. .OH....X.#*W...C..?.u......4.|..D..=...[.&...K.....).F.....A<... ..z. ..V.]..v.....Q....G.....aX.....k.Ih..l....@......W...........o/.5.0..O.1.@......\..j....I..-.V_......sR.#87O..[r.%c..FK.

<<< skipped >>>

GET /uc_server/images/noavatar_small.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:16 GMT

Content-Type: image/gif

Content-Length: 1574

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a0.0.............668cde|}~uvw...............IKL........................[fi.....................................................................qtt....................................rlf.................................................|p......T@4kc^.................{.rX.....{.....z..y.....e...................bZ.SJ6 *<21.?:.KH....**.%%...B::HBB...(''`__[ZZXWW..................SSSOOOAAA>>>111!.......,....0.0............................................................!.....:............#....rong.f..os..........-.......qg..........{...}...p..{....p..up..M?...D..N...~.....S$M.<0..P...&..../.E....c.P."...4t.q.O:(!.d..%.6oZ........Z.,.T.U..).5j.M...,...gjO...fU..h.8R.....(.KuT}...vh..m.t...... 2.aG..Y.A.n.x.E......tK$c.y.F.<........T....A..-.Xf..6q.p.w.c.B..}.$...^..s*.SN8.A.|(....>.P...D..8.@o7u...z..b..F../^(A..i.. J...L$L..<...?da`.@.......`..%W....gA./.....5... ....6.P..MQX.M..w..K.......C.4.....ivBs.....C.`d.6.....28q.....#.B.A..<....8.X..E.ad.d..B."...RF`YC.`~..._....rf...^...".....B..C.x....J..`.u.1..{.QG.2..D.0q.A~....[d,.C.B^.h....C.y...e_b...V.1GGRNi..q.E.....B.6F: ..\:..........fbKX!E.p......Ic.x.q.....D.Rh...,X *.PD.D........x*.v.....7.........hQ/......G..C..cp1..Q.....~........#.p..Y.!..W.|p....pn:T@F................U..g..9@.W]<.....m...#.k..|j..7.....".f.B.-..f......(.2.....e..6.;..w.n{......t3..Mv.z.]4.H.....2.L". .x..G....V.&.._..BLl.w.g....[L........X..... .:j..l;.u.b..K....._F3. ._..!....]8.E..U.<...>..%..r..^..>.........y......^L.?.].........G>.` .l...HV

<<< skipped >>>

GET /uc_server/data/avatar/000/00/73/25_avatar_middle.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:16 GMT

Content-Type: image/jpeg

Content-Length: 2655

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 15 Aug 2014 22:30:59 GMT

ETag: "da753e96d8b8cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......x.x.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..qP2.S.O".e9..DE'Jq..Rc.E1..4....H.....Ao`.4.l....j...4.l.....a..T..y0......R..=..<W).3B.=.>O..&......5F-...>Y....ue-..dB..EJ...4t...v......|........&..0kkH..7...C..Qf.qGU.4...t.T..........N.........T.....B..56.k.)0! UK......DS..]#.`..}.)...q..C5....4 ..j%..N.|t.Q...c.J&d.$..i.....D......5......^mJ...[..#.Eha\YD$.. .......>.p.......y.t..e.u..gx......8.C......'..3T.'.... v8.e.A."...[$..@....(.&.M.eZ.l..gD.k./..d8.j.s..&;.b.. .]8.W.......(.#..d. .*...pGj....!.......`RcEb8.O...:........ . .Q..X...t....B=k*..GN.sN.So:i.m.<.T.....7..$1.Q.].F[[..D..&.`..y9...5_..P....dd..s..".....;......=....../.G........]E.=2.kt.I.P.>>..Q.D..h.@...i.$..4..-......<C....7.........D.?..\v.kx.t.$.R..~...V.\Mh...d<.1..)8F/.%..N.C......R?...`U..F..-...e.&...H.zp...<....w.a<.A..9...@G5e....z....iB..*G........y....U.....$... .....=....a.cZ<..:0..&.7...#...N.j..l.w."I..FsSD.4..F.9..[.}.0@.c.l

<<< skipped >>>

GET /uc_server/images/noavatar_middle.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:17 GMT

Content-Type: image/gif

Content-Length: 3972

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89ax.x.............\\]...............................................................................................................}..uww....................................................................................mc\..................hJ9...........z........v6$...r........t...........m.hS.[P......`XV.rcA:9.OE<32.pn....... .((ULL!......,,&%%mkk<;;655FEEBAAVUU............cccQQQLLL...!.......,....x.x.....................................................................................................................................J@.H............O.#F.(.....)jL..aC..$V.@..I.(S.\Yr#G..A.rYR...8s.l......d...rg..H.*....K.A.>lG.&...,d..U...8.>.9....W.VX.....p......g..d..;.2.W.pQ..L.p\.W........v....B..;c..9..s.6m..P..0..b;F-K....\......m8.....GN..s.*....D.Z.V.c....Vv.9#.x..vS3...)r.*.8.L..s....?...V.....E0rr.).........=..z....aZ...v..u..r.._...aa..fH....X..o......G.E7=..~.]X..0^.ag...F...v.ZH.. '...`.,....H&....L6._.oD.F.)....*.xTv.5.Zw(....Er.".J.....:.!.R....u.. .?j.b.k.@f.g&...w....n....R.1........A4.Ro..h.......6....6.....x.I.%".j.Q..[w.f$..b.(...:*..5*%..n.j......W.................(...6.f|.....TT..$5.).fr...|.[..m.....v............@a&7....J(...K/..f ,.o..j...`W.5$!;0.}......k..K.........)h.1!Mm.. .......\..(_...,.:.icvk....<3. ....M*...@.]/....o.H...M..L3.P{....M]...6.u.C....~ }e.dS.. e...Q.....oK ..W.].._....Y..4.~.....n.w..{....Vl....%..MO4...f.!.n'.x...Nz...q`.....j7.....{.9....u..s....=F....^<B...g..........}..R...........|...m>....z."P.........>.I.~....J..n..r(!H.n...R....

<<< skipped >>>

GET /uc_server/images/noavatar_middle.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:17 GMT

Content-Type: image/gif

Content-Length: 3972

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

<<< skipped >>>

GET /uc_server/data/avatar/000/02/40/06_avatar_middle.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:18 GMT

Content-Type: image/jpeg

Content-Length: 5942

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sat, 18 Apr 2015 07:18:22 GMT

Accept-Ranges: bytes

ETag: "3e6b6fdaa779d01:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

......JFIF............................................................!........."$".$...........................................................................^.x...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...C..5..X.Csl.\[G"..|..w9.9....x.9N>...4q|..s}.Y..........8...<~....4.K..V7:......"..........>..Rw...V.4ax..C.8..o....j......N,...e....q...V...&..M;....4.>....l.?g...22..d..u...O.|SPS.f'~m. ..#,3*....U..Xo..Fq..:.q.gG..#hB0......;?4}...F.].v.*....3.]^.|./i.....IoB....#pFA.....N..?g}.W......a...[......T.G,.I9<...{..4..IGDX....J..N[.X..chnU..^6\..0.9.sA7.m..V.f..I..L....Rbv{.2^.Wa.z.F..~.N...y\......o.......}.|..T.(.*z. ..WZ......mfG.B.d~.....J.Q.......... .a ..|..tzs..%h.W)_..Ki..7D........w..T..%..`g....SR...14.............)&.[.f.u[..T.@Va.Ns....N.M.4..k....<_&.._O....jZ...... .w)=G.c..kz........4^k..W..p...?7'<..^..H......j.......fO1.*..NI>...u!...a'......v..SJf.}..9..b.....k.bi5..T.}.@..5]r..Z..b.8.H...s.H...I.0...=..x....JQ1....DO........w@.....\.:.t..^........gE.9#...0.a...S.Ipu.GT{8..6.8..._N;P....E..-V8.8N..<.P.....*........k...\..z/sS)(.e)(.~..G........#.er.F......sW.....'c.>..q.

<<< skipped >>>

GET /static/image/editor/editor.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:19 GMT

Content-Type: image/gif

Content-Length: 13832

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a............dlP(....qU....i5.............j7..E.......S ..L......TTTfee........f\6......M............FFF...wwwohF......mUJ..n..s........u.....S..U..................UB,......urk..H.......................=......\RD...........................777......z......r....w.....Cr.......""" r...ZX..............k.............3.u^......7....w:.......3..........c..3.S......y..m......p...J............^.5f...h..&.u5N....O5.....'Ja.....6..-...,.8..... ....D........./:*.e..z.....H.b...g.........Q2..........z......Uz........0V.U..j...........d...Z..........V.].4...&8.I....88........f...;[.(?x.....>......,....f.,:~............R...b..4o...Y6..%.<...8..F%x.s?...2.Q....O..........W............*...c.........'..Y..t....3...)...........v.j...Sdmr..<..4.........g.=nootk]RLF.........:.(D5(......!.......,...............H......*\......#J.H.....3j...... C.......(S.\....F0....S....g........)PPh..$..d.H:i....S.p2f...n.j..S......l*S&.Fjn..s...3....c,a..x.N0.p..1k..~.fU..\.ct../.....u...d..(3......U^42.m...j.......\.l ..........k#....p.........eU..b...-.f.8....;.d.....wS$.....R.N'..Rp.....x...X.8.R.7.b...{U.......*o,r.*a.#....!.x.U....|.At.L.P..Q..@3.....L...M..........H CR..P.'..s......}....W..........5,B..k..$..Y..B.h....<....5.b....P.M..A.....6..D.kg.w....0O.E.DA. d.@g..@ A)lP....#.......a`....q.f. 61A\...A..u..@`...x!|....r...u$.dC.....}.(...Mx.Xg!2:F......n..........f ..M.....y......*..!0.......YL0.C.N........t.k.....E....O.Z...-.P..?.h....j.C.a^.b.......n..B.....(.0/C..X'C..z....&..Y.Y............z.A4.YV.%..d...Y...B#@...12.

<<< skipped >>>

GET /adx.php?c=d25pZD05Y2QyMWFhNDMwNTRkN2EzAHM9OWNkMjFhYTQzMDU0ZDdhMwB0PTE0MzQyNzE1NzEAc2U9MQBidT00AHByaWNlPVZYMF9Vd0FKbm1GN2pFcGdXNUlBOHIyVkRkb0ZGYURuM1RWMjh3AGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD0AYmNobWQ9MAB2PTEAaT1kM2EzYzZiZg HTTP/1.1

Accept: */*

Referer: hXXp://pos.baidu.com/acom?adn=0&at=128&aurl=&cad=1&ccd=32&cec=gb2312&cfv=11&ch=0&col=en-us&conBW=0&conOP=1&cpa=1&dai=1&dis=0&ltr=&ltu=http://VVV.ltywz.com/thread-17831-1-1.html&lu_161=0&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=153x-1&psr=1276x846&pss=960x156&qn=4f4730e82ea33ac9&rad=&rsi0=960&rsi1=60&rsi5=4&rss0=#FFFFFF&rss1=#FFFFFF&rss2=#0000ff&rss3=&rss4=&rss5=&rss6=#e10900&rss7=&scale=&skin=tabcloud_skin_1&stid=5&td_id=1991537&titFF=å®‹ä½“&titFS=12&titTA=left&tn=baiduCustSTagLinkUnit&tpr=1434271564146&ts=1&version=2.0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u1991537&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.172.2203.2203

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wn.pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:12 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

Expires: Mon, 26 Jul 1997 05:00:00 GMT

GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Server: nginx..Date: Sun, 14 Jun 2015 08:46:12 GMT..Content-Type: image/gif..Content-Length: 49..Connection: keep-alive..Expires: Mon, 26 Jul 1997 05:00:00 GMT..GIF89a...................!.......,...........T..;..

GET /data/cache/style_28_common.css?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:41 GMT

Content-Type: text/css

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Wed, 03 Jun 2015 14:51:34 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip

4bfd.............}.o[9.._......K%.....,*..3..`.n`v....lkJ....)#.}..<..{..(...[..%......._...i.i;.......6._....._.../....j:8...m=n......~3.......b.....d..i...........'.,..............6...........|.y........t7[.&....y?.(/w..~..o...u.Z..=....7.6.l......_................z...N......F......`.^......zq...N........w..?}8;}8?}.8}.<.[o..w..b...O;.-.O^....|5.^oF..|u.O_...b.2[n.....b.....O.c q.m...h........h..c.......-....bv...x.O....~p.E......<...b...w....L.lAX[...-.......~v:....v9Z\............l..b.. ..h...4.*..).a.]...Qk......[..x.x.<nw...z....._:...-.....K..}.r.x<Y.Fw........:.p=..6....x...r..&f....l.......O..|<_.......t...^~[....>.pv..<.^..{.l@>l_..C...yn...A.....?...z..........E....r.z..........n....:..9..nl.z...O.<l;..CA..E.gN..|......&o..up....y...LG^.-;Pr&F.wk:.=..-. t...V....\)}..v:....6..7.......4.A1....z1.t.X...Zg..Y#..../Y.B...?..e.G..x]........A..n../>..../"..e..A..[...Z..=%...h......M*.P...m.w...QJ.R_..}..Vg..q9%(...*..9.xq..e*.@..........[......C..4...;......2..E..A{4.....x.......2.......3..g.9`.....=...^ .....Z.V.y..x..<..UH..//9.9....n..JJ................r.h....oQ....`.o9y...Lg.....VX......>dc.....T..x......V.c`..j......3~..Ck..>O_y..;..c.x.H.JG.?.....j.W. .jC..~2\$V.............. u[....|......D...%.J.l*.74...Z..j$..D}...A.W`O.c......$.....f..,.6...*.:....3.....u......o..b.lG...n@9.<].R/..m.M...knI..MI..zjjKF........w._..&ysr.2......{.*.elBDi..T........)6B......H....1...I...F....g..x....(.q.qp@..(6...8.88$#Eoj@.DY.......|..-......#".. ...-~.D..Yz.. ......_O(.:.

<<< skipped >>>

GET /data/cache/common.js?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:43 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sat, 13 Jun 2015 21:30:15 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip

4ba4...............s.I....@.m.hR.~.zf.QZ5EMkV.N..{...@.$...4..RK..e..c...{}........o..>..p._8..p......../..fV.S.~P........................0.......a..f......K....J.....V...g....y..l.:z....C.h.;J......x.o.v. ...&.cP.l.*.v\Y.l....A...M.[......>...Gu`.J...^W...!..@H...45.P./..=....J].uAqu...1...N.xr.".V.!?KK@w.*.g...m.FD4'.....h.=....5#..H.....l|.1..w. {.I..r2<yQ...n5......d....*..y.Y.x...^.......Q]J..T....r..hY.?......3...4..u.Em...x....T..N6^"M........rE..GRI.s|.y......HfLP...l..n....x..wF...\..:j..t.w.d......x2.k.~..T...Mca....o..s:x....99.......,.~a..G..qg.Eg4F}.'...18$...IgD.].....n..g.$...I(...Z....on<.....[.n.....Q.eCc....~$....K...h.H...6..;;.;;...Fm.R...|...'.'..F.f.U.....^....*M...........Vl../1..V>.........n........d .gq.k.J..v.^..../imS..U .....bN. `J.&Ml#........^#(..9...7M.[*..b.....Q......-3.70.=:...r.<...o_...*uez...<.........*-h.I....K.......!....Q.I~...9.T.U ?.Y..u..g.IJ.O......}.......lT*..5k@h....n.4Qw..A;..;..........,...Ub..W;...h....M..X.{.......t.5..._.Q./.q..g.R8............$.&.0g1..8....d:..%..i'4l.`.?.CDQ@o..Z.9..{..N}..3^j\^9f`..?%9$f<.<S...(......4.k;}Z.....J........=......x....{..W.Y#. ...i$....3|.#L..^Z3..'.....swR.60....T..q.r..M....qg.b29......(.....V.>Ud......h..e.. ....&.FN...?.R...../..s.Rk6.%2.&-.A^x.... ....\@e....q.rb.(..u./.Q...g..Mw.r........(...(-.N{tp...Lj..az;..w...O...X..F..........0...Q...hz........../.....rv...J..Nl.$................&.....7.v.....my..8.].Hs.-...?... .}:l.........7gt.......m.q..C.k_mH.e....#.q..k....qw...N^.a2...)6?..a.{...

<<< skipped >>>

GET /data/cache/portal.js?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:50 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sat, 13 Jun 2015 21:30:15 GMT

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

Content-Encoding: gzip

e10.............Z.o....W.K...].v*......T$JQ....:....-......E...J .._B.....R.QK.%...TUT*.V...@..........._*.{.3.<o......b_.Il.........B.0..~..y.ME...,Le...A....2k..[....y..q[...v.N.d....$}x..}......g..I.........l;..)..c. ..T.........c.4.n....0.E6...=.:r...F....Z.}.3..|;..d.lIo...T@.p.#.......i`d.Q.M..n.w#...<..](.qzU.....:..'.`.(,9...OB...3..Gm...["..}.U.,d8.5C...A....y\....z'.v.."...f.Y<!.=...C......."......21M......7...^-..j.Y,..g4.Y.%^0G.6)..hO..4.!V........3..Z...l:...9.YO..o..J.hwR......Uu..9W..<. U..\~R<..R... O..F....@..0=...E32...p.Xm.D...\`.......8.....,;=M..nvi..............,..RL]h.c....a.. .AH.....a@...N...\....-.....C0..X?yf...x.@.<...x..N......R.R....*.#vsXn*2...b....).F.FY2E".S.d...F.F@.....s...7^...W.y..W..y...?z.. 7....,...k.V.((..Q.M].li..,....r.S..q:&..(q..;..(...\A......*........Hp.a.lYG,..R(..90V.!<..)`=..A.....q...dv..5.Y4.M?`.Y.. .v...|x...m!=;..@gY..No(I<*N..L..y..>.$^.M.\.....t.#C....I.......O./...-.."P.y<!.0c.......Ak*..../......C.J.r.J..\d..)0.R.H...@...x=..7l.C.j[....\....wNy].D.A....J/.9h(e...YP;..%X.<SU.} .D..n1.....Kjv.8....8..0................u....i......|6.e..w.lk..)6..5"...:QFG.T...[.t.L.Z/x..d0.....8g.w.a...SP`.]..x..K...OC.H....V....v.O..qr.e.....D@."....)v.DB.E..L#J.|.Nm...2....}.....PP.*...GU...L.N..A..........K.)..X..P..V...N....}..=.4.8.8.MD?Dd..)...V9=..XH..d.p.J...6R!...}..v...Ld.z.(j...(......zU.....5..pA..^..-...}.......CF...v6h.L..z....).I....p.A...o..d....2!gYl..a..$...e...zC..l[I.G..I.l...S...`..h...{X....L.$.;.........L.9`.C..0,y;.p.

<<< skipped >>>

GET /data/cache/logging.js?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:50 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sat, 13 Jun 2015 21:30:15 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip

112............UPAN.0...VB.DTQ...FQO.....*..4..k.N.j.w6I..by<3.3.;{..-.......v).O..;(a!..r..,t=.w...fo0......6..T..x..O.<..A..t...V...UT."\.0.N.......#4..j[q/ ..-....=..5nk.*.]..RMEF(2...*.qyKX>..AL.b.j..Y}./.!.5...b...........V.-.....{...UK.JB. p. #.........#|..z.=.T..?>.........0......

GET /static/image/common/background.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:52 GMT

Content-Type: image/png

Content-Length: 1166

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

.PNG........IHDR...2...Q........w....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:F4E8DFDF4C7211E0A274B8AF749486A2" xmpMM:DocumentID="xmp.did:F4E8DFE04C7211E0A274B8AF749486A2"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F4E8DFDD4C7211E0A274B8AF749486A2" stRef:documentID="xmp.did:F4E8DFDE4C7211E0A274B8AF749486A2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.".....lPLTE............................................................................................................m.......IDATx...I..P...BEAqB.q...w........3ROL........LI.......;fJ....X$)..........I..&,.d.)."..3%.Lo....~X.I........MZ,...Hr..a..."......-.. ....P.l.W.......IEND.B`.....

<<< skipped >>>

GET /static/image/common/nv.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:53 GMT

Content-Type: image/png

Content-Length: 1939

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR.......B.......O.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:F3E955C6672611E0BB73C54CB762A343" xmpMM:DocumentID="xmp.did:F3E955C7672611E0BB73C54CB762A343"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:762A0B4D672611E0BB73C54CB762A343" stRef:documentID="xmp.did:762A0B4E672611E0BB73C54CB762A343"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...T....PLTE"g.'p....(s.,|.)u.$j.%m. x.-~.#f. z.*w.,{.%m.D..#Y.#i.'p.$h.-}.)t.)v.&o."g.#f....-..(t.,{.#h.,}."h."g.#i.<..6..'n.3..4..;..A..*r.D......x.%k. s.@.....C..?.....B..2}.?..:..7..>../z.=..(o.1|.-w.C..8..B..9..?..-w.>..)p.O'.....#IDATx....v.@...A.................,..*..l......c..Y}Zk.. .g{......e?.B..y...z!....B.T..q..b.o9e..M,h>v.|...=.N..T:iH.Ge9....UFXN........#V..7......|..7(.V..y..J...w.....t....K..OOR..&..i.. .......%..5I.W.|Gmi_..T..$...G.UW.Q...}..8.OOR..!_.._u....P..i......Z...N.:.....N.L..:...c'.7.|......T..J...i .r..Rl...u.r>..\..z>v.|....4.u..J.e)....N....J.

<<< skipped >>>

GET /data/cache/forum_viewthread.js?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:55 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sat, 13 Jun 2015 21:30:15 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip

207e.............\....u.WF.r....N.....TBPA)c0._Rw..............q..EUB.\%ld0_. .oF......r*..H..H%e(.......3.{....!6.v._.~....._...h.L..`o.......ax$..<.......P2./..'.h..8......I.=.[....\....u.$....E}.....d.~..e.u..G.f:.'@..J.. .=.t{...A<....dq....zH.v.,V........[...u..|......I...ERz$HG..d4N..]..h|..:.lF.,.Nz.-R...<.).... .c...8..H.)..<..CO;..x.^.x..6Z.,.A....-....(OF.0@<.....7...t.O..v..C.r...x..(....,....LAc..M...4..d....t.M....S.....b2.`...#%.h,3...../..&.yH..E.k3........-..........~....].\g.G....~'F....2..s.0N.....:I.*:S<[.G..2Ip.\.A....l...w$....8.M6........ZV.8.9.hH2......Y.............6.n>.$...d.O.&....G(..c..m...V-.q...q.YhJ....g......QO..V<H.\.-.NS.:....$.5.^....k..O .<..A...W.KE.f..q.J..I....F........CJ/..W'..."...Kv...Z.c......F2l.1E..;..l..'....7..,.....^......`...VmM0...~:..t..N.uQ...I..Z.....q.|j..V....B$k.*$<.L..Rn.".=.|....Vj./.........;H....};..`.7B...s.n`...$......x..'~...W.";0.....^..lxa.][C7!F..........f8v!....$..'...m....$l.0.HA.?..!Vm...................B...a..1.Q...&..\.......}.....E..O@."S....BY..%.MX_..*(....D..........}.....)...B.....,....^._...X.'[..|,.iW{t..._.LF.xr..;..{.....a....E0V.8...`P.Y1..t]@...A.....[3...`<...@......c.......{.........a.......`.....n.j........)..tk..q..7Zi..}.../K.S.V.......H....d..r....K~... ..G.6v....o.......}Rw.|&.0..n.^..M.........y..x.....).s@7S...H7....!6.M..N.T!E...>l.vv........z.]....{.I<kX^ .L.}.}z..Q.b8.....*ov..^..1...F.,*s.0...N....[....b.....S...F..t.R..p....[..[,J.....|...p...0y..3.v).nhj...W.-Y.5.W>.E.D.9...

<<< skipped >>>

GET /static/image/common/print.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:57 GMT

Content-Type: image/png

Content-Length: 1015

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:FB35016B4EA511E0915FA03E6093E607" xmpMM:DocumentID="xmp.did:FB35016C4EA511E0915FA03E6093E607"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FB3501694EA511E0915FA03E6093E607" stRef:documentID="xmp.did:FB35016A4EA511E0915FA03E6093E607"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>i.w.....PLTE.................tRNS......A...GIDATx.t.I.. ..K..hSPA....e.I.tT`b.".=...r.....GF.h.J<F.K.....8[..............S.....IEND.B`.....

GET /static/image/common/thread-prev.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:57 GMT

Content-Type: image/png

Content-Length: 1007

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:FB3501674EA511E0915FA03E6093E607" xmpMM:DocumentID="xmp.did:FB3501684EA511E0915FA03E6093E607"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3278EDDC4EA511E0915FA03E6093E607" stRef:documentID="xmp.did:FB3501664EA511E0915FA03E6093E607"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>2.......PLTE.................tRNS......A...?IDATx.b`B......P...Q...Q..|F.0.......@..q.@.a@...P,..t).........!..6:......IEND.B`.....

GET /static/image/common/hot_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:57 GMT

Content-Type: image/gif

Content-Length: 680

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a........................x..V..:..4...................................................................................................................................................................................................................}..z..y..y..z..w..u..v..p..q..p..j..k..l..n..k..h..f..c..e..a..^..]..`..X..W..\..V..Y..X..Q..Q..U..R..P..L..K..M..L..I..G..C..C...................!.......,..............).. ..........8...<1%%......HHI.I.]G44''.....Q....iS??22##...Z...c.oW.K9-$.....e...r.q.bXD2)!....hh..yw..kkUE6.%.....jnsxx...........&:Xx....3m""...N.)I|..QB. .dB.I....._...QC...."m.I...3fHR.b............)U........."9...L.%A.2.b......|......6..h1c......@....;....

GET /static/image/common/forumlink.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:57 GMT

Content-Type: image/gif

Content-Length: 170

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a.......i.....v..x.....f........f.....f.................!.......,..........Wp.I.T8k|....HJP.E..E0.....:#...t...].q(.k....<*I..q.C(.....PX..l........f.h...\...7.|%..;....

GET /static/image/common/userinfo.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:58 GMT

Content-Type: image/gif

Content-Length: 248

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a.......k........q...X?d..X..P...............~Nk.............w...u......................................!.......,..........u.&.di.d%I..........]...e...!.X2.....D.................60.P.S.U.........T...1.(...2.v_T8k.;8z.3?9...z......f`.`.(....!.;....

GET /uc_server/avatar.php?uid=2951&size=middle HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Sun, 14 Jun 2015 08:45:58 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Last-Modified: Sun, 14 Jun 2015 08:45:55 0000

Expires: Mon, 15 Jun 2015 08:45:55 0000

Location: hXXp://VVV.ltywz.com/uc_server/./data/avatar/000/00/29/51_avatar_middle.jpg

0......

GET /static/image/common/medal1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:59 GMT

Content-Type: image/gif

Content-Length: 3223

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Wed, 20 May 2009 08:06:55 GMT

ETag: "491a9f021d9c91:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a#.7.....................................................................g.....{....................{........g..Z..5...........R.....B..g...........T..F..:........s........)........c..N..:..{..k...........R..o..B.....-...........,..k.....I.....R........s..:..Z........:..)...........J..Z..5..Z..s..U..i..)........G..:.....k..R..!..).....1....s).{..{).f..{J.k!.k..r..g..k..k:.V..Z..J..J..B..1.!..NETSCAPE2.0.....!...2...,....#.6..........:I.w-5BB......jjrr};c:...........!/C.t.. -......o..Y/!..1&..?.GGM.w........:g..?T&..(....:.t 55....o.}:W....\@..........w..=p....u.vXYP.@.%........&...<....7e........Xn(..I..T..0j4.cA.Q....$..)K4dc..B..1gN......eF....... YB.0b..;Q.L.....[...12"%..Z.....u..2.:B.P...?#....W ..8(.......{.4...O.&\...gX.....8~...... ..c.....Yr.}.....0@H]...' ..f.!..?~....[7.?u~.......:..Qn.yw...d!"]8uH%..x.b....c.a....)X ...@..%E.PD.f.a..Od.EfK...y..P..HX...OT...T..._.Ax....`..Y......'.p.X...KX.T./v. X.Y."n0B.6..#..%0....00...!.Y!.$.@..=(.=.....6.`...L@..8.(.=.8p.....E...0../....V..B.W..F..\p..o..$(.T...1..@.X.a..!dJC...WA.^.....]Pe.W.p..Z....:....^.`@.L..a..0...Z ...i.a..'.`...9.........^0....q.......v<...0..B.) .@.g.A.D..PA.$.q..*IhB.l....F.!....`......... ..lDlF.......p<...P..B.?....=.q..W..C.)....p$...*....c@aD.O......p...D@B.V.qFWI.....z..... ...n.....@..?..A.,0.4}4\a../....T..D.r>a..X.0..'..F5.21..DhaG.m.0..g....;4A.l*\p..h QQ1G<...nhk...7...g.......A.F.q.....9.k.1..g..D.P....*E.i.v.....Cq..l.A..]0..5p. ...I....k.A........?AD.g.a..%....]l.R.0.@....p..c....7.#...Ep.......OK...

<<< skipped >>>

GET /static/image/common/medal2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:59 GMT

Content-Type: image/gif

Content-Length: 3081

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Tue, 11 Nov 2014 20:58:01 GMT

ETag: "d325f02df2fdcf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

<<< skipped >>>

GET /static/image/common/arw_r.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:59 GMT

Content-Type: image/gif

Content-Length: 65

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a.......fff...!.......,...................1L..fz .].TY..V..;t>....

GET /static/image/common/arw_l.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:59 GMT

Content-Type: image/gif

Content-Length: 844

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a.......fff.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,..........)....H......&..p ....B\(Q.... f.h.... C....;....

GET /static/image/common/online_member.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:00 GMT

Content-Type: image/gif

Content-Length: 365

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a..................V.....M..3..M........M..3........q..q.....3.....K..M........3..M..q.....M........:..:.....<..L..1..q.....V..M........................................................................!.....(.,...........@.`H,....RIjf2..bJ.^".G.*. ...5..z..k.3.Q.h..ja.D.<...4.vxyg_....C.y..q.. .....%.. .C'..!{... ..C....q_...C.&....C._................BF.C(A.;....

GET /static/image/common/nosexbg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:00 GMT

Content-Type: image/png

Content-Length: 1389

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: EXPIRED

cache-control: max-age=14400

age: 0

.PNG........IHDR...z...N......l.m....tEXtSoftware.Adobe ImageReadyq.e<...lPLTE.............................................................................................................m......IDATx....r.0..}.1... G..... ....C.i`w..,%..,..,Xbw../....././....}{..........M.6B.v.......h..n....h2..^ G?..:..Q9l'3.......7..l......$.aeF._........;.....[.6)8(<.=......P...0Q......1....."....]8.*j..y...i....|.......O 2F......8m....^.....Z.E.t..........`..Q.U..Jt.r.6...S...h..H.eY..C.>'eh....P..8..]a.Q..p....N.E~.T......O}.O.i0[g...n.....>.$.f..p...4)..h....q9..<|....p)8.7>NT..:. ...b#.*...KG./........:9.@....JL...G.....B.z{...!..........m..N.h[}.#...:.......Mr5;...K.....=.t..g...o.p....KBb..E..ya..1.w.3BH.m......YM.=F......[..ov...#4!L..O.......j..r.Mu....T..Z...K.g........,z.%.L..S..i....u.......,`.8[....C.Ac....P.:~w.W(.#......C.I..RM.9...........p.%.<P..J.M..`..."l&..h,PK..8R....iL.J.JKX..h..qJ.r.. p..w..@.a,....M..5EG..C...\..N..`3.4#..%w.0...XZ.......A..D.fV.p.F..3h..b..x......4@.p@..a.d...Q..........b8.R........P).c...8....*.(.[..2.H.. ..SB\..9....3#.Fq.....w*R...\..xU.N...f.[..Cb.......-C.S,..l..#.{M..|.;...>:]...Q...$..Y.o.uzu;.|.N$....2...t@..! .!.&.l.~..P....DI.p.X....z...m....3....=.=...p....%.U(.....o.2...^...........I...}].R_F.....Ek8..KG)..B.....R)...F...A*V....ft.&|ZH...j{.o.M...?>o..I......!-.]...s.....{t.'7..mR._....hy.n..3....G.y.&V..`.$w.=........IEND.B`.....

<<< skipped >>>

GET /static/image/common/flw_ico.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:00 GMT

Content-Type: image/png

Content-Length: 1305

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmp:CreateDate="2011-09-07T10:12:30 08:00" xmp:ModifyDate="2011-10-25T06:28:48 08:00" xmp:MetadataDate="2011-10-25T06:28:48 08:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:B79C72DFF6D711E088AB957638E55F95" xmpMM:DocumentID="xmp.did:B79C72E0F6D711E088AB957638E55F95"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B79C72DDF6D711E088AB957638E55F95" stRef:documentID="xmp.did:B79C72DEF6D711E088AB957638E55F95"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......0PLTE...........b.nL....V3l..{.....^.....H~...u.yU.....w}....tRNS.................#]....pIDATx.\.... ...P1M...8.r....<.....4.k............m.Al.p.@G.............\]....23#...1[J.?...vP3&.......bl.g^.....?..C~Vm.....IEND.B`.....

<<< skipped >>>

GET /static/image/common/pmto.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:01 GMT

Content-Type: image/gif

Content-Length: 152

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

GIF89a.......T..]..a..\..T..O..N..V..Z..~..b..L.. |..........!.......,..........E..I.......I(...0#y.g.,...h8.........`....A.Bq0...e2.\..U.'...:.)fL..#.;....

GET /static/image/common/ad.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:01 GMT

Content-Type: image/gif

Content-Length: 997

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: EXPIRED

cache-control: max-age=14400

age: 0

GIF89a................. X..W. q..f..r..v.....................................................................................................................................................................|..x..y..o..e..f..b.._..`..]..\..S..U..Q..M..`:.B..C..E..@..= .6!.7!.N=.3"..".-#....)#.&$.'$.??.!%..&..&..&..'..'..)..(..(.$D.....*..-..*.....0..1..3..6..:..A..B..C..H..L..P..Q..W..Z.._..c..n..p..t..~..~............w .. .w..................................................................................................................................................................................................................................................................................................................................................................!.......,..............i.&..:x...$...D..`...L.4k...... C.. Q..I. \...CG..@.p...#H..M... ...?0^....F..D.P.....=%L.P...Q...H.@.....:...`F.!H.h).'.....|.....$P..I......8.H....!K..)`.....0x .".. G.|.0.....*h...E..E.l...;....

GET /static/image/common/qzone.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:01 GMT

Content-Type: image/gif

Content-Length: 2110

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a........K.....S..d..~............!.. .. .......?v:...=r.~........Y.>...:q.......[.............>..*..J.....F.......j..N.....K..2......H......u......I.Y~..K.Z. ..[...CxG....-.Y.../,m.w.....-....">.....<...t...P,..L..!..>....=.........f.....W.."..... u....4..(a..\....B~....I....'k..I....%..".............`.G...X.....X.... z.}.d...a...~.8..a.........../p...M..?..?[..b..E.......7.....(....}..........C.....T.......q..."Z.....}.k..0.............UK.....<...b....}qVb.......$..&..;......^.......*H.....O....".u....x.....Nz.....c.B`h........6f..I....Fm....&H...l.... ...r............3.U....0w.-.....|......................................................................................................................................................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:C6E56091C07611DFA3EDC1F9F1E4707B" xmpMM:DocumentID="xmp.did:C6E56092C07611DFA3EDC1F9F1E4707B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C6E5608FC07611DFA3EDC1F9F1E4707B" stRef:documentID="xmp.did:C6E56090C07611

<<< skipped >>>

GET /static/image/common/qq_share.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:02 GMT

Content-Type: image/png

Content-Length: 3647

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR................a....pHYs................MiCCPPhotoshop ICC profile..x..SwX...>..e.VB....l.."#....Y....a...@....V....HU....H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0..>.3.o..~..@...z..q.@......qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N....l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A..............a.D@.$.<.B........A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R...J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6..l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V

<<< skipped >>>

GET /static/image/common/pengyou.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:02 GMT

Content-Type: image/png

Content-Length: 460

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR.............(-.S....PLTE...c.6&..v.B..\?..w.>1..m.S..hl.:.u.X.:N.3.....U...{.6...K.%"..[.P[..T.$..oS.En.27..C..Z.*L.!N.#9..*..W.5&..7..3..Z..U.&G.,p.?..R0..y.VF..(..A.)0..@..S.,P....NT.,0..7..N.,_.*9.. ..9..g.3F. b.0d.Kr....tRNS.@..f....IDATx.M.k.B@.E.(DsM.%.1Tz......U&..Ow.u.Y."T#%..7.].m......I.[....^Kba..3'./. $..i.S.q...|z..'....y,=.k8^.j...L3.4.@i..vW..N......ef0...Y.n..6w......B....4"...-(....."../.!7.P.%z.I;@..9.q..u?.......IEND.B`.....

GET /static/image/common/rt.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:02 GMT

Content-Type: image/png

Content-Length: 1366

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmp:ModifyDate="2011-11-01T02:12:30 08:00" xmp:CreateDate="2011-10-31T11:00:13 08:00" xmp:MetadataDate="2011-11-01T02:12:30 08:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:8BF3511AFBEC11E0AAAA984829F8A249" xmpMM:DocumentID="xmp.did:8BF3511BFBEC11E0AAAA984829F8A249"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8BF35118FBEC11E0AAAA984829F8A249" stRef:documentID="xmp.did:8BF35119FBEC11E0AAAA984829F8A249"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>E.O....rPLTE...cw.......^q..........m..g|..........s..z..i|........................._r.........................................N......tRNS.@..f...zIDATx......0..7.....H.......,.......l`...;.$...\.M.Y.....Z...Z..k..jm'....g_....B`....).,..i{GQPcCU..,.....SJ.x.s......"..A...I.......IEND.B`.....

<<< skipped >>>

GET /static/image/common/oshr.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:02 GMT

Content-Type: image/png

Content-Length: 1258

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:FB639F3C8E5E11DF977DADD5C8EF1534" xmpMM:DocumentID="xmp.did:FB639F3D8E5E11DF977DADD5C8EF1534"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FB639F3A8E5E11DF977DADD5C8EF1534" stRef:documentID="xmp.did:FB639F3B8E5E11DF977DADD5C8EF1534"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>O\......PLTE.......................................................~~...........................................................................................................................O.4.....tRNS.@..f....IDATx.t.E..@.D...a.....r.{.IQ...mz...!\.....)!...D;MV.........4l.T..VZ...L...W.S.#.........u8..|F......2.....,..z........0l......R.{..h.}.;.......7..9.#.....IEND.B`.....

<<< skipped >>>

GET /static/image/common/collection.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:04 GMT

Content-Type: image/png

Content-Length: 1327

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmp:ModifyDate="2011-11-01T02:10:13 08:00" xmp:CreateDate="2011-10-31T11:00:13 08:00" xmp:MetadataDate="2011-11-01T02:10:13 08:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:8BF35116FBEC11E0AAAA984829F8A249" xmpMM:DocumentID="xmp.did:8BF35117FBEC11E0AAAA984829F8A249"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8BF35114FBEC11E0AAAA984829F8A249" stRef:documentID="xmp.did:8BF35115FBEC11E0AAAA984829F8A249"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.r.....fPLTE....|n..3..6..4..5..6..3........E.......}l..9..F..[..T..h..k..B...........a..M..5..?..4..m..@..k......8......lIDATx.\.... .F..N...{../.....h...9O.<G... ..............A..e..|). &.v&.hkq.......JC.n............".b.B...%..$-.Gc.r.....IEND.B`.....

<<< skipped >>>

GET /acom?di=u1991537&dcb=BAIDU_DUP2_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=0&dai=1&dds=&drs=3&dvi=1432188695&ltu=http://VVV.ltywz.com/thread-17831-1-1.html&liu=&ltr=&lcr=&ps=153x-1&psr=1276x846&par=1276x818&pcs=60x20&pss=960x156&pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=140&tlm=1434271564&tcn=1434271564&tpr=1434271564146&dpt=none&coa=&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&baidu_id= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pos.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: post-check=0, pre-check=0

Connection: keep-alive

Content-Length: 1322

Content-Type: text/javascript;charset=UTF-8

Date: Sun, 14 Jun 2015 08:45:54 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Sun Jun 14 16:45:54 2015

P3p: CP=" OTI DSP COR IVA OUR IND COM "

Pragma: no-cache

Server: nginx

Set-Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; expires=Mon, 13-Jun-46 08:45:54 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1

BAIDU_DUP2_define('request!u1991537_0',[],{deps:['nova/painter/inlayFixed1392089005'],data:{"id" : "u1991537","_isMlt" : 4,"sw" : 960,"sh" : 60,"_html" : {"adn":"0", "at":"128", "aurl":"", "cad":"1", "ccd":"32", "cec":"gb2312", "cfv":"11", "ch":"0", "col":"en-us", "conBW":"0", "conOP":"1", "cpa":"1", "dai":"1", "dis":"0", "ltr":"", "ltu":"hXXp://www.ltywz.com/thread-17831-1-1.html", "lu_161":"0", "lunum":"6", "n":"38068079_cpr", "pcs":"60x20", "pis":"10000x10000", "ps":"153x-1", "psr":"1276x846", "pss":"960x156", "qn":"4f4730e82ea33ac9", "rad":"", "rsi0":"960", "rsi1":"60", "rsi5":"4", "rss0":"#FFFFFF", "rss1":"#FFFFFF", "rss2":"#0000ff", "rss3":"", "rss4":"", "rss5":"", "rss6":"#e10900", "rss7":"", "scale":"", "skin":"tabcloud_skin_1", "stid":"5", "td_id":"1991537", "titFF":"......", "titFS":"12", "titTA":"left", "tn":"baiduCustSTagLinkUnit", "tpr":"1434271564146", "ts":"1", "version":"2.0", "xuanting":"0"},"_html_old" : "cpro_template=baiduCustSTagLinkUnit|cpro_stid=5|cpro_skin=tabcloud_skin_1|cpro_cbd=#FFFFFF|cpro_cbg=#FFFFFF|cpro_ctitle=#0000ff|cpro_cflush=#e10900|cpro_conOP=1|cpro_lu_161=0|cpro_titFS=12|cpro_titFF=......|cpro_titTA=left|cpro_conBW=0|cpro_client=38068079_cpr|cpro_at=linkunit|cpro_cad=1|cpro_w=960|cpro_h=60|cpro_version=2.0","qn" : "4f4730e82ea33ac9","_qid" : "4f4730e82ea33ac9"}});....

<<< skipped >>>

GET /apps/qshare/images/icon.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: open.t.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.5.7

Date: Sun, 14 Jun 2015 08:46:26 GMT

Content-Type: image/gif

Content-Length: 1010

Connection: keep-alive

Last-Modified: Sun, 09 Oct 2011 08:19:48 GMT

Accept-Ranges: bytes

Cache-Control: max-age=86400

Expires: Mon, 15 Jun 2015 08:46:26 GMT

GIF89a\..................................................................................................................................................................................................................~..|..{..w..x..s..p..m..n..m..i..h..g..e..f..d..b..a..c..]..].......................................................................................................................!.....Y.,....\.......Y$78............7$.-...............-.................................................;JJ<!....X...X.................2R5 1O6.......8...... <80.Bv...[h...........G.....8."A.('.T.....X. 8.2..B.r..1#...=8$p!D.Q.1e.....A.X....."..N.jUZ..W.P6,.q......|5.....9..*x..)R.u.6......x..=.......l`....... F.....N.N.|.....=..Mq..B.R...... ID<HAD.m.Xp...;.n..m....x...Q.6.a....!,Q.[wq.NqS<...A...WO]h.....|. aE....O............?}.....}.....:x...@.@......A....y....S.NP.. .8..!....X..........Q... .....}...*.Xb.5....B.X..5...O.@&y...T ..E.i..Xf...ZR0..`J.%.(.i..h....l....m.)..t.)I......|.Y. .@"......$Y...;HTTP/1.1 200 OK..Server: nginx/1.5.7..Date: Sun, 14 Jun 2015 08:46:26 GMT..Content-Type: image/gif..Content-Length: 1010..Connection: keep-alive..Last-Modified: Sun, 09 Oct 2011 08:19:48 GMT..Accept-Ranges: bytes..Cache-Control: max-age=86400..Expires: Mon, 15 Jun 2015 08:46:26 GMT..GIF89a\..................................................................................................................................................................................................................~..|..{..w..x

<<< skipped >>>

GET /cpro/ui/noexpire/img/2.0.1/logo-border-light.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro2.baidustatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:13 GMT

Content-Type: image/png

Content-Length: 473

Connection: close

ETag: "554709f0-1d9"

Last-Modified: Mon, 04 May 2015 05:56:00 GMT

Expires: Thu, 01 May 2025 07:57:22 GMT

Age: 3545331

Cache-Control: max-age=315360000

Accept-Ranges: bytes

Ohc-Content-Crc: 1058936823

Server: hkg01-sys-jorcol10.hkg01.baidu.com

.PNG........IHDR...D...........xX....IDATx..W!o.0.....,.;..<.%.$...g..K0....%.92...AM N...p...a}K....hi...... ....{....8.8.Xq\s.s.g..c.q5#...Yr....=B.....6M.|.....eY....M.m..3N.c....=...a.>b2...k...8/..ch1U..Q!..).........$I.R....UU}.z.c....L8.....z...8~..........b. x. O......S.CW!.........R..ej..."S..Bn....C.8T@.P...,1SC.#.F...r .@.J"..'1y.....B....K.K. .R.K..r@..b[%...T;.1!...a.......\..^.-V.-.h]..J2.....)!&.Y.......UJ...!z..m...x.j.L1l6.?rGB..h.....'a.B.....IEND.B`...

GET /core.php?web_id=5796949&show=pic&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 762

Connection: keep-alive

Date: Sun, 14 Jun 2015 08:46:27 GMT

Last-Modified: Sun, 14 Jun 2015 08:46:27 GMT

Expires: Sun, 14 Jun 2015 09:01:27 GMT

Via: cache22.l2de1[1208,200-0,M], cache35.l2de1[1222,0], cache8.de1[1221,200-0,M], cache4.de1[1222,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:3:730717315

X-Swift-SaveTime: Sun, 14 Jun 2015 08:46:28 GMT

X-Swift-CacheTime: 899

<<< skipped >>>

GET /acom?adn=0&at=128&aurl=&cad=1&ccd=32&cec=gb2312&cfv=11&ch=0&col=en-us&conBW=0&conOP=1&cpa=1&dai=1&dis=0&ltr=&ltu=http://VVV.ltywz.com/thread-17831-1-1.html&lu_161=0&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=153x-1&psr=1276x846&pss=960x156&qn=4f4730e82ea33ac9&rad=&rsi0=960&rsi1=60&rsi5=4&rss0=#FFFFFF&rss1=#FFFFFF&rss2=#0000ff&rss3=&rss4=&rss5=&rss6=#e10900&rss7=&scale=&skin=tabcloud_skin_1&stid=5&td_id=1991537&titFF=å®‹ä½“&titFS=12&titTA=left&tn=baiduCustSTagLinkUnit&tpr=1434271564146&ts=1&version=2.0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u1991537&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.172.2203.2203 HTTP/1.1

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

HTTP/1.1 200 OK

Cache-Control: post-check=0, pre-check=0

Connection: keep-alive

Content-Length: 32930

Content-Type: text/html

Date: Sun, 14 Jun 2015 08:46:11 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Sun Jun 14 16:46:11 2015

P3p: CP=" OTI DSP COR IVA OUR IND COM "

Pragma: no-cache

Server: nginx

<!DOCTYPE html>.<html xmlns="hXXp://VVV.w3.org/1999/xhtml"> . <head>......<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <title>..................</title>. <style type="text/css">....html{color:#000;background-color:transparent;}body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,code,form,fieldset,legend,input,textarea,p,blockquote,th,td{margin:0;padding:0}table{border-collapse:collapse;border-spacing:0}fieldset,img{border:0}address,caption,cite,code,dfn,em,strong,th,var{font-style:normal;font-weight:normal}ol,ul{list-style:none}caption,th{text-align:left}h1,h2,h3,h4,h5,h6{font-size:100%;font-weight:normal}q:before,q:after{content:''}abbr,acronym{border:0;font-variant:normal}sup{vertical-align:text-top}sub{vertical-align:text-bottom}input,textarea,select{font-family:inherit;font-size:inherit;font-weight:inherit}input,textarea,select{*font-size:100%}legend{color:#000}body{margin:0;padding:0;} .....bd-logo,.bd-logo2,.bd-logo3,.bd-logo4{text-decoration:none;cursor:pointer;display:block;overflow:hidden;position:absolute;bottom:0;right:0;z-index:2147483647}.bd-logo{height:18px;width:18px;background:url(hXXp://cpro2.baidustatic.com/cpro/ui/noexpire/img/2.0.1/bg.png) no-repeat left top;background-position:0 0;_filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(enabled=true,src="hXXp://cpro2.baidustatic.com/cpro/ui/noexpire/img/2.0.1/logo-border-light.png",sizingMethod="crop");_background:0}.bd-logo:hover

<<< skipped >>>

GET /sync_pos.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1 HTTP/1.1

Referer: hXXp://cpro.baidustatic.com/sync.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISBID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISUS=1

HTTP/1.1 200 OK

Accept-Ranges: bytes

Connection: keep-alive

Content-Length: 1596

Content-Type: text/html

Date: Sun, 14 Jun 2015 08:46:14 GMT

Etag: "557ba5a3-63c"

Last-Modified: Sat, 13 Jun 2015 03:38:11 GMT

P3p: CP=" OTI DSP COR IVA OUR IND COM "

Server: nginx

<!DOCTYPE html>.<html>. . <head></head>. . <body>. <script type="text/javascript"> . var getCookie=function(b,d){var a;d=d||window;var c=RegExp("(^| )" b "=([^;]*)(;|$)").exec(d.document.cookie);c&&(a=c[2]);return a},setCookie=function(b,d,a){a=a||{};var c=a.expires;"number"==typeof a.expires&&(c=new Date,c.setTime(c.getTime() a.expires));document.cookie=b "=" d (a.path?"; path=" a.path:"") (c?"; expires=" c.toGMTString():"") (a.domain?"; domain=" a.domain:"") (a.secure?"; secure":"")},getUrlParam=function(b){b=RegExp("(^|&)" b "=([^&]*)(&|$)","i");b=window.location.search.substr(1).match(b);. return null!=b?decodeURIComponent(b[2]):null},currentDomain=document.domain.toLowerCase(),referDomain=(document.referrer?document.referrer.match(/.*\:\/\/([^\/]*).*/i)[1]:"").toLowerCase(),urlCproId=getUrlParam("CPROID"),cookieCproId=getCookie("CPROID"),targetCproId;!urlCproId||"pos.baidu.com"!==currentDomain||"cpro.baidu.com"!==referDomain&&"cpro.baidustatic.com"!==referDomain||cookieCproId&&cookieCproId===urlCproId||setCookie("CPROID",urlCproId,{path:"/",domain:".pos.baidu.com",expires:(new Date).setFullYear(2042)});. var sendByIframe = function (b) {. var c = document.createElement("iframe");. c.style.display = "none";. c.setAttribute("src", b);. document.body.insertBefore(c, document.body.firstChild). }. sendByIframe("hXXp://release.baidu.c

<<< skipped >>>

GET /acom?di=u2109486&dcb=BAIDU_DUP2_define&dtm=BAIDU_DUP2_SETJSONADSLOT&dbv=0&dci=0&dri=0&dis=0&dai=2&dds=&drs=3&dvi=1432188695&ltu=http://VVV.ltywz.com/thread-17831-1-1.html&liu=&ltr=&lcr=&ps=5695x-2&psr=1276x846&par=1276x818&pcs=60x20&pss=962x5717&pis=-1x-1&cfv=11&ccd=32&chi=0&cja=true&cpl=0&cmi=0&cce=true&col=en-us&cec=gb2312&cdo=-1&tsr=27468&tlm=1434271591&tcn=1434271591&tpr=1434271564146&dpt=none&coa=&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&baidu_id= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISBID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISUS=1; CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

HTTP/1.1 200 OK

Cache-Control: post-check=0, pre-check=0

Connection: keep-alive

Content-Length: 1144

Content-Type: text/javascript;charset=UTF-8

Date: Sun, 14 Jun 2015 08:46:20 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Sun Jun 14 16:46:20 2015

P3p: CP=" OTI DSP COR IVA OUR IND COM "

Pragma: no-cache

Server: nginx

BAIDU_DUP2_define('request!u2109486_0',[],{deps:['union/floatad'],data:{"id" : "u2109486","_isMlt" : 4,"sw" : 120,"sh" : 270,"_html" : {"adn":"1", "at":"6", "aurl":"", "cad":"1", "ccd":"32", "ccw":"1000", "cec":"gb2312", "cfv":"11", "ch":"0", "col":"en-us", "conOP":"0", "cpa":"1", "ct":"1", "dai":"2", "dis":"0", "fa":"1", "flw":"1", "ls":"3", "ltr":"", "ltu":"hXXp://VVV.ltywz.com/thread-17831-1-1.html", "lunum":"6", "n":"38068079_cpr", "pcs":"60x20", "pis":"10000x10000", "ps":"5695x-2", "psr":"1276x846", "pss":"962x5717", "pt":"1", "qn":"86671a64861f8429", "rad":"", "rsi0":"120", "rsi1":"270", "rsi5":"4", "rsi6":"-1", "rsi7":"0", "rss0":"", "rss1":"", "rss2":"", "rss3":"", "rss4":"", "rss5":"", "rss6":"", "rss7":"", "scale":"", "skin":"", "td_id":"2109486", "tn":"float_xuanfusld_120_270", "tpr":"1434271564146", "ts":"1", "ww":"0", "xuanting":"0"},"_html_old" : "cpro_float=1|cpro_template=float_xuanfusld_120_270|cpro_lunum=6|cpro_contw=1000|cpro_cad=1|cpro_position=1|cpro_follow=1|cpro_close=1|cpro_clientw=0|cpro_location=3|cpro_client=38068079_cpr|cpro_h=270|cpro_w=120","qn" : "86671a64861f8429","_qid" : "86671a64861f8429"}});....

GET /acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3&ltr=&ltu=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2002&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270 HTTP/1.1

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISBID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISUS=1; CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

HTTP/1.1 200 OK

Cache-Control: post-check=0, pre-check=0

Connection: keep-alive

Content-Length: 5347

Content-Type: text/html

Date: Sun, 14 Jun 2015 08:46:20 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Sun Jun 14 16:46:20 2015

P3p: CP=" OTI DSP COR IVA OUR IND COM "

Pragma: no-cache

Server: nginx

<!DOCTYPE html>.<html>. . <head>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <title>..................</title>. <link rel="stylesheet" href="hXXp://cpro.baidustatic.com/cpro/ui/noexpire/css/1.0.0/base.css"/>...<style type="text/css">.....container a.bd-logo{.....top:0;.....right:0;.....width:24px;.....height:20px;.....background:url('hXXp://cpro.baidustatic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5.png') no-repeat top left;....._filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(enabled=true, sizingMethod=none, src='hXXp://cpro.baidustatic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5.png');....._background:none;.....cursor: default;....}.....container a.bd-logo:hover{.....width:90px;.....height:20px;.....background:url('http://cpro.baidustatic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5-hover.png') no-repeat top left;....._filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(enabled=true, sizingMethod=none, src='hXXp://cpro.baidustatic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5-hover.png');......._background:none;....}...</style>. <script type="text/javascript" src="hXXp://cpro.baidustatic.com/cpro/ui/noexpire/js/3.2.0/base.js"></script>. </head>. . <body><div style="display:none;"><img src="hXXp://cm.g.doubleclick.net/pixel?google_nid=baidu&google_cm" height="1px" width="1px" alt="" /></div><div style="display:none;"><img src="hXXp://wn.

<<< skipped >>>

GET /9.gif?abc=1&rnd=36257576 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Sun, 14 Jun 2015 08:46:35 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=ay0EDmfjxWcCAcGK9OexXmdE; expires=Wed, 11-Jun-25 08:46:35 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=d7f1b3dd; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=91d36749b0488c641c585018_1434271595; expires=Wed, 11-Jun-25 08:46:35 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=ay0EDmfjxWcCAcGK9OexXmdE

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache

GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server: Tengine..Date: Sun, 14 Jun 2015 08:46:35 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=ay0EDmfjxWcCAcGK9OexXmdE; expires=Wed, 11-Jun-25 08:46:35 GMT; path=/; domain=.mmstat.com..Set-Cookie: sca=d7f1b3dd; path=/; domain=.cnzz.mmstat.com..Set-Cookie: atpsida=91d36749b0488c641c585018_1434271595; expires=Wed, 11-Jun-25 08:46:35 GMT; path=/; domain=.cnzz.mmstat.com..Location: http://pcookie.cnzz.com/app.gif?&cna=ay0EDmfjxWcCAcGK9OexXmdE..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /gpixel?google_gid=CAESEJjFx4RhgLnSGfBEJ8AfDVY&google_cver=1 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISBID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISUS=1; CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:24 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: keep-alive

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: nginx..Date: Sun, 14 Jun 2015 08:46:24 GMT..Content-Type: image/gif..Content-Length: 43..Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT..Connection: keep-alive..GIF89a.............!.......,...........L..;..

GET /adx.php?c=d25pZD1hYjMxYzAyNjZiMjJlM2EyAHM9YWIzMWMwMjY2YjIyZTNhMgB0PTE0MzQyNzE1ODAAc2U9MQBidT01AHByaWNlPVZYMF9YQUFOcDh0N2pFcGdXNUlBOGlQRFg4QURyRllqSzVVbDhRAGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD1FM0VBRDcxRDFGNjhERTZFREQwQURBRjQ2OEREN0U0OABiY2htZD0wAHY9MQBpPTBjZTMyNDNi&ext=cGxhbmlkPTc2NSZsaW1pdD0xNSZyYz1oeg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wn.pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISBID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISUS=1; CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:F

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:22 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

Expires: Mon, 26 Jul 1997 05:00:00 GMT

GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Server: nginx..Date: Sun, 14 Jun 2015 08:46:22 GMT..Content-Type: image/gif..Content-Length: 49..Connection: keep-alive..Expires: Mon, 26 Jul 1997 05:00:00 GMT..GIF89a...................!.......,...........T..;nt>....

GET /adx.php?c=d25pZD0xNTkzNjgzNGQ1ZTFhMjBlAHM9MTU5MzY4MzRkNWUxYTIwZQB0PTE0MzQyNzE1ODQAc2U9MQBidT01AHByaWNlPVZYMF9ZQUFFWDBON2pFcGdXNUlBOHN0TWhoOGpTamtEcFoyaTB3AGNobWQ9MQBiZGlkPUUzRUFENzFEMUY2OERFNkVERDBBREFGNDY4REQ3RTQ4AGNwcm9pZD1FM0VBRDcxRDFGNjhERTZFREQwQURBRjQ2OEREN0U0OABiY2htZD0wAHY9MQBpPTg3ODJlMDIw&ext=cGxhbmlkPTEwMCZsaW1pdD0wJnJjPWh6 HTTP/1.1

Accept: */*

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3&ltr=&ltu=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2001&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wn.pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISBID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISUS=1; CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:24 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

Expires: Mon, 26 Jul 1997 05:00:00 GMT

GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Server: nginx..Date: Sun, 14 Jun 2015 08:46:24 GMT..Content-Type: image/gif..Content-Length: 49..Connection: keep-alive..Expires: Mon, 26 Jul 1997 05:00:00 GMT..GIF89a...................!.......,...........T..;..

GET /cpro/ui/noexpire/js/3.2.0/base.js HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidustatic.com

Connection: Keep-Alive

Cookie: CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:21 GMT

Content-Type: application/x-javascript

Content-Length: 1308

Connection: close

ETag: "554709f0-51c"

Last-Modified: Mon, 04 May 2015 05:56:00 GMT

Expires: Thu, 01 May 2025 07:55:03 GMT

Age: 3545478

Cache-Control: max-age=315360000

Content-Encoding: gzip

Ohc-Content-Crc: 3435828300

Server: hkg01-sys-jorcol10.hkg01.baidu.com

...........VK..6.. ...6.:.k<B..t.........d.~$.eH.d....R.;.`...%..(..G?3.xd.h.e[6.....x.vQ..........Myj.id....F..F...p..&qj.'y.....8....K.I..c.6...8q>.._.b./.Q.'.Hf.Fo..F.o..b.SJr)..........x.|G...u..2.2@Y?d..I..6....%.....#.6...6.0$..`.l<_...zHX2e.zN.....5e.q.n-Rt..A0 fw...^1....eGK&4...n3.......RE....]...=:...g..f....K....Dy.....&.2\. `.a..k.iH...GV....\0..y....,....v.JI.V,...h....TlOB.".....d.?!.....;e....Gx. ..$.......h Sg....r....=]7....k.p..C.vJ.\\.6.Zq..I..y...w.6K...ho..!.....2.$).[M.....c....>4_E..eG.Y..,..<......l........V.....Dw.{w.6eJ....(Ou'.....R...1......9.?!S...3x.............O.`.......Y..eKL'.[....m.. ..C.....1.me. ..g...tnff..gG.z..G.......,..p.x5..6......t.h5.g..#.....gP......t..=K.L..... ..i..7.ZR...|)#R....a..E.^s..G.%ZU .."..,...M....Q..(.../......c..Py..Nub....@.s...`.k7.!.........g#...v..]i.~H8"6./..Yn.e.t./P;.a.-$.2.'..........=1.r......-PH~:BkR.O5.............kib........<`..r...D...^...*.z....Kf.5....:.....MWU........YF*nFu=Rp=Q.].[.....k.V...1....W......'..2.....6Q.:.6.....^.H.l.....~..g.9......PU7.w#H..mv. .7.#.K$Z.!R..A....p*;.8....U..C..G.f..C.n.gY......../Dur...._NrT..D._.._.R...........:....x..|.....;.8M.-....>...vR8...N...6.C.1.u.f>y.v.y..Y....D..C..N\".*...zn.!.l.5...&.-.1O......4.Sj.}.M.......{.....`.....;..p*...Z......<.Y[D...C.$b......I..O,]..7.._.......

<<< skipped >>>

GET /gengxin/qqlx/lxqq.htm HTTP/1.1

Referer: hXXp://VVV.minnanwl.com/gengxin/qqlx/lxqq.htm

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: VVV.minnanwl.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 11

Content-Type: text/html

Last-Modified: Fri, 08 Aug 2014 12:41:59 GMT

Accept-Ranges: bytes

ETag: "f67520256b3cf1:b16"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Sun, 14 Jun 2015 08:45:36 GMT

QQ424308510HTTP/1.1 200 OK..Content-Length: 11..Content-Type: text/html..Last-Modified: Fri, 08 Aug 2014 12:41:59 GMT..Accept-Ranges: bytes..ETag: "f67520256b3cf1:b16"..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..Date: Sun, 14 Jun 2015 08:45:36 GMT..QQ424308510..

GET /cloud/scripts/discuz_tips.js?v=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: discuz.gtimg.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2_Platform

Connection: keep-alive

Date: Sun, 14 Jun 2015 08:46:36 GMT

Cache-Control: max-age=7200

Expires: Sun, 14 Jun 2015 10:46:36 GMT

Last-Modified: Fri, 30 Aug 2013 01:57:44 GMT

Content-Type: application/x-javascript

Content-Length: 3265

Content-Encoding: gzip

X-Cache-Lookup: Hit From MemCache Gz

...........X[W.:.~._.83.>qMdS..Q. .....Ph.a9.......$D...m.......ix.>..%..d...h.I.e~.j.....d....._.=}..l....~]_.,..MR..3..tu].i..........N.....$..1r.F...W.>..=3.r.fo......Z.j&".\Oh...4r..._G~...>..[..=.....$.<...z.T........z...........Y8.[C..U.y.."...K1<......5:...Q.VuC.p.3cg.U{.6q..?.X#M.2...4k[...sp/..m2[[7.u.W....1..Fv..*>.;._..d...j...~.....j........wX.B..h..z.Wm].p~W}....5..J.Fe..k,Z.):.........4a..}..u....l..L.q.k..-x..n...0..]gT.2-...<2.s,y...5...l.=.a`.....v..D...D<....r....XscC[sM...~9.....2....c......<ol`....k.C..&..k...w..;....n.....i...T?.2#5.I..dg..../....A.....2.`,...R....F.. ).LM{.5H.Q.[...:_.....{L6..M.rLN........n..>~.$..U...."....C..a..}lz..../.d.>}>^,4.....M..`...)J,F..<.K..O{.....)..#}.sk.L.......Y.k...s".j...C...}....A.....J./......C>...w..u0,.......Q~....&p..E.#..pd.....k..mco.{{o...X'.....T....(...=. .d.b.bY.....c7......w...?l..O.....9...3..tA52C...a.F..y.:zY.......R.w.d.....}.../<..O..,..ZGw".....]..k[.f.:&.-....4]....T..B..P.cN...9V.U..E..)..!.....$.K.m..#.Yc..Z_..W...VS....N...mV".>'HT:.i0.`..;5~..7....f...1.~.....k6y.q.#~._fqf....6....b........h..pQ.c...$$..C#...(...t.kfp.e}..d7&.eZu...9.d..ZL.n`..p2.7j..'g....]...ty.......!.V.....k.....).X....l.t.9S.3.....=/....~C.*...L.....6..j..tR9[=@qv...).`.rJ.....=....Y.Y........w.;.*.y7..9I.\laXEf./... O.M ..rOll.lmE?._.......R...... ...(.{..=b...W..W.......d.%.8,0....VCqJ..X...9.B.....I....K..U..:..j....U.!...>\8P..'cx#[..n.Dy.o....jg.n....E..U...0H..EW...2....x..^%..l.h..Jj.=......o..9.....

<<< skipped >>>

GET /rj/post.htm HTTP/1.1

Referer: hXXp://VVV.ltywz.com/rj/post.htm

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: VVV.ltywz.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:39 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sun, 26 Apr 2015 06:11:52 GMT

Accept-Ranges: bytes

ETag: "861c72e3e77fd01:b16"

X-Powered-By: ASP.NET

9a9......QQ............1.3.5....QQ................VVV.baidu.com..................QQ............2.50....QQ....................hXXp://VVV.ltywz.com/rj/....QQ............V2.50.rar..............QQ..............2.8....QQ......................hXXp://VVV.ltywz.com/rj/....QQ..................V2.8.rar..............QQ..............3.2.5....QQ......................hXXp://VVV.ltywz.com/rj/....QQ......................v3.2.5.rar..............QQ..............2.68....QQ......................hXXp://www.ltywz.com/rj/....QQ..............V2.68.rar..............QQ............3.25....QQ....................hXXp://VVV.ltywz.com/rj/....QQ..............V2.62.rar..............QQ..............4.36....QQ......................hXXp://VVV.ltywz.com/rj/....QQ...................rar..............QQ....................3.52....QQ............................hXXp://www.ltywz.com/rj/....QQ..............V2.62.rar..................................1.1................................hXXp://VVV.ltywz.com/rj/....QQ..............V2.62.rar..............QQ..................1.1....QQ..........................hXXp://VVV.ltywz.com/rj/....QQ..............V2.62.rar..............QQ..................N1.1....QQ..................N........hXXp://VVV.ltywz.com/rj/....QQ..............V2.62.rar..............QQ..............1.1....QQ......................hXXp://VVV.ltywz.com/rj/....QQ..............V2.62.rar..............QQ..........1.1....QQ..................hXXp://VVV.ltywz.com/rj/....QQ..............V2.62.rar..............QQ..........1.1....QQ..................hXXp://www

<<< skipped >>>

GET /thread-17831-1-1.html HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:40 GMT

Content-Type: text/html; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Set-Cookie: 7rjd_2132_saltkey=b51T0zUC; expires=Tue, 14-Jul-2015 08:45:36 GMT; path=/; httponly

Set-Cookie: 7rjd_2132_lastvisit=1434267936; expires=Tue, 14-Jul-2015 08:45:36 GMT; path=/

Set-Cookie: 7rjd_2132_sid=FLA8Y1; expires=Mon, 15-Jun-2015 08:45:36 GMT; path=/

Set-Cookie: 7rjd_2132_lastact=1434271536 forum.php viewthread; expires=Mon, 15-Jun-2015 08:45:36 GMT; path=/

Set-Cookie: 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; path=/

Set-Cookie: 7rjd_2132_visitedfid=78; expires=Tue, 14-Jul-2015 08:45:36 GMT; path=/

Set-Cookie: 7rjd_2132_viewid=tid_17831; path=/

Set-Cookie: 7rjd_2132_sid=FLA8Y1; expires=Mon, 15-Jun-2015 08:45:36 GMT; path=/

Content-Encoding: gzip

4acc.............}.w.....a-..rgP..._zC...1f.....O...U.]-.tw....a...nf......./..B..%@..d.8.d.8..sc........ztWK-,..8A]...g.}...>...Y.f..[.~.....U.vJE..o?....Z.#.{%.9...s.....|.y-...vV.r.tL...c....h.a...b......T.U...|9...JPfy...rv..|d.Us..J.r5.RN..._d...=O.J......a...{...V.1.N..Q..h9q..8.>'F5l.r.z.j8.......B..)......p...sZ.v..S.o.~..6...&...p......)&..%:q.e.d.#........jSE..}..F5W1m"./..2h..56f.2.FEw../.......B..Tg.1.^s.C..4......f.T5...oo..Yc.9....C....d<..H..)7..r..1..;v....S...X1.bd^............G.a8_..s.(.h..;f.......9g..UC............9...d..fy.V1..H..-..a.@....d.\...R....rzn..q.L./..JV......,S.K.Y.*.Rf.i.8.W......o..}...F....m...<.u..-.E.}....f....~.yzRu@.\......[...{f..!#&............%@..@..z.I..yf.L....8%....aW.z.[...$..d.}..J.Y...#..0=.&U...Z........3.q..n.]4.r.T.j..Ek.P.t.r.......7...~r..k./].....k4....F....Vtx.es^......S.I...xn....T>...... ...{W6....R.h..x-...#/&.{..%.._..T.o.G......W~......o..........^......w^...n....._..sk.M..}.VY.ONz\.$....gv.H.8..7..{!X...|.[....|t...`..n....\:. Tr.....i..2.A>)..v.....r..A.d^\~.....e......z.....,.......q.....5..N{..h......,...X6[.D.... A].B.w.G3..l..U2..i.U..'..Jn.......t$8J.HN...".97.r....p.mU......b.B.@..V~T3..Hyo....(.U....O.F4..5;o........R'.l..F:..].U..U.ZA/V...o...\4..(.3.^.R.......M..]....*.4....R/..v.n.rE.\......~.....5oV.l.h.B.3p7.2.y..bC..G%..D.z4..on.9.0..F..kH./T....{.......Y..6l..~....XG...cwI..z.0......?..X.1..p.kr^......t.....,....w.........w>?q...KW......*.G....7N{JF...?n.v..l-[..a..IjV..>:.....E..9%...h.%.....&.(..3.N...Vw..%.i_

<<< skipped >>>

GET /data/cache/style_28_forum_viewthread.css?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:43 GMT

Content-Type: text/css

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Wed, 03 Jun 2015 14:52:33 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip

34a7.............}Ys.I.._.....z...K"43kj.6..kk...O0.$Z..H.R.........LH..=...LDzxx........i.0......~..,........b:...mG..b};..~}...Vw...g.|7[..U.s....`.O.......ov..n0...f.......QW..u........Y.2..3..U..l^.[.v....".....8\....=M...r.m0^n&_..la(...f..V.?....w..S5.Zu...f7....`.Y../.H&..f78...c.....~..w.....ns...N>......=TO..uwB.@..<. ~n...#..........n7....`:.*.....3.x..O...lV...:....].G.. .........}.....n6.....o...:.S.......:....Y.?....1..I..~;Z..\y.K..p....g..9.hp.[.......~{||.-.o...&..o..\0.m....~...f.....m...v..:..3.T.f%c.>.....].cR.0.k....u..}..OF*.......o..I..@.:.h.?.U.....g....Noq..-. ...(r0...x@..............?.'..s!....D..&$c.w........~.-f...;......#...P.....j..Ff.s..J..Vo. ..U.._.,.K..?........|...XC..;e@I........]Jx..<.........g.wuN...N1KY4..P....DL<..6........5.M@..O.L..@..&..=4.v.XW..6.I......r5.jv.F....S..*....^..N.IG.....nw...../..b........u...N|........h1.v.._}J...a...;.J.Nr.m.6...dSQ1u...k..}....w....f.`Hu.Vu.X.|.....G...z0.gcN.......-h...j.=.{.Q.7..._.1..pY...7-,..0B......\.~.....fL...k...3.M.@.c.M%J[c`...l..^.l..4I.....O.w..l..}X........<....'....,..)..r9V5B=..@.....l.eQu...F...~p.....g...........}.p.vT..|SrqW...G...{.W....|..Hj..^.'.....*.....V.5..../.n.r.Q....c1...1.|...`~0V...I..r...`..7.L..f....Y.H.W....AQ|WG.<.G...S.K98.t..#.|7[.U..*....AH......../....<d..s.0J...d...=..N5uQ.xK|.[.8\>.5.,.....n...t/nZ:\E...v[7.....Mk...z{..Q....:..w.8z&N...Zl. ........^...(.*-.$......o....T.....3.G.....1.)...hQ.gd..1.....?..$%),2.V-n.jC.V.....Z.@..i...Q...q$I.''...=......f...}}........E.

<<< skipped >>>

GET /data/cache/forum.js?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:50 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sat, 13 Jun 2015 21:30:15 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip

1b5b.............\.o..u.W....5.%)G...........\.%.v.;K..;................b..k .l.qk.N.6@.4..6...@].0........G.%.M..{...u.=..3...v..YP.......t ..I......p7..^K.....Y'..Y...^...%...........A^..|......A.....f.Y.Wn....:&47....4;i1.....r........&..Au.n.8..\.Q..p.E..)@.j.Ru`..v.)....I9.f|/..I.....P!..@......:...".;...PF.../jU........F...Z..~.].{g67.y'..NZv.vs3..4.,K...x..F.R..ZGA. ...:.........F....}...*..T......]V...C-.#.......=.Au`..\.........Eb.x]h.ip...LzI?....K..r..33Z.........b.kfq?...b.h)....Ha^_yb.....X.....7._[.<.....y..(8.....2./-.ilo'.....X.0...X.v..$.Xs...e..cR.U.. .a.0..k..qY..m.&.....9@.}..{-..p..s.c...<Yr.V..\....a..#g.5.@TE._!j...d!pI.\...L.QRes....Qm......5..B.Q.)gJ..(.Zdv...0a0C.....7F.^.whMkaW..5xJjN....j=EI.$..-.R<..\....fw...l.. t3.G3X..q.R...q"....*:....1#.....8.y...#....b:.DY.1 ..y...x)c.XFS......`..5n.....La.....F8.M.=z~c.vf.....U...Y.0..x0H.N....2....\......p.j...h...r.....k....hx.lc..g.;.Q..R.K.N.....D..=... ;1{.....?..!i/............b/-...;.q.N...(...?....He..:".P9..m.z_../...Q..X.`.d.;q'..........E. .....4A.mn...I.M...cFeM.F].w.h)...`....H;.f<.h..^<(...g[. .....:^.|k..8.P..e0.0?eh.....A.h.{qQ.....x .fc.uoo.gPl.{I<...t..pz.......>.....l...4.B..wf.....;.<Td;`...E...xf......g..?...XvN?6.-..a.V(..]97..g..]o...(....d.B........J..vn!-66{0.~....J...W.....J@."e,.f..(F.jx?....#..~....f*..b.^Q....KA..!.i.h........2~..clt...Q...@..`\.A.}.dm.Op.J.k....<./~..2..>.f.0(.ez..O..-..S...}.. ..dN{q....%@.{..B....$xZ....BS..w.9....DL[Q..{....0.kc...XC/-0..... ...J,.9....h..N[:..#H.

<<< skipped >>>

GET /static/image/common/logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:50 GMT

Content-Type: image/png

Content-Length: 14259

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sun, 19 Oct 2014 11:55:50 GMT

ETag: "ee24c6a093ebcf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a..K................................................................... ..'%./,$:70B?8GEAPMIVTN^[TdaYhfciihjiijjijjhomfuqh|wm.|u..............|.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,......K.....5..H......*\......#J.H.....3j...... C..I....(S.\.....0.&1a....$...(E.F.@v.las.Q..L.........0..BjA$Z........G/dqyc...V.j9.P...*...ZD.@.<.r.......Zj."..^.<.j......^d.elw...V...auoF....H.V..&0..,.....e...Q.......~*..g..B.u.........m. .....Y.[S......Q.......W.!.o......q#.@ .5Y..B.................@.'.@[..A..4...*`A......I..@...m..{".&P{n...\HHF.A2.0@P<...v......4....X..@^U...'.q..Z..V..5a.TM.!.A0x.!mM...e.. ..Z..e..a...;....F.Y..M.G..^...&'....V.IPk..G..t*..\d"....6..@,.y..%.PYA1.).wv.q....D B....T*.v`.$L.....lQ..F....H.&.d..5.AV QD}....k..y.N^.....F....HJ..05E.....V........f...x;..05....J......BLV.)..\..C... p..PX!.d&lQ... ..?jrBy. l.CL..A..w..j..e....p...U...0.........1.I.........$E.!U ..D.......P.B.

<<< skipped >>>

GET /static/image/common/px.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:51 GMT

Content-Type: image/png

Content-Length: 210

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR...2...........o.....sBIT.....O.....PLTE.......56.....tRNS....0J....pHYs...........~.....tEXtCreation Time.12/28/10........tEXtSoftware.Adobe Fireworks CS5q..6....IDAT..c`........S."....IEND.B`.....

GET /static/image/common/qq_login.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:51 GMT

Content-Type: image/gif

Content-Length: 3200

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a|..........}..o..m..}..~..n.....P..v..b..n.....r..p..z..s..q..|..t..y..x..{..v..w..m........i..d.....l.....k..f........e..j..............h..............e............................" %$! .m.....................................*(6...!.&.l....XWa....... .......ui\........V.4%SSY..............D......EER..........q.....(.....R.......cdl.t..Z........:#..........0-.....R.b..V.....e..b.......". ...............yz..^......w..~..R.h..1&...#........).*..N...Z......N:.[<..............8.*.......................O-.....0..7.....F__d..T........U............9;TY=*.H,FI`............78N.QB...tvx.....N.&..K-.............F".?....-"%.P5.....,.....)p..........7.............qv.d.G@D..................w...0.@...w$.......gN?=H.................7...............33A....$...#....G ...............!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:10EB301D755611E0A920C2ECFDA0A76D" xmpMM:DocumentID="xmp.did:10EB301E755611E0A920C2ECFDA0A76D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6DA81140755511E0A920C2ECFDA0A76D" stRef:documentID="xmp.did:10EB301C755611E0A920C2ECFDA0A

<<< skipped >>>

GET /static/image/common/newarow.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:51 GMT

Content-Type: image/gif

Content-Length: 327

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a...................!.......,.........................................L................L*......J......j............N.....................(.#Ph(0.....r...)9.gHy..........*:JZjz.......... ;K[k{..........,.ERl|..........0<M]m}..........->..nN.Nn..........o9.Om.....{........0H0!.p..:.UO....".....EN..;...1...$K.<.2...,[..U..;....

GET /static/image/common/pn.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:52 GMT

Content-Type: image/png

Content-Length: 592

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

.PNG........IHDR.......`.......pY....sBIT.....O.....PLTE.................................................................................Q..-{.,y.,w. v. t. s.*q.*p.)n.)m.)k.(j.(h.'f.'e.'c.&b.&`.%_.%\.%].%[.$\.$Z.$Y.$X.#W.#V..o>$....pHYs............Z....tEXtSoftware.Adobe Fireworks CS5q..6....IDATx....Q.....5..E1G...l..Y..iag..}..........rtX....a-:...zt.F.........vt.....a/:.G.Qt8....a.....qt8....).P....Tt....]..BE.*.P....Tt....]..BE.*.P....Tt...q.....Et...W..::.D...0..w..>:<D...0..O..9:.D......f..=:|F......~.._t...y.*.P....N....Tt.fX....]...P....Tt!>.St...1.N....Tt..l|[.S<y.....IEND.B`.....

GET /static/image/common/nv_a.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:52 GMT

Content-Type: image/png

Content-Length: 2076

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR............. ,.?....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:78A850DA537F11E09D8FB02ED5CE61ED" xmpMM:DocumentID="xmp.did:78A850DB537F11E09D8FB02ED5CE61ED"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:78A850D8537F11E09D8FB02ED5CE61ED" stRef:documentID="xmp.did:78A850D9537F11E09D8FB02ED5CE61ED"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........PLTE#;. N..W..G..\..`..e..]..V..B..T..b..d..H.(7..N.;..._..U..R..Z..g.#,{ @.!?.">.(C.&8..c..P.(2..h..m..j..a."K.._..o..X..q..R..].->..u.C...l.$I.%G.'F..C. @..G..J..E..?. L..Q..N..T..N..L..e..O..D.#H..q..R..s..X..V..M.....Z.....].M...y.P...........Q...K..O..Y..E.....z.....WtRNS........................................................................................c5.....IDATx...iS.A...........@4.}.K.1.!.\$....{z..,.f V.....-`......?....h@..k?.x.._m.'}..4......h@....._...x..G..c...x......'.Q.<...2x...<j.G.......x.....%......u...x..;K.V;....%&....'.@.........g.u.B..{=E.......

<<< skipped >>>

GET /static/image/common/qmenu.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:52 GMT

Content-Type: image/png

Content-Length: 225

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

.PNG........IHDR...q...5........9....sBIT.....O.....PLTE..........g.Z.rp....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6.......DIDAT8.c.Z..8040.......2...O....d....C..F.,..0.Sh*.?..O.xs..\..U...d.<.q.>K......IEND.B`.HTTP/1.1 200 OK..Server: nginx..Date: Sun, 14 Jun 2015 08:45:52 GMT..Content-Type: image/png..Content-Length: 225..Connection: keep-alive..X-Powered-By-360WZB: wangzhan.360.cn..Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT..Accept-Ranges: bytes..ETag: "050b69d5134cf1:b16"..X-Powered-By: ASP.NET..VAR-Cache: MISS..cache-control: max-age=14400..age: 0...PNG........IHDR...q...5........9....sBIT.....O.....PLTE..........g.Z.rp....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6.......DIDAT8.c.Z..8040.......2...O....d....C..F.,..0.Sh*.?..O.xs..\..U...d.<.q.>K......IEND.B`.....

GET /static/image/common/search.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:55 GMT

Content-Type: image/png

Content-Length: 1301

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR...=.........%Q......sBIT.....O.....PLTE....................................................................................................................................z..v..n..s..o.....i..`.._.._..^..d..]..\..Y..[..Z..Y..X..W..U..T..W..Q..T..O..U..S..P..R..Q..O..M..O..L..M..L..K..J..I..G..J..=..>..=..<..:..9..?..8..6..5..4..2..3..6..1..5..2..0.....-..0..,../..-..*..,..)~. }.&}.*|.$|.({.#z.'y.%x.!y. x.#w."v..v. u..u..t..t..r..q..p..p..o..n..m....K..M....tRNS...........................................................................................................................................M......pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6.......PIDATh....S.A...G..:.@PD...bW,..XP.P..D..Q.a...9n..Kn..es.L~.....g.a.l&. ...3..k.....<......< :..*/..t~mMMm~....:..n(..iu.u.....v...]'e..kp.w......n...?.|.Y..W_8 ...j.=.....u-..s..........]..$.....]V..T]A...........)....a.O.....5.v.!..Bk9.S0......:........m........>}O..^.?P...7. ....G...z......9..]_.)......a^...u..S1...&......'F....q.....Q^?..5R|.Z...('S.x.xZTBm..F%r2}..OfD....~....q^?...R...S...........C.2..&9.;......BJt\. *....s.~. .Y ..9....~...Ls...f.;...~.9%..{.y..Kj..w........z....)...........e.x.iI.u^.- ....K?.-V.:.e....*5N".7.........&e.....hhhw.E.>v...s7...]x....s^...a...........k.........IEND.B`.....

<<< skipped >>>

GET /static/image/common/pn_post.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:57 GMT

Content-Type: image/png

Content-Length: 3309

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR...P...!.....y.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:138CC38E7DAA11DF91D0C02D346E5D42" xmpMM:DocumentID="xmp.did:138CC38F7DAA11DF91D0C02D346E5D42"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:04A15A9B7DAA11DF91D0C02D346E5D42" stRef:documentID="xmp.did:04A15A9C7DAA11DF91D0C02D346E5D42"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>j.......PLTEh..M..'p.l..c..d.....Y..q..C..t..Z..3..=..Q..(r.j.. r.a.....;.....2}.T........w..L.....O..Q.....9..............P..>m....)u.D.................;r.(t.n..]..5g.,l.,|....L..@.....`.._.....R..>..E..Dq.@.....N.....K..T}.T..c..b..[..d..C..2{.k..J..D..>}._..B..$e.$c....H..D.....9j.p..{.....b.....^..'h.9..=|.\..V..=...z.Ny.x..>..~..4s.H..@..F..S........%i..........|..Y..=..<...../..C..o.....S..0..0c.g..O..w..H..G.....C..f..&l.]..Z..Y..X..V..r..A..@..0t.t..r.....:..B../y.~.....F..e..d..f..i.....\..T..@..F..H..D..D..W.....{...r.G.....d..C..W..O..J..N..G..&o.F..@z....%[.k..E...v

<<< skipped >>>

GET /static/image/common/thread-next.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:57 GMT

Content-Type: image/png

Content-Length: 999

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:3278EDDA4EA511E0915FA03E6093E607" xmpMM:DocumentID="xmp.did:3278EDDB4EA511E0915FA03E6093E607"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3278EDD84EA511E0915FA03E6093E607" stRef:documentID="xmp.did:3278EDD94EA511E0915FA03E6093E607"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.a6.....PLTE.................tRNS......A...7IDATx...A..@.B._.?.`...\.$....$....V.....$......._vx.......(.Z.....IEND.B`.....

GET /static/image/common/pt_item.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:58 GMT

Content-Type: image/png

Content-Length: 3598

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR...............?.....pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<< skipped >>>

GET /static/image/common/medal3.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:59 GMT

Content-Type: image/gif

Content-Length: 3457

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Wed, 20 May 2009 08:04:06 GMT

Accept-Ranges: bytes

ETag: "2cb448c21d9c91:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

GIF89a#.7.................................y.......................J.....s.....c....................:.....Y........s.....c.....L..-........k...........!..X...........J........;..e../..s...........s...........1..c.....k..R........!..:.....:..O........z..k.....Z..)..1........'.....Z........k..<...........J..J..).....Z........R.....1.....Z.......{..w@..B.{.....k.....{..k.._..^..k..k..J..Z..J..B..).!..NETSCAPE2.0.....!...2...,....#.7..........2%.q//<C......n.s}GY2...........2!.q..'/....iin.5V5....(..99EEW#.........}5YPE::9[3.)..)!.q......7V)...KI........q'.<....`.. .@.A._..h.Q.J..v.....b,0<x.....4.[|8H..@..7JH...Q........S..5...G.....&.l..%L.o...#PP..$_a....Q0.`V.yg..?G.L...gT.EJT.3........U...W?R....0. .#..........*f"....f.......;..;@..kg.T>...u..<I..A......8...G....I.(.G.j..a...G....r..1...<^Y?....q6B........5\..bgF..3..a.}I.l._9@..H.[j..W....,[t....D...q....L.....]...T.@`(.I...3.q..A.8...f......D..........."....#.........L.0........4P...F@.DrDzb@..00...0.@......N( ..E..enV.PA.(h....,.@.&xy..(0...G....XV...3.........-x...U....B@.D.$....0P....40@..(.B...........*........S.@a..\....&.pE.(\...!@..d.e9..,D..dW..A.1d.%._..F....IC..z..,.p.hH.......-.cl.B,!0...O\.......n.......A........h.E.(.....9....h|...h..R..2..r..p@0T......!3.D....f....P$1...@...>....Z.<..50A..k`.@....E... ..Csw4......f....zTq.7.V......B.P....$...Ce.Q...>2B.G|.v$TW.U.1.@A.y....V........#2....E/.-..N...c.../.0.....@..:..@.:d...M~i..h.^.....D.j....J.Q..P....."...S.........d.,...ST.D...Q...]Q.."....4.pC.r....b.Q.._...R....`

<<< skipped >>>

GET /static/image/common/fj_btn.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:01 GMT

Content-Type: image/png

Content-Length: 217

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR.............$=m"....sBIT.....O.....PLTE.../\.n.2.....tRNS..[.".....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS5q..6...4IDAT....... ....XP...6q....,-,.....E.S.y...6..v....>.....s......IEND.B`.....

GET /static/image/common/midavt_shadow.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:01 GMT

Content-Type: image/gif

Content-Length: 79

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

GIF89a...................!.......,.......... ........0........................;....

GET /uc_server/avatar.php?uid=22235&size=small HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Sun, 14 Jun 2015 08:46:01 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Last-Modified: Sun, 14 Jun 2015 08:45:58 0000

Expires: Mon, 15 Jun 2015 08:45:58 0000

Location: hXXp://VVV.ltywz.com/uc_server/images/noavatar_small.gif

0......

GET /static/image/common/weibo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:02 GMT

Content-Type: image/png

Content-Length: 3544

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

<<< skipped >>>

GET /static/image/common/fav.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:02 GMT

Content-Type: image/gif

Content-Length: 596

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

GIF89a.........Q.....M.._..[..\..]..^..\..]..c..E..f..^..c.....Z.....{..P..>..^.....Y.....K..?.._..X..F..]..[..C..a..[.....D..W..v..C..?..B..O........F..H..`..a..9..f....._..`..d..E..J..F..]..a.....f..Y...........J..L..o..w..]..0.....c..t.....\..Q..B.....k..L.....b..=.....d.....e.....W....~;.....g..P..M..f..b..g..].._..>.....T.....]..Q.._.....b..`..E..Z..K..@..E..`..^..K..Z..a.....[..f..Y..g...!.......,......................s....LX.].. pcb`...Zq.|_R..a..)_V!.u..w}JKG$n~2.55.0=^.x.gAB.S.....d.e.&W.,7C/....: Dz.O'hv....-P<.6....."j1i.Qk{.Iy>FpTI....&9..`#.H"3..\.2B......(.d......I.cF" m....;....

GET /static/image/common/share_btn.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:03 GMT

Content-Type: image/png

Content-Length: 476

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

.PNG........IHDR.......@......3_U....tEXtSoftware.Adobe ImageReadyq.e<...$PLTE.....................................,......tRNS...................6IDATx.b.....F...\\\..a....@..@.1`:..>bD.p.1".......X...jX8.......jj8..&..b`...7.n.~j..F.....X....!..p.a.. .Vv$-...X..5f.......7.....:.p..Ckc...........%?.1S'3p..3j..1.c..c...R..|c..SOqR..R..cg.NY.9j..1.......`f.N... @;vn.0..PT..#...,.w...s.=."(.L.o.........0`....F.z.......0.PR.UF...4..=l...0`.......).gJ..T...-aalz.......IEND.B`.....

GET /static/image/common/rec_add.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:03 GMT

Content-Type: image/gif

Content-Length: 1603

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a............!................z...........~......................................................!....|..u...... ........#.}....................x...".............."..!....w.................. .y..o......"....y........v..}...........t............... .{..q........r..................................................................................................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:B76446A58E5F11DF977DADD5C8EF1534" xmpMM:DocumentID="xmp.did:B76446A68E5F11DF977DADD5C8EF1534"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B76446A38E5F11DF977DADD5C8EF1534" stRef:documentID="xmp.did:B76446A48E5F11DF977DADD5C8EF1534"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,..................

<<< skipped >>>

GET /static/image/common/rec_subtract.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:03 GMT

Content-Type: image/gif

Content-Length: 1396

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a.......................................................................................................................................................................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:024FAC708E6011DF977DADD5C8EF1534" xmpMM:DocumentID="xmp.did:024FAC718E6011DF977DADD5C8EF1534"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:024FAC6E8E6011DF977DADD5C8EF1534" stRef:documentID="xmp.did:024FAC6F8E6011DF977DADD5C8EF1534"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,..........u@.pH,.I....0.W..A.p.u......'.M.B...6.&cV0j'C.X.h...M.y.....8bd.-9......C7jr)&..*.MD,.|02...N/.~...N...1.f...3......^A.;....

<<< skipped >>>

GET /static/image/common/arrwd.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:04 GMT

Content-Type: image/gif

Content-Length: 51

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

Accept-Ranges: bytes

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: MISS

cache-control: max-age=14400

age: 0

GIF89a.............!.......,...................n..;....

GET /uc_server/avatar.php?uid=7325&size=middle HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Sun, 14 Jun 2015 08:46:04 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Last-Modified: Sun, 14 Jun 2015 08:46:00 0000

Expires: Mon, 15 Jun 2015 08:46:00 0000

Location: hXXp://VVV.ltywz.com/uc_server/./data/avatar/000/00/73/25_avatar_middle.jpg

0......

GET /uc_server/avatar.php?uid=21455&size=middle HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Sun, 14 Jun 2015 08:46:12 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Last-Modified: Sun, 14 Jun 2015 08:46:09 0000

Expires: Mon, 15 Jun 2015 08:46:09 0000

Location: hXXp://VVV.ltywz.com/uc_server/images/noavatar_middle.gif

0......

GET /uc_server/avatar.php?uid=23776&size=middle HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Sun, 14 Jun 2015 08:46:13 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Last-Modified: Sun, 14 Jun 2015 08:46:09 0000

Expires: Mon, 15 Jun 2015 08:46:09 0000

Location: hXXp://VVV.ltywz.com/uc_server/images/noavatar_middle.gif

0......

GET /uc_server/avatar.php?uid=24006&size=middle HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Sun, 14 Jun 2015 08:46:13 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Last-Modified: Sun, 14 Jun 2015 08:46:09 0000

Expires: Mon, 15 Jun 2015 08:46:09 0000

Location: hXXp://VVV.ltywz.com/uc_server/./data/avatar/000/02/40/06_avatar_middle.jpg

0......

GET /data/cache/seditor.js?xB2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:13 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sat, 13 Jun 2015 21:30:15 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip

8d0.............X......Wf....*.~t.T..A\...7.....X....c.d..n.......E.-..#M..N.6N[g..C."@{Z..[.......$R..K/..8...o..q....B.J.WQr.N.S.z<.af...........C..l.6 ......T...X$bz..[...d.!.S.S...[*_....w..mi....'........J[.B...?..1o...`...f...Y....f.....a*.....D...M.....A.-.......o.6.. h....6.e.......()-g6^N.R..L..<e..|.E.J....~/.........LS..A...uqC.D. ..Y....j...V..f......i..y....5W.._f....H..u..K..l...S......^..6.3....O..l....L.^...<...1...K...../*E.....$ReI....W%..!..Mi..{T..k...$.t.ol.........m....=....,.*.!...*....Z.h...P..S.e..*...B}...LlN..u....&..e<...S|..<9...eVdh.....rR.P....O.8.....?........0..Sg..X.u....*EY,Ug........v...4..,...H..E.(.v/:..;.WM...V....G.M...x.'...c.9..R.=...0G..l.>.q.a?............../..........}....<...{w.=......~..v.d.`.T...A....Y(..k...#..i..y.G.>v.....v.?.u....cb..-p..a.......m...N...d...o..w..g..l}...Jy.g..%2...4..B...x)...._..fw.......1...>..K...,j..b....wV~...........I..]..........!}=..D....]..<3Z[....e.Y.t..z*......Zc..E.=u..J.Y...F..$ipz=..^...Yt.....C5R<....?....w.|.....9......~w.g9..........Z.Z.d....^.Pcj............J.QF ........g.6..l....Q_..4....Nfq..........j.......>..Hx0".. .El..,l..:..&,.`........jj........o.z..4....(..7b......C..../.lo...(.w..PH.c...HJ.(...X...Mw...q.V..R..z..Us...8......lH..g...)~.eQ...).D.j^.$>(..H..H.:.92m.!.....)..3.b.(..|...w.T.=F.0fY<.?..bL.._G..u...2..(.r..B._........0..._..2.......?....<n............k.I"...5q"R.....]..g?.....-....D...H.G...L.2.......5oa...b.G..L..-\._n.... L.T.Pw.).Y...F.i....[..../dq...*..x.

<<< skipped >>>

GET /static/image/common/arw.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:14 GMT

Content-Type: image/gif

Content-Length: 940

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a..-...............f..3..............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3..............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3..............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...f..f..f..f.ff.3f..f..f..f..f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3..3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3..............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...........................................................................................................................!.......,......-........H..Al..*4. .....><.Q.D..-^D.q....=r...d..&ONL.r!..._.T(.&..3...9r...0.V.(Te..G...yT.R.Jo..).aU.>c.t....._..D9..I.K....T...l..%.V.\....;....

GET /media/v1/0f000Q2KxFhCznBO83poas.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ubmcmm.baidustatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:24 GMT

Content-Type: application/x-shockwave-flash

Content-Length: 31281

Connection: close

Last-Modified: Sat, 25 Apr 2009 07:04:00 GMT

Expires: Wed, 01 Jun 2016 10:11:16 GMT

Age: 1031708

Cache-Control: max-age=31536000

media: media

Ohc-Content-Crc: 2040261723

Server: hkg01-sys-jorcol02.hkg01.baidu.com

CWS.....x....TU..7...p..n...ni......D..E..A....)A.;%.KD.....{...w.....{.=.^.5.....k..\{...H%....8 @....R..B.,. ..........`m.d...(.x...<......d..^.Tp2...?Q.T.!.2..P......@....Z.@.....,..DL..aV.ui? .........`.#.737 ..=Y.Y...w..7......OM.I.B.&.FE.M@J.& *....DE.../,,,.;.......D....Q.Q..T.....GH.FMH.F..,HOEBN.&$,*)."*DEM.&*...o.)&"$$(,............v.....d. j.......t..0Q......!..a,.,...oA H..`..6.>...i...1.M.*...."5..C..X.........1............. .8`l@..:TEQ...W........:..i(.>...Cv/.c.Xt.N.... ..........=......._....H......;.v...P...1......?o,..m..........T ..@.Q|... 2^<.)..Q.q$..........r:....2X...}F.....#.c....%(.j....L.......a.G...g;......S,G...J.\w&.#..V...G... .`.........X....P.@."....".....g~.T....TyH....Qx..1(..dI.r.j!....t.X'2.$f1..M8.Q.........[.G./;....,...i........~... ..g..oq:..3...8[.J.....]]]7 ...D...~..;uG.D0e7.....Vvl4,bB4....t.....8..tl..4w....n.add.....4.T.t..........*....88x.$8..d4..d...D....B<....$x..||\..B\.....<B....;#;..*|...n..........U......x.X0M.!"B!...0.....%..J}..SR.... &6...?....f....UZ.G..U............z.....#...U..vg.A....u.]..h.OX....'.^f..u6....`|.0.kJ(..5.aIGM.@B..\....E.su.k...Bwvv.....H".(.%4.f4.Y.......[f.....su...I..U-._.....}...D......~........(....u.t.pF....k.........;.t........|N....K.=]........U...d.D......^gZG....'..E....|5...Bu.9.pI...*b.....<.%..J..~..V.3.._.#./.J.....F.....2.h....|WC.K...8.dw..@=.".C."gMs......fg..l.g.....Jf..;...........!..K|;.....D.W.Z:E....E.IP.sr5.0.@.'...........2.. .1.?l..0.......u.........:.S..V.*v@...)..5....x.........!..$....b...

<<< skipped >>>

GET /stat.php?id=5796949&show=pic HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s13.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Date: Sun, 14 Jun 2015 08:46:26 GMT

Last-Modified: Sun, 14 Jun 2015 08:46:26 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache47.l2de1[636,200-0,M], cache40.l2de1[637,0], cache10.de1[637,200-0,M], cache2.de1[639,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:2:646636778

X-Swift-SaveTime: Sun, 14 Jun 2015 08:46:27 GMT

X-Swift-CacheTime: 5399

4aa..(function(){function l(){this.c="5796949";this.R="z";this.N="pic";this.K="";this.M="";this.r="1434271586";this.P="oz.cnzz.com";this.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la()}function g(a,b){try{var c=.[];c.push("siteid=5796949");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,k=decodeURIComponent,p=unescape,q=escape;l.prototype={la:function(){try{this.U(),this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:function(){try{var a=this;e._czc={push:function(){return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ..b4a..){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typeof e._cz_account||e._cz_account===this.c){e._cz_account=

<<< skipped >>>

GET /zh_CN/htmledition/js/qf/page/qfcode.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: list.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sun, 14 Jun 2015 08:45:57 GMT

Content-Type: application/x-javascript

Content-Length: 1887

Connection: keep-alive

Expires: Tue, 14 Jul 2015 08:45:57 GMT

Cache-Control: max-age=2592000

Last-Modified: Tue, 22 Mar 2011 16:56:08 GMT

if(typeof(nId)!=null&&typeof(sColor)!=null&&typeof(nWidth)!=null&&typeof(sText)!=null).{.document.write(.[."<style>",.".rssbook{padding:10px 15px;overflow:hidden;zoom:1;background:#f6f6f6;border:3px solid #ddd;}",.".light{background:#f6f6f6;border:3px solid #ddd;}",.".dark{background:#aaa;border:3px solid #666;}",.".mailInput{margin-top:5px;}",.".rssbook .info{color:#666;font-size:12px;}",.".light .info{color:#666;}",.".dark .info{color:#fff;}",.".rssbutton{float:left;border:1px solid #698ab4; -moz-border-radius:3px;border-radius:3px;-webkit-border-radius:3px;}",.".dark .rssbutton{border: 1px solid #585858;}",.".rssbutton input{background: #77a0d1;border: 1px solid #88b3e6; color: #FFFFFF; cursor: pointer;font-weight: bold;width:90px;display:block;height:22px;line-height:22px;*line-height:19px;text-align:center;}",.".dark .rssbutton input{background:#676767;border: 1px solid #777;}",.".rssbutton input:hover{background:#86b4eb;text-decoration:none;}",.".dark .rssbutton input:hover{background:#797979;border: 1px solid #939393;}",."input.rsstxt{width:100%;height:20px;font-size:14px;padding:2px 3px;-moz-border-radius:3px;border-radius:3px;-webkit-border-radius:3px;border:1px solid #ccc;;border-color:#7c7c7c #c3c3c3 #c3c3c3 #9a9a9a;margin-bottom:5px;}",.".dark input.rsstxt{background:#eee;}",."</style>",."<div class=\"rssbook ",sColor,." \" style=\"width:",nWidth," \"><p class=\"info\">",sText,"</p>",."<div class=\"mailInput\">",."<form action=\"hXXp://list.qq.com/cgi-bin/qf_co

<<< skipped >>>

GET /v.gif?fm=load&r_type=loadsuccess&r_tm=268742530&r_sid=&r_lu=u2108193&r_tpl=flowbar_102&r_qid=bc28cb4eb45d34c4&r_tn=38068079_cpr&r_url=http://VVV.ltywz.com/thread-17831-1-1.html&pid=201&productline=cun&productsub=cun&pj=ext_hl&tab=query&logactionid=0100100002&mod=cun&r_time=1434271595521&r_ltime=15&r_stime=1434271595506&r_sp=flowbar&r_innerWidth=10&r_innerHeight=50 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dj0.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=0

Content-Length: 0

Content-Type: image/gif

Date: Sun, 14 Jun 2015 08:46:26 GMT

Etag: "4280832337"

Expires: Sun, 14 Jun 2015 08:46:26 GMT

Last-Modified: Fri, 23 Oct 2009 08:06:04 GMT

Pragma: no-cache

Server: BWS/1.0

HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=0..Content-Length: 0..Content-Type: image/gif..Date: Sun, 14 Jun 2015 08:46:26 GMT..Etag: "4280832337"..Expires: Sun, 14 Jun 2015 08:46:26 GMT..Last-Modified: Fri, 23 Oct 2009 08:06:04 GMT..Pragma: no-cache..Server: BWS/1.0..

GET /img/pic.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: icon.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 719

Connection: keep-alive

Date: Sat, 13 Jun 2015 08:47:24 GMT

Last-Modified: Thu, 12 Feb 2015 08:15:09 GMT

Expires: Sun, 14 Jun 2015 08:47:24 GMT

Cache-Control: max-age=86400

Accept-Ranges: bytes

Via: cache1.l2de1[603,200-0,M], cache44.l2de1[604,0], cache1.de1[0,200-0,H], cache10.de1[1,0]

Age: 86344

X-Cache: HIT TCP_MEM_HIT dirn:5:917002530

X-Swift-SaveTime: Sat, 13 Jun 2015 08:47:24 GMT

X-Swift-CacheTime: 86400

GIF89a2.........f..3...33....................................................................................!..NETSCAPE2.0.....!..Powered by AFEI.!.......,....2...... !.di.hjBl..p,....x......`P.(...GR.D6...CH....,..@8.... -..EQc.8...........`...."....................~"..H........H......"...$....#.........."..........."Z.......*...%!.!.......,....2...... !.di.hjBl..p,....x..|....p r..H.C.\&.H.tJu...#b......7..W.h.......7..l..v..-....."....................~"..I........I......"...$....#.........."..........."\.......*...%!.!.......,....2...... !.di.hjBl..p,....x..|....p r..H.C.\&.H.tJu...#b......7..W.h.......7..l..v..-....."....................~"..I........I......"...$....#.........."..........."\.......*...%!.;HTTP/1.1 200 OK..Server: Tengine..Content-Type: image/gif..Content-Length: 719..Connection: keep-alive..Date: Sat, 13 Jun 2015 08:47:24 GMT..Last-Modified: Thu, 12 Feb 2015 08:15:09 GMT..Expires: Sun, 14 Jun 2015 08:47:24 GMT..Cache-Control: max-age=86400..Accept-Ranges: bytes..Via: cache1.l2de1[603,200-0,M], cache44.l2de1[604,0], cache1.de1[0,200-0,H], cache10.de1[1,0]..Age: 86344..X-Cache: HIT TCP_MEM_HIT dirn:5:917002530..X-Swift-SaveTime: Sat, 13 Jun 2015 08:47:24 GMT..X-Swift-CacheTime: 86400..GIF89a2.........f..3...33....................................................................................!..NETSCAPE2.0.....!..Powered by AFEI.!.......,....2...... !.di.hjBl..p,....x......`P.(...GR.D6...CH....,..@8.... -..EQc.8...........`...."....................~"..H........H......"...$....#.........."....

<<< skipped >>>

GET /cpro/ui/noexpire/js/3.1.6/cpro.js HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidustatic.com

Connection: Keep-Alive

Cookie: CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:22 GMT

Content-Type: application/x-javascript

Content-Length: 18315

Connection: close

ETag: "554709f0-478b"

Last-Modified: Mon, 04 May 2015 05:56:00 GMT

Expires: Thu, 01 May 2025 07:53:34 GMT

Age: 3545568

Cache-Control: max-age=315360000

Content-Encoding: gzip

Ohc-Content-Crc: 586035393

Server: hkg01-sys-jorcol07.hkg01.baidu.com

...........<.w....%....X....Z9j^.&M....&.......m .%G.......$%Q..s{.w...... .......k..>.= r|..........).I..'..\z.Q...L.....N...h.~.G.4...Kt..`.6.gT...D..DK..%J.QF.(@S...[.........w_...F.o....S.v.o...r)Z.........nH.. =O..G.;......{_9Sx.9.. Z...|....h..Z..f`:v.Ff.X..O[("m.M...............?......P....z...b.......a`.Ww.jbDAL..8[q.].F_.F...C.. 7...10..Y.bO..\>.....3..>Q3.r..A...J...........u53..NZD.....P7...."*}..OP..2.Z...9.M...u...5...o...p.0..Q.:.V... .d.B-[".8.........._Ym.3...g...._.t..#N......e...7.m.......|..l-.#.....y4..V.'3(...`Q...c..y....E..\....m#..t.(s ...3c.....F.b...5.~.}....b...N^..D.....r....d_DE.J..8pu.:.....g.c.......$(..,....4.......fe...`Ih@...} ........."....Ii..1y..aj.p....cGc..}.;..h...~P....z...Ro...C.7n48!.....NIc.............7........./.n.........]De........m....'.C..t..(..7.i3..|.h,...i.`.W...[{k...~..{...S3zN....8...~}.N.8..^.u`....N..U..?..^.L/....a..hX."i.....Sk.1...O.4@.!B..k2{...j)......5...........WV....}T..*|...(2.1....#.$.^...S3bp0.l\.".0......`......H...`/.,..=.P;.:.......9.0.h..Z~E@...eU.bj..ZWv.........Z^....h....:fY..Pi6.6....jm.....Qf... ......&..6...Y.....r.O..@. .Y. .DW....1<.>..k......o.0,.R.....18..(|..Z..lp@P.G...k...W..`.b.bWa.F...s.....1lc".n.......ro...#.~d...~PZ.. .f....G..!.!.s.,X.;.H..Yc.U.;.=....X.T.p.....f...Q.6[C9._..o...q...5ow..............{.=........PR<.V..7....0..]..}.n......^..'uh.S..o.(.7Jo..u`..j.;Q.y....V.a.k.... ....q9...8....._>T..fM..m.75..A..i...m.l.....\...M_.M..../.'N..b.N(O.>..o4......].C0'/v].VKc..^Wi..Cm..- ...H..q....

<<< skipped >>>

GET /mkt.gif?et=0&ai=8002e2c915c26c3a78b4270c968fe58c HTTP/1.1

Accept: */*

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3&ltr=&ltu=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2001&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: click.hm.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; HMACCOUNT=65BC3D3544E471DE

HTTP/1.1 204 No Content

Content-Type: image/gif

Cache-Control: private, max-age=0, no-cache

Pragma: no-cache

Connection: close

Date: Sun, 14 Jun 2015 08:46:25 GMT

Server: apache

GET /cpro/ui/f.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidustatic.com

Connection: Keep-Alive

Cookie: CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:19 GMT

Content-Type: application/x-javascript

Content-Length: 27970

Connection: close

ETag: "557ba5a3-6d42"

Last-Modified: Sat, 13 Jun 2015 03:38:11 GMT

Expires: Sun, 14 Jun 2015 09:03:34 GMT

Age: 2565

Cache-Control: max-age=3600

Content-Encoding: gzip

Ohc-Content-Crc: 524018131

Server: hkg01-sys-jorcol09.hkg01.baidu.com

.....w]U..f.js...y{...8..>......$KN....=..6[..I....WQ.DE....w.g..A.......{.'..b.`03.e.......r.&...^.......b..$.l..F[o.K..6...Y.v.~.u..b...l.....l..;..p....v.M..b4b...sU..E3..f.|1.l..eJ.Za=...y.iM...G|.....e......].....G|.......w...g=8|....G...}.E....q4.[l................|... ..Ny:.G.]....Y..B..w.b..`.......{....../../.4.8".u....B/9....~z'.|...4.".4...K..b.zo..-.~..m..;.......N.........y..[..e....(..cL.j%...{.'..v..w.N...S../.t.-..l....W..../.fM.#..X.u.. ...I2..q.e....u)...v?.X...>.....].v......w.9.{..*....<o`'M..Fy..:.{..B............^...u.r..^.\V.G.{.L.......Q.".........V.....u..|.i ..H..C#....q..J.........@w.{e.XG...|5m.....C.. ..3.fc>J.FT...H.I..m..=.-f#..0U$..6,N1-}....@....W...X.........d.mU.......9o....;>..<...........Yp.[l.(&. R.2....G..I....A>.)~..'.....1........F8......u.T.~..b......o..6.w.{..3.u..DT."..N0. ....H...Y:.[6.:....h.Y.y..gA../'.t..3...../.$......w<y.S.}.xh..".._:~.^..:.hu. .@.pZ:q:.....(.m....,.G.[...[....I.V.z..e.?.. r.......D.Fq:.....>.....'.qG......6.......;........6..<.g.K/d..7.......q.....Wa4......<.:...'..F....pi'....v.........3T....f.......k..u....7 ...O...L_...$.HB@$!...\...pIr.J.....V..G.....!.#$..f..us_.k.....T..8Mw......O..vw;sX$.....oE-.3...9..........?..%.hv.7/.8.j.7....i..v...).9.(..f...6.z.[=....&.=NXtR.....u...(.o=..O,X.......y6..F.yv4.........r..&..t.;....`-..t.8.".K.g..f.r.A..">!`.z<.e3...W......I._L.D.V'..R@.[...|b..... ..*:...Z1...ub.x..#x..G..<..Uk.z..o!.d9.....mX:K.o..D.........,......\....M.....p.u..yTP.!..i.a....b...6..(m..w.

<<< skipped >>>

GET /cpro/ui/noexpire/img/2.0.0/bd-logo5.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidustatic.com

Connection: Keep-Alive

Cookie: CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:23 GMT

Content-Type: image/png

Content-Length: 1545

Connection: close

ETag: "554709f0-609"

Last-Modified: Mon, 04 May 2015 05:56:00 GMT

Expires: Thu, 01 May 2025 07:54:20 GMT

Age: 3545523

Cache-Control: max-age=315360000

Accept-Ranges: bytes

Ohc-Content-Crc: 1974033671

Server: hkg01-sys-jorcol08.hkg01.baidu.com

.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...siTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:1cd07f07-f14f-4d1b-83a0-43c485539d9c" xmpMM:DocumentID="xmp.did:52D26256CAB511E3B696F0231D9BB8CB" xmpMM:InstanceID="xmp.iid:52D26255CAB511E3B696F0231D9BB8CB" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f6314ed7-87ee-4c03-a7bf-62894da43749" stRef:documentID="xmp.did:1cd07f07-f14f-4d1b-83a0-43c485539d9c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......,IDATx.ba``..bc .`..`..w@|...........hi.........#>...../_..................T...i.......by\....Uzzz.@.. V.;;;{...j|......`.6=,h|.>PQQ.........L...._.....\....._.]..K.jBBB.DDD>..w.<0..FFFn...e..\`...K........w..../..........o........P!.........-[...o..]...........e..d......0..o..y...&....).7o...[%%%....$A......"..|..=<<.....'O.|.hp....6L..$..A.U__........XB... fE.466...uk.........Ww....;x......."d....#........^`P(.J-@..TUU....p&....u|.C..}BB.41.............EL$3B.*'......LMM=.I..0......g`...

<<< skipped >>>

GET /cpro/ui/c.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidustatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:45:52 GMT

Content-Type: application/x-javascript

Content-Length: 27970

Connection: close

ETag: "557ba5a3-6d42"

Last-Modified: Sat, 13 Jun 2015 03:38:11 GMT

Expires: Sun, 14 Jun 2015 09:03:27 GMT

Age: 2545

Cache-Control: max-age=3600

Content-Encoding: gzip

Ohc-Content-Crc: 673261628

Server: hkg01-sys-jorcol01.hkg01.baidu.com

.....w]U..c.js...y{...8..>......$KN....=..6[..I....WQ.DE....w.g..A.......{.'..b.`03.e.......r.&...^.......b..$.l..F[o.K..6...Y.v.~.u..b...l.....l..;..p....v.M..b4b...sU..E3..f.|1.l..eJ.Za=...y.iM...G|.....e......].....G|.......w...g=8|....G...}.E....q4.[l................|... ..Ny:.G.]....Y..B..w.b..`.......{....../../.4.8".u....B/9....~z'.|...4.".4...K..b.zo..-.~..m..;.......N.........y..[..e....(..cL.j%...{.'..v..w.N...S../.t.-..l....W..../.fM.#..X.u.. ...I2..q.e....u)...v?.X...>.....].v......w.9.{..*....<o`'M..Fy..:.{..B............^...u.r..^.\V.G.{.L.......Q.".........V.....u..|.i ..H..C#....q..J.........@w.{e.XG...|5m.....C.. ..3.fc>J.FT...H.I..m..=.-f#..0U$..6,N1-}....@....W...X.........d.mU.......9o....;>..<...........Yp.[l.(&. R.2....G..I....A>.)~..'.....1........F8......u.T.~..b......o..6.w.{..3.u..DT."..N0. ....H...Y:.[6.:....h.Y.y..gA../'.t..3...../.$......w<y.S.}.xh..".._:~.^..:.hu. .@.pZ:q:.....(.m....,.G.[...[....I.V.z..e.?.. r.......D.Fq:.....>.....'.qG......6.......;........6..<.g.K/d..7.......q.....Wa4......<.:...'..F....pi'....v.........3T....f.......k..u....7 ...O...L_...$.HB@$!...\...pIr.J.....V..G.....!.#$..f..us_.k.....T..8Mw......O..vw;sX$.....oE-.3...9..........?..%.hv.7/.8.j.7....i..v...).9.(..f...6.z.[=....&.=NXtR.....u...(.o=..O,X.......y6..F.yv4.........r..&..t.;....`-..t.8.".K.g..f.r.A..">!`.z<.e3...W......I._L.D.V'..R@.[...|b..... ..*:...Z1...ub.x..#x..G..<..Uk.z..o!.d9.....mX:K.o..D.........,......\....M.....p.u..yTP.!..i.a....b...6..(m..w.

<<< skipped >>>

GET /cpro/ui/noexpire/css/1.0.0/base.css HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidustatic.com

Connection: Keep-Alive

Cookie: CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:21 GMT

Content-Type: text/css

Content-Length: 934

Connection: close

ETag: "554709f0-3a6"

Last-Modified: Mon, 04 May 2015 05:56:00 GMT

Expires: Thu, 01 May 2025 07:54:19 GMT

Age: 3545522

Cache-Control: max-age=315360000

Content-Encoding: gzip

Ohc-Content-Crc: 3052886116

Server: hkg01-sys-jorcol05.hkg01.baidu.com

...........VM..6.. .. ..dYvvS.{(...4.......9...H.E.....C..v.[..@..1.......w.l....WI.d9.....b..u......u.f...#b.1..C.DZ")._#.".A|....o....f..m T.....$.....4.9.;.. .r...C.. ..cmEl).N2C....I.H....e`Cy........_-.......?.Q..B]#J..Z!*.X) .....jU.2..m..\T....<.".>..Qr7.:OB#[)..Q..t..m@..)J.%..{..x.x..N....y.9x2.=`R8..o....7o:......?T3.!..!.....i..:A.. ..s.....^...U.U.j.@.PxA*!.X(.V....,2..c/.{..D7(.D.../.#.Y$u...H..f^m.^0......W.ml...-<.6c.6..p/.L{R..w...@eF.............jl.0.."...q...n?nn..sy-.hX.4.l'....8{...-w.............Kc..>.j.Ji..aa...J.$^..26.|.P:.`..E.....t.g..".>.Bz..'-..?..sEJ.-L~.......u........E......L.;g.@..w..Yv &.'X.z..%.2.....kv..e......S..c...^...&f..@.../...........X&.m."..w".R......?.R.'Z.X7....7.isU....h.........Ojw|v^b}z9.M8...0...zA...N..W......t....#..N-..t..w.......l)...f....-.^...!..C...o..o.....i1Y..<7k.?.d9..-mwrJ...k..`..I{m..8....B........h.,1...._().D...U.L.Y......u...gi...Nv9|....|...h.<.}..'D.z.....

POST /api/xmlapi.asmx/GetInfo HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://w.ltywz.com/api/xmlapi.asmx/GetInfo

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Content-Type: application/x-www-form-urlencoded

accept-languge: zh-CN

Accept-Encoding: gzip, deflate

Host: w.ltywz.com

Content-Length: 10

Connection: Keep-Alive

Cache-Control: no-cache

AppCode=19

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:45:42 GMT

Content-Type: text/xml; charset=utf-8

Content-Length: 252

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: private, max-age=0

<?xml version="1.0" encoding="utf-8"?>..<Server>.. <Status>true</Status>.. <Version>1.1</Version>.. <Name>163............</Name>.. <Upmode>False</Upmode>.. <Upaddress>.. </Upaddress>.. <Bulletin>.. </Bulletin>.. <Vercode>2</Vercode>..</Server>HTTP/1.1 200 OK..Server: nginx..Date: Sun, 14 Jun 2015 08:45:42 GMT..Content-Type: text/xml; charset=utf-8..Content-Length: 252..Connection: keep-alive..X-Powered-By-360WZB: wangzhan.360.cn..X-Powered-By: ASP.NET..X-AspNet-Version: 2.0.50727..Cache-Control: private, max-age=0..<?xml version="1.0" encoding="utf-8"?>..<Server>.. <Status>true</Status>.. <Version>1.1</Version>.. <Name>163............</Name>.. <Upmode>False</Upmode>.. <Upaddress>.. </Upaddress>.. <Bulletin>.. </Bulletin>.. <Vercode>2</Vercode>..</Server>..

GET /sync.htm?cproid=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1 HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cpro.baidustatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:14 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Last-Modified: Mon, 01 Jun 2015 03:15:37 GMT

Age: 1126386

Content-Encoding: gzip

Ohc-Content-Crc: 327863765

Server: hkg01-sys-jorcol09.hkg01.baidu.com

37d.............VQo.6.~..`.. 3.Z.=.v.......d.C...E.mn.$.T.....QtmI.\...lQ....w..9z}.qz....,.*{.j...?..h.2}7..GC...:...V.]:..%...... .. .;=..*.......s#W@.d^..."',..[K.i.P5-T....e@:....1.k_....V..u."...........j...9......(.....6".........0.T...kc.t.....z..D.p...Ow0..:......(..H.u....^....aq.P2..<.N./$./.../......o8...@1%v5........I_.....%..29...c{......./=....# 1.R......Z%`(..k....E.....=9G.".<.n..X*...GH.6.G.R.S...5Q.eR..-...!..zg#<#..S0.z.sV...W.......|..lu%.s%u.L.z.t..P..*.A5.i.>...Lv%.s...I...63.......P.7....." ..'b.....Ub.ao.XI..,9L...2...dBRPE.../......#).,G0..1h x......I.P.r}(..L.E..........u-7`|.].&.X...f.,F.g1.(Nb.o...R....d........2:...xyN.1.dnZ.N>d...z.M.........H.N ....;g..t.A....j.9!..........3..^&.....ZoZ.M....G..H...Jv..o..fz.Q7....-...W.....,..y.v. ..../.i....1...s..>....[.&.u.?..6...*....3.q.../.;.I.|.o..>.I..Rv....c.)'.v.2f.Q&.98..L..C.......Uc..kh....ps}.WZ..............0..

GET /pixel?google_nid=baidu&google_cm HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://cm.g.doubleclick.net/pixel?google_nid=baidu&google_cm=&google_tc=

Date: Sun, 14 Jun 2015 08:46:21 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 277

X-XSS-Protection: 1; mode=block

Set-Cookie: test_cookie=CheckForPermission; expires=Sun, 14-Jun-2015 09:01:21 GMT; path=/; domain=.doubleclick.net

Alternate-Protocol: 80:quic,p=1

GET /pixel?google_nid=baidu&google_cm=&google_tc= HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.g.doubleclick.net

Connection: Keep-Alive

Cookie: test_cookie=CheckForPermission

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://cm.pos.baidu.com/gpixel?google_gid=CAESEJjFx4RhgLnSGfBEJ8AfDVY&google_cver=1

Date: Sun, 14 Jun 2015 08:46:21 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 284

X-XSS-Protection: 1; mode=block

Set-Cookie: id=2271e9170f0200fe||t=1434271581|et=730|cs=002213fd48f627443f4e4f3c79; expires=Tue, 13-Jun-2017 08:46:21 GMT; path=/; domain=.doubleclick.net

Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT

Alternate-Protocol: 80:quic,p=1

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://cm.pos.baidu.com/gpixel?google_gid=CAESEJjFx4RhgLnSGfBEJ8AfDVY&google_cver=1">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Location: http://cm.pos.baidu.com/gpixel?google_gid=CAESEJjFx4RhgLnSGfBEJ8AfDVY&google_cver=1..Date: Sun, 14 Jun 2015 08:46:21 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Content-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)..Content-Length: 284..X-XSS-Protection: 1; mode=block..Set-Cookie: id=2271e9170f0200fe||t=1434271581|et=730|cs=002213fd48f627443f4e4f3c79; expires=Tue, 13-Jun-2017 08:46:21 GMT; path=/; domain=.doubleclick.net..Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT..Alternate-Protocol: 80:quic,p=1..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://cm.pos.baidu.com/gpixel?google_gid=CAESEJjFx4RhgLnSGfBEJ8AfDVY&google_cver=1">here</A>...

<<< skipped >>>

GET /acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&ls=3&ltr=&ltu=http://VVV.ltywz.com/thread-17831-1-1.html&lunum=6&n=38068079_cpr&pcs=60x20&pis=10000x10000&ps=5695x-2&psr=1276x846&pss=962x5717&pt=1&qn=86671a64861f8429&rad=&rsi0=120&rsi1=270&rsi5=4&rsi6=-1&rsi7=0&rss0=&rss1=&rss2=&rss3=&rss4=&rss5=&rss6=&rss7=&scale=&skin=&td_id=2109486&tn=template_float_all_normal&tpr=1434271564146&ts=1&ww=0&xuanting=0&dtm=BAIDU_DUP2_SETJSONADSLOT&dc=2&di=u2109486&distp=2001&ti=å…³äºŽæœ¬ç«™ - å›¢è´é¡¹ç›® å¤©æ¶¯ç½‘èµšè®ºå›&tt=1434271563990.27484.27828.27828&adclass=1&conW=120&conH=270 HTTP/1.1

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pos.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISBID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1; ISUS=1; CPROID=E3EAD71D1F68DE6EDD0ADAF468DD7E48:FG=1

HTTP/1.1 200 OK

Cache-Control: post-check=0, pre-check=0

Connection: keep-alive

Content-Length: 5205

Content-Type: text/html

Date: Sun, 14 Jun 2015 08:46:24 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Sun Jun 14 16:46:24 2015

P3p: CP=" OTI DSP COR IVA OUR IND COM "

Pragma: no-cache

Server: nginx

<!DOCTYPE html>.<html>. . <head>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />. <title>..................</title>. <link rel="stylesheet" href="hXXp://cpro.baidustatic.com/cpro/ui/noexpire/css/1.0.0/base.css"/>...<style type="text/css">.....container a.bd-logo{.....top:0;.....right:0;.....width:24px;.....height:20px;.....background:url('hXXp://cpro.baidustatic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5.png') no-repeat top left;....._filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(enabled=true, sizingMethod=none, src='hXXp://cpro.baidustatic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5.png');....._background:none;.....cursor: default;....}.....container a.bd-logo:hover{.....width:90px;.....height:20px;.....background:url('http://cpro.baidustatic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5-hover.png') no-repeat top left;....._filter:progid:DXImageTransform.Microsoft.AlphaImageLoader(enabled=true, sizingMethod=none, src='hXXp://cpro.baidustatic.com/cpro/ui/noexpire/img/2.0.0/bd-logo5-hover.png');......._background:none;....}...</style>. <script type="text/javascript" src="hXXp://cpro.baidustatic.com/cpro/ui/noexpire/js/3.2.0/base.js"></script>. </head>. . <body><div style="display:none;"><img src="hXXp://wn.pos.baidu.com/adx.php?c=d25pZD0xNTkzNjgzNGQ1ZTFhMjBlAHM9MTU5MzY4MzRkNWUxYTIwZQB0PTE0MzQyNzE1ODQAc2U9MQBidT01AHByaWNlPVZYMF9ZQUFFWDBON2pFcGdXNUlBOHN0TWhoOGpTam

<<< skipped >>>

GET /static/image/common/arrow_top.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:25 GMT

Content-Type: image/gif

Content-Length: 51

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a.............!.......,............a......t..;....

GET /uc_server/images/noavatar_middle.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:25 GMT

Content-Type: image/gif

Content-Length: 3972

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

<<< skipped >>>

GET /static/js/qshare.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:25 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

X-Powered-By: ASP.NET

VAR-Cache: HIT

cache-control: max-age=14400

age: 0

Content-Encoding: gzip

761.............X.O.F..y..?\].N.....a...T...Z...Y.8....s.3.Z..}....I.n......}.rn={....[.....>s.4v}.... .F.2....8..u1.......,`.... .M.g...|....).".........#.n..6.?z.... e.l....10.....d]6..P.......#.......m.A...,..c..b......r..13..bk..W?y...W..E.I............F..\'p..j....L.#...F....j7.=.r1.........$.y<..i.N.J:..Lx.)..W/..V.$Y....%f..g-.....q..r'...`O.....L..:.0.Q...HdI..;....ciK.J/..X.T...:Z\.Y..XF'}.0.....^F.e.........%...0....:.7_.u(GsO dRu..2..lVF..p*..{9..9..w._i-...37H'.yYIU..b0.oA.^.*.8W....Ed.....K.....,.....5m...M....s..4..L..8M.yc)r.ev.......g..."...o......I........~b.0OS.rc."....4..5A(J...z.}....aN.....r.. B!Al....rwo.N.W"....g..o.).8.q.cq}.'.9........d.P.y.^.....Tp..<.m........Ij..U........M.2.';._.....u....\_.3...^ie.!..Kp.-.C<~e....S.mo.. .A....<....'...K....Je.../R...}!g..9..2.....E..w/.&.Q0...ml...n.m$Y...lk.........M%T........w7p.......Z.....F.w...><..\^4].c.O.....f.B..?iv...,?....`..GA..V.2......*([..........H.xc<j.....7.$^.J%.HQ.Q.j...I...gTU.......[...0.....k.bG.......J.....S....x.| 3.s...v.1...=.4.2RMN...#d<..J....k...p.kcC~..e"..@.B..{... B..........J\)..."GV..M..\..E.H]...*...t.t'.V......!.".-........[H.....Z..S3&;.c|.=.%0......h..T6........h...c..O.?...zt.].I..8....G.G..."..B&..-... .o...p..)1......@U.K.MX../.|....h.y....bN.md..>..@].{.&.V....|.......(Z..i0)_L|....W...q#..D*.Q..k........q$b.3.dx..."....1U`.,...jNr.#|..t...'...L..3..6.;.G......:\............M2Dg.Za....QWi...Y6........F.9...-c...(Tm$cT....].<. ...31...iY....[4. ........_.....|.....O./.......%.

<<< skipped >>>

GET /static/image/common/fastreply.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:26 GMT

Content-Type: image/gif

Content-Length: 608

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

GIF89a...............p..z..{..|..J..M..X...........%..R..U..^........... ..X..Z................................-..8..R..e..e..e..............R..e..e...........!.."..e..............T..X..e...........V..e.."..%..;..\..e..e........2..R..^..c..d..f...................................... ..$..'..9..L..Q..^..c.............................................................................................!.....g.,............g........cZQP..PXa.`4..........`.d..............g@ .......!0.."......*).F%......$E.O#......,O. '&...(2.gR81-.../9.GG753...6>.NSHz..A. ..D..i2.K.%J"F......g.x.b.J..W.t...c.3b.t1y...*-c..Y(..;....

GET /source/plugin/rsf_logo_fill/template/fill_bg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:27 GMT

Content-Type: image/jpeg

Content-Length: 44277

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Sun, 09 Nov 2014 08:43:16 GMT

ETag: "c2155a34f9fbcf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

......JFIF.....^.^......Exif..MM.*.............................b...........j.(...........1.........r.2...........i...............5g...'..5g...'.Adobe Photoshop CS4 Windows.2014:06:19 19:59:32........................................y...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?..T.I%)$.IJI$.R.I$...I%)$.IJI$.R.I$...I%)$.IO...T.I%)$.IJI$.R.I$...I%)$.IJI$.R.I$...I%)$.IO...T.I%)$.IJI$.R.I$...I%)$.IJI$.R.LH...%)$.IJI$.S...T.I%)$.IJI$.R.I$.......e..).7..0..9......X.........J|c#;..E.......q.....y..y......u_V...9...p..h...4}..}/..].V&.e......?.UcC.~-|......8.~w..9......C..}..{.... }...$..&u......"..:wO...A5.c4u...7..mU..7..s.-nt..............;..2.....E..w...[3z........h".Zs}.[.....3..%<..M..u<..6.2_I...v4.._...{.sw..'..fbc..c.s....T.....;.V{7...E.cT.1.m4.C .....,o..%)$.IJI$.S...T.I%)$.IJI$.R.I$...I%)$.IO.........<a.....v.Y..".....7../g.KWp...._....a.....-..k........I%)$.IJI$.S...T.wQ.......5..e.WQ.03qm.C...Y....].....</.8

<<< skipped >>>

GET /plugin.php?id=milu_seotool:sitemap&tpl=no&myac=milu_seotool_cron&inajax=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:35 GMT

Content-Type: text/html; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Set-Cookie: 7rjd_2132_lastact=1434271591 plugin.php ; expires=Mon, 15-Jun-2015 08:46:31 GMT; path=/

Content-Encoding: gzip

4c............s,*J....R.............X.[;.C.c.#scCC..tf^rNiJj...Ks..#.M....y.L.....0......

GET /home.php?mod=misc&ac=sendmail&rand=1434271536 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:35 GMT

Content-Type: text/javascript

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

X-Powered-By: PHP/5.2.17

Set-Cookie: 7rjd_2132_lastact=1434271591 home.php misc; expires=Mon, 15-Jun-2015 08:46:31 GMT; path=/

Set-Cookie: 7rjd_2132_sendmail=1; expires=Sun, 14-Jun-2015 08:51:31 GMT; path=/

Content-Encoding: gzip

14........................0......

GET /static/image/common/scrolltop.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ltywz.com/thread-17831-1-1.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ltywz.com

Connection: Keep-Alive

Cookie: 7rjd_2132_saltkey=b51T0zUC; 7rjd_2132_lastvisit=1434267936; 7rjd_2132_sid=FLA8Y1; 7rjd_2132_lastact=1434271591 home.php misc; 7rjd_2132_st_p=0|1434271536|68c2463335140d8b63f23806e26577df; 7rjd_2132_visitedfid=78; 7rjd_2132_viewid=tid_17831; CNZZDATA5796949=cnzz_eid=1877242474-1434271586-&ntime=1434271586; 7rjd_2132_sendmail=1

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 14 Jun 2015 08:46:36 GMT

Content-Type: image/png

Content-Length: 1383

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Last-Modified: Fri, 28 Feb 2014 06:52:16 GMT

ETag: "050b69d5134cf1:b16"

X-Powered-By: ASP.NET

VAR-Cache: HIT

Accept-Ranges: bytes

cache-control: max-age=14400

age: 0

.PNG........IHDR...P...x.....%7.R....tEXtSoftware.Adobe ImageReadyq.e<....PLTE............l..j.....~..w.....z.....n.....y..v.....}..{........t..r...........p..................................................n..|..s........k........i........S..l...6tRNS........................................................N1....IDATx.b0...SSFF ...b23.... &..$&.. ..&&.[...)..1.@L.<j... ..)@....,3e2%....#...dd4.....Z...A......,,DY..r# ..)@.!.. e............&S...........!.B .....h..P..G.T6UV..8L98H..a*!.u.)..&.`E..j.. ......1...v..0.4.M.!oJ.'..#...(...B...Gb@`J..$^....G&.8RV.'..xb.....H.e...$$.i.@.cu<778W.3&(kb....XrYa...h..E.F.>@p..r.._.%e.N.".ZO..&.IFrZ..(o.........&.g..f....G.p..d[.n.R...V.XqO.......N!...;z..{...a.d....)......u.0.0 ...B.wG.......=... .....F.g...4.0.4!...E.U...`..u..a <..X..bb.......V...KL#"$....S....:.....<..}.$X..FZ.h........>&r..p.q8.P^B...L9.....q.@.....KZ.'............5.-...C.....%....r.I.8)_.-`.]R.,.A.\3....k....9....v.:...y...\.......e.........Y..7...'.Os#/......b.....G..,.....A....)NR{-}^.P...i......h.l[...8n......0(..'...v~..f...-.w.N.B...{..H.$.....0R.....|fG.E..1n......ya6]b..2.s..E[.....FA^.1..g;.....5.L..h_p....)_.../..S..G.g.Qg...|G..`.......H.a8q...E...'..'....e3../....o..a..o..b.Mi3.,......nGi/'.....G`.N(8..U..-...Q....M.(..F..Bg%.....e......v]..hB.N..*....1R/5.J[/....i..F..{..a...,K.F....ZP.u]#0....7.r/.wAw..y.g..o1.....S......)Sc.....IEND.B`...

<<< skipped >>>

GET /static/dspui/img/flowbar/arrow_left_60_e700a3bb.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: su.bdimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.6

Date: Sun, 14 Jun 2015 08:46:25 GMT

Content-Type: image/png

Content-Length: 2385

Connection: keep-alive

ETag: "2981745255"

Last-Modified: Wed, 13 May 2015 05:53:16 GMT

Expires: Mon, 23 Nov 2015 10:25:45 GMT

Age: 1549240

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Ohc-Response-Time: 1 0 0 0 0 0

.PNG........IHDR...#...<........%....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:1726200CC0E511E4B68AD4BB7D798C78" xmpMM:DocumentID="xmp.did:1726200DC0E511E4B68AD4BB7D798C78"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FF0A356BC08511E4B68AD4BB7D798C78" stRef:documentID="xmp.did:FF0A356CC08511E4B68AD4BB7D798C78"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.a,z....PLTE-..#s. ..,..#r.,..,..$u....$v.......k..$u.%v....-..z..o.....}..)u.......N........&s.~.....$t....-..*...........)..a..k..&x.B..(u....7.....m.....6}....$u...................M..~..:.....'u....[../x................$t....l..$s.......%x....R..V..,w. .................'z.=..-w.*..... ..P..............-................./y.$u....... ..j...........s.....a..T........(v.*..Y..,z....$s.S..%u....#s.......(|.#r.*.....)~.,w...................=.............................0y.,..`..*..&y....)}.I..'u.f..\..%u.......b..P..~.....E..R.....$s.,..#r.-.....,...Vjq....IDATx.\U..OE...{..{.......D.J.,.,%

<<< skipped >>>

GET /media/v1/0f000Dlh0nJS1Y3OYHhQp0.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://pos.baidu.com/acom?adn=1&at=6&aurl=&cad=1&ccd=32&ccw=1000&cec=gb2312&cfv=11&ch=0&col=en-us&conOP=0&cpa=1&ct=1&dai=2&dis=0&fa=1&flw=1&

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ubmcmm.baidustatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 14 Jun 2015 08:46:25 GMT

Content-Type: application/x-shockwave-flash

Content-Length: 34846

Connection: close

Last-Modified: Sat, 25 Apr 2009 07:04:00 GMT

Expires: Fri, 06 May 2016 10:20:31 GMT

Age: 3277554

Cache-Control: max-age=31536000

media: media

Ohc-Content-Crc: 359767942

Server: hkg01-sys-jorcol08.hkg01.baidu.com

CWS.....x....[....gai...I).T..KJ..n..A:....R....i.K..~....~..........5..y..{....s..#.........Hb...x.w{{ ./..p2..<svpp...:X:.w?...\.Ll...8.. ....p.....J..R..2<...t.4.-..x.....@.I.`....H}..C*....)......4.n......`.....~.........*.._......44............4.."b.||..4..|BBB.!.1!>vfv~a1.......])............3<..`.&!'g..........!d.....6..........[WDH.N..t..`#...1<......c.n{.B.......... ..X........O....RI....K#.j...W.....0.iM....-..@...A.].....]..A6..............'.....s..e[.h;#....y...$hU..j./s`.......G.mBi..4.....T...".*m.....(...(.R.j..K.......j$...gO.K.......-...Y.......&a......\d.0.2.be.v.....(?o.............aN.C........_.T.4.........I.Q !.1.*..K..M.G.L....-..D2.......])...&.2....~.q ..;..M..x.V&L..T...n.:)..lK..,'. ......9<6...K. d.......W..wg...~.<..jK. d.}.....i..7T....D..5...:.h....I............\....2...`AJ.....`x....Q..._....H.S....b"h.. ........X..........cH..8..4..\.N..x...k.. xH91.../q.65'..cXBR.....t1..N\.T.D..S.c#Ua!4".H..)...I....Ey....8QI...-...-.\..5.....2.....#VZ.....,i.*K...C..Yh......\.T......^$....v....I..1...R.V3..3.eT...`X....8q..^.q......IN/.k-]G,q~'.......L...e.=..'..# .....e.....l..Qn.hUR~...H......7...g.%.v....)..P..........@......g.D.C.....'..E..Q....w...'....t9..g..n..j..5......... ..@s.pR......... a.A..Q.2.y.45AK.l.... MI_.....F.0....J...k.5....J..8.8u.....!.Yb...F.n..<%_.m ......e9..8!'......gx.......C..?...t.T.V.........J...t..4A..@84]...{!....8...:\.=.l.[...C2..*...}.bf.O..v..QC.G......;.. ......I?*......{yD0<......~p..`.?..]..8......._`<.w.]..........].p.;....

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_560:

`.rsrc

t$(SSh

~%UVW

f9z.vk

u$SShe

B~nCB~J!C~.dE~

kernel32.dll

wininet.dll

ole32.dll

UUWiseHelper.dll

user32.dll

rasapi32.dll

ADVAPI32.DLL

advapi32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

uu_loginA

uu_reportError

CreateIoCompletionPort

{B6F7542F-B8FE-46a8-9605-98856A687097}

{B37C9A97-4B7C-4270-837C-1A27515588A8}

hXXp://VVV.ltywz.com/rj/post.htm

.iqW>

"3/%F

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

https

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXp://

Adodb.Stream

hXXp://VVV.minnanwl.com/gengxin/qqlx/lxqq.htm

config.ini

999999999

hXXp://VVV.minnanwl.com/gengxin/qqlx/qq.htm

\dc.dll

.text

`.rdata

@.data

@.reloc

MFC42.DLL

KERNEL32.dll

GdiplusShutdown

gdiplus.dll

WSOCK32.dll

MSVCP60.dll

dc.dll

ReportError

ReportError_A

VBYB_ReportError

VB_ReportError

uu_loginW

debug.ini

ReportError:%s

Error:%s

%s|!|%s

\dms.pdb

%u%u,

dclog.txt

port

settimeout:%d

[%d]%s

reg2:%s

checkok:%s %s

check fail:%s %s %s

check:%s %s

getcjfail:%s %s

getcj:%s %s

%s%uout

%s%uin

put img ok:%s

put img fail:%s

put img:%s %s %d

get result ok:%s,%s

get result fail:%s

get result:%s

notifyfail ok:%s

%s\%d-%s.png

notifyfail fail:%s,%s

notifyfail:%s

getimgok:%s,%s

getimg:%s

getinfo fail:%s

getinfo:%s,%s

setresult:%s,%s

HTTP/1.1 200 OK

recv:%d

send:%d

GET /ip.txt HTTP/1.1

Host: %s

User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2

select:%d

ioctlsocket:%d

socket:%d

api.qqchaoren.net

14.17.65.24

14.17.65.23

dama2.qqchaoren.net

dama1.qqchaoren.net

connect total:%s %d

:%s %d

connect discard:%s %d

[d-d-d d:d:d](u)

recv timeout:

recvfail:%d

server close:%d

recv:%d

send:%d

sendfail:%d

connect timeout:

connectok:%s %hu

127.0.0.1

1.1.3

\SkinH_EL.dll

\To configure.ini

E23EB210-E964-4807-9865-5FFF8BC100CF

\UUWiseHelper.dll

SSSSh

ByScreen.JPG

operator

GetProcessWindowStation

E:\work\UUWiseHelper

\UUWiseHelper.pdb

RegCloseKey

RegOpenKeyExW

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

SHLWAPI.dll

urlmon.dll

dbghelp.dll

IPHLPAPI.DLL

WS2_32.dll

GetProcessHeap

GetCPInfo

UUWiseHelper.DLL

uu_easyRecognizeUrlA

uu_easyRecognizeUrlW

uu_recognizeByCodeTypeAndUrlA

uu_recognizeByCodeTypeAndUrlW

zcÁ

0(1,10141

9 9

32F1C86B-E64C-4EAF-8BC1-C142570008BC

:-1014,URL

:-19011,

TEAKEY

hXXp://api.ruokuai.com/register.xml

hXXp://api.ruokuai.com/info.xml

hXXp://api.ruokuai.com/recharge.xml

hXXp://api.ruokuai.com/create.xml

hXXp://api.ruokuai.com/reporterror.xml

hXXp://reg.email.163.com/unireg/call.do?cmd=register.entrance&from=163mail_right

m = w.length,

b = f.getTime(),

p = z.charAt(q),

for (n = (e '').length - 1; n >= 0; n--) {

var o = x.charAt(n);

y = i.length,

r = r i.charAt(j);

v = v i.charAt(j)

for (t = 0; t

s = s u.charAt(t)

b = a.getTime();

hXXp://reg.email.163.com/unireg/call.do?cmd=register.verifyCode&v=common/verifycode/vc_en&env=

@163.com

@163.com----

SESSIONkEY

-12027,TEAKEY

hXXp://1111.ip138.com/ic.asp

hXXp://reg.email.163.com/unireg/call.do?cmd=register.verifyCode&v=common/verifycode/vc_zh&vt=grey&env=

Fiddler Web Debugger

The Wireshark Network Analyzer [Wireshark 1.12.0 (v1.12.0-0-g4fab41a from master-1.12)]

hXXp://VVV.uuwise.com/

hXXp://VVV.ruokuai.com/

hXXp://iframe.ip138.com/ic.asp

\Microsoft\Network\Connections\pbk\rasphone.pbk

&password=

application/x-www-form-urlencoded

WinHttp.WinHttpRequest.5.1

&softkey=

Content-Disposition: form-data; name="password"

{pass}

Content-Disposition: form-data; name="softkey"

{softkey}

Content-Disposition: form-data; name="image"; filename="System.Byte[]"

z>type=1&product=urs&url=&url2=http://reg.163.com/UserLogin.do&username=

hXXps://reg.163.com/logins.jsp

?cmd=register.start&reforward=common/reform&targetCmd=register.ctrlTop

hXXps://ssl.mail.163.com/regall/unireg/call.do;jsessionid=

&confirmPassword=

@163.com&password=

@163.com&suspendId=

hXXp://reg.email.163.com/unireg/call.do?cmd=register.resume

hXXps://reg.163.com/account/accountSecQuestionIndex.do

&question3=æ‚¨é…å¶çš„åå—æ˜¯ï¼Ÿ&answer3=

&question2=æ‚¨æ¯äº²çš„åå—æ˜¯ï¼Ÿ&answer2=

noheader=0&lastpath=&isReset=&navitem=nav_item_3&question1=æ‚¨çˆ¶äº²çš„åå—æ˜¯ï¼Ÿ&answer1=

hXXps://reg.163.com/mibao2/step1.do

hXXps://reg.163.com/mibao2/checkAnswer.do

SetClientCertificate

112.15.5.111

hXXp://VVV.ltywz.com/thread-17831-1-1.htmlt

MEs

SgP%c

-cJ}R)uv

%d&&'

123456789

00003333

__MSVCRT_HEAP_SELECT

CreateWindowStationA

MsgWaitForMultipleObjects

pljd.dll

pljd_UserLogin

pljd_UserLogin_A

pljd_UserTrialLogin

pljd_UserTrialLogin_A

?456789:;

!"#$%&'()* ,-./0123

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

Broken pipe

Inappropriate I/O control operation

Operation not permitted

iphlpapi.dll

MPR.dll

VERSION.dll

.PAVCException@@

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

VVV.dywt.com.cn

hXXp://VVV.baidu.com

(*.htm;*.html)|*.htm;*.html

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

/api/api.aspx

0@MSXML2.XMLHTTP

Microsoft.XMLHTTP

MSXML2.ServerXMLHTTP

MSXML2.ServerXMLHTTP.6.0

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

/api/xmlapi.asmx/GetStaticData

/api/xmlapi.asmx/TrialLogin&Vercode=

IPHlpApi.dll

00-00-00-00-00-00

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

/api/xmlapi.asmx/Login&Mark=

/api/xmlapi.asmx/GetInfoAppCode=

2013-01-01 08:00:00

/api/xmlapi.asmx/Communication&ed=

/api/xmlapi.asmx/Regin&Agent=

/api/xmlapi.asmx/CardReCharge&Referee=

/api/xmlapi.asmx/OrderReCharge&OrderNo=

/api/xmlapi.asmx/UpdatePwd&NewPwd=

/api/xmlapi.asmx/ChangeBinding

/api/xmlapi.asmx/GetGameName

/api/xmlapi.asmx/GetExpireTime

/api/xmlapi.asmx/CheckAgain

/api/xmlapi.asmx/GetVerCode

hXXp://VVV.google.com.hk

hXXp://VVV.sina.com.cn

hXXp://VVV.163.com

hXXp://VVV.sohu.com

hXXp://VVV.sogou.com

hXXp://VVV.soso.com

hXXp://VVV.qq.comHEAD

ntdll.dll

CloseWindowStation

program internal error number is %d.

:"%s"

:"%s".

;3 #>6.&

'2, / 0&7!4-)1#

c:\%original file name%.exe

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

GetWindowsDirectoryA

WinExec

RegOpenKeyExA

RegCreateKeyExA

GetViewportOrgEx

ScaleViewportExtEx

SetViewportExtEx

OffsetViewportOrgEx

SetViewportOrgEx

GetViewportExtEx

ShellExecuteA

GetKeyState

CreateDialogIndirectParamA

SetWindowsHookExA

UnhookWindowsHookEx

EnumChildWindows

InternetOpenUrlA

d4x7V.aCz

/IE.BsCr0S(@S

Keyu

faMsg

pi.ih

#include "l.chs\afxres.rc" // Standard components

PAD

comdlg32.dll

oledlg.dll

RASAPI32.dll

WININET.dll

WINMM.dll

WINSPOOL.DRV

1, 0, 6, 6

- Skin.dll

!"#$%&'()* ,-

25, 0, 0, 1

Windows

CCaptchaRecognizer::recognizeByCodeTypeAndUrl

hXXp://s1.uudati.com:

hXXp://s1.taskok.com:

hXXp://s1.uudama.com:

hXXp://s1.uuwise.com:

/Api/config.aspx

2.0.0.4

WiseClientAPI-2.0.0.4

CCaptchaRecognizer::__UpdateTKEY

CCaptchaRecognizer::_IsNeedLogin

/Api/DecodeImg.aspx

xxxxxxxxxxx

hXXp://p1.uuwise.net:

hXXp://p1.uudama.net:

hXXp://p1.taskok.com:

hXXp://p1.uuwise.com:

hXXp://p1.uudama.com:

CCaptchaRecognizer::easyRecognizeUrl

%d%d%d%d%d

CCaptchaRecognizer::_CalcRandomPort

/Api/VerifyAPIFile.aspx

/Api/UserLogin.aspx

CCaptchaRecognizer::login

/Api/UserReg.aspx

/Api/PayCard.aspx

/Api/ReportError.aspx

CCaptchaRecognizer::reportError

/Api/UserPoint.aspx

|2.0.0.4|

/Api/DecodeResult.aspx

ID/KEY/

ByTypeBytes.JPG

%d-%d-%d

CHttpRequestHelper::_ReadResponse

User-Agent:WiseClient-2.0.0.4;

WiseClient-2.0.0.4

CHttpRequestHelper::_InternalRequest

CHttpRequestHelper::RequestGetImage

CHttpRequestHelper::RequestPost

ServerPort

UUExtConfig.ini

-:-:-.%d

tCRYPTDLL.DLL

3.cn.pool.ntp.org

2.cn.pool.ntp.org

1.cn.pool.ntp.org

0.cn.pool.ntp.org

cn.pool.ntp.org

\\.\PHYSICALDRIVE0

Microsoft Windows Millennium Edition

Microsoft Windows 98

Microsoft Windows 95

%s (Build %d)

Service Pack 6a (Build %d)

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

Web Edition

Service Pack %d (Build %d)

Microsoft Windows NT

Microsoft Windows 2000

Microsoft Windows XP

Microsoft Windows Server 2003,

Microsoft Windows XP Professional x64 Edition

Microsoft Windows Server 2003 "R2"

Windows Server 2008

Windows Vista

Windows Server 2008 R2

Windows 7

ox-x-x-x-x-x

\Tencent\Users\*.*

nKERNEL32.DLL

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

!"#$%&'()* ,-.

uuwise.com

2, 0, 0, 4

1.0.0.1

(*.*)

1.1.0.0

%original file name%.exe_560_rwx_00401000_0025D000:

t$(SSh

~%UVW

f9z.vk

u$SShe

B~nCB~J!C~.dE~

kernel32.dll

wininet.dll

ole32.dll

UUWiseHelper.dll

user32.dll

rasapi32.dll

ADVAPI32.DLL

advapi32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

uu_loginA

uu_reportError

CreateIoCompletionPort

{B6F7542F-B8FE-46a8-9605-98856A687097}

{B37C9A97-4B7C-4270-837C-1A27515588A8}

hXXp://VVV.ltywz.com/rj/post.htm

.iqW>

"3/%F

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

https

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXp://

Adodb.Stream

hXXp://VVV.minnanwl.com/gengxin/qqlx/lxqq.htm

config.ini

999999999

hXXp://VVV.minnanwl.com/gengxin/qqlx/qq.htm

\dc.dll

.text

`.rdata

@.data

@.reloc

MFC42.DLL

KERNEL32.dll

GdiplusShutdown

gdiplus.dll

WSOCK32.dll

MSVCP60.dll

dc.dll

ReportError

ReportError_A

VBYB_ReportError

VB_ReportError

uu_loginW

debug.ini

ReportError:%s

Error:%s

%s|!|%s

\dms.pdb

%u%u,

dclog.txt

port

settimeout:%d

[%d]%s

reg2:%s

checkok:%s %s

check fail:%s %s %s

check:%s %s

getcjfail:%s %s

getcj:%s %s

%s%uout

%s%uin

put img ok:%s

put img fail:%s

put img:%s %s %d

get result ok:%s,%s

get result fail:%s

get result:%s

notifyfail ok:%s

%s\%d-%s.png

notifyfail fail:%s,%s

notifyfail:%s

getimgok:%s,%s

getimg:%s

getinfo fail:%s

getinfo:%s,%s

setresult:%s,%s

HTTP/1.1 200 OK

recv:%d

send:%d

GET /ip.txt HTTP/1.1

Host: %s

User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2

select:%d

ioctlsocket:%d

socket:%d

api.qqchaoren.net

14.17.65.24

14.17.65.23

dama2.qqchaoren.net

dama1.qqchaoren.net

connect total:%s %d

:%s %d

connect discard:%s %d

[d-d-d d:d:d](u)

recv timeout:

recvfail:%d

server close:%d

recv:%d

send:%d

sendfail:%d

connect timeout:

connectok:%s %hu

127.0.0.1

1.1.3

\SkinH_EL.dll

\To configure.ini

E23EB210-E964-4807-9865-5FFF8BC100CF

\UUWiseHelper.dll

SSSSh

ByScreen.JPG

operator

GetProcessWindowStation

E:\work\UUWiseHelper

\UUWiseHelper.pdb

RegCloseKey

RegOpenKeyExW

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

SHLWAPI.dll

urlmon.dll

dbghelp.dll

IPHLPAPI.DLL

WS2_32.dll

GetProcessHeap

GetCPInfo

UUWiseHelper.DLL

uu_easyRecognizeUrlA

uu_easyRecognizeUrlW

uu_recognizeByCodeTypeAndUrlA

uu_recognizeByCodeTypeAndUrlW

zcÁ

0(1,10141

9 9

32F1C86B-E64C-4EAF-8BC1-C142570008BC

:-1014,URL

:-19011,

TEAKEY

hXXp://api.ruokuai.com/register.xml

hXXp://api.ruokuai.com/info.xml

hXXp://api.ruokuai.com/recharge.xml

hXXp://api.ruokuai.com/create.xml

hXXp://api.ruokuai.com/reporterror.xml

hXXp://reg.email.163.com/unireg/call.do?cmd=register.entrance&from=163mail_right

m = w.length,

b = f.getTime(),

p = z.charAt(q),

for (n = (e '').length - 1; n >= 0; n--) {

var o = x.charAt(n);

y = i.length,

r = r i.charAt(j);

v = v i.charAt(j)

for (t = 0; t

s = s u.charAt(t)

b = a.getTime();

hXXp://reg.email.163.com/unireg/call.do?cmd=register.verifyCode&v=common/verifycode/vc_en&env=

@163.com

@163.com----

SESSIONkEY

-12027,TEAKEY

hXXp://1111.ip138.com/ic.asp

hXXp://reg.email.163.com/unireg/call.do?cmd=register.verifyCode&v=common/verifycode/vc_zh&vt=grey&env=

Fiddler Web Debugger

The Wireshark Network Analyzer [Wireshark 1.12.0 (v1.12.0-0-g4fab41a from master-1.12)]

hXXp://VVV.uuwise.com/

hXXp://VVV.ruokuai.com/

hXXp://iframe.ip138.com/ic.asp

\Microsoft\Network\Connections\pbk\rasphone.pbk

&password=

application/x-www-form-urlencoded

WinHttp.WinHttpRequest.5.1

&softkey=

Content-Disposition: form-data; name="password"

{pass}

Content-Disposition: form-data; name="softkey"

{softkey}

Content-Disposition: form-data; name="image"; filename="System.Byte[]"

z>type=1&product=urs&url=&url2=http://reg.163.com/UserLogin.do&username=

hXXps://reg.163.com/logins.jsp

?cmd=register.start&reforward=common/reform&targetCmd=register.ctrlTop

hXXps://ssl.mail.163.com/regall/unireg/call.do;jsessionid=

&confirmPassword=

@163.com&password=

@163.com&suspendId=

hXXp://reg.email.163.com/unireg/call.do?cmd=register.resume

hXXps://reg.163.com/account/accountSecQuestionIndex.do

&question3=æ‚¨é…å¶çš„åå—æ˜¯ï¼Ÿ&answer3=

&question2=æ‚¨æ¯äº²çš„åå—æ˜¯ï¼Ÿ&answer2=

noheader=0&lastpath=&isReset=&navitem=nav_item_3&question1=æ‚¨çˆ¶äº²çš„åå—æ˜¯ï¼Ÿ&answer1=

hXXps://reg.163.com/mibao2/step1.do

hXXps://reg.163.com/mibao2/checkAnswer.do

SetClientCertificate

112.15.5.111

hXXp://VVV.ltywz.com/thread-17831-1-1.htmlt

MEs

SgP%c

-cJ}R)uv

%d&&'

123456789

00003333

__MSVCRT_HEAP_SELECT

CreateWindowStationA

MsgWaitForMultipleObjects

pljd.dll

pljd_UserLogin

pljd_UserLogin_A

pljd_UserTrialLogin

pljd_UserTrialLogin_A

?456789:;

!"#$%&'()* ,-./0123

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

Broken pipe

Inappropriate I/O control operation

Operation not permitted

iphlpapi.dll

MPR.dll

VERSION.dll

.PAVCException@@

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

VVV.dywt.com.cn

hXXp://VVV.baidu.com

(*.htm;*.html)|*.htm;*.html

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

/api/api.aspx

0@MSXML2.XMLHTTP

Microsoft.XMLHTTP

MSXML2.ServerXMLHTTP

MSXML2.ServerXMLHTTP.6.0

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

/api/xmlapi.asmx/GetStaticData

/api/xmlapi.asmx/TrialLogin&Vercode=

IPHlpApi.dll

00-00-00-00-00-00

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

/api/xmlapi.asmx/Login&Mark=

/api/xmlapi.asmx/GetInfoAppCode=

2013-01-01 08:00:00

/api/xmlapi.asmx/Communication&ed=

/api/xmlapi.asmx/Regin&Agent=

/api/xmlapi.asmx/CardReCharge&Referee=

/api/xmlapi.asmx/OrderReCharge&OrderNo=

/api/xmlapi.asmx/UpdatePwd&NewPwd=

/api/xmlapi.asmx/ChangeBinding

/api/xmlapi.asmx/GetGameName

/api/xmlapi.asmx/GetExpireTime

/api/xmlapi.asmx/CheckAgain

/api/xmlapi.asmx/GetVerCode

hXXp://VVV.google.com.hk

hXXp://VVV.sina.com.cn

hXXp://VVV.163.com

hXXp://VVV.sohu.com

hXXp://VVV.sogou.com

hXXp://VVV.soso.com

hXXp://VVV.qq.comHEAD

ntdll.dll

CloseWindowStation

program internal error number is %d.

:"%s"

:"%s".

;3 #>6.&

'2, / 0&7!4-)1#

c:\%original file name%.exe

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

GetWindowsDirectoryA

WinExec

RegOpenKeyExA

RegCreateKeyExA

GetViewportOrgEx

ScaleViewportExtEx

SetViewportExtEx

OffsetViewportOrgEx

SetViewportOrgEx

GetViewportExtEx

ShellExecuteA

GetKeyState

CreateDialogIndirectParamA

SetWindowsHookExA

UnhookWindowsHookEx

EnumChildWindows

InternetOpenUrlA

d4x7V.aCz

/IE.BsCr0S(@S

Keyu

1, 0, 6, 6

- Skin.dll

!"#$%&'()* ,-

25, 0, 0, 1

Windows

CCaptchaRecognizer::recognizeByCodeTypeAndUrl

hXXp://s1.uudati.com:

hXXp://s1.taskok.com:

hXXp://s1.uudama.com:

hXXp://s1.uuwise.com:

/Api/config.aspx

2.0.0.4

WiseClientAPI-2.0.0.4

CCaptchaRecognizer::__UpdateTKEY

CCaptchaRecognizer::_IsNeedLogin

/Api/DecodeImg.aspx

xxxxxxxxxxx

hXXp://p1.uuwise.net:

hXXp://p1.uudama.net:

hXXp://p1.taskok.com:

hXXp://p1.uuwise.com:

hXXp://p1.uudama.com:

CCaptchaRecognizer::easyRecognizeUrl

%d%d%d%d%d

CCaptchaRecognizer::_CalcRandomPort

/Api/VerifyAPIFile.aspx

/Api/UserLogin.aspx

CCaptchaRecognizer::login

/Api/UserReg.aspx

/Api/PayCard.aspx

/Api/ReportError.aspx

CCaptchaRecognizer::reportError

/Api/UserPoint.aspx

|2.0.0.4|

/Api/DecodeResult.aspx

ID/KEY/

ByTypeBytes.JPG

%d-%d-%d

CHttpRequestHelper::_ReadResponse

User-Agent:WiseClient-2.0.0.4;

WiseClient-2.0.0.4

CHttpRequestHelper::_InternalRequest

CHttpRequestHelper::RequestGetImage

CHttpRequestHelper::RequestPost

ServerPort

UUExtConfig.ini

-:-:-.%d

tCRYPTDLL.DLL

3.cn.pool.ntp.org

2.cn.pool.ntp.org

1.cn.pool.ntp.org

0.cn.pool.ntp.org

cn.pool.ntp.org

\\.\PHYSICALDRIVE0

Microsoft Windows Millennium Edition

Microsoft Windows 98

Microsoft Windows 95

%s (Build %d)

Service Pack 6a (Build %d)

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

Web Edition

Service Pack %d (Build %d)

Microsoft Windows NT

Microsoft Windows 2000

Microsoft Windows XP

Microsoft Windows Server 2003,

Microsoft Windows XP Professional x64 Edition

Microsoft Windows Server 2003 "R2"

Windows Server 2008

Windows Vista

Windows Server 2008 R2

Windows 7

ox-x-x-x-x-x

\Tencent\Users\*.*

nKERNEL32.DLL

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

!"#$%&'()* ,-.

uuwise.com

2, 0, 0, 4

1.0.0.1

%original file name%.exe_560_rwx_10028000_00015000:

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ð

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0