Trojan.Win32.Fsysna.baco (Kaspersky), Trojan.GenericKD.2023048 (B) (Emsisoft), Trojan.GenericKD.2023048 (AdAware), GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 4463de4ec0c2b5a9621979d06bfb3a1e
SHA1: e749e9e33671f5a9c63965738b45a0b830205101
SHA256: 9263d58d6a9152adb24396ee55d428f2e8d45377c5cdf9822b5876928dfb05ea
SSDeep: 24576:RKDzSdrz3bvv0/0P8uHdmsEgaqGyGle5ZmQRagYiRwS8svICsz53 lzSx5:RKDzShzDv0/28IdEgf5Gl mAmmysw3Y2
Size: 1318912 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: StdLib
Created at: 2014-12-11 02:08:13
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1476
AppLaunch.exe:1192
hkcnd.exe:316
The Trojan injects its code into the following process(es):
klauncher.exe:212
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1476 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\MicrosoftServices\MicrosoftServices\hkcnd.exe:ZONE.identifier (28 bytes)
%Documents and Settings%\%current user%\Templates\klauncher.exe (3912 bytes)
%Documents and Settings%\%current user%\Application Data\MicrosoftServices\MicrosoftServices\hkcnd.exe (8281 bytes)
The process klauncher.exe:212 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\legend-online[1].jpg (10388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\2711201416455506613[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1905201223545295109[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ko[1].jpg (16188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1808201309193459399[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\mangir[1].jpg (7562 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\left_menu[1].jpg (672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bg[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ga[1].js (1557 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\NewHorizon[2].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\nivo-slider[1].css (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery.nivo.slider.pack[1].js (2833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\onlinehile[1].htm (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\buttons[1].js (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2912201415004395446[1].jpg (3537 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\kredikarti[1].png (523 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1905201223514964638[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1905201223524825628[1].jpg (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\banner_proxy[1].png (6348 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1704201314533078331[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\footer-top[1].jpg (306 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (10504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@oyunkolonisi[1].txt (223 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\oyunkolonisi[1].htm (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1905201223512202464[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lol[1].jpg (6807 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\all[1].css (11001 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\0210201211154505920[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\header_bg[1].jpg (769 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2111201219281529243[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\canli[1].jpg (13500 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\2004201319033623423[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1907201217175184490[1].jpg (824 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dota2butcher[1].png (35963 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Teaser_TR_240x150[1].jpg (1744 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\icon[1].gif (970 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1704201313161020470[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bayrakeng[1].png (707 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@gamecrea[1].txt (1728 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1801201310573249705[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\2612201216414968119[1].jpg (1366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2111201219225210036[1].jpg (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\2304201312262357277[1].jpg (118 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@onlinehile[2].txt (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1905201223531548098[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\parca-kontor[1].jpg (9380 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\facebook[1].png (838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\slide[1].css (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1908201312351700450[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\2507201314442430099[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery[1].js (40018 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\NewHorizon[1].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\user_menu2[1].png (7 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@providesupport[1].txt (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\news2[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bullet[1].jpg (796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1905201223515582277[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2111201219254885840[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1905201223521133576[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\goodgame[1].jpg (11952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1905201223511036852[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\0210201211160921931[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@gamecrea[2].txt (1223 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\login_title_bg[1].jpg (782 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1905201223513775728[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1103201404255902734[1].jpg (8209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\count[1].js (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1905201223521968642[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\money_calc2[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1905201223530784719[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2607201316023564419[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Candara_700.font[1].js (6553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1905201223520202044[1].jpg (118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\warframe[1].png (34383 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\3001201315163166106[1].jpg (1367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\login_key4[1].png (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\kolebot[1].jpg (6407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1905201223530066246[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\banner1[1].js (18761 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sonteklif[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bayraktr[1].png (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\login[1].js (568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2304201312020112115[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cufon_replace[1].js (149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1103201404500117596[1].jpg (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1905201223504566367[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\banner2[1].js (961 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\header-image8[1].jpg (96939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\safe-standard[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1704201315043081365[1].jpg (118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\online-2119672474[1].png (1093 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\steam[1].jpg (7932 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo_alt[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\0410201203413726153[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sa[1].js (1099 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\2612201216563244805[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1401201317452388406[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\safe-standard[2].js (5 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@onlinehile[1].txt (901 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1708201315030465994[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cufon_yui[1].js (2833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1905201223513156550[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\shopping_basket2[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\premium[1].jpg (12166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\0606201219555996174[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2612201216500218344[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\banner3[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\resim_yok[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\mobil-odeme[1].jpg (11886 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1103201404230613003[1].jpg (3808 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Cookies\Current_User@onlinehile[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@gamecrea[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040920140410\index.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@onlinehile[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\NewHorizon[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\safe-standard[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040920140410 (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@gamecrea[1].txt (0 bytes)
The process hkcnd.exe:316 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\MicrosoftServices\MicrosoftServices\csrss.exe (8281 bytes)
%Documents and Settings%\%current user%\Application Data\MicrosoftServices\MicrosoftServices\csrss.exe:ZONE.identifier (28 bytes)
Registry activity
The process %original file name%.exe:1476 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 3F 0F 7E 73 A1 DE D4 47 FD BA 1C 2B 7E 1B 2D"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Templates]
"klauncher.exe" = "klauncher"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\MicrosoftServices\MicrosoftServices]
"hkcnd.exe" = ""
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Templates" = "%Documents and Settings%\%current user%\Templates"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The process AppLaunch.exe:1192 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA E7 91 4F 36 CA 96 66 ED 6E 2C 60 DF E3 0E 2B"
The process klauncher.exe:212 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015010920150110]
"CacheOptions" = "11"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015010920150110]
"CacheRepair" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "klauncher.exe"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015010920150110]
"CachePrefix" = ":2015010920150110:"
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012015010920150110\"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1414154811"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 1D 40 C1 1C 0F 6D 30 70 F5 52 50 96 EF CB 68"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015010920150110]
"CacheLimit" = "8192"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014040920140410]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process hkcnd.exe:316 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AF DD F9 22 AF D3 C8 7A 43 E3 85 36 F9 7E C9 A0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\MicrosoftServices\MicrosoftServices]
"csrss.exe" = ""
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Templates" = "%Documents and Settings%\%current user%\Templates"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan adds the reference to itself to be executed when a user logs on:
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe, %Documents and Settings%\%current user%\Application Data\MicrosoftServices\MicrosoftServices\hkcnd.exe"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan adds the reference to itself to be executed when a user logs on:
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe, %Documents and Settings%\%current user%\Application Data\MicrosoftServices\MicrosoftServices\hkcnd.exe"
Dropped PE files
| MD5 | File path |
|---|---|
| 0995db7e9a1adf6ef9179530478b8990 | c:\Documents and Settings\"%CurrentUserName%"\Templates\klauncher.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1476
AppLaunch.exe:1192
hkcnd.exe:316 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\MicrosoftServices\MicrosoftServices\hkcnd.exe:ZONE.identifier (28 bytes)
%Documents and Settings%\%current user%\Templates\klauncher.exe (3912 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\legend-online[1].jpg (10388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\2711201416455506613[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1905201223545295109[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ko[1].jpg (16188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1808201309193459399[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\mangir[1].jpg (7562 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\left_menu[1].jpg (672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\bg[1].jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ga[1].js (1557 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\NewHorizon[2].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\nivo-slider[1].css (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery.nivo.slider.pack[1].js (2833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\onlinehile[1].htm (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\buttons[1].js (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2912201415004395446[1].jpg (3537 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\kredikarti[1].png (523 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1905201223514964638[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1905201223524825628[1].jpg (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\banner_proxy[1].png (6348 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1704201314533078331[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\footer-top[1].jpg (306 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (10504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@oyunkolonisi[1].txt (223 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\oyunkolonisi[1].htm (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1905201223512202464[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lol[1].jpg (6807 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\all[1].css (11001 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\0210201211154505920[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\header_bg[1].jpg (769 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2111201219281529243[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\canli[1].jpg (13500 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\2004201319033623423[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1907201217175184490[1].jpg (824 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dota2butcher[1].png (35963 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Teaser_TR_240x150[1].jpg (1744 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\icon[1].gif (970 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1704201313161020470[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bayrakeng[1].png (707 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@gamecrea[1].txt (1728 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1801201310573249705[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\2612201216414968119[1].jpg (1366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2111201219225210036[1].jpg (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\2304201312262357277[1].jpg (118 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@onlinehile[2].txt (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1905201223531548098[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\parca-kontor[1].jpg (9380 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\facebook[1].png (838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\slide[1].css (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1908201312351700450[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\2507201314442430099[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery[1].js (40018 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\NewHorizon[1].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\user_menu2[1].png (7 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@providesupport[1].txt (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\news2[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bullet[1].jpg (796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1905201223515582277[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2111201219254885840[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1905201223521133576[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\goodgame[1].jpg (11952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1905201223511036852[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\0210201211160921931[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@gamecrea[2].txt (1223 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\login_title_bg[1].jpg (782 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1905201223513775728[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1103201404255902734[1].jpg (8209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\count[1].js (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1905201223521968642[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\money_calc2[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1905201223530784719[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2607201316023564419[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Candara_700.font[1].js (6553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1905201223520202044[1].jpg (118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\warframe[1].png (34383 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\3001201315163166106[1].jpg (1367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\login_key4[1].png (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\kolebot[1].jpg (6407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1905201223530066246[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\banner1[1].js (18761 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sonteklif[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bayraktr[1].png (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\login[1].js (568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2304201312020112115[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cufon_replace[1].js (149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1103201404500117596[1].jpg (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1905201223504566367[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\banner2[1].js (961 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\header-image8[1].jpg (96939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\safe-standard[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1704201315043081365[1].jpg (118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\online-2119672474[1].png (1093 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\steam[1].jpg (7932 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo_alt[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\0410201203413726153[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sa[1].js (1099 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\2612201216563244805[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1401201317452388406[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\safe-standard[2].js (5 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@onlinehile[1].txt (901 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1708201315030465994[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cufon_yui[1].js (2833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1905201223513156550[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\shopping_basket2[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\premium[1].jpg (12166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\0606201219555996174[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2612201216500218344[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\banner3[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\resim_yok[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\mobil-odeme[1].jpg (11886 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1103201404230613003[1].jpg (3808 bytes)
%Documents and Settings%\%current user%\Application Data\MicrosoftServices\MicrosoftServices\csrss.exe (8281 bytes)
%Documents and Settings%\%current user%\Application Data\MicrosoftServices\MicrosoftServices\csrss.exe:ZONE.identifier (28 bytes) - Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe, %Documents and Settings%\%current user%\Application Data\MicrosoftServices\MicrosoftServices\hkcnd.exe"
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe, %Documents and Settings%\%current user%\Application Data\MicrosoftServices\MicrosoftServices\hkcnd.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version: 0.9.612.2
Legal Copyright:
Legal Trademarks:
Original Filename: kolebot2.exe
Internal Name: kolebot2.exe
File Version: 0.9.612.2
File Description:
Comments:
Language: English (United States)
Company Name: Product Name: Product Version: 0.9.612.2Legal Copyright: Legal Trademarks: Original Filename: kolebot2.exeInternal Name: kolebot2.exeFile Version: 0.9.612.2File Description: Comments: Language: English (United States)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 8192 | 1292116 | 1294336 | 5.54364 | d83bd67c1071af874e31f74fede23b57 |
| .rsrc | 1302528 | 16008 | 16384 | 3.48702 | 3997881b085225ae4f6b516b8d52f676 |
| .reloc | 1318912 | 12 | 4096 | 0.011373 | 3186d59edd925cc6a4f663852305f8f8 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://oyunkolonisi.com/ | 104.28.24.86 |
| hxxp://gamecrea.com/ | 80.84.50.94 |
| hxxp://onlinehile.org/ | 141.101.118.48 |
| hxxp://gamecrea.com/js/jquery.js | 80.84.50.94 |
| hxxp://gamecrea.com/css/all.css | 80.84.50.94 |
| hxxp://onlinehile.org/leqo/NewHorizon.css | 141.101.118.48 |
| hxxp://gamecrea.com/js/buttons.js | 80.84.50.94 |
| hxxp://gamecrea.com/js/cufon_yui.js | 80.84.50.94 |
| hxxp://onlinehile.org/leqo/footer-top.jpg | 141.101.118.48 |
| hxxp://onlinehile.org/leqo/bg.jpg | 141.101.118.48 |
| hxxp://onlinehile.org/leqo/bullet.jpg | 141.101.118.48 |
| hxxp://srv.sayyac.net/sa.js?_salogin=leqo&_sav=4.3 | 173.192.214.225 |
| hxxp://onlinehile.org/leqo/header-image8.jpg | 141.101.118.48 |
| hxxp://gamecrea.com/js/Candara_700.font.js | 80.84.50.94 |
| hxxp://srv.sayyac.net/sa.gif?_salogin=leqo&_sav=4.2&_saje=1&_sace=true&_sacol=32&_sares=1916x902&_saref=&_saa_u=1&_say_u=1&_sam_u=1&_saw_u=1&_sad_u=1&_sawd_u=1&_sadh_u=1&_sanv=1&_sarnd=0.7286422810229216 | 173.192.214.225 |
| hxxp://srv.sayyac.net/icon.gif | 173.192.214.225 |
| hxxp://gamecrea.com/js/cufon_replace.js | 80.84.50.94 |
| hxxp://gamecrea.com/css/nivo-slider.css | 80.84.50.94 |
| hxxp://gamecrea.com/js/jquery.nivo.slider.pack.js | 80.84.50.94 |
| hxxp://gamecrea.com/images/bayraktr.png | 80.84.50.94 |
| hxxp://gamecrea.com/images/facebook.png | 80.84.50.94 |
| hxxp://gamecrea.com/images/bayrakeng.png | 80.84.50.94 |
| hxxp://gamecrea.com/images/logo.png | 80.84.50.94 |
| hxxp://gamecrea.com/images/header_bg.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/css/slide.css | 80.84.50.94 |
| hxxp://gamecrea.com/js/banner1.js | 80.84.50.94 |
| hxxp://image.providesupport.com.cdn.cloudflare.net/js/0oevzq5g4ez0z12oo7ml0q32bo/safe-standard.js?ps_h=lpVC&ps_t=1420825573301 | 104.20.2.40 |
| hxxp://gamecrea.com/js/banner2.js | 80.84.50.94 |
| hxxp://gamecrea.com/js/banner3.js | 80.84.50.94 |
| hxxp://gamecrea.com/news/dota2butcher.png | 80.84.50.94 |
| hxxp://gamecrea.com/news/warframe.png | 80.84.50.94 |
| hxxp://image.providesupport.com.cdn.cloudflare.net/image/0oevzq5g4ez0z12oo7ml0q32bo/online-2119672474.png | 104.20.2.40 |
| hxxp://image.providesupport.com.cdn.cloudflare.net/cmd/0oevzq5g4ez0z12oo7ml0q32bo?ps_t=1420825574129&ps_l=http://gamecrea.com/&ps_r=&ps_s=HGU2Bj70eskw | 104.20.2.40 |
| hxxp://gamecrea.com/news/banner_proxy.png | 80.84.50.94 |
| hxxp://gamecrea.com/news/canli.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/news/lol.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/news/goodgame.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/news/ko.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/news/mangir.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/news/premium.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/news/legend-online.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/news/mobil-odeme.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/news/parca-kontor.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/news/kolebot.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/news/steam.jpg | 80.84.50.94 |
| hxxp://srv.sayyac.net/count.js | 173.192.214.225 |
| hxxp://gamecrea.com/images/user_menu2.png | 80.84.50.94 |
| hxxp://gamecrea.com/images/money_calc2.png | 80.84.50.94 |
| hxxp://gamecrea.com/images/shopping_basket2.png | 80.84.50.94 |
| hxxp://gamecrea.com/images/news2.png | 80.84.50.94 |
| hxxp://gamecrea.com/images/login_title_bg.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/0410201203413726153.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1708201315030465994.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1905201223513156550.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1905201223504566367.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1808201309193459399.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/2111201219281529243.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1905201223513775728.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1908201312351700450.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/2111201219225210036.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/2111201219254885840.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/0210201211154505920.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/2912201415004395446.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/2507201314442430099.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/2004201319033623423.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1401201317452388406.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1905201223511036852.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1907201217175184490.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1905201223521968642.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1905201223530784719.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/2607201316023564419.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/2612201216414968119.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1801201310573249705.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/3001201315163166106.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1704201313161020470.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1704201314533078331.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1704201315043081365.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1905201223512202464.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1905201223521133576.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/0210201211160921931.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1905201223524825628.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/2304201312262357277.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/2612201216563244805.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/2612201216500218344.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/images/resim_yok.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1103201404255902734.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1905201223515582277.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/2711201416455506613.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/2304201312020112115.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1905201223520202044.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1905201223530066246.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1905201223531548098.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1905201223514964638.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1905201223545295109.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/0606201219555996174.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1103201404500117596.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/kategori_resimleri/1103201404230613003.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/js/login.js | 80.84.50.94 |
| hxxp://gamecrea.com/images/Teaser_TR_240x150.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/images/login_key4.png | 80.84.50.94 |
| hxxp://gamecrea.com/images/kredikarti.png | 80.84.50.94 |
| hxxp://gamecrea.com/images/sonteklif.png | 80.84.50.94 |
| hxxp://www-google-analytics.l.google.com/ga.js | |
| hxxp://gamecrea.com/images/logo_alt.png | 80.84.50.94 |
| hxxp://gamecrea.com/images/left_menu.jpg | 80.84.50.94 |
| hxxp://gamecrea.com/undefined | 80.84.50.94 |
| hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.1&utms=1&utmn=420109449&utmhn=gamecrea.com&utmcs=utf-8&utmsr=1916x902&utmvp=280x130&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=GameCrea.com&utmhid=1497608487&utmr=-&utmp=/&utmht=1420825580879&utmac=UA-34644237-1&utmcc=__utma=184313904.586816636.1420825580.1420825580.1420825580.1;+__utmz=184313904.1420825580.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=2009778987&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ | |
| hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.1&utms=1&utmn=420109449&utmhn=gamecrea.com&utmcs=utf-8&utmsr=1916x902&utmvp=280x130&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=GameCrea.com&utmhid=1497608487&utmr=-&utmp=/&utmht=1420825580879&utmac=UA-34644237-1&utmcc=__utma=184313904.586816636.1420825580.1420825580.1420825580.1;+__utmz=184313904.1420825580.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=2009778987&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ | 173.194.113.96 |
| hxxp://image.providesupport.com/js/0oevzq5g4ez0z12oo7ml0q32bo/safe-standard.js?ps_h=lpVC&ps_t=1420825573301 | 104.20.2.40 |
| hxxp://image.providesupport.com/cmd/0oevzq5g4ez0z12oo7ml0q32bo?ps_t=1420825574129&ps_l=http://gamecrea.com/&ps_r=&ps_s=HGU2Bj70eskw | 104.20.2.40 |
| hxxp://image.providesupport.com/image/0oevzq5g4ez0z12oo7ml0q32bo/online-2119672474.png | 104.20.2.40 |
| hxxp://www.google-analytics.com/ga.js | 173.194.113.96 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /undefined HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 404 Not Found
Date: Fri, 09 Jan 2015 17:46:22 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Accept-Ranges: bytes
Content-Length: 113
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>....
GET /undefined HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 404 Not Found
Date: Fri, 09 Jan 2015 17:46:22 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Accept-Ranges: bytes
Content-Length: 113
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html
<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>....
GET /undefined HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 404 Not Found
Date: Fri, 09 Jan 2015 17:46:22 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Accept-Ranges: bytes
Content-Length: 113
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html
<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>....
GET /undefined HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 404 Not Found
Date: Fri, 09 Jan 2015 17:46:23 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Accept-Ranges: bytes
Content-Length: 113
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html
<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>....
GET /undefined HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 404 Not Found
Date: Fri, 09 Jan 2015 17:46:23 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Accept-Ranges: bytes
Content-Length: 113
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/html
<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>....
GET /undefined HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 404 Not Found
Date: Fri, 09 Jan 2015 17:46:23 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Accept-Ranges: bytes
Content-Length: 113
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: text/html
<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>....
GET /undefined HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 404 Not Found
Date: Fri, 09 Jan 2015 17:46:23 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Accept-Ranges: bytes
Content-Length: 113
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: text/html
<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>HTTP/1.1 404 Not Found..Date: Fri, 09 Jan 2015 17:46:23 GMT..Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4..Accept-Ranges: bytes..Content-Length: 113..Keep-Alive: timeout=5, max=94..Connection: Keep-Alive..Content-Type: text/html..<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>..
GET /css/all.css HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:13 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:31 GMT
ETag: "7fc1-4d75a63f6f4c0"
Accept-Ranges: bytes
Content-Length: 32705
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/css
.header { margin-bottom:10px; background-image:url(../images/header_bg.jpg); }..header .top { padding-top:5px; }..header .top .top_left { color:#333; }..header .top .top_left a { font-weight:bold; color:#000; text-decoration:none; }..header .top .top_left a:hover { text-decoration:underline; }..header .top .top_right { }..header .top .top_right a { margin-left:5px; }..header .logo { padding-top:15px; padding-bottom:15px; }..header .links { margin-top:20px; }..header .links .header_link a { background-color:transparent; display:block; font-size:17px; padding:10px; padding-top:15px; padding-bottom:30px; font-weight:bold; color:#000; margin-left:15px; }..header .links .header_link a:hover { background-color:#5BA0E6; color:#FFF; }....header .links .header_link_ a { display:block; font-size:17px; padding:10px; padding-top:15px; padding-bottom:30px; font-weight:bold; color:#000; margin-left:15px; }.......calendar * { margin: 0; padding: 0; border: 0; font-family: Tahoma, serif; font-weight: normal; color: #000; }..calendar .invalidday a, .calendar .invalidday a:hover { color: #ccc; background: #fff; cursor: default; }..calendar .selectedday { background: #ddd; }..calendar .today { font-weight: bold; color: #f00; }..calendar a { padding: 0 2px; color: #000; text-decoration: none; }..calendar a:hover { background: #bbb; }..calendar table { border-collapse: collapse; font-size: 90%; }..calendar tbody td { width: 20px; }..calendar td { padding: 1px; text-align: center; }..calendar thead tr td { border-bottom: 1px solid #
<<< skipped >>>
GET /js/cufon_yui.js HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:14 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 10 Nov 2011 21:26:44 GMT
ETag: "3d3d-4b1680fa48d00"
Accept-Ranges: bytes
Content-Length: 15677
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
/*.. * Copyright (c) 2009 Simo Kinnunen... * Licensed under the MIT license... */..var Cufon=(function(){var L=function(){return L.replace.apply(null,arguments)};var V=L.DOM={ready:(function(){var a=false,c={loaded:1,complete:1};var Z=[],b=function(){if(a){return}a=true;for(var d;d=Z.shift();d()){}};if(document.addEventListener){document.addEventListener("DOMContentLoaded",b,false);window.addEventListener("pageshow",b,false)}if(!window.opera&&document.readyState){(function(){c[document.readyState]?b():setTimeout(arguments.callee,10)})()}if(document.readyState&&document.createStyleSheet){(function(){try{document.body.doScroll("left");b()}catch(d){setTimeout(arguments.callee,1)}})()}P(window,"load",b);return function(d){if(!arguments.length){b()}else{a?d():Z.push(d)}}})()};var M=L.CSS={Size:function(a,Z){this.value=parseFloat(a);this.unit=String(a).match(/[a-z%]*$/)[0]||"px";this.convert=function(b){return b/Z*this.value};this.convertFrom=function(b){return b/this.value*Z};this.toString=function(){return this.value this.unit}},getStyle:function(a){var Z=document.defaultView;if(Z&&Z.getComputedStyle){return new A(Z.getComputedStyle(a,null))}if(a.currentStyle){return new A(a.currentStyle)}return new A(a.style)},gradient:I(function(d){var e={id:d,type:d.match(/^-([a-z] )-gradient\(/)[1],stops:[]},a=d.substr(d.indexOf("(")).match(/([\d.] =)?(#[a-f0-9] |[a-z] \(.*?\)|[a-z] )/ig);for(var c=0,Z=a.length,b;c<Z; c){b=a[c].split("=",2).reverse();e.stops.push([b[1]||c/(Z-1),b[0]])}return e}),quotedList:I(function(c){var
<<< skipped >>>
GET /js/cufon_replace.js HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:15 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Fri, 18 May 2012 20:26:20 GMT
ETag: "95-4c0555d7bf300"
Accept-Ranges: bytes
Content-Length: 149
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript
Cufon.replace('div.header_link_', { fontFamily: 'Candara', hover: true });..Cufon.replace('div.header_link', { fontFamily: 'Candara', hover: true });HTTP/1.1 200 OK..Date: Fri, 09 Jan 2015 17:46:15 GMT..Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4..Last-Modified: Fri, 18 May 2012 20:26:20 GMT..ETag: "95-4c0555d7bf300"..Accept-Ranges: bytes..Content-Length: 149..Keep-Alive: timeout=5, max=98..Connection: Keep-Alive..Content-Type: application/javascript..Cufon.replace('div.header_link_', { fontFamily: 'Candara', hover: true });..Cufon.replace('div.header_link', { fontFamily: 'Candara', hover: true });....
GET /js/jquery.nivo.slider.pack.js HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:16 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 07 Nov 2012 19:51:34 GMT
ETag: "3e32-4cded0bb1fd80"
Accept-Ranges: bytes
Content-Length: 15922
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
/*.. * jQuery Nivo Slider v2.5.2.. * hXXp://nivo.dev7studios.com.. *.. * Copyright 2011, Gilbert Pellegrom.. * Free to use and abuse under the MIT license... * hXXp://VVV.opensource.org/licenses/mit-license.php.. * .. * March 2010.. */..(function($){var NivoSlider=function(element,options){var settings=$.extend({},$.fn.nivoSlider.defaults,options);var vars={currentSlide:0,currentImage:'',totalSlides:0,randAnim:'',running:false,paused:false,stop:false};var slider=$(element);slider.data('nivo:vars',vars);slider.css('position','relative');slider.addClass('nivoSlider');var kids=slider.children();kids.each(function(){var child=$(this);var link='';if(!child.is('img')){if(child.is('a')){child.addClass('nivo-imageLink');link=child;}..child=child.find('img:first');}..var childWidth=child.width();if(childWidth==0)childWidth=child.attr('width');var childHeight=child.height();if(childHeight==0)childHeight=child.attr('height');if(childWidth>slider.width()){slider.width(childWidth);}..if(childHeight>slider.height()){slider.height(childHeight);}..if(link!=''){link.css('display','none');}..child.css('display','none');vars.totalSlides ;});if(settings.startSlide>0){if(settings.startSlide>=vars.totalSlides)settings.startSlide=vars.totalSlides-1;vars.currentSlide=settings.startSlide;}..if($(kids[vars.currentSlide]).is('img')){vars.currentImage=$(kids[vars.currentSlide]);}else{vars.currentImage=$(kids[vars.currentSlide]).find('img:first');}..if($(kids[vars.currentSlide]).is('a')){$(kids[vars.currentSlide]).css('display
<<< skipped >>>
GET /images/facebook.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:16 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 30 May 2012 17:57:05 GMT
ETag: "346-4c144add1fe40"
Accept-Ranges: bytes
Content-Length: 838
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.lSKkSA..f..M..i.........b......q.R./.B........n...]..?.|.*bmk[Jl.#i..u..;... .<0.......93l.......U).<.VL{....A..Z6..}.LS........qV...W......nW.U..N(E...i..Q..m..&..6...t.k.^....v..r.U.../............6..{u...5..v...d...'m.S......jq.Z...e....<..d2...<........-....5.....0..y.y....l.......""-...8p..r...D@..|..)........_..q..R....<......t.V..$!}..5*8g.~.._........71q.....S.p._B.aRjS..B..b...{..r!j....x.0.p.._jp.t66..M...m..3.`....2.'.}^..,9..ATsVlh.A$....cf.?...i..)dO*H.. .......|\....C..V....q...g..,._<.......9&FR.V~......8./.....a.e...0..D...c..,..t.[MF......T....a....`..C.......>.,?b.'%..=.$..K......#.....D*!fg.p.=2ck2....I."..cb...O.....It.V...8NTk.F...5D.f1.@RC{.]&..E.CqX......z&o....~W. ..x.q.p...\.....>3..a.K...m.[-..s{k}.......x.L..F....IEND.B`.....
GET /images/logo.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:16 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 30 May 2012 17:57:33 GMT
ETag: "20aa-4c144af7d3d40"
Accept-Ranges: bytes
Content-Length: 8362
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR.......2.....7..s....pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>
GET /css/slide.css HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:16 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:31 GMT
ETag: "940-4d75a63f6f4c0"
Accept-Ranges: bytes
Content-Length: 2368
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: text/css
.pix_diapo {..z-index:1001;..overflow: hidden;..position: relative;..width: 560px;..height: 300px;.}..pix_diapo > div {..display: none;..height: 100%;..left: 0;..top: 0;..width: 100%;.}.#pix_pag {..margin: 0 auto;..margin-top:-35px;..z-index: 1002;.}.#pix_commands {..cursor: pointer;..display: block;..float:left;..margin-top:18px;..margin-left:-2px;.}.#pix_play {..background: url(../images/play.png) center no-repeat;..height: 24px;..left: 0;..top: 0;..width: 24px;.}.#pix_stop {..background: url(../images/pause.png) center no-repeat;..height: 24px;..left: 0;..top: 0;..width: 24px;.}.#pix_pag_ul {..float: right;..margin: 0;..padding: 0;..margin-right:5px;..margin-top:15px;.}.#pix_pag_ul > li {..cursor: pointer;..display: block;...display: inline-block;..float: left;..list-style: none;..text-align: center;..text-indent: -9999px;..margin-right:2px;.}.#pix_pag_ul > li > span {..background: #FFF;..-webkit-border-radius: 2px;..-moz-border-radius: 2px;..border-radius: 2px;..display: block;..height: 12px;..width: 12px;.}.#pix_pag_ul > li:hover > span > span {..background: #000;.}.#pix_pag_ul > li > span > span {..-webkit-border-radius: 2px;..-moz-border-radius: 2px;..border-radius: 2px;..display: block;..float: left;..height: 8px;..margin: 2px;..width: 8px;.}.#pix_pag_ul > li.diapocurrent > span > span {..background: #006699;..-webkit-border-radius: 2px;..-moz-border-radius: 2px;..border-radius: 2px;.}.#pix_pag_ul > li > .pix_thumb {..border: 4px solid #f2f2f2;...border: 4px
<<< skipped >>>
GET /js/banner2.js HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:16 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Mon, 30 May 2011 18:09:02 GMT
ETag: "2071-4a4822ea34b80"
Accept-Ranges: bytes
Content-Length: 8305
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Content-Type: application/javascript
/*.. * jQuery Easing v1.3 - hXXp://gsgd.co.uk/sandbox/jquery/easing/.. *.. * Uses the built in easing capabilities added In jQuery 1.1.. * to offer multiple easing options.. *.. * TERMS OF USE - jQuery Easing.. * .. * Open source under the BSD License. .. * .. * Copyright .... 2008 George McGinley Smith.. * All rights reserved... * .. * Redistribution and use in source and binary forms, with or without modification, .. * are permitted provided that the following conditions are met:.. * .. * Redistributions of source code must retain the above copyright notice, this list of .. * conditions and the following disclaimer... * Redistributions in binary form must reproduce the above copyright notice, this list .. * of conditions and the following disclaimer in the documentation and/or other materials .. * provided with the distribution... * .. * Neither the name of the author nor the names of contributors may be used to endorse .. * or promote products derived from this software without specific prior written permission... * .. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY .. * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF.. * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE.. * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,.. * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE.. * GOODS OR SERVICES; LOSS OF
<<< skipped >>>
GET /news/dota2butcher.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:16 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Sun, 18 Aug 2013 08:27:38 GMT
ETag: "3fc0b-4e43498b0d280"
Accept-Ranges: bytes
Content-Length: 261131
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR...O.........;.7>....gAMA....|.Q.... cHRM..z%..............u0...`..:....o._.F....pHYs................!tEXtCreation Time.2013:07:24 19:54:56.......YIDATx^l...m.z...n..nN....u......Y.q0& .&...v...D...GR../..o...'E.ec.X.B..Ps....?.]};.|....JT..}.{.>k.5.w~.O3...'..g. ..4...(.b~...J...wE. v..n[.w...j.,7.b5..]Y.UU.Q..Ev9..~qQ..N....}.Eq....(.b..%..,.t_TEU....^'K...NO.._.QR.'..;w.V..~...x.....|..h.E.o............(j$I......eT5j.\-....I..;...l....d>.'.|..^=.?...w:J.;.jyY.fq.5....MT.u].Q...)._.e#...*..;J.F.DI]..^PT.r.o.e.EUTGe..t...N6.u.\\.kgY..H...n6...ei...f.dM.$.....*......8..Vy]Ei.....J..oqEzQ].-...u K{.f...4..~..jDU.OEu../.#eRVu..L.Y].y.W....U......ut.\_-.I.;/.e.......y....b..n6e......".x.N..V.V]....l4..V.Y..,...]^._.V...t;.f...}.$.fs0....]>.l..;...(.o...n...sv\.-.Y..L.:..$..*Z.,A..aS...,.x".}....G.O....F....4..VQ.iT...a..y.zPU..6.8eg&uU..Q3e-.2..6..._.VXw.@T....o.v....... ..hw.E.zr.I .B.. ..'.L.. .k.5;,K.4...U.].I[..|.Y.._..W._..........N...p........*.I..q....o}.......D.....X..o~....vZo.]......Q.Qee..w......#g.KP....$..vy.wY...^.,.~...A.........%?Y'|.eT.g....Q....I~.....6..cd;.#Xc."'.....w..E.........).W.........o1G....}x.....w.13..^g.Q..y....y..4Rl.. .......r....5.....p2Y......K.......p.....Zx...Z..M|.3{....8|...3.P.....d.....U...&.E..L.f#n.8....K..R..=.Y...gu.._.bW..........!6.|S...|...(Z..U.Ok^.Q.'~6..r...o/........vd...'(..0s2\.{=\m.....>P......v....=b}'....^*..*bk........t..cx...........o~..N.l...7y\...U...GR..z..f....:*3..........E9.-..5>....J..>.....aap.}Y.Y#.`.....;.V..(
<<< skipped >>>
GET /news/banner_proxy.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:17 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Mon, 06 May 2013 09:49:27 GMT
ETag: "139d7-4dc099dcb37c0"
Accept-Ranges: bytes
Content-Length: 80343
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR...0...,.............pHYs.................gAMA....|.Q.... cHRM..z%..............u0...`..:....o._.F..9MIDATx..}w|.G..3.....%.Xr.l.%.............#............r-.w..Z .$..........*.jV....-3.?...o..W}.>"..}g...<.|....x.C@@@@@@@`.A&..E@@@@@@`.....................y1....qp..$..1....PJE/........88.n.h.E`H........h...PJ@@@.J# 0.`....y...A.!..`....D!Q.P...........p...;./..&.1.4..%..@..>.B..F@@@@@@`.ap.Ugn.&B`..!Q..L..H(.Q.#K.%A`.................cB.... W.P...$..<E.".G].........f0.4#....y)..KY...~.~A`.........a.!'..LH..c.........~.E~.~Y.=' 0w.F7. B`...!....,.(.._....|.P`.........~...-2%.(.........../..........|F\'^........yM`...............q...........5.!.........,X.#LH.....................#0..C..# .@@..# .. .x........0..&$........B`.YH.........T......................%0.L............[..# .` LH...........($.........*.........,4.<0..........<0".I@@@@@@`a..-B........X0.>0...........F@@@@@@`.A..$ .....#.x.........l.".....................O...............}...E9.....l.)...~..c........*q..W.h.......u`J}3.83...,/.......O=....o...p..(...WaCu...._.}........\.._y.....!-... j....6O.7...<....w]....i..-........M^..c,...O...w......C..O.n....fy.s...M.b....3.U..:.....<........!0.g.&$A^.<.../.."0.....Z......~..$/&8.a ....Y.....}g....H.!..6..0!.... ....i.....i6....^... 0ejb.....`?(a ....X*.".I....O..U<..............Su.6q.....R!0".I...%O^..o....l$..E`l..............`...4g...H.q8./.....#=#..iY......*.U.l..\a&.aJ.........-...2~y..)......}C....../ .7}~.;....X.|_N....
<<< skipped >>>
GET /news/lol.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:17 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Mon, 01 Jul 2013 07:58:54 GMT
ETag: "12bda-4e06e998cab80"
Accept-Ranges: bytes
Content-Length: 76762
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....H.H......Exif..MM.*.......>.........V.?.........f............Q...........Q...........Q.................z%..............................u0.......`......:........o...............C....................................................................C.......................................................................,.0.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...C..=....k..U.)4i_....L.g..J.[.....<a..c....O..7%......{..}>.td......5...B..k_...#.2_Gc..m.V.$.0;._B ......_.?h.k......-!..Pd..r..a_...wV.{{.zJ...x.VTS....{~...(..7....kM<.b......|.w,%...o?H...=..B..R.pk......k.w..|G....5K.....[t...........W.....s.h.x..o............./..i.A*.m. .m..s_.....n.Rk...:....9.w~....x........_q.E,:...q.R......?d...7...|u...c...n..%...\...Q.1..x9..u.T..<q.U[..I.Xt..j...z..b.. ..y{.....]E.....v..x.._..I.A..X..V....K).......-...k.....o.........X..ic.....J..#...UVX..M,i...=..?...7....g....Z.......u.!?j.\|.DDr..A9.......DE.Q.?]......x......N.a...&.~...GC......C....5..tUXD......:.../!..(..o.o.......OI.!.5..K..D...hQ.....:o.a.....^s..5.S...Dq.\.. ...Z.|'46.G..n...........z.#....|._P..K|1...W...>,..f
<<< skipped >>>
GET /news/ko.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:17 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 18 Apr 2013 21:51:48 GMT
ETag: "2ada3-4daa99bf9a500"
Accept-Ranges: bytes
Content-Length: 175523
Keep-Alive: timeout=5, max=89
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....H.H.....=Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS2 Windows.2013:04:19 00:38:10............................0...........,...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................V...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?.'..~...Y.>N...r.....Uvc.{...n.....e.....c..,n.(....gc4?..8.[.w.~..k7.G....9...B........YSYc.nS.$........9.......z?A..k]..mX..kj}/..@...f......l>.:..)?..V.....c...E.2.m...lc\}M...........C..{.......UNC......f.].......N....vu1.mh...?".;......o.....{=/V...nc.i~n&6u5>.i.....?..S.......1..d...._.?. R{.28.qp.}......]._}.....m..e... ..*t.-.f..U,.%.Z.. ....>.N... G...G...-....d. =.{..aM.L.w.......F....a.i..&.........5........E.cEZ.<y..Rm8gd.\.w...A.......Zjc.pxp.e....T.....`......).....>.q......Bn.l.l..H0@...R.f;j..^.M.......h...:.Ny`ul..6.I;...}.)...d..'... ick>..5....8.....`m..n.... .t..%U..........i..A-=.,$..Kd.... zt..............a..p.
<<< skipped >>>
GET /news/mangir.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:18 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 18 Apr 2013 21:55:02 GMT
ETag: "12864-4daa9a789d980"
Accept-Ranges: bytes
Content-Length: 75876
Keep-Alive: timeout=5, max=88
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....,.,.....C....................................................................C.......................................................................,.0.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..G.?. .........Zi..e......=..C.........z...~..?.......#.....QE`z.Q.G.#t5.......Z....&x.....Waqw.A;...m5....Y~YD...Y.l..s...........5......g.,..q......Si..'.vN.z]...>...?Z..O...v..~.v..o.Ui.i...Z.>.]1./....[....T...:....9......7..m........;..Kfn.......".O...!K.\g..B.A.T~.6.R......lw.<-...#....M./.6..;..^_.....R\.....L...0.dv=6...<c..ze....4{....U... ..{...`.......#.J........W.-SC....5...o.......Bdq....T'...2.5.o..#....~....u...^..#\....gEm8.=........7....]....k..b*.g.I......[.f.%e.............o...^....]._....'c^......>.......y.k-KK.....LV&)...^`.c!...s.u.....J/.x.S..k/......2[.0.Y..Z...o..4../.}.k.d...96Q}6..~...."P.On.9T..e.QW...)^.z\.h`.t.......-|].......k.........zg....f.%.y...nC [.do<:......3............b.../z.r^C....P..,.G..n?w=..N_...N.9R|.=.v.\Y.fU!G.]NS...f....j.....]Q.Mi41$.[]C....{ic.L....n.9....*>s._._a.._.<Y....0.gM^.P.5M#P....X......j..\/.9r$.....d.....P..... ....&
<<< skipped >>>
GET /news/legend-online.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:18 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:49 GMT
ETag: "2200b-4d75a65099d40"
Accept-Ranges: bytes
Content-Length: 139275
Keep-Alive: timeout=5, max=87
Connection: Keep-Alive
Content-Type: image/jpeg
......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS5 Windows.2013:02:07 21:46:53............................0...........,...........................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................V...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?....nA...j...%..z[..&.....oJ..r[.fO]...-......j.............2.J.....}7W...wq.....E&.....\..]&...7..mt...-v.P...K.....2..O...X.....nWTp.c.....ni..{.......y.S..s.........e.6 ...........;....hr.&....o...dt...Y......7.S_...U~9v.[..G......2.{?......;7..^....]O...@........k.?c..?.......N._.......]N.mo......o......S...d.r.pMv.....z..nA/.....&.x.f]]..].{...5............oJ..r[.w..*Rm.nA....O...7..V.....j[gz[.oQ/Q*U.w.S.E...^..[=....6.....7.kY.b.Y....L..-..&...n.....&.2.7..u...*.....t...._....;.....!..Kle....X..n.N'.....Yu...o8.~..|W.`......3....6.6.i~.v.....a.....S....k."...6...h/.decV.1..T..e.....%N..k....K..^V6..m.....8...s.......l........Q.... u.T.....9............(.u._.G...#.....n20..>./k..
<<< skipped >>>
GET /news/mobil-odeme.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:18 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:50 GMT
ETag: "1e984-4d75a6518df80"
Accept-Ranges: bytes
Content-Length: 125316
Keep-Alive: timeout=5, max=86
Connection: Keep-Alive
Content-Type: image/jpeg
......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS5 Windows.2013:02:11 19:56:39............................0...........,...........................................&.(.................................^.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................V...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?..D....}9.k....Y.E...6.L.............I............9..B:q.../..x.i=rK....X2..n6.:.E.9.a.k.[G......../..O.J..._Uw........g..z......7.RK..$@...G.~Y1G..b$I..}2...u.......%...[OU....a,6.Z].T...k.;..'Zo..P...e.... ...w.qo.k.z.b..#Z....4....;......]D.9_D8../..k..s..u.k$......}?..|......F!...4....6..[=.7..{..w25.......l.{.#..{]........I..2....*...h{A..{;.H...$..`.@#Pu...uL[.._E..i,s.Ike.m.....U..-..O_..G...oM....u..9.{.u ..6.....J.l.............K..=p.k.-"C=gF.....^.......~.}^........W..g0.k..V........s.m.z...w...'._...........S..qu.k]f.c..X...V..~u...=.......dcu.Z.......6...k.U....e.C:..f...).Is....k.}..2.y.9.mel...[.D..K.g....c.......X.u..M.....[cM^.....}...?....m.{.IN.K.t.....=.Om.f.....is..J..
<<< skipped >>>
GET /news/kolebot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:18 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:49 GMT
ETag: "12ea5-4d75a65099d40"
Accept-Ranges: bytes
Content-Length: 77477
Keep-Alive: timeout=5, max=85
Connection: Keep-Alive
Content-Type: image/jpeg
......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS5 Windows.2013:02:11 19:34:00............................0...........,...........................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................V...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?..)J...-kq.,.([..H$p.?!..@...$.vI)J.$s...nH.vU%...r[..RYJP.%. U%...r[..RYJP.%. U%...r[..RYJP.%. U%...r[..S..... oKz..&.x.....N.u...CK..ze....[..7K..m.n.n..k..vl.~..Xx=K..z......7............A...._}vz..t.HDUfD.....n.....b|R|.......?)..>..)z=0..........'..qz.X..Y.Ssm{n..53u/.4..5........o.....\_......m...d6.....=......Vv}%.GX.....5....,.\.kc..;w.....38pG.Sf....?....7...g.W..'..=...,.\...M.....1..E.9.mm-..Z.../.....Y..]o.T.o_ue....6..C....)eU..~....{} ./.~.Z..>..k../a..{...w...vS....I{\_..2..J._...>...?X.g...V.......vF.t....s....n...n.e6W{.....R..>..W.r..k..-.#....x...........pt...... ml-c.A;....w... ..e.w...Z........:.I zu. ...1..I..Xk6.qi...6.... .....zO.....>..}J....}.....{
<<< skipped >>>
GET /images/user_menu2.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:18 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 30 May 2012 17:58:23 GMT
ETag: "1f01-4c144b2782dc0"
Accept-Ranges: bytes
Content-Length: 7937
Keep-Alive: timeout=5, max=84
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR..............>a....DiCCPICC Profile..x...wT......l/.]."e.......H.&....KY.e..7D."...V$(b.h(. .X......"J.F........;'..N..w>.}..w......(.!.a...@.P"...f..'0....D..6.p....(.h..@_63.u.._....-.Z..[..3.....C. .K.....;.?..r!.Y...L.D...)c.#c1. ..2N.....|bO....<.G......q.....|........|.o...%.....ez6.....".%|n:..(S...l...@..}.)_.._....;G.D,HK.0..&L.gg.3.....H,.9.L...d.d.8.%.|.fY.P..............-.........d....2...A../.../ZN-..).6[.h);.h[..../..>....h...{..yI.HD.VV.....>.RV....:|..{..<K.y.k....r.Y........... .p.L.......UZ_.a..O...B...t...4..B.@"..2........*..~.k.hu..=..(....k.....I...@...B......=.i.QF....a.2.....1e2;2.....d.........t.....0....8.W..|A.... .,.\........`.(.%`.....^P..@.8...Ip.\.W.5p...C`.<...5.. ..Q!...iC...d.. w....".x(.J....Z...J.r....5@.C'.s.e.....C....;..)0....a ..{..p4..N...K.Bx3\...G.V..|.......). d... ...a#aH......H1R.."MH...\G....-...a.... &.3...,....b.1.0....u.0f...K.j`....@l.6...-.Vb..-.....Q.k.......p..x\.n.......;.......x........s..|.~'....~.?..C .....?B.AHXK.$.&.&....3D......F......u..b.q.8CR$...H.....R...t.t...L&.....d.y5..|.|.<L~KQ..R..D....r.r.r...J..R=..T.u3..z....F.&g).(..[%W#.*7 .\.(o .%.H~.|..q.>.......[...R.F......"M.F1L1[.T...e.'Jx%C%_%.R.....J#4..Gc...u.:...(.G7...3.%.....Ie%e{.......S.C..a..dd1.......T4U.T.*.T.T.T.U..z..U.U.Uo..Sc...e.mUkS{..Q7U.P.W..~A}b.}......9.....5L5"5.i...........i..<.9.........:.5.M.v..hWh..~.Tfz1..U......N..Tg.N......|.......Hz,.T...N.I}m.P.....w...,.t.......F.............-5j4.oL5.0^l\k|..g.2.4.mr..6u0M7.1.3.....f...
<<< skipped >>>
GET /images/money_calc2.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 30 May 2012 17:57:43 GMT
ETag: "1f02-4c144b015d3c0"
Accept-Ranges: bytes
Content-Length: 7938
Keep-Alive: timeout=5, max=83
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR..............>a....DiCCPICC Profile..x...wT......l/.]."e.......H.&....KY.e..7D."...V$(b.h(. .X......"J.F........;'..N..w>.}..w......(.!.a...@.P"...f..'0....D..6.p....(.h..@_63.u.._....-.Z..[..3.....C. .K.....;.?..r!.Y...L.D...)c.#c1. ..2N.....|bO....<.G......q.....|........|.o...%.....ez6.....".%|n:..(S...l...@..}.)_.._....;G.D,HK.0..&L.gg.3.....H,.9.L...d.d.8.%.|.fY.P..............-.........d....2...A../.../ZN-..).6[.h);.h[..../..>....h...{..yI.HD.VV.....>.RV....:|..{..<K.y.k....r.Y........... .p.L.......UZ_.a..O...B...t...4..B.@"..2........*..~.k.hu..=..(....k.....I...@...B......=.i.QF....a.2.....1e2;2.....d.........t.....0....8.W..|A.... .,.\........`.(.%`.....^P..@.8...Ip.\.W.5p...C`.<...5.. ..Q!...iC...d.. w....".x(.J....Z...J.r....5@.C'.s.e.....C....;..)0....a ..{..p4..N...K.Bx3\...G.V..|.......). d... ...a#aH......H1R.."MH...\G....-...a.... &.3...,....b.1.0....u.0f...K.j`....@l.6...-.Vb..-.....Q.k.......p..x\.n.......;.......x........s..|.~'....~.?..C .....?B.AHXK.$.&.&....3D......F......u..b.q.8CR$...H.....R...t.t...L&.....d.y5..|.|.<L~KQ..R..D....r.r.r...J..R=..T.u3..z....F.&g).(..[%W#.*7 .\.(o .%.H~.|..q.>.......[...R.F......"M.F1L1[.T...e.'Jx%C%_%.R.....J#4..Gc...u.:...(.G7...3.%.....Ie%e{.......S.C..a..dd1.......T4U.T.*.T.T.T.U..z..U.U.Uo..Sc...e.mUkS{..Q7U.P.W..~A}b.}......9.....5L5"5.i...........i..<.9.........:.5.M.v..hWh..~.Tfz1..U......N..Tg.N......|.......Hz,.T...N.I}m.P.....w...,.t.......F.............-5j4.oL5.0^l\k|..g.2.4.mr..6u0M7.1.3.....f...
<<< skipped >>>
GET /images/login_title_bg.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 30 May 2012 17:57:32 GMT
ETag: "30e-4c144af6dfb00"
Accept-Ranges: bytes
Content-Length: 782
Keep-Alive: timeout=5, max=82
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....H.H.....C....................................................................C.......................................................................2...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..A..?..~..Ep?.G...?.U....S.t....>.K....i........8../..Z ...>......k........n..,.i.v...??........?...........o.&..o..>....?.y......u~V....G{..y....4QEz...|.........
GET /kategori_resimleri/0410201203413726153.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:34 GMT
ETag: "3fdc-4d75a6424bb80"
Accept-Ranges: bytes
Content-Length: 16348
Keep-Alive: timeout=5, max=81
Connection: Keep-Alive
Content-Type: image/jpeg
......Exif..II*.................Ducky.......P.....]hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="64532CC2676F7D35F7DD407DCBDF400C" xmpMM:DocumentID="xmp.did:A3E119E90D5311E2AE1FF827F3F34BC0" xmpMM:InstanceID="xmp.iid:A3E119E80D5311E2AE1FF827F3F34BC0" xmp:CreatorTool="Adobe Photoshop CS6 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:68E662483E0DE211B2AEC0091037E1EE" stRef:documentID="64532CC2676F7D35F7DD407DCBDF400C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................}..................................................................................................!..1".AQa2..#u.v..Bb'.q.rW...3C...%.........................!1..A..Qa."2q.......s%...$..BRb.#3S..r...4T5..............?..o_M.|.....K.h....K.h....K.h....K.h....K.h....K.h....K.h....K.h....K.h....K.h....K.h....K.h.k..*7b.. ....T..U.H.%..f.WgK.u.."$.u...]...62..P.=.!...W.7.2..p..=.%{.Aq.(...L4L...p..b#Z....4..D(...B..W
<<< skipped >>>
GET /kategori_resimleri/1905201223504566367.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:36 GMT
ETag: "30fa-4d75a64434000"
Accept-Ranges: bytes
Content-Length: 12538
Keep-Alive: timeout=5, max=80
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.._...t]....o..j..6..&w.F..%N.#...Z..!._.x._...M.nm/.<k.]....|.....pFH=....T.-......d1..9S'ND...z..5..`.k:..6.w.S..5....Y.....T.9.....o.<S..s.....7,..}.r.....5....fa....ns) ..\...)n..,......../.7s#9..$....a%.gs8Q.N./.2j..#..z...l.yo.Y...P...m.F..... ...[#48B..Y..d.g.....%.....j.:.. I=..".z..E-.......8D.4V..w.z..~3.......w...... J...r6...w.<v4.6Il.\*..G..........#.....#..n......y7G&3.j_..UT[#9Q.vF'.Q../...qe..K..m}Vi-4..f.....c.B..C...0G5........x.3....o.:..s..lt..w...|...1..i[.V.,.F$.fH..A.....29....i..ZG.O.&...U.....O.........;.Ac..n.......I..h,...A../..=.T.a.e.E7...{...c.C.j.... ...a.;.....i6...q....s]...^.[..?5...7.$Y.c.O......d~...V.L[.V.i.t .... .H.\n........R...._."..~.b...#h.?....z..,]L%Y78.yy~.V...J5b.h...|e..~!7.\A$...l....~1]..-....u8l......H....<d....s..~.:?.o.....6.j..y....|..P.Ww..nea.....5.?....W.[i>.]>Khm.......9...".(?6.c.3.y..B...F.....>..z=...._....^..Svq........
<<< skipped >>>
GET /kategori_resimleri/1808201309193459399.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Sun, 18 Aug 2013 06:19:34 GMT
ETag: "1da1-4e432ceb04980"
Accept-Ranges: bytes
Content-Length: 7585
Keep-Alive: timeout=5, max=79
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......(...(...(...(...(...(...|i.<....'.g..."....n/..~0...4.?....i..cW.... .>...b..p...u..9W)_.?.A..,.........=B.o.>*.Y.m.d...|.. 90....:...2a..-..f.^......o....[.f.....|>.&.....a..fK..H.(.K..N....{.....Xn.~...[?....g.F..>6.%......Ci4.....n.m...:.0.....,.W....C...#o.~*.F......Zi......h....Z......~..)...fW..S...).sD....v.>1...d......m..N....O.....UnSR....jP..}.. .*x.R.....G.'.$..?.OO......m.MWF......Z..GX..K8`ml#...q6.$."...................x'...C...].M...)$. ...).....P.5.o.m..{....B.-O.......c.\^Lp.P..\.F..DU.qUG..c. .\...'....l...k6.E..!.......-;C..E..1cj....0Y...<.....7j>5..%.-.L.g. .h~....$.B.9.s,%....p.=<......dn<..#..d/G.....k.5...V..M...?I...G...._...#]L<.i..T...$.S....(.,.Rr.g.....9T...*...z...-M...%....%.8.c.I...........W.R.P...$....Td.$.........t..%N....go....-.Kq.x^e[.O.#....W.{..b........(....'...h..O..i.,...[.....V........9.......d'.....>....'.........:.
<<< skipped >>>
GET /kategori_resimleri/1905201223513775728.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:37 GMT
ETag: "19ff-4d75a64528240"
Accept-Ranges: bytes
Content-Length: 6655
Keep-Alive: timeout=5, max=78
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....3...QE..S@...4..N)<...@.QLI..~...(....E.P.E.P.E.P.E.P.E.P.E.P.1...U.....9....h..^].T~.....>.j.3....n...U..........2... .......%9(E].*.....U. vz<..5c.8.._5~...W..?.n..6...]s......V.kw....[ue...FR} ............T.6..|2.1......h........{v.f.....g...-}3.....:4{o...._.5.'.:g.4X.;._.xv.K.....s{3K<..a........D.T.<.M7...C...OS2....5..'./.%..,../....?.o./..1>]..=..o .."...........'.<_......o.v&L{..`...|.....(|..u}bs..s.[.D...HJ... ..`=.tW..&.a8..]..BH....O~..^......F._V.....S.9....(...w........|s..|R....Y.7....5..H..l.g.o....?|W....o.._..I;....<q.M......H>..c . ...-?i....!.R...\....y...\.._.x;....W.t..x.O.[tZ..W.x....!... ...~.YA....D8..7.VR.i'.....N.....V.Cqkp..h.I...V^......q&...Ooj.N.> ..8e...........Y...~.k7._.s.W....!lc..q...n..O........x......]{./6....Gm..._H..E.u.......o.e.\). ."..m...........}nK..\.N..,...............3.>.%xG..(...(...(...(...(.......rzt....*w..}._.
<<< skipped >>>
GET /kategori_resimleri/2111201219225210036.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:40 GMT
ETag: "1f99-4d75a64804900"
Accept-Ranges: bytes
Content-Length: 8089
Keep-Alive: timeout=5, max=77
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...u%.;{..%.....1M|.9.c........>&.v.]O.kgD.A%..A.x..89.^.........J7J.[I}...fnQ.....E9?.].&8...=?.=............Aq..........O......F.xo......~....k. ........r.....[...K...............^(.....z..........][..h.....Hc....-glga.8p..=.k...I'.! ..,.'.'s..Zu[.*...BQ_{V8....X.a....V.....O.h?.?...U:..C...~Q..Z...=.....Z...TrJ.&....R.@'..G1 n..S......?..j........ ).b....V...k.p...S..2Znv('.....s2.A......2).|.N..?s....'.......g08 .......M.....;P....Y..GOJRX.d~T....7...Q.1x[<..MP.......)lP...e....V.x=..YR.A.....K.FH..j.E1<.....h.QRjv..g.....|........*.RO.By.....>..).&..O....<~.xg.....!...b..n..4.cG..R..c\.{..g.d?.:....A..D..H~.?..3. [....................)......$... .x......o.S.8b..RPZ..V<GB...|L..:...%v<Vn..c.'.@......f.}1F.e..x.=..|U. ..B\......z.n..|r#...0k........tc.,..s]..F..1..............#.,...f....-..x.H.~....5...m.I.......fW.X}...X....c.s.\..._....e..z.g.?{..,..?..?.......}>..7..dO...
<<< skipped >>>
GET /kategori_resimleri/2912201415004395446.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Mon, 29 Dec 2014 13:00:43 GMT
ETag: "a03e-50b5a76576738"
Accept-Ranges: bytes
Content-Length: 41022
Keep-Alive: timeout=5, max=76
Connection: Keep-Alive
Content-Type: image/jpeg
......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS6 (Windows).2014:12:28 18:50:40..........................,...........,...........................................&.(.........................................H.......H..........Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?...=.}........I.H.S$............$......?z[....L.J_{..x..o....2I)}.........~....X.......i..Q]....p....1.....w.'.J........~v..V9.....E>..."Jsw..........$......?z[....L.J_{..x..o....2I)}.........~..$.......{....2C........}#.L..H.S$.$.I)I$.JRI$..v...OO...x....i.{......Uzg.......7.y.XE......u99.>.^.M.o.d..........g......h......R ...Oa.R*...../]...1.=.el..{.kZ.....k......s0.X.0.i.c..u.6.......n.n....[...z.6fQ..`e.}JO........!.X....D.....PA..i......#.o...".:.@...l......}'?....o......._.l..).t.I%)$.IJHr.C........}#.L..H.S$.$.I)I$.JRI$..v...OO...x....aW...OO...x....a.<...$}Q..D.@1.ns...i.....o{~......^.........\..].......O.u.......................A.....$P.....L..U.lv...n74......@..!.fG.o.
<<< skipped >>>
GET /kategori_resimleri/2507201314442430099.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 25 Jul 2013 11:44:24 GMT
ETag: "4d3e-4e2548c311600"
Accept-Ranges: bytes
Content-Length: 19774
Keep-Alive: timeout=5, max=75
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....f..jZ...}..<.1.#l.....Z.....&..-..[...pbS..2=:w........$..gp...H.y.v....5.E...s....?J..x.....m<...?..&.....o.s...........tQ.........w......~..d... .s...<.....?5.b..Ff.Q....h...w.........~....4..|A.5.^.c......2.>.c..........!.1.&...&.F^..m..\......g..L..g..4[.7...}.J.GU...&....q.{.Bw.4A.(.-nw=.q..]@.......8#mz..............^..V1.M'....g ..P. ...~.*o............~...4.o.ac..VKi%...D..H...>^..U.\ ..?..=....|W......oG..R..<..........n...N:......).....t...\.....>.<..e.4.7R......E..>{.......R.....L...R{e.m...&.......o....w."^....C_Mk..............^y........~..S...<Qes....z.......#4.m4/p.*......s....xs........^$.V...@7\.....tbQ.....p....6........9.3...\..h..6y.\..e..P.8..{5........N...J...`......3J..>.@...p>.K......g$.V.........?6\..c.../......~.?...........7.~.uw<....]-...IB.6d....>A...E.`.F.{s......#ox..M_^.t;k..X......B.*L..u.~PO.n.4....V.Ki..a....q.F)..9}.?..
<<< skipped >>>
GET /kategori_resimleri/1401201317452388406.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:36 GMT
ETag: "2c54-4d75a64434000"
Accept-Ranges: bytes
Content-Length: 11348
Keep-Alive: timeout=5, max=74
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......g{.T...EJ.d......Ak........S.m. ....\...Z..K..=7....i.....}......O.....>....^....um*{....w&.q,...%..L.${..........)b......w..i..\..E...e....Z..|..>..`.....,U.P.Ay....x.sL.*.......cF...Egf...6.$.z$8Q.|.Wg.g...!....Ss(.I'..k..c.O.......o...O....v......]J_....#..i.Z..$....XD...,.Y~3..t..|=.=... ..)....it......&...T.../.WGfU..#...H...)...,.V.l}.a.T..a8.N6n5$....4.^....I.-%...Z....R9.L...h.D...C......x/X.e.mg.~".n.}{...i....m...'d.'.....2..d.j......Iic.x......2..8%A....5........v....=S1..W!7..~O....%.d..&.... .t]k.............mko..H...hE..U^.Sn...q.z.R.=o.=?...=J.q'....../.d.........gp.M......7R....y.......v2D.....p.8.k9ciX...e...8..U..F...o?MJ.._.2.~O.....?.'..j.."...?.5....>o.&.<..H...N.S.F}.u....M..>Hr..Y....nN.$..d...G.$......R>........[3....q..........i.}...p..Z.^J......e\.q...x...\e[.g?v.w.~;...'.d..........?..M.-..&..b..\).<f&..^..{z..5..x'\....Z....V.L...l%..bF@V.T1=..r.
<<< skipped >>>
GET /kategori_resimleri/1905201223511036852.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:37 GMT
ETag: "1425-4d75a64528240"
Accept-Ranges: bytes
Content-Length: 5157
Keep-Alive: timeout=5, max=73
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...#`..z..?.P..(...:[...|4o.I...H]kY.<W.....;.$v.=GU....VK{T..2;`".F......v...........r....Cu...,.4...{P..2.[qD...<..C$|...~....=?....v..o.|M..b.k...h>5.........IM>....t.F@..mv...V.v...V.v.M........jb)J...Qi?F...EG...''5%is.(...(...(...(...(...(...(...(.............G..1..:.....X..-.]."Ckj....<.G...~z..s|g..O....|a.|?.(u_..._.x......C..* ..L.....oh..kc..H.......9o.U....f...KN...}\..7^Y .0.t..=.[.^.a.}...|......./~>|R.....O.,...W..../...m....l...V..-.w.[...xi...ey..b)F...*q..]I. .u.......m......]......'9"&c.s.3.k........ .z.....^%.th,.....,.n.b.)6..S../..N..d.x.9bG......i...O...K..........k......2.f.0... |..Bx....v?.g.../.....y.|y..?./.>!....t; .t......8...!GY.)m....$y.p4).U.).....OU..74./=..a......K.(S.....{ ..'......._...l...... Z..J.U.'..V7.w.V.Q.p.f......G,....uir....>........A....|`..?.,.1'.z......hU....-.....D......>...o.,'.K
<<< skipped >>>
GET /kategori_resimleri/1905201223521968642.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:38 GMT
ETag: "23c2-4d75a6461c480"
Accept-Ranges: bytes
Content-Length: 9154
Keep-Alive: timeout=5, max=72
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......d...... TU26.QH..P.b2O4.M.u.Z...........<6...........H..n......3..Q..}VG...5..G.E.o..'..\.d.8.=......{.>Fb.*.w1.{......q..."....1...<.q..n..L.3...g..Fv1...s.J..nm.8.......a.X.R.ax.......%..S$...'?hC......4...3wdB.......8....e.}Um.-....!.......@y.0 ..u.>3....f7V...u=%B.6......y....9......e...Ok..>,t%.,%......} ....WK..1..1.~f.=..>.v..}..c...p?....D..O..../.R.y.y.........n...Ip......a..o.w3..d.......*.3..,K_w...8.T.'.O.%...Q...h.u.4(..8.Hz.J. ..u.......2^...C.H.a.N.l..`...a...i.I...........H...a...k..................v.;jZ.........."<.5...No....C..{...2...[.._....>....".......c,...;.(..!..8.O.}..i..~..?.H.(l-.....q$6..@<..s.k........>...~.._..C.G.=K...e.,....e.O)m..HVF|..V.`....o../.xv..Y...x.>@.)...W....pTUWY.....1.6 5.iF4.(E...?.>..........o._.p@."`..?6...k.....%..._w.......$\..s.?._X|w......5;....k..8Q...=3_..s......[k.#....p7e....`/O..FWg...5....K..d|....=..H
<<< skipped >>>
GET /kategori_resimleri/2607201316023564419.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Fri, 26 Jul 2013 13:02:35 GMT
ETag: "1068-4e269c1a370c0"
Accept-Ranges: bytes
Content-Length: 4200
Keep-Alive: timeout=5, max=71
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....F.u....l.Q@..F.u....l.Q@..F.u....l.Q@..F.u....l.Q@..F.u....l.Q@..F.u....l.Q@..E:..(...(...(...(...(...(...(.'..........G..../.._.f...e.. {.cW....Kg.... E....yS.BmQ.n ....e....?...?d....?..imog..._6...o0..0.....FVV......\!.........6.VR...%..QE..QE..QE..QE....(...Q@......W..5....^........l.g.h...^...r#.%gl*.......C...L..;..........4x.A. k..KR.V.kic.......D...@...x........e~...<).k.....5....n.......N......X.HJ.0 ...."...~._.>.....E.......kU.".:......~....<.;...6............<i....!.F..?.k~.......a..qe....F.dR..e!w........g.....%.F.......X..[.l|A..i.2...*.2 .$...d......\.{...w....._....|H...}n...R.....yR..|..`...RA...@..lnk..K_.g.....~.?.l!....7..>....H.E.-...GTU....I..x=... ...Y..^..o.MS.x.....].....^.........#.!UUA$............<Q..jZo....P............\...$GXJ...A.....y?...:.../.z... ........izU.N...2.H.R.(%..H.............K.{....... .rX..vz..................V$.P]..x..{............|.
<<< skipped >>>
GET /kategori_resimleri/2612201216414968119.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:41 GMT
ETag: "3fd3-4d75a648f8b40"
Accept-Ranges: bytes
Content-Length: 16339
Keep-Alive: timeout=5, max=70
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..m.w..}WF...n.lg..b8 ...Fj........-......7.N.....O.......~....ZX.o.t.n]..R70U...z).H.../.......u....q.K..%..R....".f........eQO<VX...r......(...}....m..tTK8..f.$U. ._j...(`*..b....W.Z..>..5..^BR...........dm...?.........x_....m2_.-J.15..L.....?w...zyNG..VT...~kn....x....r.YY#._.?./.?g.....O. .M.kl)m..Gn..........{...4~SJ..............5..[.CZ...c.."...B..F..;..8.P...............O.....[H.;X.4....q.i'$.z...... ,.ja..U.............H-.V....n...3...S.<u5..x...[...vH.)..2>...Urr{pz.^<....5..J.O......x...._#..:.#...?...<..>.=........=.o........-...N..$..$W....L4....;...}.......s.|d.g........#5.H....h....e.q.~Q...[|Ao...~..$$.j`Gt....[.W..W.W....".r~.....t...{..=....=wb\....%I...W./............*..mKS.#.....|.X....?......6..o..... .J.C.{.C%..#.x....$o..........h..s}..s..@@2H..I..1..~..o...#.......m....h>. .".7.$gf..0...;s_EE.].7...W.^.........o..........."...QQ...BC..6.l...b.a..Q.,r.vcR
<<< skipped >>>
GET /kategori_resimleri/3001201315163166106.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:41 GMT
ETag: "247a-4d75a648f8b40"
Accept-Ranges: bytes
Content-Length: 9338
Keep-Alive: timeout=5, max=69
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......^.....7..b.o..v...t=n=.I..$..2Tz) ...8.}.......g.......a...>.%.........-....9.~....{.~..$.}.Vwa(...9n...C'.d...y.....G.w...1.W.a.m..NZ...y......n..k..........._.........FR.......k.[.........{.Cn....&........,n-V6.....i..L?d........&...*.[o.lu........'.....LR.x.U._/C.*..k.q-(*..[...(Ik..............s.zw........?!G..Z.v..=..y....A.T...._l|.A..}*E...N..R/...BI...*u....*...Q.|....i.w......be.. ..Q.o.H>.."dI.SOO.L......"].S........>..jH~..%...i...`...>...$...RG....F:........J.C..p})..?Zb}......j..>......HG..Z..wmo..5...c.....k..."...c.7...JV......"..jv.....o B.,..Wh......#.cM...E...M...n.>.cVY........,x.^.....b..6..p._]^..V.o4.....G....p..8.4..\'.r.X..Z..k'. ......d.Lq4...D..W..NI.7..m.K..C....d._.........4.I.......m....?Z..8J.:.......Q....i...)...t.W7....:SX.......i........S.j.....!....V.{qk.I...4.A[k.\D.<....@....n...j...o..:e....7.......#,Kn&..R.e9..h... .8......TM{j...i..U.v.
<<< skipped >>>
GET /kategori_resimleri/1704201314533078331.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 17 Apr 2013 11:53:30 GMT
ETag: "39b4-4da8d22724280"
Accept-Ranges: bytes
Content-Length: 14772
Keep-Alive: timeout=5, max=68
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..u..........Tz/.o.....U........J; o._.w..........@P.$........I.. .s.O W.. ......}.....x.....6..@.....d..8.;X.../. .S...\.uTa....h..6~..58>0x.y..-?L.>5...F#/q.M..b.,1....l.-.o...|....?.|K......^Xkz..o..@.c..s,.).V}..R..$y........9..:.G..#...n%.<?ic;...>......g9....Z....]|w..[....O.jf;...).......Li.:....:.8..|. 1...d.....G._/.....-w....?.?.?....h..x.........Y.wh%.i#.K.-rd.I...k.H._Xx..J.-..v.|5.......Q...sP.o...&..Yc.H. ..[..2...9............n...5..k......0C.6.F..W.}.....i..wvVWZo..}/K.o.U...........B.....I.nrI.&....![.<...EIEu.z.;...>EG...Zx.F3w........~...F.....h..V..y.iO..,#.f.:X.B.(..:L...fX..(.%.X..s.'.I.x.....e...c...~..zn.5......};.`..mE....[.i.B#.......| c7.....Z6.s......8...} yN...M....r...V_.5...8..n.._..^..k~...M#VMEG....N.,...,.. ...?..v....V.Y......v..}U.......'.F.=KJRM....Yz...i.!.q.......xk._.....s..._......P..n.icc...2b..D..]...98........?...a.......js'..o...../..M.Vk.
<<< skipped >>>
GET /kategori_resimleri/1905201223521133576.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:38 GMT
ETag: "261d-4d75a6461c480"
Accept-Ranges: bytes
Content-Length: 9757
Keep-Alive: timeout=5, max=67
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...-.....S[.]>..s...p....-.$.q"3.........[.j..qT..NV=...Q.z.....V..2.....]$..hP..zTU....Y..N.* ....W..s.=E2I....P..X......7.......s....W.F~^k..<a..l.1....j........O<.m...KY3..cN...._x.Zg....u...\..p..=A...........C....;T...$..g.z....o.Z..|w....g.O.@M......|...=S.|w.r7Ek......W.i^'.m..9.........OJ...........zu.G.\....4x....'.t}C.|M...................I..$.....]...P....z.^V3.%.z........=.u-.#..[...9.6.>%.2.2...tZW...o.........N.L.:9.:.r...FH.sNG.9..<.}....:.....Dg..%..............Q,....Gz....V.|.Q..y;.. Z8J.....W.N...c..)A.p^...o.../.N1...J.l........_.R..E`...U^...|X........^-.._.Im.-.HR..!..R.aS.w....~..z.. ..................m.Ew.kr|.....b.....G...9.l.F.77 k....Wq.. ...c..=K..n..<Ml....I$d.k....?x.;.x.S.W.=5Xc.g#>.~.^....ZM....g..8`..3..O.FppA...Ep7........i.Q....2d.t=.......{.*X.n.ui.'.....F\..^...*....u9Q.......b.2.......&...=......'....'.Eq~ .1.5..;.7..3...y.~Q%U.......8.^.viE.\x
<<< skipped >>>
GET /kategori_resimleri/1905201223524825628.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:38 GMT
ETag: "f67-4d75a6461c480"
Accept-Ranges: bytes
Content-Length: 3943
Keep-Alive: timeout=5, max=66
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......(...(...(...(...(...(...(...(...(...(...(...(...(...(..H .P.E~.~.?.k...g.g..U...Z...x.N.U.......E4k"#I).>..!v..g.z.......oA./u-G....l..w...&.l..$.......".?.j.....V%.......4P3..._...7......]...O.xc..9.....x.=...Em....0$..>\a.H....nO.W.....?................\E..1m....."wU...$.lY.....4...G...R.e....Oq.LG..]....w.M..}.....z..|.kp.1jz..Z....1.[........UU.a.......................E.......?..~...~:xO...5.5..>....7>S....r.M'..H... ..e....?7..#.(......@..Q@..Q@..Q@..Q@..Q@..Q@..n z.E.~.......|W...#G.uK.| ......[e.l...%.....r..v...._u.....<m.K~.^)...|Ai.....7..qI... 2..S....Y..3..W.._z...(...V...'.O...:^.u)_.x..m.h7...%...e3...C.....#i.@=.....O......W.o....u;....h.\z....k....2.'...rW..O.....K.......M.........vu ]%.Ia..Y.=.c,h......O.H.k.|..7...OM....P.P.]N..aqt.QH..9m. $.....0..>6....W...;.A...}..m..P........}.......?d....V...a...x....v.S....G.B.d.v.7.N."..e..._......zP....9....(...(...(.
<<< skipped >>>
GET /kategori_resimleri/2612201216563244805.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:41 GMT
ETag: "191f-4d75a648f8b40"
Accept-Ranges: bytes
Content-Length: 6431
Keep-Alive: timeout=5, max=65
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....h..jZ(...e..n.4n.5-.]..e..n.4n.5-....v.]..E...........z.......{.7{..x....Z.......{..M...=.\..s..'...z...K.....O..J.....q_....@...Z......o...t....[..^ ..9....p..$.9.E.....f..._.~..jp.7d.: n.p2y..9.*.eF......|...2...&....: ..._u.zfy..&..".}..*X...v...M5{/..w..w..Kc..w.. ..v_r"..h..jM....8.4]..e....4n.5.}..4]..e.....9..J..I"..3"........I'.......w............(.QE..Vg..I4]... k..m".d......r#R....d..5.PN...`....../.)l\..M...~x...g...T......;..).....j....Y....`Eu>.....|,.^..M...O.|.....d..u.w....C.....?.W../....O.O..Gi.kx...WlBCvH..N....S.......U..E.YD...8.5..e.........M:..\..g.._.T...U.....m.k}........|].>5.N.]........h.L.3.........d......'...u.*.AQ~...}I...'...eP?.2H..=..G.. ....i.X\Eyey.M..0d..C..u......8.>.4~%.?..S............$.k..4j.I..._.QO...e?.E..RO.x.....,.F.y.M..*C...W95.>>....0.V..=v.;..E.{.....q..os...O....K~....U..S...$..P.d.,]...e...b.?.b.I..3...r..p.xd...]...#..W...>n...
<<< skipped >>>
GET /images/resim_yok.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 30 May 2012 17:57:56 GMT
ETag: "3700-4c144b0dc3100"
Accept-Ranges: bytes
Content-Length: 14080
Keep-Alive: timeout=5, max=64
Connection: Keep-Alive
Content-Type: image/jpeg
.....3Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................z..'....z..'.Adobe Photoshop CS5 Windows.2012:05:10 04:59:59............................d...........d...........................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................d.d.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?....I%)$.IJI$.R.I$...I%)$.IJI$.S.....I%)$3s."..L.......$.IJI%.U...3.).I$...I$.$.I).....I%5...N.uO\....).....L..x...fI>..e.5.{.*- 5.N.*a.T....$...H5......I..@. ....H..=..)f.q.9L.,v..a;>.......II($.......O..%)$.IO.....I%1...tk.[..tG..DH....)p...<.4....P'k\...9......RRQS..5Q>..~......#Y...k.ZO.JN `2......s..%.s.I..T..Z.....I%)$.IO.....I%)$.IM{..c...9j..k....9.p.......O`.H.Fm,i.O.#SK.k<.........mk.......I$.$.I).....I%)$.IJI$.R.I$...I%)$.IJI$.S......I$..T..I$..T..I$..T..I$..T..I$..T..I$..T..I$.......Photoshop 3.0.8BIM.%......................8BIM.:....................printOutput........ClrSenum....ClrS....RGBC....Inteenum....Inte....Clrm....MpBlbool.....printSixteenBitbool.....pr
<<< skipped >>>
GET /kategori_resimleri/1905201223515582277.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:21 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:38 GMT
ETag: "1b10-4d75a6461c480"
Accept-Ranges: bytes
Content-Length: 6928
Keep-Alive: timeout=5, max=63
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...(...(...(...(...(...(....8]...r:W........O...5o......;..*E.O.>&..t...*$..........s....I#....lV.....V..c.m.%....A.J.M...qQ_..7.O..*.w..7......2-...tx.T#.k'R...2...j......l....B.4..^....t.:..."xk.q^...^{8.......>...8..9.F ...'.....>....r.I.{.%..y...\.1...FK..i..i...<Z...n.._.........4.KYX.......K9nvn.......g8= .....h..7.g.......x......i..4.._...x.{..%.)J........@.c<.y..e..... *.N.[^...g.7._.?g........TW.?...go.*%...~.?.,....|$....q..>....._.P....G...O.....|.ia.&.to..K.l...P.N.v.v....K.F.......G!..EU7...1.<t....J..C~Bl.EUI.h.5.....~..W......h^...Q.......2.N..2.b..3.)..gKEyF..o..............E.(`.e..J....%$.$..$.^...$g......E@..G'..;.I..%.........m....1....&..6.Z.....?....u..@..VW...k.....Gm.x{.w...W.$[...$.....N.8.,..O.....=*......M[.b.l....Y......C.../.........0...&....-....Z.&..F.r.B...|.t....E...gk.CF2I...Cj....}R....Mw$....h.T.......k.F..5\.^ .o..|.*.G..\.
<<< skipped >>>
GET /kategori_resimleri/2711201416455506613.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:21 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 27 Nov 2014 16:45:55 GMT
ETag: "22c3-508d9e0be9890"
Accept-Ranges: bytes
Content-Length: 8899
Keep-Alive: timeout=5, max=62
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..........V5...5^......>ECE.i..)^=....*..RH..........9.s.....R..V}..No.6..(...(...PqIE.K...AFe.....e....^=. "...`..y.............0..r....n........A... ..P7f...yy.....S.......o...E;.>...Q.........ji].....7..7..E.?...2f.E..QE.....].K.@...~u.U...%..@.%;.\.)I.%..$Q...He(..$..N.............N.(..##.}j.:f`..Umd..'....|.~s.@.n.D.`~UU.-O..3...T....K.J.).M...;..J2i(.(...)GZJr.h.{.......c8.......`..=?*..P....Y....H.h.T.BX.:....$|.c.....S....#..P..~....I@..Q@.@..f..]..zUEm..y....c..1.(...R.m....(...3.(...r.....<....P...|.nM...Q.@..Q@..Q@.*..@\....Z...Ni...9.\.~Rt9.._... p8.OJ[...z..8...]....}.P..NF....@.......x.GE.=zR....J7}(.=i(...(...(...(...(...(...*f..;S.$P.(.#i....(...(...(...(.....Q@..2...M%......(...(...(....".;...............J(...(...(.....(...(.b...y'.MH]..3.I..._.xjO.x..L...{:@.z)c.k.....rx..;|...s.....4.[lQ....i..9...<..C....R.jK....Y../..X...~~..7 ......b.!....4.E.f..h..LA....-..G...s\...#
<<< skipped >>>
GET /kategori_resimleri/2304201312020112115.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:21 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Tue, 23 Apr 2013 09:02:01 GMT
ETag: "3a0b-4db037038d440"
Accept-Ranges: bytes
Content-Length: 14859
Keep-Alive: timeout=5, max=61
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..J.........._P.'.|.....E[...e..8.....t??N..1............R.9..<...SM0yc.3..x*.Q.j.....S..~$_..IK...s!-.W-.......i....N...........SG..R.gT/)S ,QA.`....#U'..g.L:.As.$d.......g.W..W.O.x...@.<k..o..KW.eHl..T..7V.Y.H$..IF..."..J..T....os..R....K..:...?|A.<..|6.5o).................d.Dv.&G.F3........XJ.._~...............O......h...]Gim.K.\.d........8...=A......Ku..wE:.!.X<S....*...".<..-..~....1z.U.|..?.'........n......Wi...X..!..6|......a...)/.&r.'..>3B.......O...; ...M}b`...6....?S^!.....#.......z..>-.jo5...3.....!Z.Qd9{...V.r_n.......i .......qSvI5..,._..'...O.] @.......X........#....A/,6.....Ab...9`x.{.. ..u..5........*!.5-s.f...V..v.....9......q_X.2.S.|&.nb...u.kT"]o....v..).?y<...?...d0....d.....j. ..@..s..z.5.,...gR...g..*.^.7.|...M.?........O....5..i.w..4.].[..-..."..(.a]....$1lW....|I?....'.u.........^K(o.`....La....u. ...I..\....%......H..@..z.<....R........l ...0.&.z.i..
<<< skipped >>>
GET /kategori_resimleri/1905201223530066246.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:21 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:39 GMT
ETag: "31e5-4d75a647106c0"
Accept-Ranges: bytes
Content-Length: 12773
Keep-Alive: timeout=5, max=60
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....'...?..A..y. h......usa1xS#.....0n..U.p.G?w~..<.g.~....!..*..u.....RI....b...1...>6..m..]._I|.%<.....W'........?...O..X.....Z.K...2*....PpJ.0GJ...8..\..1..'....~..s....|..uM7[.F......w........v.?&0q.W.|............n.g.*....ehfe..P.(.....c..x.......i. .0..h..Zq..!f9?.I ....|....x.^.S.._..?Kh..>....6...|...H..B.<G<..yc._....,......;.9....[.{.lj..Rk.n...:.X.....NI...c.d.\...;.1..?.w...j............G.>;.na&.n..G..~.U.}..:`.~x..._.D.'s._._\...........w...q..;....z7..c.i.i.......ob.,..yTeR....88.gS...v.}..,..>OQ...}./ig$.$.....5....;.... ...-.x...V.kZ..cn..`..5.L.J...4.6.......O.... ....4..k>..}...}.]..W.....J...W....t.......?....6|C........D.....Z..!......v.c.9.Syy......u....._.../....$z-.k?..h4.]J._5...c.p..'6........'5.....>y.'.~w...Hb^.. ....;..%....w>4..|;}.....~..qxNH....o.G....{p64.....t..i.$t..* .>...b'.....j.....<....mb..U.......C..f.c....>b9.....2._.?
<<< skipped >>>
GET /kategori_resimleri/1905201223514964638.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:21 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:37 GMT
ETag: "2ae7-4d75a64528240"
Accept-Ranges: bytes
Content-Length: 10983
Keep-Alive: timeout=5, max=59
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..rl...p..I.]....:G.5K..IuI... .#,.E.b@..I!...d.1.. ....M~.B.....M.YvD..R..4.H.K3}..~......E...B..E....6.....:...Z..Y.4.W. .$...gO.uc.f}.`.<..~...|m{a....R..%eq.i...........(.......u./FS.op{.z.....'I..qZ..._.....$..BB.....'..,....Y...t.&.P.e.M..qk.]...|..\H.'..a....}..qrJ?.....7c..`.....*Y.3..M...6....q ........k..G.C..i.........'.=.Y..5...u.Zm.7c..>....@..*....]..,...n.e......R.v=EJ.`..F..<.N.{........Wo.] ........*..". .#..d.'..=>.s.^.Imd..H..F...Up.....I7:...!q..C..;...W.y.......N.4....)n...-.0<......(... .Mw_.......j...m....9U......L.)r.5@.rr... ..HS.*..W....Ce..e!...9.`......V.O .<Wi..~;..E.\.....,.qrc1=.{.?fT.lx.l..!...#..t.la.dK...f.....f..qS......d..T...k.M.v...~.[.f.j0...h.^c..s....J.`........|k.i...|?*G..?Y....{...`.. ....r..q...X.s.. ..Z.....y.'......76.R...F.`T...A......%........n........pQ........c..5...W.R.WK"....f...z......m{..H.Eh...lN..P..!...#..\v.{q.i.4....q.4ALf-.
<<< skipped >>>
GET /kategori_resimleri/0606201219555996174.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:21 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:35 GMT
ETag: "1e73-4d75a6433fdc0"
Accept-Ranges: bytes
Content-Length: 7795
Keep-Alive: timeout=5, max=58
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..... ......N('....M...;..$..j...p o...Z.........l.W...........Y...B...Mm.~..5.H......E!....Z\.Z(.d...[`8.l.n..y.pb..w..p....R.!<.7.......N.( ...w..*..=.\....iZ...=...\.%.n.........:...voSh..(..-....n...(l..`......5\.#..).....9... ...7.pP..'.R...h......K..N.....ii...@.Z.I}8DWbs.T.. ..w...i,.f.F......*........=G...?. .,u@.AL........n9..g...WT.|1w..I.e`!......n.vT_8...*.0p.f.k...]6.......e..)Tm{...F..{0.1...j.d{ch....Nao.K8...9..8..?.........Gi!h.l.q!-.......o ....u......o.h.S]..,-Y6f.EiK..U..G$..c........c..].......K..........s......./.. ..U..*.....=.4}......%h.....X.n.........\E<w.......&wM..h. ............mJ.k.cQ........fs.FA'.`...l.A.J.~../...a.x.L..../...kV.....]..N.2.r~.....n.m._....4.........K. .......:5..S3.....T........n<.........-.p.1.8..&.Q.M] .%....v>3.....|m4......d...I.g....I..C....?........c.On.f.,.d[.|..U......8...A.F ..l&..dh.G$.......5.8.U..#:..}......r.~.0.G.K.i...]-.....*
<<< skipped >>>
GET /kategori_resimleri/1103201404230613003.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:21 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Tue, 11 Mar 2014 02:23:06 GMT
ETag: "c430-4f44b667c7680"
Accept-Ranges: bytes
Content-Length: 50224
Keep-Alive: timeout=5, max=57
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.........................................................................B.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..6....pG.l.=.......Sw.0....?.\....k.`2>./q.v:.....RB.........._\.....f..b6..N..z{.O.......S..S..D..>a..C.5.m..~....4O.z5.]\...h....F..d..'..._.....7...4_.n.......%.D...b.|Wm#X.P.S...opz{5}i........@ ..qMJ.5Yr.=/.=....................].m..../.5_S....,....W....7...Z.qN...>mO.3.............S...`/..9.......?.j.....g....Kah.:....95D{i.>w......f]K.J6.bxz......o......;.u...E.........z.>b|.. ..._P.? Rs.A..../^...]...w...X....`.~..Z.......<.t...k.....3.X&6<.Xz..q...w..g..vA....}_.k..._e...*.......k.........D...x.._\....Z#.!. .........I$.3...{.....O...g..o.[[26..e.......v.G.M.]Y..^.a.................00...#.WYy....R...........|....3.....u..`fh.........B...u....e..p...}uq..ME.6..].Y.^...].....[..G...................?eo.@..f....b...t....<....w.._.n...?.....Tos..e...3.x.....V..8*c.....?...L...............B.^/5o.X.............s...eo...$L.cY}......6.?h....x..EQ.......u.......^.y.I>.8......
<<< skipped >>>
GET /images/Teaser_TR_240x150.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:22 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 03 Oct 2012 00:08:31 GMT
ETag: "5687-4cb1c70553dc0"
Accept-Ranges: bytes
Content-Length: 22151
Keep-Alive: timeout=5, max=56
Connection: Keep-Alive
Content-Type: image/jpeg
......Exif..II*.................Ducky.......P.....ohXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:B3F01AE0280DE211B2AEC0091037E1EE" xmpMM:DocumentID="xmp.did:ABE2777D0D4911E2A9F8BFCE0FD97DBA" xmpMM:InstanceID="xmp.iid:ABE2777C0D4911E2A9F8BFCE0FD97DBA" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:62E662483E0DE211B2AEC0091037E1EE" stRef:documentID="xmp.did:B3F01AE0280DE211B2AEC0091037E1EE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d....................................................................................................................................................................................................................................................!..1Qa"A.$..2......VWqB...#3.v..R%...b..Tdte..&f.')8.......................!..1A.Q...aq.."R.S.....2r..T.'.Bb...#s.d..5Ue&.34..%6...c.C.$............?..5...V.QJk.E.S_.-...g./l.2.5..WGfB.% ...V.8...* :...iJ.a.t...f..[i....].bOh}......T...U6..[.>.....;/.......\..}k>.,<I9............~..e...v..
<<< skipped >>>
GET /images/sonteklif.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:22 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Sat, 16 Feb 2013 12:18:13 GMT
ETag: "2ab6-4d5d67c5c8b40"
Accept-Ranges: bytes
Content-Length: 10934
Keep-Alive: timeout=5, max=55
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR...-...-.....:.......pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>
GET /images/logo_alt.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:22 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 30 May 2012 17:57:34 GMT
ETag: "1246-4c144af8c7f80"
Accept-Ranges: bytes
Content-Length: 4678
Keep-Alive: timeout=5, max=54
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR.......2.......}.....pHYs.................iCCPPhotoshop ICC profile..x.c``......$..PPTR.........~..........!1...1 .....!/?/...020|.......pY......4..\PT...p....(%.8.......CzyIA...c....HRvA...c....HvH.3..c....OIjE.....s~AeQfzF.......cJ~R.BpeqIjn..g^r~QA~QbIj..........^.......<.CSU.*...(....>.1.H.-*..%.......C%.*.....Q....2.250]b.`nd..b.2...5..*...&v...........\.\m....y.x........{._- $.Z.M..P....a.tQ^..bq...[%R$.%.JUH.J?..#.*'(wV.G.G.W.....(.%...[....4d5.j......c. ..J...|...(#KcI..&.L...0....L.....Q...c..j.......c.{]...w[...c..B....}....[..>`k...c..Cn.>.....)...m.........0;qs.....Lir.6.Q.UY......c.W/.),..]|..m.D.KEa......k....'5.k..l...:..z.`.wW{..^.>.....&...8.u....3.g...h....y..p-.[.x.....&,...xU...ku.5....`S...[..M..a...U{8...;~@.`...G..n>.~......g...=.~.......Z\[vC.f...w........#....*>..B.e.k.7uo../...S..w_..........?..U.........<.1... cHRM..z%..............u0...`..:....o._.F....IDATx...Ko............%K....~.&JXF<O.Q.....@. .`..>.Z.....UV.|.5...q..<.&.J3..f...c....,Z.H.i.(.")....n_...".h....q........9....". a.|C.&..!...HvP..*..@.F.......]......:.....?T.....l....U.....p...@V..&lh8.`....../..Y.U...'..H.......M.._..#...m.7*...v...D&P....x..t~......\....&D.,A...$..=lO...7vU.=)..e.....}D.(....?}.......l,l.............E..Q.$.....~..wv.g....d..c9.[T(3.[...j..d....P..-..=)|.(..u....}.Z.&.....V...-...t....G..Zi...q.Pt.@...i2.....d.....pha5w..}B....X..Rf.......Z...XL.9..pg"%..}..L$.2...I)..:.P./Q.z]Q..#n.<5M.l*._3p.K....<..c|......T..a0...0..<...jC.Z..c..NB1.....
<<< skipped >>>
GET / HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: onlinehile.org
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:04 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d97d3c472a8cfcbd38b32aa9eb27d7ac71420825564; expires=Sat, 09-Jan-16 17:46:04 GMT; path=/; domain=.onlinehile.org; HttpOnly
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.28
Server: cloudflare-nginx
CF-RAY: 1a6273c18e0005c9-WAW
Content-Encoding: gzip
864.............XKs.6...W...#U..<$Y..G.e ..*..[..\.&.!a....#Q....`O.y.{..rm..<4#Y..vK:h.&.......OM..E...x.1.n.......m.......\.=.pe?.......D..S.DR.*....(....vkJ!.pX.>}W...St..N...:.....?....U1....&....(....0-.........k..i.XX.&....\...7..&.jn...A...I..(.i"9.......oG2.ep&2.z.iSq..R...M.x........T.R.v..G...Xb.............t..QE..j`W........[! .A..P.UM.....#.c........T.M.....5.jY....6...@..j.......j1..;e.#...]..7|f........s.5$....f.n...7<..>.fnCP; @.\.....(K.q.e....X......F..*.#......#R.l.[k....u.G.%7.......d...I.....<........,...!..8.s*.3..d.}...@d.."(.(.}C...D.......m.<....4..R......>..../qY(.....3.T......s...s.9}.<.;xf...Q'..u...N.,q.d..GU..:.m|c..v7;...I)KR....F.[_.K:.<...jw......H...w....0n...^..zR@.L5.v:....L....N...v...t$\.. ....7cE....HF%...L...Z..7.(.. d..v...k..FN.......o..\........."V.).....r}Q..ZA...2a..;._...{.._...|.,Z*.....J8|...2.).4~...a L.*..*1...j.gR.....vP....cG]*\..?..HN?\r.......Ji.....S...u..?X.s...N*. ..DA..T..^!W._q<.J\.....W.I.jJ.j...'..../..G.xL9....U5.A.N.......Q.....k^.@..e.^........V...fe....i;c....6....._Y xC...>.9pr`.|T...j....m,..].....mD~.\...7w..S)f..WNV.A..L*...=!K.._.p...7Al..c3..ll>..{...z....Rd.R.....bXBU&I&/....o...'/.}.@1..Q..K{y.._B.3.P.4......^ws...B.......yQ.9/........&J......fwg..C,...-w.7!..........m...j....]....cf......}.Y........s.^$........;...,x.'6_.o.7.....1. .9..{...^..S..dN.O...<.q......>....J.$..W.^*.#...Y.....h.......@....R..T.U.i@[b.V. ..>......S...Q..T....t.Y.5.......z.e.>...FD.<.....*...b....."!d.......&...
<<< skipped >>>
GET /leqo/NewHorizon.css HTTP/1.1
Accept: */*
Referer: hXXp://onlinehile.org/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: onlinehile.org
Connection: Keep-Alive
Cookie: __cfduid=d97d3c472a8cfcbd38b32aa9eb27d7ac71420825564
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:05 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Sun, 30 Jun 2013 01:01:35 GMT
CF-Cache-Status: REVALIDATED
Expires: Wed, 14 Jan 2015 17:46:05 GMT
Cache-Control: public, max-age=432000
Server: cloudflare-nginx
CF-RAY: 1a6273c86fa405c9-WAW
Content-Encoding: gzip
743.............X...6...j\S.l......iw2.<$y.n.]....D@.....O.. 0.KQeSBR..>}...k.eEuJ.}I.SQ.... *.o..g.g.!...'.g?.:.J$.oJ..p]....w.t>..q..yI..T....8..}..a..JRZ....$.......U......5......>..4..Dx/..3.$...<.......x....hQ. N(q.MyCD. .ZQX... ..v......&}..y..k7..'...w..z.......w.'.... ..8..EQJq;...._h......}...=.....5I..^T....Z..1....5..[9...19.vm..?./J..1J......k........l.M4.gM.......6.P.i9 2g......\...._6.).F.B.R.)C.;Nc.8.......gt..> ......x...9B...p.=:.d<'..\q8.$...d...]Zd.y..hA.....5.m.?...[...{.M.. ....0|..8I.^....kZ.yNY.g{.../...^).2d.:..q1(=:m.FPb...b.0..X..W.A$qo>.%m..._......."x/..-.......[...X.;..k..H.Q.Z:#....9E.....K.$!.....SCs.k@j....W...g.U.....h..}....|1........g..t.u..z.?...]`3..Y........h...JeUF....a(s.....Yf...Qq\Tu'."..S/.`.....u..J.1..=.......s..<......2.N3}a.e4.oa.[M..AH..C.\.T.@.H..>.ba............DH0.......R...$.E.[ .t.A!..d.X.`@'\e..m`.q.%.Lf(.....E.(..oYo0.f...1>{H..H....q.$I.@...>K.V....R....].9.2...Z....._....=x.bd....lp...5o..s4.A...2.,;V.-......^Q............@9.^.r.`..3.A..R...=.......kuLBPk.Sq.d.1..1.C....U.Y.;x7..nm......'.!B.,.X`..8.........B..]..i.^n..xE...d..m..E.~..4.d.f4.W-hH...&9g7S....KlR&.XA....J...rNto ..FB.~...FG9...Y.a.B.h.....*03.]].&%...5..w.........W.kf.f.E.Ojs..#;AmD..cQ .1oc0.sc........S....(3'..w...:y..!.bz.tA...t.2.......C..9:U..e9..$..n'5#..(8...i.(3=o9..Q..(.<.-...t.Wm...i..e.bJ..t=..Z..k.MD...O:...{3.].A.:IX\......'..M..c>......wY1}yb......IY..d.....%...%..U.eE..;...k.4......<..o.\...;....S.n.....y...... M..n.....O...".3 d
<<< skipped >>>
GET /leqo/footer-top.jpg HTTP/1.1
Accept: */*
Referer: hXXp://onlinehile.org/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: onlinehile.org
Connection: Keep-Alive
Cookie: __cfduid=d97d3c472a8cfcbd38b32aa9eb27d7ac71420825564
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:06 GMT
Content-Type: image/jpeg
Content-Length: 306
Connection: keep-alive
Last-Modified: Wed, 25 Jan 2012 07:19:20 GMT
ETag: "20816ae-132-4b755150b2e00"
CF-Cache-Status: REVALIDATED
Expires: Wed, 14 Jan 2015 17:46:06 GMT
Cache-Control: public, max-age=432000
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 1a6273cb205e05c9-WAW
......JFIF.....d.d......Ducky.......d......Adobe.d.................................................................................................................................................................L......................................................................................?...td......
GET /leqo/bullet.jpg HTTP/1.1
Accept: */*
Referer: hXXp://onlinehile.org/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: onlinehile.org
Connection: Keep-Alive
Cookie: __cfduid=d97d3c472a8cfcbd38b32aa9eb27d7ac71420825564
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:06 GMT
Content-Type: image/jpeg
Content-Length: 796
Connection: keep-alive
Last-Modified: Wed, 25 Jan 2012 07:19:00 GMT
ETag: "20816b6-31c-4b75513da0100"
CF-Cache-Status: REVALIDATED
Expires: Wed, 14 Jan 2015 17:46:06 GMT
Cache-Control: public, max-age=432000
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 1a6273cd50eb05c9-WAW
......JFIF.....d.d......Ducky.......d......Adobe.d.................................................................................................................................................................t.....................................................................".............................!1AQ.."2.q..R#.............?......t.......L.[.e.d.c......!%. w........1........I."..T.f.w....v.k.]...a2H....P<K3..3... n.A`62|f...X....c.k.._.vW./..g6q.._Cn@5.C_.......c.;.Q%..;.Fl.B......G....%Z....].Gq.5...........WiQ$........;.l<.......E.Z..[ H..V.G.G.w./@}Do.6.pG~.<Q.[9.;4.yHd3'........i........,.1Z...D.g9.E_....O.8&...5...g{7_..*..............H...k.`...q #x.P.8...V..N..........*.em ..4.$...w.:.V...%%...1..?...e...G9.U.....d....e\..dj.M;.........3....(...!.a6x=...Zsf>.=X..r...HTTP/1.1 200 OK..Date: Fri, 09 Jan 2015 17:46:06 GMT..Content-Type: image/jpeg..Content-Length: 796..Connection: keep-alive..Last-Modified: Wed, 25 Jan 2012 07:19:00 GMT..ETag: "20816b6-31c-4b75513da0100"..CF-Cache-Status: REVALIDATED..Expires: Wed, 14 Jan 2015 17:46:06 GMT..Cache-Control: public, max-age=432000..Accept-Ranges: bytes..Server: cloudflare-nginx..CF-RAY: 1a6273cd50eb05c9-WAW........JFIF.....d.d......Ducky.......d......Adobe.d.................................................................................................................................................................t.....................................................................".............................!1AQ.."2.q..R#..........
<<< skipped >>>
GET /ga.js HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:40:58 GMT
Expires: Fri, 09 Jan 2015 19:40:58 GMT
Last-Modified: Thu, 13 Nov 2014 21:10:00 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 16068
Age: 315
Cache-Control: public, max-age=7200
Alternate-Protocol: 80:quic,p=0.02
...........}kW.:..w~....c...pk..f....--..M..dY.!Wb.KK.o.gF.-'..9...vob{t..Fs..O.".........9..@.#......?... e!...qg.I...A"..N_.').x.I.........I.Dr6}...|$].B..X...`...Ao.. .fQ.....x8..\..8....a..0............{...a}x.W|..:l..}.. ...u4....#.%O.AO....k.N[..a....&....tx..;.....'..:.N!y..Gg....9..a...7....cH>.bw...0..a.a..p5.1d.o|4.=8l.1&.D..,.X.5f..`...s.....[....&p:.H.........x......A.9h#.^..>. ...:...N...,H.1...;.....b..&a.;....o;.b......v.....N.wr..... ...z.......o..,Wjj8......j.r./.Y..RI.6.(........T....Dq....l.0.c.[1.o..h.R....ju..........,;...i....^.....T....|tV.L....;..i^S...-q........[Wup...~.......}.r .W.x..{-...Cd..k.V....A..^;.n...?.N...^.|..bc{.._...h.w=...f..}.U}...|...........[..62...Q....Cw.EV1..>..`..Q.cC.`..0...\v.:.'.....L.$.1.\O.C........B..A^2b..<..%....A%|.E...@N:I*.Y5.A.F.."h..... .^Y)|..L.2D...pqYc.......@..#Y(...J..#w...S.....70.. .;...Y....3..k.........@....&c..J.;....Q....R5.M...x.=`.<.f.U....C.{..>....{...t.....i>..Yk..@e..v.Cf5........o`.Z..V.....V)..9.....^u...X.....}.N.O....~...-......D..V.2o.F.......,Le.."J9.....k...r...#.w.i.!.......oe...a..QA.u.......4.X....{5...Vs..t.0. ...n<..j.y...`-^....uBtf.Gu. S[[.YU...T.._.lP.....(o@=1.-N....?....V>&."...'..d..:.sS..Kq....].UySz5..3..$.<.{..".%.Iar\Y.WVt\....;k..h...O..b...2.....=H.@...v0l)....x.7k..T..Di..T......q..4.5..h....N...... T;.T5SB=.f0.....k............Vh..E.b...Dz....V....u....5...F...A...CX7.e..R9.....Ym5..e|......5..-..]W.u..H...m..J.5k..nT...t!...._|.{<I..!F...j{..-..........).s~g.j....$T.-!.....Z
<<< skipped >>>
GET /r/__utm.gif?utmwv=5.6.1&utms=1&utmn=420109449&utmhn=gamecrea.com&utmcs=utf-8&utmsr=1916x902&utmvp=280x130&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=GameCrea.com&utmhid=1497608487&utmr=-&utmp=/&utmht=1420825580879&utmac=UA-34644237-1&utmcc=__utma=184313904.586816636.1420825580.1420825580.1420825580.1;+__utmz=184313904.1420825580.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=2009778987&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Fri, 09 Jan 2015 17:46:15 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date: Fri, 09 Jan 2015 17:46:15 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2..Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.............,...........D..;..
GET /sa.gif?_salogin=leqo&_sav=4.2&_saje=1&_sace=true&_sacol=32&_sares=1916x902&_saref=&_saa_u=1&_say_u=1&_sam_u=1&_saw_u=1&_sad_u=1&_sawd_u=1&_sadh_u=1&_sanv=1&_sarnd=0.7286422810229216 HTTP/1.1
Accept: */*
Referer: hXXp://onlinehile.org/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: srv.sayyac.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 09 Jan 2015 17:37:21 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: close
Expires: Fri, 09 Jan 2015 17:37:20 GMT
Cache-Control: no-cache
GIF89a.............!.......,...........L..;..
GET / HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: oyunkolonisi.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:04 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dd7fd3e35ea6f10e175dd8dfdb18a890f1420825564; expires=Sat, 09-Jan-16 17:46:04 GMT; path=/; domain=.oyunkolonisi.com; HttpOnly
X-Powered-By: PHP/5.5.9-1ubuntu4.5
Set-Cookie: PHPSESSID=7g0ibh8ap4avh6olklqu0fgo42; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Server: cloudflare-nginx
CF-RAY: 1a6273c15e0605c9-WAW
Content-Encoding: gzip
1e.............H...W../.IQ..........a...... .......0..HTTP/1.1 200 OK..Date: Fri, 09 Jan 2015 17:46:04 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Set-Cookie: __cfduid=dd7fd3e35ea6f10e175dd8dfdb18a890f1420825564; expires=Sat, 09-Jan-16 17:46:04 GMT; path=/; domain=.oyunkolonisi.com; HttpOnly..X-Powered-By: PHP/5.5.9-1ubuntu4.5..Set-Cookie: PHPSESSID=7g0ibh8ap4avh6olklqu0fgo42; path=/..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0..Pragma: no-cache..Server: cloudflare-nginx..CF-RAY: 1a6273c15e0605c9-WAW..Content-Encoding: gzip..1e.............H...W../.IQ..........a...... .......0..
GET /cmd/0oevzq5g4ez0z12oo7ml0q32bo?ps_t=1420825574129&ps_l=http://gamecrea.com/&ps_r=&ps_s=HGU2Bj70eskw HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: image.providesupport.com
Connection: Keep-Alive
Cookie: __cfduid=d7cc9ca9f72818f53afc26f3cf2bf59221420825567; vsid=HGU2Bj70eskw
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:09 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI CURa ADMa DEVa OUR IND COM NAV", policyref="/w3c/p3p.xml"
Cache-Control: no-cache
Pragma: no-cache
Server: cloudflare-nginx
CF-RAY: 1a6273da94fd05d5-WAW
GIF89a.............!.......,..............;HTTP/1.1 200 OK..Date: Fri, 09 Jan 2015 17:46:09 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI CURa ADMa DEVa OUR IND COM NAV", policyref="/w3c/p3p.xml"..Cache-Control: no-cache..Pragma: no-cache..Server: cloudflare-nginx..CF-RAY: 1a6273da94fd05d5-WAW..GIF89a.............!.......,..............;..
GET /js/0oevzq5g4ez0z12oo7ml0q32bo/safe-standard.js?ps_h=lpVC&ps_t=1420825573301 HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: image.providesupport.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:08 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d7cc9ca9f72818f53afc26f3cf2bf59221420825567; expires=Sat, 09-Jan-16 17:46:07 GMT; path=/; domain=.providesupport.com; HttpOnly
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NOI CURa ADMa DEVa OUR IND COM NAV", policyref="/w3c/p3p.xml"
Cache-Control: must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: vsid=HGU2Bj70eskw;Domain=.providesupport.com;Path=/;HttpOnly
Server: cloudflare-nginx
CF-RAY: 1a6273d735bd05d5-WAW
Content-Encoding: gzip
ed............t.OK.1.....;Ls()....CY.{._@..v'.v;...P....YW.x...7...I:....[.[..?.^....[...7.[..K...$.......].=c..V{......b7.....H.`R.....t.".-.5HK.G.....@&./.A....}3r.....w......<...i.b..3ijM....O...6#.|..{....y..*.9....ya*R....H..r..#.........2ee...VMO.@.=._l}.S.......T......c...d...x..D..............o........H.<.......]2...%.........8`.....:mb..J\.".s....N5.C....bH.^~M4..K.[..h..eE>...].rg.F??..*bTi\.q`;r....Z&e........6-.....I.&(.U.d.e<..X......&>.G.F...../.Uu...~a....W..T%..m...d....|M.R.G.I[..)!L..[.DF>.........3c..:z8.-M......o..y..I!......a....... ...G2.....o.....j.^a..`..e.|...k..U[Ga.....M.M......Z..s....hc.&.w...#..oE.. 8.I -&g..v..G.Qx...G..9....o*f..v.E5.}2........ z..P.iDI.S..]Lq...K...Kb....Kq..{..0$... LX=...._;.<[0...8R8...1...MG71..li..A.q...e...............\....Zp.|.B.{-C.u ..*M.g.]....'.`..0..xx.Ob.zG.....Nb..c......h.).a..<..`.k...=..C....C]\.........M..gz..G.<4.2..GY;:..../.Y..*.......aFWjU.O..hmvP&.-.R..>.......{.$..f..].\.U....tW..K...i...3ix". F.0.6I.{..._.......3af...XKo.@.>.R....b*......DUO..UU...V1.2nH.......`.B.\z....y~........n.,.o...F.%.....%".&..\...OW..]l....RPB. b....vx.3;..r.m/...V....Nf...=..3.0..Uj..R...b....y.g..`........c..4..,..,.............U=...p2.'....D68o8.ez[...L...|NH...'.x......3..6....2...,M...1.d..-`..O..,...)pq^s..y.h%.K..YV..N.U./n.w.jUh..P...\.A..f.......Q..\bna...c.....8R2.6.5..$....&...*.>...4$.d...Z9w.Na.y..e.....0...fD.y}.Z.w.]..Uz.r@.h..]?.B....'y..6F.Nw.....&......T...=p...|..m..;.:..../.U.o.~....._..q..j..,...w...4..1).
<<< skipped >>>
GET /image/0oevzq5g4ez0z12oo7ml0q32bo/online-2119672474.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: image.providesupport.com
Connection: Keep-Alive
Cookie: __cfduid=d7cc9ca9f72818f53afc26f3cf2bf59221420825567; vsid=HGU2Bj70eskw
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:08 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="NOI CURa ADMa DEVa OUR IND COM NAV", policyref="/w3c/p3p.xml"
Cache-Control: public, max-age=2592000
Last-Modified: Fri, 19 Apr 2013 11:37:54 GMT
Expires: Sun, 08 Feb 2015 17:46:08 GMT
CF-Cache-Status: MISS
Server: cloudflare-nginx
CF-RAY: 1a6273da960d05d5-WAW
cf8...PNG........IHDR.......(.............sRGB.........gAMA......a.....pHYs.......... ....9.IDATx^m|..]U..w{.{...Lz#....i.C.`..(......(.P.>... ..b..P@:..!!..{2-.g..^..[.N....3..]..{.o...9.1..,.......F..V........yBmj.....v.=...._.~...0<...........w......Ix#5..D..w..."J%/.p...Ej,..;.gn.[..b...a.[.cp0... .,9...NTE....c.........D..........mB).E.X@__/|....~9..q....B...k....I.n.....B).....C..dK.`I.x..2.....WEM......T_u.L.4...,.Wh.].....ry.~..O..<.>o..u...d.G...Nv!.._...h......2...............x.V.....I.H.... ...2.U.4.~.&............ .......I......E.3.[.......Y............16...Y......!.....S....!.AU..W. ... .E$P..`....... ..E.U....R.q$..P.mA _D]U#.."..5.8...<..EY.G.~..B.3.*O......4.(.. ../.GOF.....(f....H.|.?.w.aL.....&4...v0.9*-3S......$.....^.T..K"0.....F....TO...J.......$ .DBv"...V.A..[...e.Le ...Q...TM.l.j..Ed...H.....h.......g......B8..}.....P...'..>E.b....%G1.....&dI...r$%d.I.[..s.N..Up.B.F.$.=\l<2<.^..) ..&.."...g..hM=....kmG.&B...v.F....|.....b.>....8=aN0c.v....l.Z....}..zQpz...!..b.{.. [H...8.A..LJd..b..%..8$4..t .u"_....T.NY.&.r...}. ..b..&...CU..n.R].........9.^W.b.IT4..j&.,..oc..k~.Lj.<..Pd..<...........:ez..S^...&.l...w.p...s.U8..#zT..J.O...4!...Tg...4.,...%....E!...|..K.4NE.g/.'L.@.a.....at.....6db...S.U.QC.1:8.......CM].Fc)....H....Yj.zx.%..j.v.........q\E....F........G.5.....*....Di.u.6yi%-dc.....-l.@<..2%.X.I.d..G.W,.h...d.u.0.....\T.C.). .1B....}.&..Q..f.t.\..<Z}......s..........".R..$......1^...N.3.s.m.`..'I..1.Y..84.A....'K..c....L....r.i...;...<.~xN.~.u.<
<<< skipped >>>
GET /leqo/bg.jpg HTTP/1.1
Accept: */*
Referer: hXXp://onlinehile.org/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: onlinehile.org
Connection: Keep-Alive
Cookie: __cfduid=d97d3c472a8cfcbd38b32aa9eb27d7ac71420825564
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:06 GMT
Content-Type: image/jpeg
Content-Length: 1497
Connection: keep-alive
Last-Modified: Wed, 25 Jan 2012 07:18:59 GMT
ETag: "20816b2-5d9-4b75513cabec0"
CF-Cache-Status: REVALIDATED
Expires: Wed, 14 Jan 2015 17:46:06 GMT
Cache-Control: public, max-age=432000
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 1a6273cb606f05c9-WAW
......JFIF.....d.d......Ducky.......P......Adobe.d...................................................................................................................................................(........................................................................................a...!..1AQq.V."B.#$e..&......b.........................Q.R....................?.. 2....:...Wu....8.Q..s.eUE4....USe4.&.33<..b.....%8Q9..4....4F6..Ltl.m..])Z.O;...S...GM.Zg..o.....=.l..,...qj?.....~....-ibf..i.....b6...GW..c ....Vf....D.E.2X....8m..U.91qc../......1.`:.?%NZ#...1Tl...h..D...M./...rbbG.t_..qG;i*..1mS.LL.T.... n3....`O.....m.yqF..)h..f""......C..S...$D....D^Q.Z@`.33..l.......S....d.Lu.tE........|.LJ.....AhT..1........S...z..Y.F..<f..M.XS.rW_E.x.QhW...e5>.i..s.=O.s.......V0|..pfj.... ..l.l...|.>.'.....'.:.T.4...Q3.Y......O....x.... ...H.s.9>S.v...m.......z9..|.>..{.......................}.x=....j.H.93.;Zr>......5.$y....9.o~.wC....<.L...........C..G&..kNO.9...E.@q.q.U. ...p..W5.....G...UsP.@q.......8.........A.T..8.8....9`...A.H*9........AQ.D.(. .(..nj ...q.x ..7.q...x......o....@p*9.. ...^..8....A...,.....SsQ...@q............@q.77.q...xX.x.............75.q.q.q.q.M.7.....@q.G5.{...C.%.....x..... ...=.... ...T{.D.... .......K.!...UsP.@q..8...j .... 8....8Q.A.8....p. 8....j ..@q.........@q.g........ ..`...0Ev,......]...`%.0...0Q.0...........L..1D1....*...@Z..".....................`..-.B..xh3U..D?P.?P..B.SY....s.g.K.w.z....Cx:..%?5..........................^.......{`.Q{......{`.Q{.........
<<< skipped >>>
GET /leqo/header-image8.jpg HTTP/1.1
Accept: */*
Referer: hXXp://onlinehile.org/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: onlinehile.org
Connection: Keep-Alive
Cookie: __cfduid=d97d3c472a8cfcbd38b32aa9eb27d7ac71420825564
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:06 GMT
Content-Type: image/jpeg
Content-Length: 1057650
Connection: keep-alive
Last-Modified: Sun, 30 Jun 2013 01:01:02 GMT
ETag: "20816af-102372-4e054a54cef80"
CF-Cache-Status: REVALIDATED
Expires: Wed, 14 Jan 2015 17:46:06 GMT
Cache-Control: public, max-age=432000
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 1a6273cd80f905c9-WAW
.PNG........IHDR...............{.....pHYs.......... ......gAMA....|.Q.... cHRM..z%..............u0...`..:....o._.F..".IDATx...y.nY....a.}.o...2_N.U.5.=TWw.B D#...@.I.m.Hn.@r.!...,G..l.`.E..`...7&..p..,.34t.4]Twu.Y...|..........8..y.e..zIf7../n...{...}.^{.........%7...... .;.1..l.....,%.&N...I...*.s...\"x.Q....0.. .v..........:...q " ........j.v.V...o.......v;..'o}..o/t0...C.N..t...U.\{c.u.]..37.zjo....t.......6. ..}../}.._...[.OO.F..8.s&.....zD....:.\.4u].c3.."".3A...o...~3......2.q.*...PP.o^..K.x....vJ.:[lN.k. ...Fy2....f...?...u.[.Y .....Y.@.....>....h9..Dd....z..,.T..A.s`..R..4D.ff..3%.UU.......LV{.tCZnp(..]0BQ.%...AI9..c$......a1......!..QU5Q3..........~0.....f.P....Z..97...}.&...p.j6..Y....U.P.zrT........7...'.~....s......M=....8.:S~.."".....U..........y...^..7^y..7...........~..>w..O._......O~.k_{...>......}..__-O..DTJI).@].u]_.~UU..n..."..|=..&.LD.....LC..,....0.x.)%5%$f.*OD.G........ac.D...W.S(*9.u.#W7....c...d.................t.!.....2.Ls...?.O...>......^...._x........j....._...?.......>.aB.;.u5.B..h`.h@|.h..u............<.#.......g_!..S..s...O...;..k.yo........^..o..........;..../......~....}...,...;.:..s..M.}Bo.=.8.Cg.....L..u~g.rL]A..6.X4.D.hR...TM1xf...9.......[...'...j.........h4P...........O...'?......?...YB.X{GlbZ....A......!".""...^...u"...{?.Kf....../...X..P....a....I}eF.[...?...|.[.g..Nn.m.... j. 7.._x.w...{.._8E7Tu..........*.@h.E$3.x.W.<......?...u6..mo.........||.@D..._..............Tl.Y..`|.l.`..`..........c...{-.....a.../.....D.oDd4q.yI....9.c.c..M..... .....I...E3Rm
<<< skipped >>>
GET /count.js HTTP/1.1
Accept: */*
Referer: hXXp://onlinehile.org/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: srv.sayyac.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 09 Jan 2015 17:37:24 GMT
Content-Type: application/x-javascript
Content-Length: 156
Last-Modified: Sun, 06 Nov 2011 19:46:07 GMT
Connection: close
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000, public
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-Ranges: bytes
if(undefined !== window.sayyac){sayyac.advCount=function(){if(this._td&&this._td.time&&this._td.last_time){this._td.dur=this._td.time-this._td.last_time;}}}..
GET / HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:13 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By: PHP/5.3.29
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
c398..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xhtml">.<head>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.<title>GameCrea.com</title>.<base href="hXXp://gamecrea.com" />.<link type="text/css" rel="stylesheet" href="css/all.css" />.<script type="text/javascript" src="js/jquery.js"></script>.<script type="text/javascript" src="js/buttons.js"></script>.<script type="text/javascript" src="js/cufon_yui.js"></script>.<script type="text/javascript" src="js/Candara_700.font.js"></script>.<script type="text/javascript" src="js/cufon_replace.js"></script><link rel="stylesheet" href="css/nivo-slider.css" type="text/css" media="screen" />..<script type="text/javascript" src="js/jquery.js"></script>.<script type="text/javascript" src="js/jquery.nivo.slider.pack.js"></script>.<script type="text/javascript">.function baslik_goster(gelen){ document.getElementById('baslik_' gelen).style.display = 'block'; }.function baslik_gizle(gelen){ document.getElementById('baslik_' gelen).style.display = 'none'; }.</script>.</head>..<body>.<div class="header golge">..<div class="center">. <div class="top">. <div class="top_left left">. <b>..ye Giri..i</b> yaparak y
<<< skipped >>>
GET /js/jquery.js HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:13 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Tue, 31 May 2011 14:13:20 GMT
ETag: "119ee-4a493018ce000"
Accept-Ranges: bytes
Content-Length: 72174
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
/*!. * jQuery JavaScript Library v1.4.2. * hXXp://jquery.com/. *. * Copyright 2010, John Resig. * Dual licensed under the MIT or GPL Version 2 licenses.. * hXXp://jquery.org/license. *. * Includes Sizzle.js. * hXXp://sizzlejs.com/. * Copyright 2010, The Dojo Foundation. * Released under the MIT, BSD, and GPL Licenses.. *. * Date: Sat Feb 13 22:33:48 2010 -0500. */.(function(A,w){function ma(){if(!c.isReady){try{s.documentElement.doScroll("left")}catch(a){setTimeout(ma,1);return}c.ready()}}function Qa(a,b){b.src?c.ajax({url:b.src,async:false,dataType:"script"}):c.globalEval(b.text||b.textContent||b.innerHTML||"");b.parentNode&&b.parentNode.removeChild(b)}function X(a,b,d,f,e,j){var i=a.length;if(typeof b==="object"){for(var o in b)X(a,o,b[o],f,e,d);return a}if(d!==w){f=!j&&f&&c.isFunction(d);for(o=0;o<i;o )e(a[o],b,f?d.call(a[o],o,e(a[o],b)):d,j);return a}return i?.e(a[0],b):w}function J(){return(new Date).getTime()}function Y(){return false}function Z(){return true}function na(a,b,d){d[0].type=a;return c.event.handle.apply(b,d)}function oa(a){var b,d=[],f=[],e=arguments,j,i,o,k,n,r;i=c.data(this,"events");if(!(a.liveFired===this||!i||!i.live||a.button&&a.type==="click")){a.liveFired=this;var u=i.live.slice(0);for(k=0;k<u.length;k ){i=u[k];i.origType.replace(O,"")===a.type?f.push(i.selector):u.splice(k--,1)}j=c(a.target).closest(f,a.currentTarget);n=0;for(r=.j.length;n<r;n )for(k=0;k<u.length;k ){i=u[k];if(j[n].selector===i.selector){o=j[n].elem;f=null;if(i.preType==="mouseenter"||i.preType==="mo
<<< skipped >>>
GET /js/buttons.js HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:14 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Fri, 30 Mar 2012 10:53:36 GMT
ETag: "d23-4bc73a7018c00"
Accept-Ranges: bytes
Content-Length: 3363
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: application/javascript
// Copyright (C) 2005-2008 Ilya S. Lyubinskiy. All rights reserved...// Technical support: hXXp://VVV.php-development.ru/..//..// YOU MAY NOT..// (1) Remove or modify this copyright notice...// (2) Re-distribute this code or any part of it...// Instead, you may link to the homepage of this code:..// hXXp://VVV.php-development.ru/javascripts/dropdown.php..//..// YOU MAY..// (1) Use this code on your website...// (2) Use this code as part of another product...//..// NO WARRANTY..// This code is provided "as is" without warranty of any kind...// You expressly acknowledge and agree that use of this code is at your own risk.....// ***** Popup Control *********************************************************..// ***** at_show_aux *****..function at_show_aux(parent, child)..{.. var p = document.getElementById(parent);.. var c = document.getElementById(child );.. var top = (c["at_position"] == "y") ? p.offsetHeight 0 : 0;.. var left = (c["at_position"] == "x") ? p.offsetWidth 0 : 0;.. for (; p; p = p.offsetParent).. {.. top = p.offsetTop;.. left = p.offsetLeft;.. }.. c.style.position = "absolute";.. c.style.top = top 'px';.. c.style.left = left 'px';.. c.style.visibility = "visible";..}..// ***** at_show *****..function at_show()..{.. var p = document.getElementById(this["at_parent"]);.. var c = document.getElementById(this["at_child" ]);.. at_show_aux(p.id, c.id);.. clearTimeout(c["at_timeout"]);..}..// ***** at_hide *****..function at_hide()..{.. var p = document.get
<<< skipped >>>
GET /js/Candara_700.font.js HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:15 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 26 Apr 2012 19:40:16 GMT
ETag: "5a52-4be9a283a6800"
Accept-Ranges: bytes
Content-Length: 23122
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
/*!. * The following copyright notice may not be removed under any circumstances.. * . * Copyright:. * . 2008 Microsoft Corporation. All Rights Reserved.. * . * Trademark:. * Candara is either a registered trademark or a trademark of Microsoft. * Corporation in the United States and/or other countries.. * . * Description:. * Candara is a casual humanist sans with verticals showing a graceful entasis on. * stems, high-branching arcades in the lowercase, large apertures in all open. * forms, and unique ogee curves on diagonals. The resultant texture is lively but. * not intrusive, and makes for a friendly and readable text.. * . * Manufacturer:. * Microsoft Corporation. * . * Designer:. * Gary Munch. * . * Vendor URL:. * hXXp://VVV.microsoft.com/typography/ctfonts. * . * License information:. * hXXp://VVV.microsoft.com/typography/fonts/default.aspx. */.Cufon.registerFont({"w":181,"face":{"font-family":"Candara","font-weight":700,"font-stretch":"normal","units-per-em":"360","panose-1":"2 14 7 2 3 3 3 2 2 4","ascent":"261","descent":"-99","x-height":"7","bbox":"0 -301 341.023 91","underline-thickness":"3.51562","underline-position":"-21.6211","unicode-range":"U 0020-U 015F"},"glyphs":{" ":{"w":78},"\u00a0":{"w":78},"A":{"d":"150,-229r75,229r-56,0v0,-8,-5,-30,-16,-66r-82,0v-11,36,-16,58,-16,66r-53,0v0,-5,14,-42,41,-112v27,-70,41,-110,41,-117r66,0xm144,-99v-20,-60,-30,-93,-30,-98r-3,0v0,5,-10,37,-31,98r64,0","w":226,"k":{"\"":18,"'":18,"y":4,"w":4,"v":4,"\u00dc":4,"Y":9,"W":5,"V":5,"U":4,"T":9}},"B":{"d":"149,-125v2
<<< skipped >>>
GET /css/nivo-slider.css HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:15 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:31 GMT
ETag: "81e-4d75a63f6f4c0"
Accept-Ranges: bytes
Content-Length: 2078
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/css
.nivo-controlNav {..position:absolute;..right:0px;..bottom:5px;..padding-right:2px;.}..nivo-controlNav a {..display:block;..width:8px;..height:8px;..background:url(../images/bullets.png) no-repeat;..text-indent:-9999px;..border:0;..margin-right:0px;..float:left;.}..nivo-controlNav a.active {..background-position:0 -8px;.}...nivo-directionNav a {..display:block;..width:30px;..height:30px;..background:url(../images/arrows.png) no-repeat;..text-indent:-9999px;..border:0;.}.a.nivo-nextNav {..background-position:-30px 0;..right:15px;.}.a.nivo-prevNav {..left:15px;.}...nivo-caption {. text-shadow:none;. font-family: Helvetica, Arial, sans-serif;.}..nivo-caption a { . color:#efe9d1;. text-decoration:underline;.}../*====================*/./*=== Other Styles ===*/./*====================*/..clear {..clear:both;.}.......nivoSlider {..position:relative;..text-align:center;.}..nivoSlider img {..position:absolute;..top:0px;..left:0px;.}..nivoSlider a.nivo-imageLink {..position:absolute;..top:0px;..left:0px;..width:100%;..height:100%;..border:0;..padding:0;..margin:0;..z-index:6;..display:none;.}./* The slices and boxes in the Slider */..nivo-slice {..display:block;..position:absolute;..z-index:5;..height:100%;.}..nivo-box {..display:block;..position:absolute;..z-index:5;.}./* Caption styles */..nivo-caption {..position:absolute;..left:0px;..bottom:15px;..background:#000000;..color:#FFFFFF;..opacity:0.8; /* Overridden by captionOpacity setting */..width:380px;..z-index:8;..text-align:left;..padding-left:10px;..pad
<<< skipped >>>
GET /images/bayraktr.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:16 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 09 Aug 2012 13:31:18 GMT
ETag: "23f-4c6d53e09b580"
Accept-Ranges: bytes
Content-Length: 575
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR................a....pHYs................ cHRM..z%..............u0...`..:....o._.F....IDATx....n.Q.E...vmb..E...RB.....J..A.. (.."S..tnSD.RD...#..`.N.(.c.......].. a.6S..{g.(..>P@.....,05.j.gg ....8...?2@.........9$.Q..<./....v:.5.h.2....p.....l..}.n.hP.7..EH..h....=....M}w....|6C]_.......`.<\..`..$......=F..L..Q....V...;;.c....,I..q.....azt...A....xI...W.3...I..... .zA..1...(Eus.I.......@......y.8Gbm.....0|^.~CPD.^.....!M..........<.ch-...}. MA....w.>.<}B..../Q...........Z.ZE.!....y.|....<'--...E8...i..j. ..X..@../|.z.\dP.e0....;...Z..u..!E....IEND.B`.....
GET /images/bayrakeng.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:16 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 09 Aug 2012 13:31:05 GMT
ETag: "2c3-4c6d53d435840"
Accept-Ranges: bytes
Content-Length: 707
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR................a....pHYs................ cHRM..z%..............u0...`..:....o._.F...IIDATx...]H.Q...g{.95...1....b$.0$.f.}..IE.fA]D.E`..^....J......R".r..Q.....1?&..........].....s........BJ.j$. ..<W.80.......-..y4l.....c1^<.g..e.Tr...pc7........(.kIufg @Z......rbo)E.j.{.....}.v.tL6.e{\..Q..gc.....W.i.`..=...E.L........=.......'4..".ef.*v.......`.@.Lp...fCj..!..\.U'....8.......7mU.~.m$5.......H.f.HI..............q...b.'"h.)D...#..`.*...........K.....de% ..pW"...._..|Axr.....J<......ZHy......Y.H..%0o%...OM.x..)...0...N...........}.'.......:.w.Qq.Cg.8..k..........e...:....U..6.....8y.&.?.....Zvh.....KgX..@dq.A...;]HM#...w$.@.....j.........@..f.Y....`N...B....j..w.....kXp7....IEND.B`.....
GET /images/header_bg.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:16 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 30 May 2012 17:57:13 GMT
ETag: "301-4c144ae4c1040"
Accept-Ranges: bytes
Content-Length: 769
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Content-Type: image/jpeg
GET /js/banner1.js HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:16 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Fri, 19 Apr 2013 11:09:11 GMT
ETag: "9b6b-4dab4bfa3e3c0"
Accept-Ranges: bytes
Content-Length: 39787
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Content-Type: application/javascript
// Diapo slideshow v1.0.4 - a jQuery slideshow with many effects, transitions, easy to customize, using canvas and mobile ready, based on jQuery 1.4 .// Copyright (c) 2011 by Manuel Masia - VVV.pixedelic.com.// Licensed under the MIT license: hXXp://VVV.opensource.org/licenses/mit-license.php.;(function($){$.fn.diapo = function(opts, callback) {....var defaults = {...selector...: 'div',.//target element......fx.....: 'simpleFade',.//'random','simpleFade','curtainTopLeft','curtainTopRight','curtainBottomLeft','curtainBottomRight','curtainSliceLeft','curtainSliceRight','blindCurtainTopLeft','blindCurtainTopRight','blindCurtainBottomLeft','blindCurtainBottomRight','blindCurtainSliceBottom','blindCurtainSliceTop','stampede','mosaic','mosaicReverse','mosaicRandom','mosaicSpiral','mosaicSpiralReverse','topLeftBottomRight','bottomRightTopLeft','bottomLeftTopRight','bottomLeftTopRight','scrollLeft','scrollRight','scrollTop','scrollBottom','scrollHorz'....//you can also use more than one effect: 'curtainTopLeft, mosaic, bottomLeftTopRight'....mobileFx...: '',.//leave empty if you want to display the same effect on mobile devices and on desktop etc.....slideOn....: 'random',.//next, prev, random: decide if the transition effect will be applied to the current (prev) or the next slide........gridDifference..: 250,.//to make the grid blocks slower than the slices, this value must be smaller than transPeriod......easing....: 'easeInOutExpo',.//for the complete list hXXp://jqueryui.com/demos/effect/easing.html......mobileEasi
<<< skipped >>>
GET /js/banner3.js HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:16 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Sat, 23 Jul 2011 05:46:08 GMT
ETag: "5b8-4a8b619404800"
Accept-Ranges: bytes
Content-Length: 1464
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Content-Type: application/javascript
/**.* hoverIntent r6 // 2011.02.26 // jQuery 1.5.1 .* <hXXp://cherne.net/brian/resources/jquery.hoverIntent.html>.* .* @param f onMouseOver function || An object with configuration options.* @param g onMouseOut function || Nothing (use configuration options object).* @author Brian Cherne brian(at)cherne(dot)net.*/.(function($){$.fn.hoverIntent=function(f,g){var cfg={sensitivity:7,interval:100,timeout:0};cfg=$.extend(cfg,g?{over:f,out:g}:f);var cX,cY,pX,pY;var track=function(ev){cX=ev.pageX;cY=ev.pageY};var compare=function(ev,ob){ob.hoverIntent_t=clearTimeout(ob.hoverIntent_t);if((Math.abs(pX-cX) Math.abs(pY-cY))<cfg.sensitivity){$(ob).unbind("mousemove",track);ob.hoverIntent_s=1;return cfg.over.apply(ob,[ev])}else{pX=cX;pY=cY;ob.hoverIntent_t=setTimeout(function(){compare(ev,ob)},cfg.interval)}};var delay=function(ev,ob){ob.hoverIntent_t=clearTimeout(ob.hoverIntent_t);ob.hoverIntent_s=0;return cfg.out.apply(ob,[ev])};var handleHover=function(e){var ev=jQuery.extend({},e);var ob=this;if(ob.hoverIntent_t){ob.hoverIntent_t=clearTimeout(ob.hoverIntent_t)}if(e.type=="mouseenter"){pX=ev.pageX;pY=ev.pageY;$(ob).bind("mousemove",track);if(ob.hoverIntent_s!=1){ob.hoverIntent_t=setTimeout(function(){compare(ev,ob)},cfg.interval)}}else{$(ob).unbind("mousemove",track);if(ob.hoverIntent_s==1){ob.hoverIntent_t=setTimeout(function(){delay(ev,ob)},cfg.timeout)}}};return this.bind('mouseenter',handleHover).bind('mouseleave',handleHover)}})(jQuery);....
<<< skipped >>>
GET /news/warframe.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:16 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Sun, 18 Aug 2013 08:27:44 GMT
ETag: "4b399-4e434990c6000"
Accept-Ranges: bytes
Content-Length: 308121
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR.......8.....j..c...DiCCPICC Profile..H...wT......l/.]."e.......H.&....KY.e..7D."...V$(b.h(. .X......"J.F........;'..N..w>.}..w......(.!.a...@.P"...f..'0....D..6.p....(.h..@_63.u.._....-.Z..[..3.....C. .K.....;.?..r!.Y...L.D...)c.#c1. ..2N.....|bO....<.G......q.....|........|.o...%.....ez6.....".%|n:..(S...l...@..}.)_.._....;G.D,HK.0..&L.gg.3.....H,.9.L...d.d.8.%.|.fY.P..............-.........d....2...A../.../ZN-..).6[.h);.h[..../..>....h...{..yI.HD.VV.....>.RV....:|..{..<K.y.k....r.Y........... .p.L.......UZ_.a..O...B...t...4..B.@"..2........*..~.k.hu..=..(....k.....I...@...B......=.i.QF....a.2.....1e2;2.....d.........t.....0....8.W..|A.... .,.\........`.(.%`.....^P..@.8...Ip.\.W.5p...C`.<...5.. ..Q!...iC...d.. w....".x(.J....Z...J.r....5@.C'.s.e.....C....;..)0....a ..{..p4..N...K.Bx3\...G.V..|.......). d... ...a#aH......H1R.."MH...\G....-...a.... &.3...,....b.1.0....u.0f...K.j`....@l.6...-.Vb..-.....Q.k.......p..x\.n.......;.......x........s..|.~'....~.?..C .....?B.AHXK.$.&.&....3D......F......u..b.q.8CR$...H.....R...t.t...L&.....d.y5..|.|.<L~KQ..R..D....r.r.r...J..R=..T.u3..z....F.&g).(..[%W#.*7 .\.(o .%.H~.|..q.>.......[...R.F......"M.F1L1[.T...e.'Jx%C%_%.R.....J#4..Gc...u.:...(.G7...3.%.....Ie%e{.......S.C..a..dd1.......T4U.T.*.T.T.T.U..z..U.U.Uo..Sc...e.mUkS{..Q7U.P.W..~A}b.}......9.....5L5"5.i...........i..<.9.........:.5.M.v..hWh..~.Tfz1..U......N..Tg.N......|.......Hz,.T...N.I}m.P.....w...,.t.......F.............-5j4.oL5.0^l\k|..g.2.4.mr..6u0M7.1.3.....f......
<<< skipped >>>
GET /news/canli.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:17 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Sat, 20 Apr 2013 23:11:56 GMT
ETag: "2966c-4dad2f63ca700"
Accept-Ranges: bytes
Content-Length: 169580
Keep-Alive: timeout=5, max=89
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....H.H.....dExif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS2 Windows.2013:04:19 20:49:25............................N...........-...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................R...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?..T.I%)$.IJI$..}.{-........I.h_d.f...g.......YtLy7.K...X2....y-...#.Y.....{..Qi......~.........N#..Y..<.....Y.2.R.}=............uZ .?!......~.?;.?......f.......G4...../;u...8.kt....~....n..e....k...Rr..3.&......<@Q.T.2.lv......0..r9..63.Oo.%~.h...t.}...ddp.......k..v..>..:.R.,a.o..A.v....Pi.w.|C...|62....m..^^.Hmu_..?.....5f.C..e.o..a.n.ic...7.................d........*..W...u.l..E.C.c}.'....s.....d4..fEm.....=/..I.....u..|........@x....5%8.W&...n.u..Z....9...{.....`.......e~...X...d.._JfF^%W.....7^...bcSVI.uUf;vO..~..N...V..a...f..w."...K".TZ...C,.}WS^S..dX..S...9.-...OI.....y...:...w....K..#?G....?...M...2'{=.O....n.[...:kC.m}P....k.s.l}.eR..
<<< skipped >>>
GET /news/goodgame.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:17 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 18 Apr 2013 21:51:49 GMT
ETag: "219a9-4daa99c08e740"
Accept-Ranges: bytes
Content-Length: 137641
Keep-Alive: timeout=5, max=88
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS2 Windows.2013:04:19 00:23:33............................0...........,...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................V...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?...........S..Uk...s....r~.(.`...`....U}@4j%n....q7....DcK..@.R....i6..X.:..Vu...)...X76}..$|R. ...L.u..UU......s... ..GR..YV....u~..s.s.N....W.6.......n-... ..h.}O.;....j.......lk ....V.d#.3.....y<.1...:u.Z..4@........:....{.Z...w...kmcq'..~.......O...b..E...r..........~........H.......T...H....5....2..j..k..g...FcJ.S..d.....s..L.*.J.],..Z....r|..2.V./.....O..Y..R.m.~.....?u.V.2.e..._#"......Go.(1.)........M1...4(?.......]..xC.......Pj.=..F...(5..F..@..n.#.u..?...!......K~...pF'..\o.H>."#.\.C. ..NF.`......m..P.n...U.....c*.G..=g.....AI......c8.~`wsq:m6...^X.\........k..........E..'n..o...wX........SX..8..,.{.uL..YG...1.".\...r../Z.W].uM.V..}.c.w.
<<< skipped >>>
GET /news/premium.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:18 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:53 GMT
ETag: "20ad1-4d75a6546a640"
Accept-Ranges: bytes
Content-Length: 133841
Keep-Alive: timeout=5, max=87
Connection: Keep-Alive
Content-Type: image/jpeg
......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS6 (Windows).2012:12:04 01:48:30..........................0...........,...........................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................V...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?..)J.. .yze)J.....X.),...........CZ...7....l......\k.....a.u...G~....kr.......7..mu...4d-.a.E..se)D....!.......k.v.@..0.{Z.v.....\...8...^..8.m..o.)..`fO.D.....a..e..1......<....)J....x....Z.6.O..mc.........-....E..~ ._...V.k.{.~........\.<...k~?&.........q<Q.:..~.qG....n\. G?...2..en...y.=.........s.........l.K.....-4.f.\$V..;.U?.....X..c.......}.-.......r%)Z.}\.v.......Q.................5...V............[\.l%....}..z|......E...c.']..A..#..@<;.........X..u...4.....v.x.........7i/-as..X.0.k.s.....u...!..X.9..VR.vcS Yo..:...x..i.g.n..z....M..N..~.......={.G..... ..V.R.r...m..V.Fm....._m..U....G.......U.hv5.....a...X../e77.u$'.H.P..@.F.o..JTe)Em?.....BR....S...u,Z[F=.)i$W..n....
<<< skipped >>>
GET /news/parca-kontor.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:18 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:50 GMT
ETag: "1a47a-4d75a6518df80"
Accept-Ranges: bytes
Content-Length: 107642
Keep-Alive: timeout=5, max=86
Connection: Keep-Alive
Content-Type: image/jpeg
......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS5 Windows.2013:02:11 20:03:32............................0...........,...........................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................V...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?...)Q..bS.|L.)Q..*W.)JTe)J...R......S.c..`.?..D.$......b..JR.)JT.&R....hqs......!......e*@.;2..&5....^@.!.HkA{........e.X..i........9k.... .]^...)Q..*O.)JTe)J...R..JR.q?...e)P..c...l.)P..*W.9JT...#......[cX...X...Z.[.g....Vr..N..,........6>...1..*.hv.m.......G..,...rs...G$.I.../......G....fE.......7...c.N..oc-.-v.e...\wT.9..K/......}.O.m....t.K'...^...;..........UW.g....NE..^,...Z.<n...............G..V...(..#...3....k....}.3)...T..{?G...........Y..9..'.$..`.$.1.3....?..}......9.Lt.a5..5....5..WfGS.}-.l..h......*...*]m....z.-............w:....2..7c..M.o./.=*A..o..7).:.....]a.c]M......N...Q.........$...........C..2...I..d....f........*.M..2...7..F?b9#?...p.....c./s..e....Tvz.X.y.F....
<<< skipped >>>
GET /news/steam.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:18 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:56 GMT
ETag: "1a793-4d75a65746d00"
Accept-Ranges: bytes
Content-Length: 108435
Keep-Alive: timeout=5, max=85
Connection: Keep-Alive
Content-Type: image/jpeg
......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS5 Windows.2013:02:07 21:34:39............................0...........,...........................................&.(.................................c.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................V...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?..e1sG$&......?...O..Yz.nn?E.........qc..c.........)...#.K{|G.._.:.5..!.....*....#.^..9._......6Z1..:...za..sl......{){....}.QrSO{|G......C6..X}I.0....4V(kl....h....{/...W.....~....G#e.5R.CG...j....-.U........{|G......V9..XAsO..,.<zBE.v.w~...l....N...u..lm...^.R6...{.....V....].....).#{\.o.]V..@.......n............R.K..3#)."................}8x.jk_...d........|...{)...=F.m.6.......k2~.C..v{.j..._........mIN.. o....@..].h.eN.k...-..t....O.n>F k..2......Z.Gb%.....3?..M..m..i...>.m..a...e....`......5~.....JWM.>.....'!.....m.h}........S.......z..j..m..}..G.*...Uk.4.c~.......[fm..}.em...>.~....S.)H[......e.P.....5....T.Y...~.....~.....k........Y.....e.Q.Q..}-..sX:.....Q..?.......
<<< skipped >>>
GET /images/shopping_basket2.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 30 May 2012 17:58:03 GMT
ETag: "2096-4c144b14700c0"
Accept-Ranges: bytes
Content-Length: 8342
Keep-Alive: timeout=5, max=84
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR..............>a....DiCCPICC Profile..x...wT......l/.]."e.......H.&....KY.e..7D."...V$(b.h(. .X......"J.F........;'..N..w>.}..w......(.!.a...@.P"...f..'0....D..6.p....(.h..@_63.u.._....-.Z..[..3.....C. .K.....;.?..r!.Y...L.D...)c.#c1. ..2N.....|bO....<.G......q.....|........|.o...%.....ez6.....".%|n:..(S...l...@..}.)_.._....;G.D,HK.0..&L.gg.3.....H,.9.L...d.d.8.%.|.fY.P..............-.........d....2...A../.../ZN-..).6[.h);.h[..../..>....h...{..yI.HD.VV.....>.RV....:|..{..<K.y.k....r.Y........... .p.L.......UZ_.a..O...B...t...4..B.@"..2........*..~.k.hu..=..(....k.....I...@...B......=.i.QF....a.2.....1e2;2.....d.........t.....0....8.W..|A.... .,.\........`.(.%`.....^P..@.8...Ip.\.W.5p...C`.<...5.. ..Q!...iC...d.. w....".x(.J....Z...J.r....5@.C'.s.e.....C....;..)0....a ..{..p4..N...K.Bx3\...G.V..|.......). d... ...a#aH......H1R.."MH...\G....-...a.... &.3...,....b.1.0....u.0f...K.j`....@l.6...-.Vb..-.....Q.k.......p..x\.n.......;.......x........s..|.~'....~.?..C .....?B.AHXK.$.&.&....3D......F......u..b.q.8CR$...H.....R...t.t...L&.....d.y5..|.|.<L~KQ..R..D....r.r.r...J..R=..T.u3..z....F.&g).(..[%W#.*7 .\.(o .%.H~.|..q.>.......[...R.F......"M.F1L1[.T...e.'Jx%C%_%.R.....J#4..Gc...u.:...(.G7...3.%.....Ie%e{.......S.C..a..dd1.......T4U.T.*.T.T.T.U..z..U.U.Uo..Sc...e.mUkS{..Q7U.P.W..~A}b.}......9.....5L5"5.i...........i..<.9.........:.5.M.v..hWh..~.Tfz1..U......N..Tg.N......|.......Hz,.T...N.I}m.P.....w...,.t.......F.............-5j4.oL5.0^l\k|..g.2.4.mr..6u0M7.1.3.....f...
<<< skipped >>>
GET /images/news2.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 30 May 2012 17:57:45 GMT
ETag: "2c90-4c144b0345840"
Accept-Ranges: bytes
Content-Length: 11408
Keep-Alive: timeout=5, max=83
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR..............>a....DiCCPICC Profile..x...wT......l/.]."e.......H.&....KY.e..7D."...V$(b.h(. .X......"J.F........;'..N..w>.}..w......(.!.a...@.P"...f..'0....D..6.p....(.h..@_63.u.._....-.Z..[..3.....C. .K.....;.?..r!.Y...L.D...)c.#c1. ..2N.....|bO....<.G......q.....|........|.o...%.....ez6.....".%|n:..(S...l...@..}.)_.._....;G.D,HK.0..&L.gg.3.....H,.9.L...d.d.8.%.|.fY.P..............-.........d....2...A../.../ZN-..).6[.h);.h[..../..>....h...{..yI.HD.VV.....>.RV....:|..{..<K.y.k....r.Y........... .p.L.......UZ_.a..O...B...t...4..B.@"..2........*..~.k.hu..=..(....k.....I...@...B......=.i.QF....a.2.....1e2;2.....d.........t.....0....8.W..|A.... .,.\........`.(.%`.....^P..@.8...Ip.\.W.5p...C`.<...5.. ..Q!...iC...d.. w....".x(.J....Z...J.r....5@.C'.s.e.....C....;..)0....a ..{..p4..N...K.Bx3\...G.V..|.......). d... ...a#aH......H1R.."MH...\G....-...a.... &.3...,....b.1.0....u.0f...K.j`....@l.6...-.Vb..-.....Q.k.......p..x\.n.......;.......x........s..|.~'....~.?..C .....?B.AHXK.$.&.&....3D......F......u..b.q.8CR$...H.....R...t.t...L&.....d.y5..|.|.<L~KQ..R..D....r.r.r...J..R=..T.u3..z....F.&g).(..[%W#.*7 .\.(o .%.H~.|..q.>.......[...R.F......"M.F1L1[.T...e.'Jx%C%_%.R.....J#4..Gc...u.:...(.G7...3.%.....Ie%e{.......S.C..a..dd1.......T4U.T.*.T.T.T.U..z..U.U.Uo..Sc...e.mUkS{..Q7U.P.W..~A}b.}......9.....5L5"5.i...........i..<.9.........:.5.M.v..hWh..~.Tfz1..U......N..Tg.N......|.......Hz,.T...N.I}m.P.....w...,.t.......F.............-5j4.oL5.0^l\k|..g.2.4.mr..6u0M7.1.3.....f...
<<< skipped >>>
GET /kategori_resimleri/1708201315030465994.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Sat, 17 Aug 2013 12:03:04 GMT
ETag: "193c-4e4237d4c8e00"
Accept-Ranges: bytes
Content-Length: 6460
Keep-Alive: timeout=5, max=82
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...(...(.....a..>..5..p.....fOEWmF%.$c...Y..@.....}..\.h.@."Z*$...ds........!`(.h....`...I.R.4.QE..QE..QHN(.4..QE..QE..QE.|.........5.)..,R..@U... ..z.A...{W....5-].......'..../D.1......#.....]..).tK.Q....\1*....rW.f. .....?G..F.vx.=........g..<\.\G..k7...?FL.2....x<.X....eJ*/.>....t.|)....R..O.u.O..d9...........&L....?.E.gw\.....=k.{J....|...,... ..3N...mG....?q...I>?..N~...^ .......-b.G.Z..-2.u.4.,HwF.s..F..........Zu...5..j.y..#V}.8.........8.rM.{.v...................._..?...t=..7VV6.I......... .S..$....~.....L..$.....U.....='...o...z..]..!..o.fh.#,N.V..0.Ey..LW....|15.*.....?..7....E..;)..}.9....r.nk.....{....Ax.....t..x.T:..>.{k%.....96......3_WW....?...._.H..t......:V.k.^.M...3*....2!^Tg.~............a...f.;.I0T........R.._..8.W.S.?4....f...X...1..YP............M[..........#=. .?k..(.....LV....k3..Y..@..W|...FUX...j.G5....o..d...|..
<<< skipped >>>
GET /kategori_resimleri/1905201223513156550.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:37 GMT
ETag: "271d-4d75a64528240"
Accept-Ranges: bytes
Content-Length: 10013
Keep-Alive: timeout=5, max=81
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..:.O.(Vx~g.[0..9$v....'.t3..2.G...&?/...Nx....~Q.^:.t2y...W....>...^....a.....m.!. ....=.....%...-.7@.2...g#.l...3.J.{...L.m....1./.~.b......[6.`.d*.#....g..`.G.F....O...........a.....a6......c._......|.....2.V....V.............o...X.D. .t.......Q..w..._.-..nf.......:}I.M.tj.....?s.....;Uo.#.o?J......j>.....W.Kkal..KB..[..;d...i.M.(N.......988...[....?JC.1.../...<.......C.y!f8...w9..{.....^%......wz.N.[...Q.........Y....................p...{w..c..#@.D.,....[..;G...Sj.].sq".I..@...$..3^......9.^..x.m.Y..1y.%.RD.."..y..s.......JQ.#......)cn......t.=_.p.....<..F.E..{...K...y...Ol..&........J..k........Q[x.Z..Vk=R....U<I...l. .../.1.....K.C.jZX.}....)1..F]$............7.....?.<9.Ho.<...T..C....y.;]F)V..H./6.h..6....7y.J.7y.(..R.m.f.Q.S.a.....}.s...i.&.m.xj..w...t...6h. .;....?..E..g.#taS........w....... d*.p....3.....*X..c.T.....|../...............R2..Oz@.7..k..~:.U5.5.......6.%....;
<<< skipped >>>
GET /kategori_resimleri/2111201219281529243.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:41 GMT
ETag: "10f4-4d75a648f8b40"
Accept-Ranges: bytes
Content-Length: 4340
Keep-Alive: timeout=5, max=80
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..........J.h?...E>3.......N..........71Am..B. |*....O.z../..E........]\......O>;......._:P.......i../?.?................^~,..Mw.....Q@......Y.......X.............K...y.....5....^.E.{...=g.......c...k.....z../..E........]x.........._......).....?..?........S]...u..P.......i../?.?................^~,..Mw.....Q@......Y.......X.............K...y.....5....^.E.{...=g.......c...k.....z../..E........]x.........._......).....?..?........S]...u..P.......i../?.?................^~,..Mw.....Q@......Y.......X.............K...y.....5....^.E.{...=g.......c...k.....z../..E........]x.........._......)..... .(..............9j..4...._....Ry....-C..F...FX.@.F.}q....><9.......'.:....ut..........o..mm.....dn.u..........-..?g_....ay..k.=;R...nVY,|..;.G.@#.;..#.^..K..Q........?...?..I.iz..jzF...jn.bT..... ......%..8e#..4.QA.O4P0..R0...Ws.:...<...Q.............~............Mk._........&.......D..9_.W.1 ..._.?.n.
<<< skipped >>>
GET /kategori_resimleri/1908201312351700450.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Mon, 19 Aug 2013 09:35:17 GMT
ETag: "32ad-4e449a8779f40"
Accept-Ranges: bytes
Content-Length: 12973
Keep-Alive: timeout=5, max=79
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......(...(... c.~...%..K.t{v..u...l.R..i.".O..9=.Oj....?..W.{.....D ......Ff.2....A..YO...a..d............k?..Lm.l| ...v..T..9g.[T..`..... .....|!......c...~...m..wzv........Ub...V.1F.....c2.....$.]o...~.......K.....~.j.!...cKO.Zk.F.B^cm7.m.Q....`.q...!./...O..7Z5....Zip.w{.."..]r.T...C...{ .|.d.Y.V8.[.AV..k.9...dk..?g=w.v>"...i:"x./.Af...: :(...v1Vi.e.QT.....~..;..5.......^.GK..!.....Q[gf.t..." .,.X.8S^..)..A~'.....g.~6h..... ..Y.H.Z./.7..4.y.F.K..#.6.(....k......%~.........>....1..,..t..BO..s.r.7.r.$,._(..n......> ...>... ..}..O.f....h.{;...W..HRd...v#c.;U.s..1^C.J...$...hk...WZw..C.Z, ...>..(.. .".&"D.".....O.?...O.g...}.....u.......o.j.............[.f.P..[|,....g....o........`x ..0../.....D.!...g...M..Ey..........[y{.E.s J.....O..ho.'V....|.....6.y.k.....C.O...jE7}.f..&..nT..aps....V:....h|Q{...,......n.....6t............8.m...H....._.....|oi&..?.. .u(Hf...c...\8ry.E....m.........
<<< skipped >>>
GET /kategori_resimleri/2111201219254885840.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:40 GMT
ETag: "1ebc-4d75a64804900"
Accept-Ranges: bytes
Content-Length: 7868
Keep-Alive: timeout=5, max=78
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...|F.>.|>.........n...u(....RJ....>.x..?h..C.W-c<...j.d.htYT....pGZ..<?.|@.U.Xiq.].... .F.e...|..m.@...^s..=G.zrX..[.j.on.=...N..P6...]. ..._.a#hE..?.2..)U.*..;...I...........o4>Ky.N.h.H...[v.c.y...E..> Hoe.(.6Tx........l.{..]..o.j...o....v.o.X0..... .U.........E.Up.7;H....~..i9.5._....dxl;..........m......g./.*...@....&.....u/..._i.5.7}.M..R...c.........K8.C..6.A.x.F....5....}:.....#.|.5...Uw..?;....q...s,u...m.}NI.?.?mi)_Gm..~...@<mm.Gu...n..7.=......T...NA<.<....?k.S...i....=....7..Cr.e.L....f...8.G.....fA#..z......o.~1..o.....J.. .o.l.3.....5hV_.Z...\#.e)a........^....s...H..H`..G9...H.!&7....8.ds_:.i....q....!..e.Ddpy${....{...~-..qa.i.Ey..Eysi<.I..F...!X.FT..9.W...t./...q.....Mu*..U.......d.E.......7O....4l.Ip.K...=...5....X<.,..$..7..T.Aq.[...k.d...qT.|-......z...J...o.P..U.EJ:=..~..xY...Q.....vi.$...S..-"g,#...W-.N#s. =8...|2......$..,y.N..>.j.S..qg.....
<<< skipped >>>
GET /kategori_resimleri/0210201211154505920.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:19 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:34 GMT
ETag: "3c45-4d75a6424bb80"
Accept-Ranges: bytes
Content-Length: 15429
Keep-Alive: timeout=5, max=77
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....,_..?..Q.X........@..,_..?..U/.j.o.4{.CQ....-..=....0 .....z.\....KC..~..7..s..{..^...V...eF.....]w..X.- .xH.........;.....wD.s.......ZjZT.p;.hS...DKF.|........Q)Y..n~./....G>8.H..Fmy..........%....|W.=F...Com.[.4.Q....'..........?.....?.?.... ...<>........Xx..Zf...f..'.[.....2......!-........?...........x..E..%........1.X..G.4K).~Tp.....h...k......|...'_6..8$...~.....=.FWN..8.;.m.|...?hO.>R?.'...".V.....Pw.:S...>....m......b........w.....f..K<uy........e..k.$..../.^....7../t..ZH..nn<.r..,~`.$.}S.w........5O.x.......K....~.Eqmj......2....g...5...k_.......J*.......7.d....u;'.../.<o....4.....p[?.,..Q\.O..b..q...^q.T~._.?cM& ..x..N..A%..o.....;w.(...#{mL.7g..w.......g...L..|3..........$....Gmo...:-...D......]..I........Hx...3.......<J,.Oi<...M.=>=B...-.i"h$...! . .uF.....s....M. C.....O.<......}V.l~.....t...V...>...;(..5...6nK))...6>.v.~.y.......t.. .7..LG...
<<< skipped >>>
GET /kategori_resimleri/2004201319033623423.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Sat, 20 Apr 2013 16:03:36 GMT
ETag: "366c-4daccfa65c600"
Accept-Ranges: bytes
Content-Length: 13932
Keep-Alive: timeout=5, max=76
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...[S..p...v.z..u....../>.>...v6K.^.S.2j...f....).......1..J.@UU.,.....@.WJ.$.Vb1.......jc.....,.C.....1.d. ...{.....*.?!.\V!SJ..Oe.v=..$.>R.=).Y?./...s.........~...%#.xr.O...<E...?..> .O..%...m....ql$|..K.........$.O..b..*....<.J..1.H%H...z..o.@..K..Z...My7.<q.....wr.&.6......0N.\.....9.....Q.,E:......6...=m{ j..s.r..).xP.a. .....]....]v=w..?.u.Sm..._,.!..n$V......B.[.^....3.P.r<.....t.._...=.k.....|I.5.4.C..<j...P.....:.......C.Z..?..s....*k.k..q.%|.'>.W.{z.).[..?O..<.r.........N)[..c.........~.........6.%......_.G>/..J....(^.....O.A....~9..|K.oS..-..y..3..M(IC....p...v.q.F..r.W...Yjj...@.4E<...H.....<..s.w...........K......o.........3..........3J*..I>.W..m...<z...}......o(<....6.....Y.....S..........A.H.......N^H.. .cL.....V..........h\..).T..2.c.....k..?.....x.I.......A$q]i..V...d)wY...w.....Ea....X."...W...]...U..W.V.....5...._|c...2j....D.A.d.Z.
<<< skipped >>>
GET /kategori_resimleri/1907201217175184490.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:40 GMT
ETag: "2c4f-4d75a64804900"
Accept-Ranges: bytes
Content-Length: 11343
Keep-Alive: timeout=5, max=75
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF...................................................& ..'..../ #'),,,..150*5& ,)...........,$..,),),)),),,,,),),,,,),),)),,),,)),)),,,,,,,),,,,,)..........."........................................?......................!..1.A."Qa.q...2...B..#Rb..r..3c....4C...............................%.......................!1.AQ.2a."q.............?.. ....X...R.J..6.. .T....J.O.....[...:...\.[}.*...,...L.X.v........f..c..c.>..fo2O..sJk....,[..Gy....g.m.k.WU .1.....WE....l..;}.dm...L.%.$S...G5.]k].Y.M_M6..iu.......!.g ...y....zMC....t.6...Ca.8"...x...5.z?../Y...m0..l/x....Ke.l.Q.Wz..J..I.....g.l.l....-..F.y....^.......t..6.D....F....e>..A.T......._b..A6..m.1...3../..........iJ.Z....j5:n.n.. ...r3.$....?1[.../E...k.._....l...q .`.5e<..r.n.b..I..I'...u......KS.K&...n..m..}.\<..0.T>.{}?..R.:.M..e...j..}....'.........Z..e..:...-."............f;PR..y..V.|Y.]Q....!.|Sp..H..)I'..'.3...Z.%...oR...Z$.......".>....S..../.M[V.(.w....He..N ....._z...!.;..=...<.=3]....h..b.....k........`.P{.EsO.>.]GT.....[......"=D.v . S.fo.YT..#...$.....q.. P.........t...7Kk.V...m_...].(r..P.s=.K.....S},Z....D\...'........q....=.I...L..e 7.#.D..O.KU..t...[[....D.I#.f...$..&.k.t........kb>...f..qpV%.1.>fF1.@..R.w...~..WzG.7.*.......?J..[............q..H.1C5.<[.. . .P........c...M2...v..s.3...=.4*..^..8.y..fL....Z......e.$... ...R...,v....;...J..)W....U..*T..R.@......OI......n._..........N'...~..j-=.~.[GVo.P...`..@..*..b.>......^...[.[..i.[k..S$....gng.&.?..y..F.....\...?..|..m...aiP.Lp%...."j.....r.%...*"("..`
<<< skipped >>>
GET /kategori_resimleri/1905201223530784719.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:39 GMT
ETag: "275f-4d75a647106c0"
Accept-Ranges: bytes
Content-Length: 10079
Keep-Alive: timeout=5, max=74
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....F......9...$..]..4.....B@..1...$.#...ky.H.a.Y...RG...P...$.1..>........R.$.?....%Q.<...u-}..c...."N.u... -t.'e>t..._Z..<=....{.{....#....I..[....y#.:.......cJ4.zyt=..iic....Z...O.3...{._..8....ea....c.h_...I..8R......^.k.8....;>..;.. ...*T.S..!...n...I..[I%d,#..pz..-..3.d.N.u.A.W....."@.oo...........^gB...X|...k..c.NU........mY.i..] K....r....|I,.,........h....,d...*..9...G.J..S.3j...9.f..r[...=k.....?l..k..fa..........7...[.@....{n..F...[..2.I.X...3...g..........v..........g.L....^.o.....6....RM...*.i..G_.t`s8....4.8.8i`.....c.uYnu...\..v......W....&...(..H.n...>.N*?.~...-..D.B..c.........k.1h.d...V#.Gi....8.B..Q<\.9T..wg..'Z...[.bV.P.r.mC...3.......V...;.n.3..V.8.5....Wy'|.t..(.x.O.'...t.....M..^T...*..xd......^..D.z.5...N...."..FTE.\rq......Kyxt.y.. D.Nw?..]..Md.~.mam..i.e.rs.s\W..)7......e.i..QG....F..k.c..Z.....S..Q3............{.......Y..-....<.6.Oe=.....x..!i..H...&g
<<< skipped >>>
GET /kategori_resimleri/1801201310573249705.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:36 GMT
ETag: "1b99-4d75a64434000"
Accept-Ranges: bytes
Content-Length: 7065
Keep-Alive: timeout=5, max=73
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......(...(...(Q.....M.....b.Y...$q.wv'.@.I'.w&.=.......Z|k...... ..G.T...#.MF.....X<.!.......v...N1_K..(.......4..O.....kW.....*...pG......</..F.8.o.....d_..........{b..#...h...H.....I?..o.g.......^........Q.m..'....zo.....pm=..sA*..O.......!F.....h_.U...z....Q.m............=_....Ij............<...z.:5...B....s.....G_.....(...<.......D......z..u.lg.4.....,.......9.T%$L..) .A.t..?e....^..&..-..C......S...B.n...X...w..)..$O.]I...".......g.z.G.....^._.....%m..YL...J.b\..By..B..rW.........u\..SD.....V..xv.. .Ic.`]XF...cVE.Z..d...L(.e .......(...(...(...(...(...(...(................... D..O.j1..V.....{..by#.wl}..~./^..i.e..y.....]\8.(.B.#.....I8....g.. ....W..8...5....@........T......................F,...;.`?.....?.g...........\.....?......................?k.?...x?..s...i.....~.d.[.1../........g...........\.....~.. .....O.A.?....&.....k2.1|2`;..<p..-|i.........Q....|Z.|_.6.Mk..J]"..L.6.v..
<<< skipped >>>
GET /kategori_resimleri/1704201313161020470.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 17 Apr 2013 10:16:10 GMT
ETag: "2201-4da8bc65aee80"
Accept-Ranges: bytes
Content-Length: 8705
Keep-Alive: timeout=5, max=72
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...l.W...QQ.Ni|.EO:.'}..L........;...M0.%..YY.S........E....(...(...(...(...(...(...(... ....t... u.kzN.l.....;h..p.@5..t. ............_.....!..Y..M2.K.-..'....[9...&..[..I..9!.....^..\>w_....aF.)U..\.....j..n..fX.a..N<..I/3......So...z/......{>B.x.....TrO. ..m......<% F....fN..x.S.G.J.yg...y_.........n.y..M.dA...1.$.....=.W.xW..-.)x).I>.[j.....k..hq.......}...oC..........g'....m'.......<..?.s..=.V.L....q.J.....L..2..u.Tu......a.]J..[./.. ..G...;m..O.-...x.......V.g/.......2.C........Gk.....O..$......C...L#u...q...........&...Y..R.........y...c..e..4j2N.(....._..n....*.QF..j..ox.)'...g...3.b...E]_E.g....y..ko.[..?e..Y.Gm.\... .H...s.iG.1...K..u........|.&.....=/n.....7...8g.k.'..o....0.........] ...a..V.T..$Q8..7 .8.$`..|C......xr=.g.....p.S.....<.'...v..nqZ.j..!ME..R5f...s._}..:I...J..e. .5...(O.......B>..'......<s....:M...-......f...%)$S7*\....`k...m.q......4...Q.. .
<<< skipped >>>
GET /kategori_resimleri/1704201315043081365.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 17 Apr 2013 12:04:30 GMT
ETag: "1bb5-4da8d49c90f80"
Accept-Ranges: bytes
Content-Length: 7093
Keep-Alive: timeout=5, max=71
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...(...(....;.U..P)~./.....4...'.e...r..&.....<....M.GEI.Y............9?..@..R}._..'..h.,...O....tT.e..y...|.>./.....4...'.e...r..&.....<....M.GEI.Y............9?..@..R.IOH.?..K.)..........~.7.....4}.o../..h.**_.M..<....M.b..yK..|......S..)...G.....R...&."......._....)..........I.Dp..}...........~.....)..t...^6...4=.D..u..;h.......T.y8.&...o........-xw.... ..?T.V...a.I..r|..&.....fV\.0.......8...*o..?.^....k.c.3..m......l....x...=..n.2......@.....c*ar.4.%y%}.D|.......t?....._...i..~..w..Q..k...W.H..|U...g?;..... .c......C.............M......t..B.....{T.......*.b.y..W...c].....A......~(h..Ge..}w^.R.X...[B?...1.....?../.V_......0.4....O.Z.......kn[>..b=.tb.I}z.:)r.E...1.....Vw...G.g.?h_.>1.........zF.....;.1..%$...<S...../..\...=..A........8.x. ...~.|.....| ...D..*..j............qs.FfU.K....v....,..q.3...'.|E..........(x..O.H..........kw
<<< skipped >>>
GET /kategori_resimleri/1905201223512202464.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:37 GMT
ETag: "3497-4d75a64528240"
Accept-Ranges: bytes
Content-Length: 13463
Keep-Alive: timeout=5, max=70
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....... ON.....I}............q...~#.WE.7......'....E/.....}>..!W.u...!Ibq.s_..........'..mln..........Is1.,. ......M.J..#./..f...1.m..f..*...n..>...G.......N....'.5.!.7JLW.w.".]..........A"....e_.x..H.B......]... .. [u..1..v2...;..r.../.....o...J..vw ...w^'.x,...t.<..8....Pp1.K.._.>...7t?.\.......:..u.V.".....p...H.......@.$.?.bM.N...g}\.=..VVv?.]_....O@.$z.....f.A.i.X:.....Y....YL.f.yx......>.....?.hfh.-bt.`..2! .p .....@..6........V.0F.z\....Ze.."...n.F..A`.JF.*..[.....n...#....5.....h.O..uS.....g.c...3....21.,.Q.u..c*.:S....?......jB....3.....?.....m..>..KE....lM.k.j..i...X.@....8bH.$..?.^#...5.....y.[....y$.Pz......k..b=.9.Z^g."...^d...4s.P9<.....:.d..~...d...>"Z.2..4... X...V...........F.D..)\.....J)..$..<......O......#.....4[.Z... _"..!...!Pv.~..../..K................q.:..k`..H.X.E....#.?0Q"..d.......?....`...[..:.. .}..i.y...6.6UX,bF'9...X.|h.4...\...7.;....G.....e.'^
<<< skipped >>>
GET /kategori_resimleri/0210201211160921931.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:34 GMT
ETag: "27f6-4d75a6424bb80"
Accept-Ranges: bytes
Content-Length: 10230
Keep-Alive: timeout=5, max=69
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....GH.Tx.)......m.-..d)..w......=......-......^*.O....Z.#R..S....t..Pc.. .....~!km..hv...q.T.b....a........T3..l.....~..5..#.......Y,.y.1.#.SY.^N..m...3V.4..x..6.:N."..d..M...F...PA|........[...Z_..kq...>O...=.gK.....\4...t)...W.......*X|.;M...^.sPi.%...}.O..(....a.9#D....1.u....Q.%..fb.H.rq..[R.l.|....k.._..V.....F..~..9#5$.D...6i..._....D.p&WI.P0F.. ....y...<.=k...-..sp....`..t..........'............!..S....lG......p.\...!Rm........A. #'?.tz7...h...... CQ.).$..?...T.2.. @~.)....|uol..~....7.p..Xh^1../.E.o...9...x.X..E......O...yQ.A....U......$.H..5........$..>.F.R....GL..._.Z}.K......s.]J..E.[._.BV.-...".\jv.w..(|.0...A....h.eV=..5.DIpr..GN.J9{.:...d.X....R....2.@...t.M..Ml.U...c.?..u-....$.I.d.4.%sY..'.^BC:'<..~5.c.E..d.>.B....|..o..|. ..%.{[.>...Vf8...6. .1...x..;$.[y...*l.}7/U8.."..2..{..so`....^.Q|. ..b........r6..4...# ...... ....^..5..6.....Z8..........y...%..}.4R .80..HzH..
<<< skipped >>>
GET /kategori_resimleri/2304201312262357277.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Tue, 23 Apr 2013 09:26:23 GMT
ETag: "1a4e-4db03c75d2dc0"
Accept-Ranges: bytes
Content-Length: 6734
Keep-Alive: timeout=5, max=68
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..........V?h_..u.. ..i.............._..J...h...(...(...(...(...(...(...(...(...(...(...(...(..o.,...c......W.... ...[..'..)X....}.....J.....QN.}?ZB1@.E.P.E.P.E....(..AZ.J)v}..JS...@.......PF(...(.h....iW...m.......*....Z..[ ...f...E4.M...(QNt1...aM..E.P....V..........O..e......G.1..........]...7.....).S..#..W....u....?.m.R.9..:.....~.g...{..|u.k.....O..ie.8...H.9.. ....W._....V....s.5Kk.[..x..o..Wj.y......,.....5.J.T}..~[.U.O.{(4...........C.|I...<9.......g...B.4.0....m4.l_.:]..27.|..(?.~..j..S.........o.j...}...$.P..Y.%..1...m..p......~.:..o.V.......>.u.Y.....6..v.7F..e..P.Fk.xT.yF..O.9#...,....W.....?.%......QO.;.j.........{...]r0kC..........k..x....p.%..Z...r .........W...[.Zw.mo.^.......g.hZM..c$lp.E.'.l..zc.W....b...........X.}a....X.... ..)n.../p..N...= .....w.6.*...e.........B.R.I.....B.y4..........o.&.....k3XY|8.;.n7H....8.........G.....]...~.i...5.F.K... ....TRD.,;....\q^[.......?k....
<<< skipped >>>
GET /kategori_resimleri/2612201216500218344.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:20 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:41 GMT
ETag: "2cbe-4d75a648f8b40"
Accept-Ranges: bytes
Content-Length: 11454
Keep-Alive: timeout=5, max=67
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......u.O...y..V.s.....>c6..........25$...........'.........-. .m.......<.......h...?2._j.-..pz...B...j...x.A__.jxm....s.J. ;...^.2..6z.T..qf..#...1...J.....G.(...O5.7.t.T..Y....Y..k.._:o..Gt.`. 9.=)..).V..?`....).p...z-..R".m .......S....*F.....6R"..N..>..KVjl..,7...C.m.-.....1..?.<.Q./.V....A.$..&....X..~.?..0{._..y<-.......!..H....#0e..v.%..X.1^.&..|x...jW...kp*...h1."..$.f.....~..eI[.Y.......*..N..r....o.N..<....O....9..)...YZ.D..A..V..g?..}6.o.,.ky.\.9...5.jw-r.`...J....j.%...MK...^.._..X4.Q......u.*. .Olt5..1l....$<~.......H..R....A7w.`Y.'v.)....>..?.....t.d.........r7..j...f.......k....%....9 .....D.epz{UH...R..9.^i.}.;)'$.|`>.'...%t.x...ud...UQH...:V.......0..f....9.[.P...T.F:.5\..."m .H....0.....*....B.s....Q...{j.......6.*w`...............#... .(9....K..)....{.....H....WS.;[A..... ...u.f.....rA.K.;.g..9..m_Z......q..D........FkgG./.<]d..g.|K{ev..$P...V(W..... ..
<<< skipped >>>
GET /kategori_resimleri/1103201404255902734.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:21 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Tue, 11 Mar 2014 02:25:59 GMT
ETag: "11c54-4f44b70cc3bc0"
Accept-Ranges: bytes
Content-Length: 72788
Keep-Alive: timeout=5, max=66
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......Y..._..-...k...t.K.........Ff....I..WG........_.........g.. ..........]}.y..0w.......y...h.....Q..B..T.?..z....?....?.U...........;.G....S.......P......|(...W..*w..v..`....*...N......Q@.C........_......?..........;..;^.E.y..0w.......y...h.....Q..B..T.?..z....?....?.U...........;.G....S.......P......|(...W..*w..v..`....*...N......Q@.C........_......?..........;..;^.E.y..0w.......y...h.....Q..B..T.?..z....?....?.U...........;.G....S.......P......|(...W..*w..v..`....*...N......Q@.C........_......?..........;..;^..P.h.............;..;G.0w.......y...k..sFy..!o.?.H..*...N.......3......E....^n'....]?7.......m/.......|..i.)p...j....(..<.......:.j.g.."..8...U..s..3f.....J...../.7.~..Z...\.F..0=.%...=Tj...M.\....a....(......x.A....x7..(7.<.#...-.c....<?.o.....|'....k.N.|....$..?..ER|..A!...N..?O:.....`/...Z......xZV.......:..vZ....J\*.......@........^H.~..j...R.m.......1...U..eI92.J........K.3x..
<<< skipped >>>
GET /kategori_resimleri/1905201223520202044.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:21 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:38 GMT
ETag: "1cf6-4d75a6461c480"
Accept-Ranges: bytes
Content-Length: 7414
Keep-Alive: timeout=5, max=65
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(....1.@p{...I.z...E.P.E.P.E.P.E.P.E.P.E.P.E............q.:..."}....y6.3.......)...A.I.fi."..n.`.x..N...H..y|..cz..F.G...r....."r..3..X~!......0.j.!..........V....U].#.....7._.|;..~*.^..Q......m.l-M...e...c%.C3......G..8.. ...^......U.!..u........v.........<.a.. w?H.O...$jT.U...f... e......[\Cs..tr....z......-..\.....6.........7.;-G.:...sM..S...{.....{......]B.9.q_.s.-...g9$..z.....R..V>{.8f.A...i.i{..k...........U8.R....LS..>..v.n....tY... .\..zt5E..y..[=3.y..K.v..t#.i6L.m......=}...PI=..W.L*...^...GV...=........w..z.....'...Z../..TE.....``..{}y.A.B.r...N....C..U.b..=.....j..(...H.D.;.8...<.kU.<....q.....f..PL..3. ....T.2.x......oT..}..Z. .3.S~...n.8...0.. ..h.........Gl...}.........5 .*._,Q.;..'.......V...`...N............W...o. ......OQ....>".......<Nmg...,...`..G.oi2.>ef..s.6.N...s.~........]..o.v..6.)7.~...b....T.?6.O..^(..7.y..9a({U....p.....>ZSq...T.g...s..._.t..
<<< skipped >>>
GET /kategori_resimleri/1905201223531548098.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:21 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:39 GMT
ETag: "20a3-4d75a647106c0"
Accept-Ranges: bytes
Content-Length: 8355
Keep-Alive: timeout=5, max=64
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(.....'...q..x..G...O.....k...lt.?qH..|4.?.4.y.....k.ms..-......to.j..G.`........`P..E.J.Wo..*(G.Z..c.r...k......?......x.X.H..YcW ......4............w..'...#Csa...0.{.....1.............>;...7..}[\.G.4y.ne...........qa. .0.<...'..1...... ..c.\I.....i....................e.....PYe.{h\.p.]..............;........or.HE...k..QrQH.....W.'.E...._..4]1...t..u.n..Y..X.$....?......J..../....mm.x..Q....3...........2\m>...#.0.0u1..q.%.mo..O^.3....sJY.,.".eZq.....Ev..].G...O. C.....2Og|r...2..N.8<.....&b2..8.s_.|a.-}...G......o.......$...-#s.[.......ny!..}.Z...n.........4p.T....\....j....BwKGt...C~.....l..8..K..uf........a..K.<g.......v.s.7.k.~.3,.#...f#...k..(..n....u.....I.p....x8......y......x...o....n......\G..QE..QE..QE..QE......?...~......j...ta-m.......B....d....n..........M..~..z ."...R....$x..(......PiI.P.z#......c.P|V...E.K........i.n......8.9.:.N[....F._.M.j....m...........p...x.{.^..
<<< skipped >>>
GET /kategori_resimleri/1905201223545295109.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:21 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Thu, 07 Mar 2013 19:05:40 GMT
ETag: "17e2-4d75a64804900"
Accept-Ranges: bytes
Content-Length: 6114
Keep-Alive: timeout=5, max=63
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.......................................................................d...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....(...(...(...(...(...h...O.h...@=r?:o...dP}.f.........k".-...$6.C..y...h22.....&....|Eno...9..H.E..Y.|.H*.&.9....9.@.A....9.......x../........./....mQ$]......D.......x85......8..};P..Q.z3@..f..(...(...(...(...h..-...p..FN9..u...eL....b..;.(%X6=.4.].........@...MiA^.k.....C.sc%.....k..`...y.......$..o.x..A..-..p.I.Iv.........V..~...5]X......K,....X$.).<.......}.n.........t..k.?....._....>.}...... _<YS ...Wf..Q.`g.J.......h......x..e............2.W..r.......u\d..QX...=........`.).4.!.X...n.A........3.7:HT7`.w..WQ...7.......s..~.....>..~...g.|9.x.V..........z....|.........eT(..q^.}.........h.......F.."o.{.u...kK..a.R:......~........-.q.7......|}....V.P.fn.&W....<!."|9...f.....?.u.D/.$o....#.U......7...c/.h.....G}......=.@#q.".>....Z.^.1.......|...W.............<mw..k.!}.XD.......N....O. ._J.N.m.L....=(...Q@.#7.y......\.....?.<-w.]Lb.4L...._...:.C...Z3.N....H...0...od.lE...G?.x
<<< skipped >>>
GET /kategori_resimleri/1103201404500117596.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:21 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Tue, 11 Mar 2014 02:50:01 GMT
ETag: "7d49-4f44bc6bf6840"
Accept-Ranges: bytes
Content-Length: 32073
Keep-Alive: timeout=5, max=62
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....`.`.....C....................................................................C.........................................................................A.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....?.?............u..?7....I.ZE}..,.G4......$rM.e.'.B...#....[.AW?........D.f..l.n.@.....<d} .N.n.5......Ueg$0'.E.Q.....$0....#V?.m...............|Y..........G...oC........c#.`..I9..l....?.|U.xj....B......q:..>^.......7.[m~..>'|?I.....Va.#.._._.......G.E... x.....-......5.~. ..<7-&@..>:..k.._........O....:............[I..=.?<|....\C.X.....uc.-k..........8.J..~..).....5.G.O.....0.K.'U..;i>....27...\.. .T...._.....q.....M.c..x..[...&.u..[...j.i..(df..B0G...v>......m...f...|x./....U.O....j.".......1.N..... .<U.3lO.[tk^.....i.......*..F........O.y#.W...........C.?..........|-.{C.....]...e}.kV....O.47q0R...0...[......QM,.D..;.V....J>....I...U..rO.(......k...?..]GQ...'D.dD..U\......k.........._..............K....*..$*.A....O...."..e....U..E...8".5 ............]..M...[............I..]O.Z<m.. ......MT|Q3i..%.5..............6..:\.\ ..Y...G8?Z...@....6...o..~..W...u..?7........
<<< skipped >>>
GET /js/login.js HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:21 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Sat, 19 May 2012 01:06:26 GMT
ETag: "238-4c05947332880"
Accept-Ranges: bytes
Content-Length: 568
Keep-Alive: timeout=5, max=61
Connection: Keep-Alive
Content-Type: application/javascript
function emailclear(deger){if(document.getElementById('email_giris').value=="Email Adresiniz"){document.getElementById('email_giris').value="";}}function emailget(deger){if(document.getElementById('email_giris').value==""){document.getElementById('email_giris').value="Email Adresiniz";}}function passwordclear(deger){if(document.getElementById('sifre_giris').value=="Sifreniz"){document.getElementById('sifre_giris').value="";}}function passwordget(deger){if(document.getElementById('sifre_giris').value==""){document.getElementById('sifre_giris').value="Sifreniz";}}HTTP/1.1 200 OK..Date: Fri, 09 Jan 2015 17:46:21 GMT..Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4..Last-Modified: Sat, 19 May 2012 01:06:26 GMT..ETag: "238-4c05947332880"..Accept-Ranges: bytes..Content-Length: 568..Keep-Alive: timeout=5, max=61..Connection: Keep-Alive..Content-Type: application/javascript..function emailclear(deger){if(document.getElementById('email_giris').value=="Email Adresiniz"){document.getElementById('email_giris').value="";}}function emailget(deger){if(document.getElementById('email_giris').value==""){document.getElementById('email_giris').value="Email Adresiniz";}}function passwordclear(deger){if(document.getElementById('sifre_giris').value=="Sifreniz"){document.getElementById('sifre_giris').value="";}}function passwordget(deger){if(document.getElementById('sifre_giris').value==""){document.getElementById('sifre_giris').value="Sifreniz";}}....
<<< skipped >>>
GET /images/login_key4.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:22 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 30 May 2012 17:57:30 GMT
ETag: "d09-4c144af4f7680"
Accept-Ranges: bytes
Content-Length: 3337
Keep-Alive: timeout=5, max=60
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR... ...........^?....pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>
GET /images/kredikarti.png HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:22 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Fri, 26 Apr 2013 15:13:20 GMT
ETag: "1ca5-4db44f9ad8400"
Accept-Ranges: bytes
Content-Length: 7333
Keep-Alive: timeout=5, max=59
Connection: Keep-Alive
Content-Type: image/png
.PNG........IHDR...h... .......=.....pHYs................ cHRM..z%..............u0...`..:....o._.F... IDATx...y..U...k..3.....@ .!...$$@.xE.AA.A.q ....p....9 *...^...^@F!.\..b..$..2w...cNw.s..^.........z.z.t..=......F....6.u......Z.U..."x..U.{..PU....(....*.G.TD.*....*^@.A@.ST.P...Q.^@..D.....Kh.P.. ("....=...[.p...&..o..5G..[......>}...}..sU.:.Dx/ .dcV..cP.... .....C....... a......m....Q.8R....^..Y.1........#..bkQcH.a$E. .*...l..=|R........../.......Z....Y..^6m.hL....K.U.b<..D#..TI.%..H.`A..$.....@- .[%G...5.q.O....xb....P....S....E..B..(N<....y......F.#.Qm.Q.....-].....Xc@..AQT...x.3...1.......A.A...`m"........z.......".8..x...5.!oD1*.........;.q... 5V.7t....>.E........ ...\.l.8..4.0[.....mJQc...SkxE.y.5..o.lj.I.%....G.[.;j...=`''..f..].<...:..=...:jX.....ZY.k....m.'.*.o.,^-^=H.G0..a..n....K.....O...p....x..H.`.....P...`%a.A5.&.&..oM......[....&4...1.,..^ak...U....I.".7.T.....x....O.T}......:>`wQ'.a.~p..<.s...........?.NWKS..S...R....k.......... ..|....0.......e..~|.._...7.P.E.{,..Z.OQM..D>..Yl..=..m..9.j.p..$x.dV....1.(.*6[>c.2....T...*.$x.C.-.i...c.....{g...Y..m~.@.Bm.@>...=k.t....(..kP.$F.%....K...... .....a.b5`...@.08f..~..|.6rq|. .L.Ph...x.K...##.[.].<.1......@-4 g~d7g........?.GWG...K...:Dr.q.J......MA....`LR.(X.&.F.<X.u>,&Y....2d.....0.l..W...{..^=.....CP.....N3...2" @^...l..C5.1.-.. &....ht=<\x....H...5&@g@...CCW....*>ez...w?......o....w.........H..c.'.1..%Ezk..s.Um.x.n...4V..H..nPE.g.C...... 0".s9l..x..../..d...&.`5.Q.*.p..I5..a......2..TP...8.....01......
<<< skipped >>>
GET /images/left_menu.jpg HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2015 17:46:22 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Wed, 30 May 2012 17:57:23 GMT
ETag: "2a0-4c144aee4a6c0"
Accept-Ranges: bytes
Content-Length: 672
Keep-Alive: timeout=5, max=58
Connection: Keep-Alive
Content-Type: image/jpeg
......JFIF.....H.H.....C....................................................................C.......................................................................(...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..............O..........4V7......Q@..h...?.E.P.......
GET /sa.js?_salogin=leqo&_sav=4.3 HTTP/1.1
Accept: */*
Referer: hXXp://onlinehile.org/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: srv.sayyac.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 09 Jan 2015 17:37:21 GMT
Content-Type: application/x-javascript
Content-Length: 4083
Last-Modified: Fri, 09 Jan 2015 12:03:05 GMT
Connection: close
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Cache-Control: public
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-Ranges: bytes
var sayyac={_version:'4.2',_login:'*',_secure:("https:"==document.location.protocol)?true:false,_visit_period:30,_c_path:'/',_c_host:document.location.host,_cust_host:false,_c_s:false,_sai:'',_saf:'',_sas:'',_sav:'',_i:false,_td:null,_init:function(){if(this._i==true)return;this._i=true;var a=this._login;if(!this._cust_host){if(this._c_host.indexOf('VVV.')==0)this._c_host=this._c_host.substr(4)}document.cookie='_sacc=1';this._c_s=(document.cookie.indexOf('_sacc=')==-1)?false:true;document.cookie="_sacc=;expires=Thu, 01-Jan-1970 00:00:01 GMT";var b=document.cookie.split(';');var c='';var d='';var t='';var i=0;for(i=0;i<b.length;i ){c=b[i].split('=');d=c[0].replace(/^\s |\s $/g,'');var e=null;var f=null;if(c.length>1){e=unescape(c[1].replace(/^\s |\s $/g,''));t=e.split(',');f=t[0];if(f!=a)continue;e=t[1]}switch(d){case'_sai':this._sai=e;break;case'_saf':this._saf=e;break;case'_sas':this._sas=e;break;case'_sav':this._sav=e;break;default:break}}var g=new Object();g.v=this._version;g.je=1;g.ce=this._c_s;if(typeof(screen)=="object"){g.col=screen.colorDepth;g.res=screen.width 'x' screen.height}else{g.res=g.col=''}g.fv='x';g.cs=(document.charset!==undefined)?document.charset:(document.characterSet!==undefined)?document.characterSet:'undefined';g.loc=document.location;g.ref=document.referrer;g.first_time=new Date(0);g.last_time=new Date(0);g.time=new Date();g.id=this._cai;g.a_u=g.y_u=g.m_u=g.w_u=g.d_u=g.wd_u=g.dh_u=g.nv=0;if(g.ce){var h=this._sav;h=(h==null)?[0,0]:h.split('.');var j=this._sas;var k=this._saf;if(k
<<< skipped >>>
GET /icon.gif HTTP/1.1
Accept: */*
Referer: hXXp://onlinehile.org/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: srv.sayyac.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 09 Jan 2015 17:37:21 GMT
Content-Type: image/gif
Content-Length: 970
Last-Modified: Sun, 06 Nov 2011 19:46:07 GMT
Connection: close
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000, public
P3P: policyref="/w3c/p3p.xml", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-Ranges: bytes
GIF89a).&....jj...VRR..[.jk.hi.TU...H.........NPnhhi......ST.....Umif.TV.......km.ST..u....h.kWX.'%i..^..;(%......c.....s..~.!nNO...U........`{{.gS.yz.... ".,.v...BDf^`.iX.z}.AB.$'Z]^..9v.3\,-:k7.1.....DD.!.......,....).&....@.pH,..Hcc.J....tJE5..a6....Z.g.(;Z..z.h..l5....E)...X..... e~....?vBy.............."("........8..8..........".............w...l..i..i.B..k......8...j.,......&&6.6.........i..1....66/.. .L....x.p......x..B.(0..Z.Z(<......p\...A..._..8...v....@.&....H..........d..c..2k.........`.@!.E., ..&"&R.J/Dm.c@..9.P..c....XZ..I..._u..0@...."........\T...D..:%H.......#...!....B'.-...v...^..g...b..."....s.6.X....c ..#BI..44..\...\g@.>]...$...0b...:.....y...6.W?.....>h@.CC.....'......M `{...A...w...-.....cA.3..^..f..n....!.%..!.$..!W.Z0..........B.%..c.1. .......%.h#...P..8....:..c..X...T")$.E..B.......L`..2.x..7T.A.M....2...._."..7....o.y..7..&...Z..y..........B.....y....qG........y...f.I..X.(...Jh....''Y.`...............@..za..w4....6....F........;..
GET /undefined HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 404 Not Found
Date: Fri, 09 Jan 2015 17:46:22 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Accept-Ranges: bytes
Content-Length: 113
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>....
GET /undefined HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 404 Not Found
Date: Fri, 09 Jan 2015 17:46:22 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Accept-Ranges: bytes
Content-Length: 113
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html
<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>....
GET /undefined HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 404 Not Found
Date: Fri, 09 Jan 2015 17:46:22 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Accept-Ranges: bytes
Content-Length: 113
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html
<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>....
GET /undefined HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 404 Not Found
Date: Fri, 09 Jan 2015 17:46:22 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Accept-Ranges: bytes
Content-Length: 113
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html
<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>....
GET /undefined HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 404 Not Found
Date: Fri, 09 Jan 2015 17:46:23 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Accept-Ranges: bytes
Content-Length: 113
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/html
<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>....
GET /undefined HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 404 Not Found
Date: Fri, 09 Jan 2015 17:46:23 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Accept-Ranges: bytes
Content-Length: 113
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: text/html
<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>....
GET /undefined HTTP/1.1
Accept: */*
Referer: hXXp://gamecrea.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gamecrea.com
Connection: Keep-Alive
Cookie: PHPSESSID=550d47d9117ff6a806d45f415043c2e8
HTTP/1.1 404 Not Found
Date: Fri, 09 Jan 2015 17:46:23 GMT
Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Accept-Ranges: bytes
Content-Length: 113
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: text/html
<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>HTTP/1.1 404 Not Found..Date: Fri, 09 Jan 2015 17:46:23 GMT..Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4..Accept-Ranges: bytes..Content-Length: 113..Keep-Alive: timeout=5, max=94..Connection: Keep-Alive..Content-Type: text/html..<html>.<head>.<meta http-equiv="refresh" content="0; URL=hXXp://VVV.gamecrea.com">.</head>.<body>.</body>.</html>..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
klauncher.exe_212:
.text
.text
`.data
`.data
.rdata
.rdata
P.idata
P.idata
@.edata
@.edata
@.rsrc
@.rsrc
@.reloc
@.reloc
Windows
Windows
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
MSH_SCROLL_LINES_MSG
uxtheme.dll
uxtheme.dll
shell32.dll
shell32.dll
USER32.DLL
USER32.DLL
MAPI32.DLL
MAPI32.DLL
comctl32.dll
comctl32.dll
DWMAPI.DLL
DWMAPI.DLL
TaskDialogIndirect
TaskDialogIndirect
ssShift
ssShift
htKeyword
htKeyword
EInvalidOperation
EInvalidOperation
%s[%d]
%s[%d]
%s_%d
%s_%d
%s, ClassID: %s
%s, ClassID: %s
ole32.dll
ole32.dll
kernel32.dll
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
oleaut32.dll
EVariantBadIndexError
EVariantBadIndexError
clWebSnow
clWebSnow
clWebFloralWhite
clWebFloralWhite
clWebLavenderBlush
clWebLavenderBlush
clWebOldLace
clWebOldLace
clWebIvory
clWebIvory
clWebCornSilk
clWebCornSilk
clWebBeige
clWebBeige
clWebAntiqueWhite
clWebAntiqueWhite
clWebWheat
clWebWheat
clWebAliceBlue
clWebAliceBlue
clWebGhostWhite
clWebGhostWhite
clWebLavender
clWebLavender
clWebSeashell
clWebSeashell
clWebLightYellow
clWebLightYellow
clWebPapayaWhip
clWebPapayaWhip
clWebNavajoWhite
clWebNavajoWhite
clWebMoccasin
clWebMoccasin
clWebBurlywood
clWebBurlywood
clWebAzure
clWebAzure
clWebMintcream
clWebMintcream
clWebHoneydew
clWebHoneydew
clWebLinen
clWebLinen
clWebLemonChiffon
clWebLemonChiffon
clWebBlanchedAlmond
clWebBlanchedAlmond
clWebBisque
clWebBisque
clWebPeachPuff
clWebPeachPuff
clWebTan
clWebTan
clWebYellow
clWebYellow
clWebDarkOrange
clWebDarkOrange
clWebRed
clWebRed
clWebDarkRed
clWebDarkRed
clWebMaroon
clWebMaroon
clWebIndianRed
clWebIndianRed
clWebSalmon
clWebSalmon
clWebCoral
clWebCoral
clWebGold
clWebGold
clWebTomato
clWebTomato
clWebCrimson
clWebCrimson
clWebBrown
clWebBrown
clWebChocolate
clWebChocolate
clWebSandyBrown
clWebSandyBrown
clWebLightSalmon
clWebLightSalmon
clWebLightCoral
clWebLightCoral
clWebOrange
clWebOrange
clWebOrangeRed
clWebOrangeRed
clWebFirebrick
clWebFirebrick
clWebSaddleBrown
clWebSaddleBrown
clWebSienna
clWebSienna
clWebPeru
clWebPeru
clWebDarkSalmon
clWebDarkSalmon
clWebRosyBrown
clWebRosyBrown
clWebPaleGoldenrod
clWebPaleGoldenrod
clWebLightGoldenrodYellow
clWebLightGoldenrodYellow
clWebOlive
clWebOlive
clWebForestGreen
clWebForestGreen
clWebGreenYellow
clWebGreenYellow
clWebChartreuse
clWebChartreuse
clWebLightGreen
clWebLightGreen
clWebAquamarine
clWebAquamarine
clWebSeaGreen
clWebSeaGreen
clWebGoldenRod
clWebGoldenRod
clWebKhaki
clWebKhaki
clWebOliveDrab
clWebOliveDrab
clWebGreen
clWebGreen
clWebYellowGreen
clWebYellowGreen
clWebLawnGreen
clWebLawnGreen
clWebPaleGreen
clWebPaleGreen
clWebMediumAquamarine
clWebMediumAquamarine
clWebMediumSeaGreen
clWebMediumSeaGreen
clWebDarkGoldenRod
clWebDarkGoldenRod
clWebDarkKhaki
clWebDarkKhaki
clWebDarkOliveGreen
clWebDarkOliveGreen
clWebDarkgreen
clWebDarkgreen
clWebLimeGreen
clWebLimeGreen
clWebLime
clWebLime
clWebSpringGreen
clWebSpringGreen
clWebMediumSpringGreen
clWebMediumSpringGreen
clWebDarkSeaGreen
clWebDarkSeaGreen
clWebLightSeaGreen
clWebLightSeaGreen
clWebPaleTurquoise
clWebPaleTurquoise
clWebLightCyan
clWebLightCyan
clWebLightBlue
clWebLightBlue
clWebLightSkyBlue
clWebLightSkyBlue
clWebCornFlowerBlue
clWebCornFlowerBlue
clWebDarkBlue
clWebDarkBlue
clWebIndigo
clWebIndigo
clWebMediumTurquoise
clWebMediumTurquoise
clWebTurquoise
clWebTurquoise
clWebCyan
clWebCyan
clWebPowderBlue
clWebPowderBlue
clWebSkyBlue
clWebSkyBlue
clWebRoyalBlue
clWebRoyalBlue
clWebMediumBlue
clWebMediumBlue
clWebMidnightBlue
clWebMidnightBlue
clWebDarkTurquoise
clWebDarkTurquoise
clWebCadetBlue
clWebCadetBlue
clWebDarkCyan
clWebDarkCyan
clWebTeal
clWebTeal
clWebDeepskyBlue
clWebDeepskyBlue
clWebDodgerBlue
clWebDodgerBlue
clWebBlue
clWebBlue
clWebNavy
clWebNavy
clWebDarkViolet
clWebDarkViolet
clWebDarkOrchid
clWebDarkOrchid
clWebMagenta
clWebMagenta
clWebDarkMagenta
clWebDarkMagenta
clWebMediumVioletRed
clWebMediumVioletRed
clWebPaleVioletRed
clWebPaleVioletRed
clWebBlueViolet
clWebBlueViolet
clWebMediumOrchid
clWebMediumOrchid
clWebMediumPurple
clWebMediumPurple
clWebPurple
clWebPurple
clWebDeepPink
clWebDeepPink
clWebLightPink
clWebLightPink
clWebViolet
clWebViolet
clWebOrchid
clWebOrchid
clWebPlum
clWebPlum
clWebThistle
clWebThistle
clWebHotPink
clWebHotPink
clWebPink
clWebPink
clWebLightSteelBlue
clWebLightSteelBlue
clWebMediumSlateBlue
clWebMediumSlateBlue
clWebLightSlateGray
clWebLightSlateGray
clWebWhite
clWebWhite
clWebLightgrey
clWebLightgrey
clWebGray
clWebGray
clWebSteelBlue
clWebSteelBlue
clWebSlateBlue
clWebSlateBlue
clWebSlateGray
clWebSlateGray
clWebWhiteSmoke
clWebWhiteSmoke
clWebSilver
clWebSilver
clWebDimGray
clWebDimGray
clWebMistyRose
clWebMistyRose
clWebDarkSlateBlue
clWebDarkSlateBlue
clWebDarkSlategray
clWebDarkSlategray
clWebGainsboro
clWebGainsboro
clWebDarkGray
clWebDarkGray
clWebBlack
clWebBlack
olepro32.dll
olepro32.dll
PasswordCharlaD
PasswordCharlaD
OnKeyDownL
OnKeyDownL
OnKeyPress
OnKeyPress
OnKeyUpH
OnKeyUpH
ssHorizontal
ssHorizontal
OnKeyUp
OnKeyUp
TOleControl|%D
TOleControl|%D
AutoHotkeys
AutoHotkeys
\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\
\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\
EInvalidGraphicOperation
EInvalidGraphicOperation
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
ssHotTrack
ssHotTrack
TWindowState
TWindowState
poProportional
poProportional
TWMKey
TWMKey
KeyPreview
KeyPreview
WindowState
WindowState
GlassFrame.Bottom
GlassFrame.Bottom
GlassFrame.Enabled
GlassFrame.Enabled
GlassFrame.Left
GlassFrame.Left
GlassFrame.Right
GlassFrame.Right
GlassFrame.SheetOfGlass
GlassFrame.SheetOfGlass
GlassFrame.Top
GlassFrame.Top
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
User32.dll
User32.dll
Proportionall
Proportionall
OnExecute
OnExecute
{43826d1e-e718-42ee-bc55-a1e261c37bfe}
{43826d1e-e718-42ee-bc55-a1e261c37bfe}
%s%s%s%s%s%s%s%s%s%s
%s%s%s%s%s%s%s%s%s%s
TKeyEvent
TKeyEvent
TKeyPressEvent
TKeyPressEvent
HelpKeyword
HelpKeyword
crSQLWait
crSQLWait
%s (%s)
%s (%s)
imm32.dll
imm32.dll
IWebBrowser
IWebBrowser
IWebBrowserApp(nH
IWebBrowserApp(nH
IWebBrowser2\nH
IWebBrowser2\nH
TWebBrowserStatusTextChange
TWebBrowserStatusTextChange
TWebBrowserProgressChange
TWebBrowserProgressChange
TWebBrowserCommandStateChange
TWebBrowserCommandStateChange
TWebBrowserTitleChange
TWebBrowserTitleChange
TWebBrowserPropertyChange
TWebBrowserPropertyChange
TWebBrowserBeforeNavigate2
TWebBrowserBeforeNavigate2
TWebBrowserNewWindow2
TWebBrowserNewWindow2
TWebBrowserNavigateComplete2
TWebBrowserNavigateComplete2
TWebBrowserDocumentComplete
TWebBrowserDocumentComplete
TWebBrowserOnVisible
TWebBrowserOnVisible
TWebBrowserOnToolBar
TWebBrowserOnToolBar
TWebBrowserOnMenuBar
TWebBrowserOnMenuBar
TWebBrowserOnStatusBar
TWebBrowserOnStatusBar
TWebBrowserOnFullScreen
TWebBrowserOnFullScreen
TWebBrowserOnTheaterMode
TWebBrowserOnTheaterMode
TWebBrowserWindowSetResizable
TWebBrowserWindowSetResizable
TWebBrowserWindowSetLeft
TWebBrowserWindowSetLeft
TWebBrowserWindowSetTop
TWebBrowserWindowSetTop
TWebBrowserWindowSetWidth
TWebBrowserWindowSetWidth
TWebBrowserWindowSetHeight
TWebBrowserWindowSetHeight
TWebBrowserWindowClosing
TWebBrowserWindowClosing
TWebBrowserClientToHostWindow
TWebBrowserClientToHostWindow
TWebBrowserSetSecureLockIcon
TWebBrowserSetSecureLockIcon
TWebBrowserFileDownload
TWebBrowserFileDownload
TWebBrowserNavigateError
TWebBrowserNavigateError
%TWebBrowserPrintTemplateInstantiation
%TWebBrowserPrintTemplateInstantiation
TWebBrowserPrintTemplateTeardown
TWebBrowserPrintTemplateTeardown
TWebBrowserUpdatePageStatus
TWebBrowserUpdatePageStatus
%TWebBrowserPrivacyImpactedStateChange
%TWebBrowserPrivacyImpactedStateChange
TWebBrowser
TWebBrowser
OnWindowSetResizable
OnWindowSetResizable
OnWindowSetLeft
OnWindowSetLeft
OnWindowSetTop8uH
OnWindowSetTop8uH
OnWindowSetWidth
OnWindowSetWidth
OnWindowSetHeight
OnWindowSetHeight
%s:%s
%s:%s
kolebot.dll
kolebot.dll
hXXp://oyunkolonisi.com/
hXXp://oyunkolonisi.com/
208.94.241.66
208.94.241.66
213.229.102.70
213.229.102.70
94.76.208.12
94.76.208.12
KERNEL32.DLL
KERNEL32.DLL
\KnightOnLine.exe
\KnightOnLine.exe
" E03ED890-8E94-4B42-B1C5-3CDA401AA9C2
" E03ED890-8E94-4B42-B1C5-3CDA401AA9C2
\swixdorf.swx
\swixdorf.swx
KnightOnline.exe
KnightOnline.exe
..//kopath.ini
..//kopath.ini
loginstatus.kole
loginstatus.kole
autologin.kole
autologin.kole
alarm.mp3
alarm.mp3
kopath.ini
kopath.ini
..\kopath.ini
..\kopath.ini
kmodule.dat
kmodule.dat
..//loader.cfg
..//loader.cfg
hXXp://gamecrea.com
hXXp://gamecrea.com
hXXp://onlinehile.org
hXXp://onlinehile.org
\loginstatus.kole
\loginstatus.kole
C:\loginmutex.kole
C:\loginmutex.kole
psapi.dll
psapi.dll
user32.dll
user32.dll
EnumWindows
EnumWindows
ntdll.dll
ntdll.dll
advapi32.dll
advapi32.dll
EnumChildWindows
EnumChildWindows
EnumThreadWindows
EnumThreadWindows
Wininet.dll
Wininet.dll
FtpPutFileA
FtpPutFileA
*.klg
*.klg
kmodule.dat bulunamadi!
kmodule.dat bulunamadi!
kmodule.dat bozuk! yeniden indiriniz!
kmodule.dat bozuk! yeniden indiriniz!
_dbg.kole
_dbg.kole
Split IP: "%s"
Split IP: "%s"
Quald %d is %s
Quald %d is %s
Not a valid ip, quad: %d AND/OR quad:%d is zero
Not a valid ip, quad: %d AND/OR quad:%d is zero
Otologin DevreDisi
Otologin DevreDisi
webMaind
webMaind
tabotologin
tabotologin
chotologin
chotologin
tmautologin
tmautologin
WebBrowser2
WebBrowser2
WebBrowser3
WebBrowser3
WebBrowser4
WebBrowser4
tmautologinTimer
tmautologinTimer
xxtype.cpp
xxtype.cpp
derv->tpClass.tpcFlags & CF_HAS_BASES
derv->tpClass.tpcFlags & CF_HAS_BASES
Inappropriate I/O control operation
Inappropriate I/O control operation
Broken pipe
Broken pipe
Operation not permitted
Operation not permitted
%H:%M:%S
%H:%M:%S
%m/%d/%y
%m/%d/%y
%A, %B %d, %Y
%A, %B %d, %Y
d/d/d d:d:d.d
d/d/d d:d:d.d
xx.cpp
xx.cpp
varType->tpClass.tpcFlags & CF_HAS_DTOR
varType->tpClass.tpcFlags & CF_HAS_DTOR
varType->tpClass.tpcDtorAddr
varType->tpClass.tpcDtorAddr
(vbFlag && (errPtr->ERRcInitDtc >= varType->tpClass.tpcDtorCount)) || (!vbFlag && (errPtr->ERRcInitDtc >= varType->tpClass.tpcNVdtCount)) || flags
(vbFlag && (errPtr->ERRcInitDtc >= varType->tpClass.tpcDtorCount)) || (!vbFlag && (errPtr->ERRcInitDtc >= varType->tpClass.tpcNVdtCount)) || flags
memType->tpClass.tpcFlags & CF_HAS_DTOR
memType->tpClass.tpcFlags & CF_HAS_DTOR
varType->tpArr.tpaElemType->tpClass.tpcFlags & CF_HAS_DTOR
varType->tpArr.tpaElemType->tpClass.tpcFlags & CF_HAS_DTOR
dttPtr->dttType->tpPtr.tppBaseType->tpClass.tpcFlags & CF_HAS_DTOR
dttPtr->dttType->tpPtr.tppBaseType->tpClass.tpcFlags & CF_HAS_DTOR
IS_CLASS(dttPtr->dttType->tpMask) && (dttPtr->dttType->tpClass.tpcFlags & CF_HAS_DTOR)
IS_CLASS(dttPtr->dttType->tpMask) && (dttPtr->dttType->tpClass.tpcFlags & CF_HAS_DTOR)
elemType->tpClass.tpcFlags & CF_HAS_DTOR
elemType->tpClass.tpcFlags & CF_HAS_DTOR
_noParam.VType == VT_ERROR
_noParam.VType == VT_ERROR
variant.cpp
variant.cpp
_empty.VType == varEmpty
_empty.VType == varEmpty
VType == rhs.VType
VType == rhs.VType
C:\builds\Tp\emuvcl\utilcls.h
C:\builds\Tp\emuvcl\utilcls.h
'%s': %s @ %s/%d
'%s': %s @ %s/%d
(%s) Error: %lX (%ld) @ %s/%d
(%s) Error: %lX (%ld) @ %s/%d
Parms.VType == (VT_ARRAY|VT_VARIANT)
Parms.VType == (VT_ARRAY|VT_VARIANT)
ParmTypes.VType == (VT_ARRAY|VT_I4)
ParmTypes.VType == (VT_ARRAY|VT_I4)
wstring.cpp
wstring.cpp
ADVAPI32.DLL
ADVAPI32.DLL
VERSION.DLL
VERSION.DLL
COMCTL32.DLL
COMCTL32.DLL
COMDLG32.DLL
COMDLG32.DLL
GDI32.DLL
GDI32.DLL
SHELL32.DLL
SHELL32.DLL
OLE32.DLL
OLE32.DLL
OLEAUT32.DLL
OLEAUT32.DLL
RegCloseKey
RegCloseKey
RegFlushKey
RegFlushKey
RegOpenKeyExA
RegOpenKeyExA
GetCPInfo
GetCPInfo
GetProcessHeap
GetProcessHeap
SetViewportOrgEx
SetViewportOrgEx
ActivateKeyboardLayout
ActivateKeyboardLayout
GetKeyNameTextA
GetKeyNameTextA
GetKeyState
GetKeyState
GetKeyboardLayout
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardLayoutList
GetKeyboardLayoutNameA
GetKeyboardLayoutNameA
GetKeyboardState
GetKeyboardState
GetKeyboardType
GetKeyboardType
LoadKeyboardLayoutA
LoadKeyboardLayoutA
MapVirtualKeyA
MapVirtualKeyA
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
launcher.exe
launcher.exe
@Kaynak@WB_GetHTMLCode$qqrp19Shdocvw@TWebBrowserp16Classes@TStrings
@Kaynak@WB_GetHTMLCode$qqrp19Shdocvw@TWebBrowserp16Classes@TStrings
@Kaynak@WB_SaveHTMLCode$qqrp19Shdocvw@TWebBrowserx17System@AnsiString
@Kaynak@WB_SaveHTMLCode$qqrp19Shdocvw@TWebBrowserx17System@AnsiString
333333333333333333
333333333333333333
33333833
33333833
3333339
3333339
3333333333333338
3333333333333338
:*"*"$3338
:*"*"$3338
3333333
3333333
33333333
33333333
33333333333
33333333333
3333333333338
3333333333338
33338?383
33338?383
333333333333
333333333333
:*3:"$3338
:*3:"$3338
333333333333333
333333333333333
.EvEp
.EvEp
.Gw-3P
.Gw-3P
S.Fr3Fa
S.Fr3Fa
Font.Charset
Font.Charset
Font.Color
Font.Color
Font.Height
Font.Height
Font.Name
Font.Name
Font.Style
Font.Style
Icon.Data
Icon.Data
webMain
webMain
KinghtOnline.exe konumu:
KinghtOnline.exe konumu:
oto login
oto login
Oto Login Aktif
Oto Login Aktif
PasswordChar
PasswordChar
Items.Strings
Items.Strings
Oto login kaydet
Oto login kaydet
C:\NTTGame\KnightOnlineEn1\
C:\NTTGame\KnightOnlineEn1\
C:\NTTGame\KnightOnlineEn2\
C:\NTTGame\KnightOnlineEn2\
C:\NTTGame\KnightOnlineEn3\
C:\NTTGame\KnightOnlineEn3\
C:\NTTGame\KnightOnlineEn4\
C:\NTTGame\KnightOnlineEn4\
C:\NTTGame\KnightOnlineEn5\
C:\NTTGame\KnightOnlineEn5\
C:\NTTGame\KnightOnlineEn6\
C:\NTTGame\KnightOnlineEn6\
Lines.Strings
Lines.Strings
C:\NTTGame\KnightOnlineEn
C:\NTTGame\KnightOnlineEn
*.exe|*.exe
*.exe|*.exe
KnightOnline.exe goster
KnightOnline.exe goster
version="11.0.2902.10471"
version="11.0.2902.10471"
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
40484
40484
=#='= =/=3=7=;=
=#='= =/=3=7=;=
6 6$6(6,6064686
6 6$6(6,6064686
5!5%5)5-5
5!5%5)5-5
0-1M1}1
0-1M1}1
7 7$7(7,7074787
7 7$7(7,7074787
; ;$;(;,;0;
; ;$;(;,;0;
? ?$?(?,?0?4?8?
? ?$?(?,?0?4?8?
5$6(6,606
5$6(6,606
4 4$4(4,40444
4 4$4(4,40444
? ?$?(?,?0?4?8?@?
? ?$?(?,?0?4?8?@?
6 6$6(6,6064686
6 6$6(6,6064686
5 5(5,5054585
5 5(5,5054585
="=-=2=
="=-=2=
=(>_>"?{?
=(>_>"?{?
> >$>(>,>0>4>8>@>
> >$>(>,>0>4>8>@>
6 6$6(6,606
6 6$6(6,606
6l6K6p6
6l6K6p6
5 5$5(5,5054585
5 5$5(5,5054585
7084888
7084888
:)0-040~0
:)0-040~0
5 6/63686
5 6/63686
1 1$1(1,1014181
1 1$1(1,1014181
7%7s7|7
7%7s7|7
> ?,?0?`?
> ?,?0?`?
8(8,8\8`8
8(8,8\8`8
84888\8`8
84888\8`8
NUnable to retrieve a pointer to a running object registered with OLE for %s/%s
NUnable to retrieve a pointer to a running object registered with OLE for %s/%s
Failed to clear tab control Failed to delete tab at index %d"Failed to retrieve tab at index %d Failed to get object at index %d"Failed to set tab "%s" at index %d Failed to set object at index %d
Failed to clear tab control Failed to delete tab at index %d"Failed to retrieve tab at index %d Failed to get object at index %d"Failed to set tab "%s" at index %d Failed to set object at index %d
Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count
Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count
UTF-7Ênnot remove shell notification iconÊnnot create shell notification icon"PageControl must first be assigned"%s requires Windows Vista or later
UTF-7Ênnot remove shell notification iconÊnnot create shell notification icon"PageControl must first be assigned"%s requires Windows Vista or later
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design mode
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design mode
Unable to insert a line Clipboard does not support Icons
Unable to insert a line Clipboard does not support Icons
Text exceeds memo capacity/Menu '%s' is already being used by another form
Text exceeds memo capacity/Menu '%s' is already being used by another form
- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.
- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'
%s property out of range
%s property out of range
Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic
Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic
Unsupported clipboard format
Unsupported clipboard format
%Invalid variant operation (%s%.8x)
%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
Operation not supported
External exception %x
External exception %x
Interface not supported
Interface not supported
%s (%s, line %d)
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
System Error. Code: %d.
Privileged instruction(Exception %s in module %s at %p.
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
No argument for format '%s'"Variant method calls not supported
Invalid variant operation
Invalid variant operation
Integer overflow Invalid floating point operation
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid class typecast0Access violation at address %p. %s of address %p
Resource %s not found
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Property %s does not exist
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
DCOM not installed!'%s' is not a valid integer value
DCOM not installed!'%s' is not a valid integer value
'%s' is not a valid GUID value
'%s' is not a valid GUID value
I/O error %d
I/O error %d
Cannot open file "%s". %s
Cannot open file "%s". %s
Invalid file name - %s
Invalid file name - %s
Invalid stream format$''%s'' is not a valid component name
Invalid stream format$''%s'' is not a valid component name
Invalid data type for '%s' List capacity out of bounds (%d)
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Error reading %s%s%s: %s
Failed to get data for '%s'
Failed to get data for '%s'
No help found for %s#No context-sensitive help installed
No help found for %s#No context-sensitive help installed
Ancestor for '%s' not found
Ancestor for '%s' not found
Cannot assign a %s to a %s
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot create file "%s". %s