Gen.Variant.Graftor.116077_3c34522f47

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:1092

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1092 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\1GQ340U13[1].gif (527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\scbg[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\qmv16[1].swf (420546 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\jquery-1.2.1.pack[2].js (1740 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\ico[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\MagicWeaponv1240[1].swf (41613 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\bdsstyle[1].css (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\zb_nav_20131205[1].png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\c[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\jquery-1.2.1.pack[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\lazy_iframe[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\A4399dv_base[1].swf (8065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\flash_ctrl_version[1].xml (530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\tjrm_img011[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\pic[1].gif (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20141010[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\tjrm_img09[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\unilogin_package[2].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\crossdomain[1].xml (570 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\CASYO8RM.htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zrsp_1[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\4399_13510057915[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\t_3[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\t_2[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\googlevideoadslibrarylocalconnection[1].swf (34703 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\sy_ico[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20150115[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\play_hs1202[2].js (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (3504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\trace_news[1].js (559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\t_lm[1].png (1631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\crossdomain[2].xml (407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\n_zm1[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\jcsp_1[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\zwsf2-3[1].gif (1800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\zm_add[1].png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\021615139200[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\tjrm_img07[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\yt_blacklist_domains[1].txt (254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\t_8[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\logo[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\icon_keys[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\crossdomain[1].xml (842 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\b_3[1].gif (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\hottop[1].gif (857 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\faspbtn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\qmv16[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\bg_9[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\CAW1MFCT.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\4399_14511864345[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\CA63EB6D (1917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\crossdomain[2].xml (331 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\02104939B23[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\libg_2[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\tjrm_img08[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\more_zb[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\bg_7[1].png (6 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (435 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\game_bg[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\bg_3[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\b_1[1].gif (610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\ico_ann[1].gif (1 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s8.4399.com\settings.sxx (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\bg[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\061109192641[1].jpg (3204 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\yt_blacklist_domains[1].txt (478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\test_domain[1].txt (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\bdshare[1].js (182 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\shell_v2[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\78072[2].htm (4190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\t_4[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\c_5[1].gif (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\unilogin_package[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\bg_4[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\core[1].php (752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\c_2[1].gif (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\headerBg[1].gif (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\t_1[1].gif (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\chkDomain[1].js (554 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\topbg_20140506[1].jpg (4662 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[1].txt (924 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\right[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\bds_s_v2[1].js (2515 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\sp_line_1[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\FuYun[1].swf (18169 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[2].txt (1517 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\4399[1].js (902 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\more_boss[1].gif (588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20150115[2].css (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\is[1].png (3796 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\ico_1[1].gif (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\lmbtn[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\n_mg_bg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\lb_ico_v1[1].png (652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\121055423955[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\tjrm_img06[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\more_boss_s[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\libg_1[1].gif (899 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\logger[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\1016395W521[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\101634512c8[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\4399_17485812405[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\style[1].css (337 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\b_2[1].gif (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\tgbtn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\crossdomain[1].xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\ucenter[1].js (16593 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\libg_3[1].gif (542 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\031G3106195[1].jpg (10308 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\4399_18380750073[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\zj_btn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\CAQRWXMB.htm (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\ftbtn[1].gif (477 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\play_hs1202[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\b_4[1].gif (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\go_bbs[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\nav_bg[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\bg_8[1].png (1947 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\c_3[1].gif (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\4399[2].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\stat[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\xml[1].xml (574 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\c_1[1].gif (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\ecom[1].xml (233 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\s8.4399.com\seed4399Value.sxx (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\011K053B24[1].jpg (6296 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\new_icon_1[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\bg_1[1].gif (791 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\CAC5MZ41 (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\10163ZO2N[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\test_domain[1].txt (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\78072[1].htm (4926 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\left[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\bg_6[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\t_5[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\news_footer[1].js (961 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\googlevideoadslibraryas3[1].swf (1387 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\sszn[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\1Q62S330N[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\core[1].php (751 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@4399[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\31151042OF[1].jpg (2296 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\sc[1].gif (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[2].txt (435 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\0913524M015[1].gif (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\t_6[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\4399_17152503697[1].jpg (125 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\b_5[1].gif (317 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20141010[2].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\bg_5_20130716[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\t_9[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\qmv16[1].htm (1738 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\ctrl_mo_v5[1].swf (47840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\c_4[1].gif (81 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\click[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\base[1].css (10225 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\78072[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\CAC5MZ41 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\CA63EB6D (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\4399[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20150115[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\test_domain[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\qmv16[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\jquery-1.2.1.pack[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\play_hs1202[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\yt_blacklist_domains[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\crossdomain[2].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\unilogin_package[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[2].txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20141010[1].js (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s8.4399.com\settings.sol (0 bytes)

Registry activity

The process %original file name%.exe:1092 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040320150404]
"CachePrefix" = ":2015040320150404:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040320150404]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012015040320150404\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040320150404]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040320150404]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D 64 FB 4D 28 38 17 2A 22 A9 68 18 31 BD A6 22"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040320150404]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\1GQ340U13[1].gif (527 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\scbg[1].gif (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\qmv16[1].swf (420546 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\jquery-1.2.1.pack[2].js (1740 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\ico[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\MagicWeaponv1240[1].swf (41613 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\bdsstyle[1].css (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\zb_nav_20131205[1].png (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\c[1].php (1177 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\jquery-1.2.1.pack[1].js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\lazy_iframe[1].js (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\A4399dv_base[1].swf (8065 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\flash_ctrl_version[1].xml (530 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\tjrm_img011[1].jpg (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\pic[1].gif (719 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20141010[1].js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\tjrm_img09[1].jpg (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\unilogin_package[2].js (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (539 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\crossdomain[1].xml (570 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\CASYO8RM.htm (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zrsp_1[1].jpg (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\4399_13510057915[1].jpg (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\t_3[1].gif (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\t_2[1].gif (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\googlevideoadslibrarylocalconnection[1].swf (34703 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\sy_ico[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20150115[1].css (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\play_hs1202[2].js (4 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (3504 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\trace_news[1].js (559 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\t_lm[1].png (1631 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\crossdomain[2].xml (407 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\n_zm1[1].png (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\jcsp_1[1].jpg (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\zwsf2-3[1].gif (1800 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\zm_add[1].png (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\021615139200[1].gif (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\tjrm_img07[1].jpg (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\yt_blacklist_domains[1].txt (254 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\t_8[1].png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\logo[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\icon_keys[1].gif (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\crossdomain[1].xml (842 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\b_3[1].gif (248 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\hottop[1].gif (857 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\stat[1].php (1177 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\faspbtn[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\qmv16[1].htm (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\bg_9[1].gif (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\CAW1MFCT.xml (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\4399_14511864345[1].jpg (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\CA63EB6D (1917 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\crossdomain[2].xml (331 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\02104939B23[1].jpg (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\libg_2[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\tjrm_img08[1].jpg (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\more_zb[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\bg_7[1].png (6 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (435 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\game_bg[1].gif (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\bg_3[1].gif (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\b_1[1].gif (610 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\ico_ann[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s8.4399.com\settings.sxx (196 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\bg[1].gif (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\061109192641[1].jpg (3204 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\yt_blacklist_domains[1].txt (478 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\test_domain[1].txt (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\bdshare[1].js (182 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\shell_v2[1].js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\78072[2].htm (4190 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\t_4[1].gif (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\c_5[1].gif (180 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\unilogin_package[1].js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\bg_4[1].png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\core[1].php (752 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\c_2[1].gif (70 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\headerBg[1].gif (228 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\t_1[1].gif (599 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\chkDomain[1].js (554 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\topbg_20140506[1].jpg (4662 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@www.4399[1].txt (924 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\right[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\bds_s_v2[1].js (2515 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\sp_line_1[1].jpg (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\FuYun[1].swf (18169 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@www.4399[2].txt (1517 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\4399[1].js (902 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\more_boss[1].gif (588 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20150115[2].css (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\is[1].png (3796 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\ico_1[1].gif (44 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\lmbtn[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\n_mg_bg[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\lb_ico_v1[1].png (652 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\121055423955[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\tjrm_img06[1].jpg (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\more_boss_s[1].gif (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\libg_1[1].gif (899 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\logger[1].js (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\1016395W521[1].jpg (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\101634512c8[1].jpg (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\4399_17485812405[1].jpg (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\style[1].css (337 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\b_2[1].gif (250 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\tgbtn[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\crossdomain[1].xml (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\ucenter[1].js (16593 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\libg_3[1].gif (542 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\031G3106195[1].jpg (10308 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\4399_18380750073[1].jpg (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\zj_btn[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\CAQRWXMB.htm (38 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\ftbtn[1].gif (477 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\play_hs1202[1].js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\b_4[1].gif (244 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\go_bbs[1].gif (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\nav_bg[1].gif (776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\bg_8[1].png (1947 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\c_3[1].gif (84 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\4399[2].js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\stat[2].gif (43 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\xml[1].xml (574 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\c_1[1].gif (160 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\ecom[1].xml (233 bytes)
   %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\s8.4399.com\seed4399Value.sxx (80 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\011K053B24[1].jpg (6296 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\new_icon_1[1].png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\bg_1[1].gif (791 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\CAC5MZ41 (58 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\10163ZO2N[1].jpg (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\test_domain[1].txt (29 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\78072[1].htm (4926 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\left[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\bg_6[1].gif (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\t_5[1].gif (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\news_footer[1].js (961 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\googlevideoadslibraryas3[1].swf (1387 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\sszn[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\stat[1].gif (43 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\1Q62S330N[1].gif (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\core[1].php (751 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@4399[1].txt (163 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\31151042OF[1].jpg (2296 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\sc[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[2].txt (435 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\0913524M015[1].gif (84 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\t_6[1].gif (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A836VEVG\4399_17152503697[1].jpg (125 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\b_5[1].gif (317 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\zmxy3_20141010[2].js (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\bg_5_20130716[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\t_9[1].gif (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IR6ZY14H\qmv16[1].htm (1738 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\EJYH0J63\ctrl_mo_v5[1].swf (47840 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\c_4[1].gif (81 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\click[1].js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FO1PCRNK\base[1].css (10225 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: Language Neutral

Company Name: Product Name: ?????Product Version: 1.0.0.0Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ?????Comments: ??????????(http://www.eyuyan.com)Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	823235	823296	4.62638	c3b22ba3755ed4068c0508f0e26590ab
.rdata	827392	2788168	2789376	5.37485	06410a3cf54dcbffa19d32c00e5c8697
.data	3616768	371210	122880	3.5825	5c1351e2dcb872fa4e51837a1b7db8b1
.rsrc	3989504	43116	45056	3.95955	020435d2f98f02d1c7006c9d5951ad78

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://4399hw.xdwscache.glb0.lxdns.com/flash/78072.htm
hxxp://4399hw.xdwscache.glb0.lxdns.com/css/zmxy3_20150115.css
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/jquery-1.2.1.pack.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/trace_news.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/logo.gif
hxxp://e.xdwscache.glb0.lxdns.com/moeryongshi/images/headerBg.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1309/121055423955.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1504/021615139200.gif
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2014/12/13/4399_14511864345.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2015/3/9/4399_18380750073.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2015/3/6/4399_13510057915.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/imageyx/seer2012/hottop.gif
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img011.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img09.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/101634512c8.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/10163ZO2N.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2015/3/12/4399_17485812405.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img06.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1502/02104939B23.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1405/1016395W521.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/go_bbs.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/sc.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1504/011K053B24.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1503/31151042OF.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/topbg_20140506.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/game_bg.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1503/061109192641.jpg
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1404/0913524M015.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/lb_ico_v1.png
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2015/1/26/4399_17152503697.jpg
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img08.jpg
hxxp://other.all.4399yyy.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/zj_btn.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/zm_add.png
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1504/031G3106195.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_1.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_1.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1302/1Q62S330N.gif
hxxp://e.xdwscache.glb0.lxdns.com/uploads/userup/1209/1GQ340U13.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_5_20130716.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_6.gif
hxxp://e.xdwscache.glb0.lxdns.com/upload_pic/2012/tjyx/tjrm_img07.jpg
hxxp://other.all.4399yyy.com/4399swf/js/chkDomain.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/libg_1.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/sszn.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/nav_bg.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/scbg.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/bg_7.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/n_mg_bg.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_2.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/ico_1.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/lmbtn.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/tgbtn.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_3.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_8.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/ftbtn.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/faspbtn.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/more_boss.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/libg_2.gif
hxxp://e.xdwscache.glb0.lxdns.com/resource/ucenter.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/more_boss_s.gif
hxxp://e.xdwscache.glb0.lxdns.com/flashUniLogin/css/style.css?v=20121016
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/more_zb.gif
hxxp://e.xdwscache.glb0.lxdns.com/resource/css/base.css
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_9.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/ico_ann.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_4.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_lm.png
hxxp://other.all.4399yyy.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.swf
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_5.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_6.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/jcsp_1.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/sp_line_1.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/c_5.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_9.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/zb_nav_20131205.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/libg_3.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/lazy_iframe.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy2/icon_keys.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_1.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/n_zm1.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/bg_3.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/bg_4.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_1.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/left.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/right.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_2.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_2.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_3.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_3.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_4.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_4.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/new_icon_1.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3/zrsp_1.jpg
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/b_5.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/t_8.png
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/unilogin_package.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/news_footer.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/newaobidao/ico.gif
hxxp://e.xdwscache.glb0.lxdns.com/js/bdshare.js?t=3313
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/zmxy3_20141010.js
hxxp://stat.d.4399api.net/crossdomain.xml
hxxp://bae.jomodns.com/static/js/shell_v2.js?t=13
hxxp://bae.jomodns.com/static/js/logger.js?cdnversion=396683
hxxp://stat.d.4399api.net/flash_ctrl_version.xml?ran=33756.68819062412
hxxp://e.xdwscache.glb0.lxdns.com/crossdomain.xml
hxxp://e.xdwscache.glb0.lxdns.com/control/zwsf2-3.gif?20120719
hxxp://e.xdwscache.glb0.lxdns.com/control/A4399dv_base.swf?20150324
hxxp://bae.jomodns.com/static/js/bds_s_v2.js?cdnversion=396683
hxxp://stat.d.4399api.net/flash_flow/log.js?g=100015389&u=774c0f21700953182032bf6a9cddba0a&r=65945896
hxxp://stat.d.4399api.net/xml.php?ran=48787.24794834852&gameid=100015389&url=http://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm
hxxp://bae.jomodns.com/static/css/bdsstyle.css?cdnversion=20131219
hxxp://4399hw.xdwscache.glb0.lxdns.com/flashzt/img/zmxy3_20120913/sy_ico.gif
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/play_hs1202.js
hxxp://4399hw.xdwscache.glb0.lxdns.com/jss/4399.js
hxxp://bae.jomodns.com/static/images/is.png?cdnversion=20131219
hxxp://cb.e.shifen.com/crossdomain.xml
hxxp://4399stat.5054399.com/js/click.js	115.182.52.78
hxxp://cb.e.shifen.com/ecom?di=62872&tm=BAIDU_CLB_XML&asp_url=4399.com&return_type=1&ran=9822.47437350452
hxxp://all.cnzz.com.danuoyi.tbcache.com/c.php?id=30039538
hxxp://gprp.4399api.net/s?uid=&vid=14280573350542688&m=&f=&c=&t=1428057335054&v=1	42.62.52.249
hxxp://pagead46.l.doubleclick.net/pagead/scache/googlevideoadslibraryas3.swf
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=30039538&t=q
hxxp://oq.cnzz.com/stat.htm?id=30039538&r=&lg=en-us&ntime=none&cnzz_eid=2007449240-1428052356-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1581191383	198.11.132.200
hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=4073713&web_id=4073713&show=pic
hxxp://pagead46.l.doubleclick.net/pagead/scache/googlevideoadslibrarylocalconnection.swf?googleConnection=_google_video_ads5383778685454967769
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=4073713&show=pic&t=z
hxxp://oq.cnzz.com/stat.htm?id=4073713&r=&lg=en-us&ntime=none&cnzz_eid=1424361423-1428055768-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=435416256	198.11.132.200
hxxp://all.cnzz.com.danuoyi.tbcache.com/img/pic.gif
hxxp://pagead46.l.doubleclick.net/pagead/yt_blacklist_domains.txt
hxxp://static.n.shifen.com/v.gif?pid=307&type=3071&sc=996,4797,1276,818&desturl=&apitype=1&linkid=i81ggq5vtls&velo_load=5734&velo_cssload=1125&velo_jsLoad=4672&cite_uid=480925&cite_type=1&cite_mini=1
hxxp://pagead46.l.doubleclick.net/crossdomain.xml
hxxp://pagead46.l.doubleclick.net/pagead/test_domain.txt
hxxp://pagead46.l.doubleclick.net/pagead/ads?video_url_to_fetch=http://my.4399.com/100015389_game.html&unviewed_position_start=1&image_size=336x280,300x250,250x250,200x200&videoad_start_delay=-1&video_doc_id=zmxy3&flash=11.6.602&frm=0&u_tz=180&dt=1428057337851&u_h=846&u_w=1276&u_java=true&u_his=0&u_ah=818&u_aw=1276&u_cd=32&u_nplug=0&u_nmime=0&u_asa=1&output=xml&ad_type=text_staticimage_flash&channel=0000000398 game398 Fullscreen&num_ads=3&url=http://www.4399.com/flash/78072.htm&client=ca-games-pub-9606551472994074&correlator=829002686208195183&video_product_type=4&sdkv=1
hxxp://pagead46.l.doubleclick.net/pagead/adview?ai=CR6B-82weVbOKGsXB7QauhID4CP7hye8Fltz0x5MBnMWi3jIQASDTqPoVYKWepIaYI6AB8uOg0QPIAQGpAom0oqnv5GY-qAMByAMTmAQEqgSiAU_QO7YcnHV800ZeADXz2RopFtMtmbTxzvmCDe78PrGNRJ79Ir5ODcbBOPk_EW_EDQEEw-V1G9pfGrMs2uEYbhgOQTwjTbtnS-kOMWmNJREeHsJLm-9Wt0gtHAwiV1P6MWmw0FuNQzCZ565fLM0KqmKrae3yZw4qILhHb_H7rrL1CahhlKAHCknRyXahsgADo6-tKKEGxuKJw3ioceq6KRT-RJIFBAgEGAGAB_ab3y7YBwHCEwA&sigh=Dr_XFq_1CpU&ve=1
hxxp://stat.d.4399api.net/flash_flow/view.js?g=100015389&u=774c0f21700953182032bf6a9cddba0a&s=35b04bfb5551774272942c9d98036044&a=13&r=52209393
hxxp://e.xdwscache.glb0.lxdns.com/control/ctrl_mo_v5.swf?20140327
hxxp://imga2.4399.cn/upload_pic/2012/tjyx/tjrm_img07.jpg	203.130.61.92
hxxp://nsclick.baidu.com/v.gif?pid=307&type=3071&sc=996,4797,1276,818&desturl=&apitype=1&linkid=i81ggq5vtls&velo_load=5734&velo_cssload=1125&velo_jsLoad=4672&cite_uid=480925&cite_type=1&cite_mini=1	115.239.211.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/libg_2.gif	8.37.235.27
hxxp://googleads.g.doubleclick.net/pagead/test_domain.txt	216.58.209.162
hxxp://www.4399.com/flashzt/img/zmxy3/zm_add.png	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/c_5.gif	8.37.235.27
hxxp://pagead2.googlesyndication.com/pagead/scache/googlevideoadslibraryas3.swf	216.58.209.162
hxxp://newsimg.5054399.com/uploads/userup/1503/061109192641.jpg	203.130.61.92
hxxp://oz.cnzz.com/stat.htm?id=4073713&r=&lg=en-us&ntime=none&cnzz_eid=1424361423-1428055768-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=435416256	198.11.132.200
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/sc.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3/new_icon_1.png	8.37.235.27
hxxp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm	218.95.101.8
hxxp://bdimg.share.baidu.com/static/js/bds_s_v2.js?cdnversion=396683	211.90.25.48
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/right.gif	8.37.235.27
hxxp://cb.baidu.com/ecom?di=62872&tm=BAIDU_CLB_XML&asp_url=4399.com&return_type=1&ran=9822.47437350452	115.239.210.141
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_8.png	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3/jcsp_1.jpg	8.37.235.27
hxxp://s25.cnzz.com/stat.php?id=4073713&web_id=4073713&show=pic	1.99.192.16
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/sszn.gif	8.37.235.27
hxxp://stat.api.4399.com/xml.php?ran=48787.24794834852&gameid=100015389&url=http://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm	115.182.52.104
hxxp://bdimg.share.baidu.com/static/js/shell_v2.js?t=13	211.90.25.48
hxxp://imga3.4399.cn/upload_pic/2012/tjyx/tjrm_img09.jpg	203.130.61.92
hxxp://www.4399.com/flashzt/img/newaobidao/ico.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3/bg_7.png	8.37.235.27
hxxp://stat.api.4399.com/flash_flow/view.js?g=100015389&u=774c0f21700953182032bf6a9cddba0a&s=35b04bfb5551774272942c9d98036044&a=13&r=52209393	115.182.52.104
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_lm.png	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/more_zb.gif	8.37.235.27
hxxp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.swf	218.95.101.8
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/c_2.gif	8.37.235.27
hxxp://bdimg.share.baidu.com/static/js/logger.js?cdnversion=396683	211.90.25.48
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_8.png	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1504/031G3106195.jpg	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/left.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/go_bbs.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/lb_ico_v1.png	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1405/10163ZO2N.jpg	203.130.61.92
hxxp://newsimg.5054399.com/uploads/userup/1503/31151042OF.jpg	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/libg_1.gif	8.37.235.27
hxxp://imga4.4399.cn/upload_pic/2012/tjyx/tjrm_img011.jpg	203.130.61.92
hxxp://c.cnzz.com/core.php?web_id=30039538&t=q	195.27.31.248
hxxp://www.4399.com/jss/zmxy3_20141010.js	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/nav_bg.gif	8.37.235.27
hxxp://imga1.4399.cn/upload_pic/2014/12/13/4399_14511864345.jpg	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3/n_zm1.png	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/ico_1.gif	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1209/1GQ340U13.gif	203.130.61.92
hxxp://s8.4399.com/4399swf/js/chkDomain.js	218.95.101.8
hxxp://stat.api.4399.com/flash_flow/log.js?g=100015389&u=774c0f21700953182032bf6a9cddba0a&r=65945896	115.182.52.104
hxxp://www.4399.com/css/zmxy3_20150115.css	8.37.235.27
hxxp://googleads.g.doubleclick.net/crossdomain.xml	216.58.209.162
hxxp://bdimg.share.baidu.com/static/css/bdsstyle.css?cdnversion=20131219	211.90.25.48
hxxp://newsimg.5054399.com/uploads/userup/1504/021615139200.gif	203.130.61.92
hxxp://googleads.g.doubleclick.net/pagead/adview?ai=CR6B-82weVbOKGsXB7QauhID4CP7hye8Fltz0x5MBnMWi3jIQASDTqPoVYKWepIaYI6AB8uOg0QPIAQGpAom0oqnv5GY-qAMByAMTmAQEqgSiAU_QO7YcnHV800ZeADXz2RopFtMtmbTxzvmCDe78PrGNRJ79Ir5ODcbBOPk_EW_EDQEEw-V1G9pfGrMs2uEYbhgOQTwjTbtnS-kOMWmNJREeHsJLm-9Wt0gtHAwiV1P6MWmw0FuNQzCZ565fLM0KqmKrae3yZw4qILhHb_H7rrL1CahhlKAHCknRyXahsgADo6-tKKEGxuKJw3ioceq6KRT-RJIFBAgEGAGAB_ab3y7YBwHCEwA&sigh=Dr_XFq_1CpU&ve=1	216.58.209.162
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/tgbtn.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/b_1.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3/sp_line_1.jpg	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_6.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg.gif	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1309/121055423955.gif	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/b_2.gif	8.37.235.27
hxxp://pagead2.googlesyndication.com/pagead/yt_blacklist_domains.txt	216.58.209.162
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_1.gif	8.37.235.27
hxxp://www.4399.com/flash/78072.htm	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/c_3.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/topbg_20140506.jpg	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1404/0913524M015.gif	203.130.61.92
hxxp://googleads.g.doubleclick.net/pagead/ads?video_url_to_fetch=http://my.4399.com/100015389_game.html&unviewed_position_start=1&image_size=336x280,300x250,250x250,200x200&videoad_start_delay=-1&video_doc_id=zmxy3&flash=11.6.602&frm=0&u_tz=180&dt=1428057337851&u_h=846&u_w=1276&u_java=true&u_his=0&u_ah=818&u_aw=1276&u_cd=32&u_nplug=0&u_nmime=0&u_asa=1&output=xml&ad_type=text_staticimage_flash&channel=0000000398 game398 Fullscreen&num_ads=3&url=http://www.4399.com/flash/78072.htm&client=ca-games-pub-9606551472994074&correlator=829002686208195183&video_product_type=4&sdkv=1	216.58.209.162
hxxp://www.4399.com/jss/4399.js	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/lmbtn.png	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1405/101634512c8.jpg	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_4.png	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/b_4.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/sy_ico.gif	8.37.235.27
hxxp://imga.4399.cn/upload_pic/2012/tjyx/tjrm_img08.jpg	203.130.61.92
hxxp://www.4399.com/jss/play_hs1202.js	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/c_1.gif	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1405/1016395W521.jpg	203.130.61.92
hxxp://cdn.comment.4399pk.com/crossdomain.xml	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_5.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_5_20130716.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/faspbtn.gif	8.37.235.27
hxxp://www.4399.com/jss/news_footer.js	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3/n_mg_bg.png	8.37.235.27
hxxp://c.cnzz.com/core.php?web_id=4073713&show=pic&t=z	195.27.31.248
hxxp://imga1.4399.cn/upload_pic/2015/3/9/4399_18380750073.jpg	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/game_bg.gif	8.37.235.27
hxxp://pagead2.googlesyndication.com/pagead/scache/googlevideoadslibrarylocalconnection.swf?googleConnection=_google_video_ads5383778685454967769	216.58.209.162
hxxp://newsimg.5054399.com/uploads/userup/1504/011K053B24.jpg	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/scbg.gif	8.37.235.27
hxxp://www.4399.com/jss/unilogin_package.js	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/libg_3.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_4.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/ftbtn.gif	8.37.235.27
hxxp://stat.api.4399.com/crossdomain.xml	115.182.52.104
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_9.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3/zrsp_1.jpg	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/more_boss.gif	8.37.235.27
hxxp://imga1.4399.cn/upload_pic/2012/tjyx/tjrm_img06.jpg	203.130.61.92
hxxp://s4.img4399.com/flashUniLogin/css/style.css?v=20121016	203.130.61.92
hxxp://cdn.comment.4399pk.com/control/ctrl_mo_v5.swf?20140327	203.130.61.92
hxxp://news.4399.com/js/bdshare.js?t=3313	203.130.61.92
hxxp://www.4399.com/jss/jquery-1.2.1.pack.js	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_1.gif	8.37.235.27
hxxp://imga4.4399.cn/upload_pic/2015/3/6/4399_13510057915.jpg	203.130.61.92
hxxp://imga.4399.cn/upload_pic/2015/1/26/4399_17152503697.jpg	203.130.61.92
hxxp://www.4399.com/jss/lazy_iframe.js	8.37.235.27
hxxp://bdimg.share.baidu.com/static/images/is.png?cdnversion=20131219	211.90.25.48
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/logo.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/bg_9.gif	8.37.235.27
hxxp://imga1.4399.cn/upload_pic/2015/3/12/4399_17485812405.jpg	203.130.61.92
hxxp://ptlogin.3304399.net/resource/ucenter.js	203.130.61.92
hxxp://cb.baidu.com/crossdomain.xml	115.239.210.141
hxxp://w.cnzz.com/c.php?id=30039538	1.99.192.14
hxxp://newsimg.5054399.com/uploads/userup/1502/02104939B23.jpg	203.130.61.92
hxxp://www.4399.com/jss/trace_news.js	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/more_boss_s.gif	8.37.235.27
hxxp://cdn.comment.4399pk.com/control/zwsf2-3.gif?20120719	203.130.61.92
hxxp://stat.api.4399.com/flash_ctrl_version.xml?ran=33756.68819062412	115.182.52.104
hxxp://www.4399.com/imageyx/seer2012/hottop.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/c_4.gif	8.37.235.27
hxxp://newsimg.5054399.com/uploads/userup/1302/1Q62S330N.gif	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3/bg_3.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3/zb_nav_20131205.png	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/zj_btn.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_2.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy2/icon_keys.gif	8.37.235.27
hxxp://icon.cnzz.com/img/pic.gif	195.27.31.246
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_6.gif	8.37.235.27
hxxp://news.4399.com/moeryongshi/images/headerBg.gif	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/b_5.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/b_3.gif	8.37.235.27
hxxp://ptlogin.3304399.net/resource/css/base.css	203.130.61.92
hxxp://cdn.comment.4399pk.com/control/A4399dv_base.swf?20150324	203.130.61.92
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/t_3.gif	8.37.235.27
hxxp://www.4399.com/flashzt/img/zmxy3_20120913/ico_ann.gif	8.37.235.27

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: googleads.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/x-cross-domain-policy; charset=UTF-8

ETag: 13264204777643215726

Date: Thu, 02 Apr 2015 19:38:07 GMT

Expires: Fri, 03 Apr 2015 19:38:07 GMT

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: cafe

Content-Length: 407

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=86400

Age: 53844

Alternate-Protocol: 80:quic,p=0.5

.............R.0.E{..p.Ld.d......$MJYR...F.;...L((R.R....^=.]..&..Q9....S.^UU.......m.....p.)..N >..~..|.....m.q..aEh.P.rg....I...N.B...;K....2...`...~(a.M......1...5OM...3.&F.D.LE...D.....Q..l.6.L..K....K...$*g.R'D.A.9..GH=..?-.J.......)....@>............].".D...a....P=..9..........W..U.=.=J$..4.D.....;.rO@>.....RC.W./.1...-..X..=..C..P%.:Uq...\N..?.LI.~....K.....r.%/..._.6.1...... ..........U....r,....nt>....

GET /pagead/test_domain.txt HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://pagead2.googlesyndication.com/pagead/scache/googlevideoadslibrarylocalconnection.swf?googleConnection=_google_video_ads53837786854549

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: googleads.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/plain; charset=UTF-8

ETag: 3643785376238531823

Date: Thu, 02 Apr 2015 19:38:42 GMT

Expires: Fri, 03 Apr 2015 19:38:42 GMT

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: cafe

Content-Length: 29

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=86400

Age: 53809

Alternate-Protocol: 80:quic,p=0.5

............OLIM.5...........HTTP/1.1 200 OK..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Content-Type: text/plain; charset=UTF-8..ETag: 3643785376238531823..Date: Thu, 02 Apr 2015 19:38:42 GMT..Expires: Fri, 03 Apr 2015 19:38:42 GMT..X-Content-Type-Options: nosniff..Content-Encoding: gzip..Server: cafe..Content-Length: 29..X-XSS-Protection: 1; mode=block..Cache-Control: public, max-age=86400..Age: 53809..Alternate-Protocol: 80:quic,p=0.5..............OLIM.5...............

GET /pagead/ads?video_url_to_fetch=http://my.4399.com/100015389_game.html&unviewed_position_start=1&image_size=336x280,300x250,250x250,200x200&videoad_start_delay=-1&video_doc_id=zmxy3&flash=11.6.602&frm=0&u_tz=180&dt=1428057337851&u_h=846&u_w=1276&u_java=true&u_his=0&u_ah=818&u_aw=1276&u_cd=32&u_nplug=0&u_nmime=0&u_asa=1&output=xml&ad_type=text_staticimage_flash&channel=0000000398 game398 Fullscreen&num_ads=3&url=http://www.4399.com/flash/78072.htm&client=ca-games-pub-9606551472994074&correlator=829002686208195183&video_product_type=4&sdkv=1 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://pagead2.googlesyndication.com/pagead/scache/googlevideoadslibrarylocalconnection.swf?googleConnection=_google_video_ads53837786854549

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: googleads.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/xml; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Date: Fri, 03 Apr 2015 10:35:31 GMT

Server: cafe

Cache-Control: private

Content-Length: 1170

X-XSS-Protection: 1; mode=block

Set-Cookie: test_cookie=CheckForPermission; expires=Fri, 03-Apr-2015 10:50:31 GMT; path=/; domain=.doubleclick.net

Alternate-Protocol: 80:quic,p=0.5

Expires: Fri, 03 Apr 2015 10:35:31 GMT

...........V...F.........S...ZB...``....F...R......"NU.]*I..?pU2..l..A.C..FZb&e{.T*;o.....n.s.m.g;...........KS.^8K...............c.*m;.Y-..R....@....5...R........bf..t.J..y")U:..%..>:.T......%...0cC.sB.F..Y.u....Fs..Dp.g.....&Z..b...f..\...j~.-.shTEa..r.D.y.../.n..]......Q.a... v..;5............S..p&..P...;..`.t.c.........t.=..-0.6.........vkRf. ...........|.;l-.....k..s."{.~}1....*MU.>..0=.6 ...u.\ ................Z.sEB-..c. S.j..Bc....-d.Aox.......e....A.._.....[s..y^' B]7..%.me..u_.u..........0o8..)..qZ.A..nW....0I..X.l2......RA...Pa...V.j. 3....5.Y\..W...Cu......v.y.RbK.b...*....N.-c......hNB..0 ..|FC..|U7|.x...4....o.5..X....D7.....E...0zu|....G.........1M...{R...............FE?E....y..gNn..?W.~.^F.........>. w..............w*.........O._.3?;a.c.A..EW.."......,M/.N.......0p.5Px...R.....?......&5A..*....L.[.......uO.ll...^..=e)^T$0.'...M......5n..c...Z_B."..B.....<.>e)....3.......vV.V#.....;L-!.Uz.V001.$6.z...).C.=c.`...V@3....7..q.._.?z....'_...."...&V.Od..a.$....H.........x...6..M.|.q.g.A......W[uk8&...L...c.B.RIPW&.u. .\..c......D......>..Q$.64}. .t.r. ..d..}zy.d;. ..B...q.-.j..:._..e.....p.L...-...1..... ..<..&.2.-.YQ.5A....<..........Z... .......

<<< skipped >>>

GET /pagead/adview?ai=CR6B-82weVbOKGsXB7QauhID4CP7hye8Fltz0x5MBnMWi3jIQASDTqPoVYKWepIaYI6AB8uOg0QPIAQGpAom0oqnv5GY-qAMByAMTmAQEqgSiAU_QO7YcnHV800ZeADXz2RopFtMtmbTxzvmCDe78PrGNRJ79Ir5ODcbBOPk_EW_EDQEEw-V1G9pfGrMs2uEYbhgOQTwjTbtnS-kOMWmNJREeHsJLm-9Wt0gtHAwiV1P6MWmw0FuNQzCZ565fLM0KqmKrae3yZw4qILhHb_H7rrL1CahhlKAHCknRyXahsgADo6-tKKEGxuKJw3ioceq6KRT-RJIFBAgEGAGAB_ab3y7YBwHCEwA&sigh=Dr_XFq_1CpU&ve=1 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://pagead2.googlesyndication.com/pagead/scache/googlevideoadslibrarylocalconnection.swf?googleConnection=_google_video_ads53837786854549

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: googleads.g.doubleclick.net

Connection: Keep-Alive

Cookie: test_cookie=CheckForPermission

HTTP/1.1 200 OK

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Date: Fri, 03 Apr 2015 10:35:35 GMT

Server: cafe

Cache-Control: private

Content-Length: 58

X-XSS-Protection: 1; mode=block

Set-Cookie: id=220102a30602002b||t=1428057335|et=730|cs=002213fd48f6502419f07f7554; expires=Sun, 02-Apr-2017 10:35:35 GMT; path=/; domain=.doubleclick.net

Set-Cookie: test_cookie=; expires=Mon, 21-Jul-2008 23:59:00 GMT; path=/; domain=.doubleclick.net

Alternate-Protocol: 80:quic,p=0.5

Expires: Fri, 03 Apr 2015 10:35:35 GMT

..........3...(M..*.sI... (..N...p..s4sIr.0..pt,...Ba.&...HTTP/1.1 200 OK..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options: nosniff..Content-Encoding: gzip..Date: Fri, 03 Apr 2015 10:35:35 GMT..Server: cafe..Cache-Control: private..Content-Length: 58..X-XSS-Protection: 1; mode=block..Set-Cookie: id=220102a30602002b||t=1428057335|et=730|cs=002213fd48f6502419f07f7554; expires=Sun, 02-Apr-2017 10:35:35 GMT; path=/; domain=.doubleclick.net..Set-Cookie: test_cookie=; expires=Mon, 21-Jul-2008 23:59:00 GMT; path=/; domain=.doubleclick.net..Alternate-Protocol: 80:quic,p=0.5..Expires: Fri, 03 Apr 2015 10:35:35 GMT............3...(M..*.sI... (..N...p..s4sIr.0..pt,...Ba.&.....

<<< skipped >>>

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.comment.4399pk.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 03 Apr 2015 00:46:33 GMT

Server: nginx/1.0.4

Content-Type: application/xml

Last-Modified: Wed, 17 Mar 2010 03:06:58 GMT

ETag: "5288176-14b-481f66842f880"

Accept-Ranges: bytes

Content-Length: 331

Age: 1

X-Via: 1.1 ami3:0 (Cdn Cache Server V2.0)

Connection: keep-alive

<?xml version="1.0"?>..<!DOCTYPE cross-domain-policy SYSTEM 'hXXp://VVV.macromedia.com/xml/dtds/cross-domain-policy.dtd'>..<cross-domain-policy>.. <site-control permitted-cross-domain-policies="all" />.. <allow-access-from domain="*" />.. <allow-http-request-headers-from domain="*" headers="*"/>..</cross-domain-policy>......

GET /control/zwsf2-3.gif?20120719 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.comment.4399pk.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sun, 28 Jun 2015 18:27:53 GMT

Date: Mon, 30 Mar 2015 18:27:53 GMT

Server: nginx/1.0.4

Content-Type: image/gif

Last-Modified: Wed, 07 Sep 2011 08:07:32 GMT

ETag: "5383f2e-2bc8-4ac556fa31900"

Accept-Ranges: bytes

Content-Length: 11208

Cache-Control: max-age=7776000

Age: 1

X-Via: 1.1 jswx84:8101 (Cdn Cache Server V2.0), 1.1 fjqzwt234:8106 (Cdn Cache Server V2.0), 1.1 ami4:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a..P...........[#.Z".Z#AAC.......wH..........ee......... ...kkl......aab.........ZZ[.zz...............noq..X@@@....66qqq.JJ............PPQ............$$$............... ......===................l:.......... ...000......xxy...............................$$...EEF....["...............HHI.DD...............uvx..{..b...555....]&...}}~.b-TTU...uuu.....lrrtCCC999LLM.]]...eefnor...........r}~.BBD.f1.==.........zz{.............UU.PPFFH......KKL..v.mm...NNP....h5.............|P._(...stv............BAC.....~...WWX....... ....................................wwz......ggh.\$AAA......__`...{|~......................................................ccc~.....RRS....uu............................\#.Z".........GGI.........................["...SSU.Z".p@......ppp...DDFCCE..v....]$...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:CFA3FEFBD85011E0A753A3E3D59E8251" xmpMM:DocumentID="xmp.did:CFA3FEFCD85011E0A753A3E3D59E8251"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CFA3FEF9D85011E0A753A3E3D59E8251" stRef:documentID="xmp.did:CFA3FEFAD85011E

<<< skipped >>>

GET /flashUniLogin/css/style.css?v=20121016 HTTP/1.1

Accept: */*

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s4.img4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sun, 05 Apr 2015 18:22:30 GMT

Date: Fri, 06 Mar 2015 18:22:30 GMT

Server: nginx/1.6.1

Content-Type: text/css

Content-Length: 4097

Last-Modified: Thu, 24 Oct 2013 07:49:35 GMT

ETag: "5268d10f-1001"

Cache-Control: max-age=2592000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 zhj192:8108 (Cdn Cache Server V2.0), 1.1 kf48:2 (Cdn Cache Server V2.0)

Connection: keep-alive

@charset "utf-8";..body{background-color:#37383c;}../*login*/..#regbot {display:block;}...loginDiv{border:none;width:538px;background:none;}...login_hd{background:url(../images1/tbg.gif) no-repeat;padding:37px 25px 0; }..#login_tagnum{background:url(../images1/ptlogin.gif) repeat-y 0 0;padding:0 5px;}...login_fd{background:url(../images1/ptlogin.gif) no-repeat -538px 0;height:23px;}...login_close{background:url(../images1/closed.gif) no-repeat;width:15px;height:15px;top:8px;}...login_close:hover{background-position:0 -15px;}...login_horizon .ptlogin_btn, .login_vertical .ptlogin_btn{background:url(../images1/spriteV4.png) no-repeat;width:73px; height:28px; overflow:hidden;}...login_horizon a, .login_vertical a{color:#ffaa00;}...login_vertical .login_hor .q_tip{color:#899999;}...login_vertical .login_hor label{color:#899999;}..#login_tag{height:28px;}..#login_tag li, #login_tag li a, #login_tag li.selectTag, #login_tag li.selectTag a{background:url(../images1/ptlogin_tab.gif) no-repeat;}..#login_tag li{width:84px;height:28px;padding:0;text-align:center;}..#login_tag li a{width:84px;height:28px;padding:0;text-align:center;line-height:28px;}..#login_tag li.selectTag a{background-position:0 0;color:#fff;}..#login_tag li a{background-position:-84px 0;color:#464646;}..#login_tag li{top:1px;}...login_vertical #login_simple_toregister{background:url(../images1/spriteV4.png) no-repeat -74px 0;width:73px;height:28px;overflow:hidden;}...login_vertical .ptlogin_register{background:url(../images1/spriteV4.png) no-repeat 0 -

<<< skipped >>>

GET /flash/78072.htm HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 03 Apr 2015 10:10:57 GMT

Date: Fri, 03 Apr 2015 09:40:57 GMT

Server: nginx

Content-Type: text/html

Last-Modified: Fri, 03 Apr 2015 09:24:33 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=1800

Content-Encoding: gzip

Age: 3250

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive

400a...............sT../.......:.b.gQ{..6...0....::.........t....ox.1....@HB*IhB.,$....p....>`|p......RV!..u.{..w.......r...kx..<...}...S...#.E..?....E.%.....X..}....m........}.........tu,..?....jl.{*.;z..........}{bo..t.c.Y..............ao|.HuM...s.T*.....2]A.t..1.Z..J*.h.zsC.........}o.U.........o5...O...J.7T6n8Xf..Q\..>....tIy...tcUY..QU......HmYUueI. H...@m..t..z..tQS}5.......<...2S..xY.....6c.r.6...U.....j..kjy..[....... 7^.105uo~.|R....\..1yr....R..9s|~j.....;..5.#... *.....h.}o...S..._......]......?..;v........_.=......'..\.....X.....COv..=5vn.........?A..|..M......5.x.x.M'..e..zNO.h...h..|z...q.xp._.|.hm}E..b....&.v.....C...VW..^t......XyC...RC.mM.........zCqC......* 1..`=.....h..,.N..l.{l(>.~3.?$.>.TSN....,......O.......t......U........*.7..=......~..............?.....:]^.x.$v.....'........*....E../......=........?.v.........X..O.{um9...f=..h..2..>.......?-.....F...m.....\.l}.Q..?.....<.}&.....3..........o4U..]..7........?.......$O..e..|H...R6.....'.xWEmy.......#.....B>.?..H....1].........No...o..##.j ..*..9R....=...i.W..|..M.....L..z...bC1(n...........* k............o..f......c....A.c.....k...o6.ZJ7c...k...:P\...".{..h2>.K.?P......t...j.....TW=.......p..3p...{.....3.....X.......|}S...[.<....e...I.....*...z.)......GxH.?e..\....X..gY........"&.7....h<.TB.{..F.IO....i...'.&.PDKxI...`.S......*.....m..x.K..2..:.Y..[....zHm#v....M\.D.i..UD.a....L7..\.\q.([. jk..jJc..>.|8tv..gb......$.1...6...WP.8.7U7U::....U1#........>..TqW........W'..}.p..#...;.k...w.m.v'gS]um..!F.

<<< skipped >>>

GET /css/zmxy3_20150115.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 10:14:40 GMT

Date: Fri, 03 Apr 2015 10:14:40 GMT

Server: nginx

Content-Type: text/css

Last-Modified: Tue, 13 Jan 2015 07:48:19 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=7776000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 shb18:2 (Cdn Cache Server V2.0)

Connection: keep-alive

1671.............].n#Ir>{.y.r7.x.-...'R.{g.._....E.HQM.8di..}..|...`.W...=._dFfdVQ$[.................m...u.a1.;Y......>%..................T...y..GY.}...............i..v...N.fRL..v..f6...............ng8..V......>.W....y.....i....s5Y\...?$.r[.._~..x......g7u.X_..i. .e..m.M..F..o.Nn..z.4m.LD....W|zY...r3Jo..l..,F)..V...U.y.|Y-....~Z....~.T;.".\NWeAh.{4..[..i4'.......2.....Xn ......./..Y};....nn.....uH..DHk.^....=U...vIr,.....,..?...xL.$....@L.U.0.].f....../.K.*.o.K......%k..J...j...gi...Y....r.X...).-.H........K...\.....?Z...L.......G.r^. .n..r.1.D.0b...(.L.".9..h..^.....$.E.%.C.!......b..d,.l......z.....g..vU<.&.j...P......`....%.)E.r...rS.6.6.?.....=.e".yB8X......3d.YmL..T.&...H....Y... .....\....yu.; ......m..(~..5X8KF.....bLl....._.-.....o.a._...d..h=r7..{...v.7u..Td.dcu.... .....O....|....4...].....6.{....d!...'.. ....,..u.^.......x.7n..M.J..=.a..o-r...6R..|.eQ0.G.N.V.c.c.......'..p...B..b.!.*r...E...........G...kX......b3^N...&.9......D...'..2.$._.}.......O.K\n@..06....S...V..i...|8.......S...Q...-*$}...A?v..@.5.l..._.....\n..}}..W.H..[.).........0#Q.QB..:...."...%..c.V:7.1DD...`.....]...x.2.~3..,..8.K.=..O./.$.c.@..wY...z#....R.r..v..2|.@......jr8C.ug...'.DN.}..,.~..2b[-m.qy...s..N.$=.i.....(^....!..].n....V.....1..ErSD...}Xw....y=....I(.%.j..%.g.l^.7.e.8.!...:@..n..9Z9...T..... .e.......-....8.0...`...."?.7.....6N\[n...........6..Z}....a.J...j.........../..b...aWl......NbB.6....w......01.@H.D.....h..|..\..t....%..~C5R...V............X..... Te*..z.a....Vnf.3.......u......z..?V;....}(...b....t..P

<<< skipped >>>

GET /jss/jquery-1.2.1.pack.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:48:05 GMT

Date: Fri, 03 Apr 2015 08:48:05 GMT

Server: nginx

Content-Type: application/x-javascript

Last-Modified: Sun, 10 Nov 2013 09:24:37 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=7776000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive

39f2..............y_.J......h.$R,.......B....d;@..E6f..m..b^...U.@..{..9cI.^..k.j....JOJ'....g)..(....gW....Y.m.Gk......R......A.xZ.;A)Y\\*....K...._.O....3:.T..e..t6.d.I.-]....4=.J[..%......k..................o/g.L...?^..Y. ._l...RRiV..b.4.X]\,.{...D.^va..........f.R.U.y.....3.w9.L.......Nx.f.8.....Np3......y.Z}.......$..N..B ....w..?[..Jmuo:...Qo<:.y....u3.SN.A..MG.._........=~.....V'...-..}..\...h8?.....G..A.(.u.r....... Q...h....W......oW:i|.r.3...."...b..|..k..>......l..... .. .#..[.....n.~|^Z.K..^.^.J.V.Kki...........F.^Z.,.....{ j.<....u....W.. 4....L...|{z....G...$(?...=;z.G.............t-.<Ooj..o.N..nX.<..z....oy..z.<...=....?z.....v..d&z.:tU}......V....~.*{T...e;..Q...V..d.(..n........J=z.. ...m.....r.(....)i.@...A..cp..DIw.K.^..4.#uLOQ....b...x....T.....8...=...O..b...n(..=Z..c:.s..mX.4=c~/\...l..w....b......R M?.Z.z.....n.d.^.-.b...._.:..o....R._\._.,Q...._.2..P.TP.Z.^/ . ...w>..............n...........X..=..g..|ai...>..Y.dy... Q...@.gV.........{.....o.....J..e..3..C...C.3@.......8...x.P..8.B..C....]... ..g.xm.=z...AW.B5...1...Z..LS......]..(...rb.`...K..i9u.1.....f..A.....iz.....a...k.'$D.. ._j..a.z.b...z.W..> v..R]..uk....[V....7.......k...b...[..}E.qX......n.3I.EL,...O....]-.o.`...........D3....-.........Q..j'..jW........X,3..I..=..........E.G.._8.V~vT...(..0..Q...(..g.1.V..J5...K.6..i......K. .K."6.Q....a.K.....{O. .n..nY..........u.~...n@.........-f.%;^."vh9v.......$.{~.`... ZGb...m...@..C......2}.F..i....:...o.....,J[..O.uAM$`...p..]k.............@..9.0...6[s..V....:

<<< skipped >>>

GET /jss/trace_news.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:33:47 GMT

Date: Fri, 03 Apr 2015 09:33:47 GMT

Server: nginx

Content-Type: application/x-javascript

Content-Length: 559

Last-Modified: Wed, 26 Feb 2014 01:36:00 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive

GET /flashzt/img/zmxy3_20120913/bg.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:03 GMT

Date: Fri, 03 Apr 2015 09:48:03 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 5892

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

GIF89aP.Q....................................................................................................................................................................................................................................................................................................................................................................................................!.......,....P.Q......;.?C.BA:7A.84..C...C..54C=.&.:.@......=..A?.".46.<:.@4$=.?>;;...:@B.?@.:...@..7..AB..4B6C..6..<...;.A@...A.7.<..9....6;.C6:B .@p...... A|..1.HA..|...p...:t........6.......A.....X..... .#... |0."/.........G........U.hBt....`..Bx.H& ....j...u..b..d..!.....an......6|T.2dH...$....@..9.... ...9.T..C.........X..#...&d..^..... ....#.A.b... 1.I .....j.......J.P.q@..G....p ...5...@@...A@P......A*.. AB.......C.J.Cj`4.`....x.....%D..Q0..78 ...|...@LP...............C...P.hA|0..Al..k.T.@.......P..": .......;7`5.F.. ...><..T.....<`c...$I..6..C.F...y?`...A,g.......6....b2E.I...A...dZ.7...A.......@....A.R-yu.O#.Ce.D.`...H.....B.....A....'....D..0@...p..J..T..8\9...ahh.;0r..B.FL&..`...l....l`....z..@...P=0.........ER.s........kV:.....X`....`..5...Q...C....,....A.C......P..@|.........&V`.dC..C....`... ..E..@...`C.{......q............XA.....`C2&..A.Y.....@.A..m...?7&..<. ....!.BIb ...!`. ...U.=.....\.......]:.q..@l`8.=\uu.6.|A.>$.....paR..@.`.....I.p.X6 ..k....YI...$4X.. >...S%#........%x.A.W....=...&..9...@.....p@..\...or...............;...E9.@$..0...h........@....W..9..;.[....q9..5.@."..

<<< skipped >>>

GET /imageyx/seer2012/hottop.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:49:17 GMT

Date: Fri, 03 Apr 2015 08:49:17 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 857

Last-Modified: Sat, 20 Apr 2013 02:58:00 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,..........6....H.........p.......H..... ^,.......j.).c.....T......;....

GET /flashzt/img/zmxy3_20120913/sc.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:02 GMT

Date: Fri, 03 Apr 2015 09:48:02 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2967

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89aw............P...f..[..q-..y............... v....,[..c."m......2....x....aq...xZ'.3.....o5...4..t..R....{m.Hu2Gb*!.OLH......hR2.X..d.....{h..#.9v.....{WR^....B.>HT...^..Fx.xM.............~pj..Y....:.c..5p..4l...........,..L...K..'h...:....G.........[. W...........4..V=Sd......Q...c.......S*F..=G...<g...)d.e.1......E:0..7...........t.$J.}%..Y........YT.............-.I...........dQ.Q.Ujc....B.rhd......"R..N...C.P1.\C........3..C:'Bs[H...K.......$...:>R...@..z._..O1Qs..."Mz....'1 `.=}..7b.2^........2........5.........5n../`..........*I[....."8TX..D..6..;..?..2~.H..L..q........QczS............. ...v..~ -!..!..?.....v..<...M..U.u.....T...}........./........Y.>~Ibj....."..P..,..v..w....% ......... q.L..0H]/Rc..R..U.k...........N.......AUnf...P.d...R.a...V.........=..=...!.......,....w.........................H..H.....3j...cGW<d..PH.....&I.!....c..I.&...~.L....._..X.2C.S..*].....P.J....=..,bq..a..=....AB...........p...K....x...........H..C....X;bH..8.!g.....K..i.......C..M...(..,H.....7$.b.&E..7643.yD.o~...N...... _.<..F.....'...o...#.]...:...S...NW...S.....B...*.(.....O.......^,`..E.[ha........F.F,.6........rt .;G....P`b..f.....l.....(....c..6:0.......a@.....hc.[.8.%[l.@}F...'3V9#.W,...>.`....b....Y&.lx....PP@z.."...0..?....?....|>.......K.6...,.X../6n.L.?.B....c.'tv:.4.5.A.L.I..t... ..2.)......v...zF...4..j......?.D..?.&.......>.$..?.L......K .h.K.."..?..j....... `..0....#.p..;.....O$.E.&.....^!...;.O ..{i...2...T.q... ...N.l..P.K....O.....>....>.....4..../`PD.k..M1....(....

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/game_bg.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:03 GMT

Date: Fri, 03 Apr 2015 09:48:03 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 17568

Last-Modified: Fri, 21 Sep 2012 09:31:28 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a..........z...........utu....................................g..........................u..w..DEE.................................................................................u................................Y...vz.............................................o...............................................[~.{.................................z..............................{.......................................n.....................................................b.......................j.....|..............^........~....................................................................................................................................................................................................................aaa.................................!.......,.............8.ac ....*$x.....#Jt..`......x..F..1V...$H.%.nTy..J..?..ic#..7q...o..r.r......a...M..fR...]...*....M.$.A..`.....,..h..e.d...I.6..`K..w.........}`.A..a....m0...$H.C.L.N.$.3O.l....3.....4..p..^.....s... .....o......$....p...*.$T."......K.N}z....k....w.H.S....2d...._.........O..}..X..?......8....h...2....2...I@.`... ...e.a.>.F....v....6.-%....o........*..hc.5..#*...J @..K ...I<.$...G..d<P:y.@TR.P.VVy%..i..A..)...Md.D.Q...l....?...*..b'.v..'.w..g..x.$.@..h........*(......p.B(.qZJ.....'...Zh..n.)..b:*..F.j$.....'..............!......D..!...k...Z........V....FR.1.$......ZX.}..ma........n......]....A..x..w..F.`.....Y....D.`U8..B\(..28.`..~ ..#...W.R,q.....e.0...,.Q..0...r4..\.8....<....@.-4...@^ .B...L7.4}l@.u...w..#..

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/lb_ico_v1.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:03 GMT

Date: Fri, 03 Apr 2015 09:48:03 GMT

Server: nginx

Content-Type: image/png

Content-Length: 652

Last-Modified: Fri, 01 Aug 2014 07:21:22 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR..............Fg.....tEXtSoftware.Adobe ImageReadyq.e<....PLTE......................................7........G.....=..V.....1..=.....b..c..L..E.....^../..l.....n...!%...-..4..K.....]..>..w.....*..f.................2../..M..D..\..J.....W.....0.....j..c.....,.....Y.................J..6...../..a..X..Y..R..f........s..6..k........k..........ZtRNS.............................................................................................o....IDATx.b....0..S....L.!.."..@4;B..../7L."f.`....d.C..8.CM...."..v...I. ...Fr2..\5Uy..=.X#m.#.t.@b^...!.*.L...0uZ,.>.<"f...p..6.....p..#H.\..f.F.....B..vdD...0\..PB..Hy.pA......BZdJ.......IEND.B`.....

GET /flashzt/img/zmxy3/zm_add.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 10:14:41 GMT

Date: Fri, 03 Apr 2015 10:14:41 GMT

Server: nginx

Content-Type: image/png

Content-Length: 6369

Last-Modified: Tue, 13 Jan 2015 07:48:19 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR.......G.............tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:70D8E8579AF711E49A46A9E99F340B05" xmpMM:DocumentID="xmp.did:70D8E8589AF711E49A46A9E99F340B05"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:70D8E8559AF711E49A46A9E99F340B05" stRef:documentID="xmp.did:70D8E8569AF711E49A46A9E99F340B05"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>H.......PLTEW.K..................R......".........-..j.......k...WV]e....w..e.W..m.........V.....-......z.#.....XP....e. .......n3.....X.....................z.......\..............k..y,C..t4RdF}.......w..h....\y. e4.........i.R.7...v...g...d..A..S..........v.............R.x.....0t.............2s..........=...8zOe..1...........p.....m..)..............g.Y...?..Y.....$..a.X\...S...O..jM...P...jh.....i.....Wn.......a...^.,-.E....x......T.ey..............(O..~......?.....v..NN...Q.............1n..&......S......].......=|.......?...........^..%R......l...{..%`..(M.3|jwxu..i..#.....2..............C.

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/c_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:28:06 GMT

Date: Fri, 03 Apr 2015 07:28:06 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 160

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a................s..............!.......,..........e......I..8....`(.di.h..l..p,.tm.x..............r.l:...tJ.Z.._p.h<...xL.....z.ng|.-.......~.....np.r...;....

GET /flashzt/img/zmxy3_20120913/bg_6.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:28:05 GMT

Date: Fri, 03 Apr 2015 07:28:05 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 13918

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a.............%''..................................................g..Veff..............I...............kmmbaJ.........TUU......u{{! .}....z..gmrr.....f............y|}............333......X\\.........ejjBDD...^cc........\...qo7JLLBB5VVV.....>.....................:==...NQQ...VYY......EJJ..lpuu.........>@A..[.....O...WbZ79:B@#..M....005A9.....V........WIMPQO$..............................21'......qqq..................;>M...........................a_-SWW.........!""...............agf.........sxxjoo.$.477...ISQ... --10.s..RQ>[__...DFG.................................................................................z..............D..........................fpl...qwv......ghi...................................................186...FHI', ...............sts........i.........!.......,...............H......*\......#J.H.....3j...... C..I....(S.\.....0c..I....8s........V..J....H.*].....P.J.J....X.j......`...K....h..] ...U....;Bn..x............L...... ^......#K.L.....3k....g.w.........?.^......c..M.....s...zo..p...M...... _.........m0x^...k..........g.}....E.X.........O...............(....h...&....6....F(....h.iveH.?.v... .(..$.h..(....,....0.(..4.h..8..J.<....@.)..D.i....v.A.%y..PF)..TVi.......\v...`.)c...7..b....l..f.Z.)..t.i..d...@..w....*.. .I...&.....)P.v-*...V..%.f.........@.a...j..........).tE......*f......P...|.. ..8.J...&k.|.6....F.!8.Vk..J.*...v.*... ....)..........n..Vw.....&........7....<%...l0.e.{n.Z..J(Dx(.3.W.-.B6.p..Nl.......D&..:..L..^|..:..,..S.i2.*..2.3....|..c..px................?..

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/sszn.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:04 GMT

Date: Fri, 03 Apr 2015 09:48:04 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2150

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89aS......1.....)..N.....B..=..m..J..$..2..>..........."..R..E...m....6..J..*...........t..f..<.....6..8..>......\s.}.2..S........I..T..A..A..,........5.....E.....D..<...Vk...].....P.....O..b..$..a.."..Y..Z.....-..H..%..*.....i.....(..6..6...........^...........T..!..@..:.....=../..&.....#.. ..&.."...d|...U.....$..9..4..?........a..[..S..G..@..G...Ym*........%........g..e..]..Y..U..W..Q..B..?..F..?..9..;..:..(..........................?..L..>.......s...Z.....<..F..H..............=..B..@..A..C........E..V.....M...........W..G........@.....c..&..1........F....z<.....E.....Q..I..:..7..:..7...........W..;...u.;..6.....f..2........7..@.....P.....J..j....."..D..D..!.....-.....q..D..L...u.M..=..G...........!..<..b..e..9..R..8..8..D..9..H..I..K..:..@..B..A..(..Y.....8...a....!.......,....S.......'..% F....*\.........UK.@\.8D.&...P a...`...W.......Z..u3bdV.....:....$@.(R....(QbIZ....M.Vi.. . J.d...K..h.D.z.(....r..f...3gH.|....#J....c...:..h....!b.\.`......I.<..)IP..Je...Qe4L*...(P.<]Z....K...2c......h. ...-{.x.;G0....(...1...)_...T.J.H...,H9L.R_.:v..'.i....,.K.......o.4t..F......Q& ?.(..-.lF.%...N.h.SJ(....Yd..V.....0....?k.5".y..E.^.....!'...PAc...3......eKA..'.Q..-...O..F..k.>..(#.d..W|..2.....]....`...1...e._..c.^.Y.-C.b....p.$..u.YS.P.G..T.I.|..?.2....2..1.V....F..TD...&z..J ....H....(.vT..o..b...Z.'.e*Zk.f.Z.;.$X$)..4./.|..G..!B)..Z..V..G..BJk.... .....u..".?.A.@ ...*.".......K.......>...a&...a...?Sm..g....A).PA ..r.... ..#H B&.....H\.-.'...?.....l../'.X.Y.....A.@.J..d.I... .

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/scbg.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:28:06 GMT

Date: Fri, 03 Apr 2015 07:28:06 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 5156

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a..M.....;*K..T....jn./...[...pD.G6....G4s. ...........l.te..G.}l......qOJk&........J6.YM.gX..e.*1yc/1pj.gi{.E:~y...sV*..U..qp)......g.........%(-Dy.....VS.....Z....ZLg..t ...K......e...zn0RVLTW.....p...........Hx14j=B...SL0.yw..pI~...6.....[P......k\..Q.eZ..f.?,Q<*X.......I_........f*.weWx.7........s..vu.'...Cx.@^&8F8..s..{.....ND\jf......fah7...k.......fd.u....Z......2...t..@.@F..c....z:Zd3B.......r..f........F..C....S....9W`TvFlD.t%...q........v..P.......~k........xY/#..\.oZ|4..cP..~..............i..^.....L..\e ...U.{h...........m.ve..........xa..V.aR..p........IO|.G|.b.......c.....s..`...Y...........Iz.Y..z.'..u..p...\.6..G......m.$....xpq..[e].....^..\.O@.E1...>"$...J.Jb. ..y.~~{.(;fN..g'..|.)..}......A=G..r....o^..........xe..!.g$*Y......r..p..h..c..m`.......s!.......,......M........H......*\......#J.H.....3j...... C..I....(S.\.........I....8........@...J....H.*].....P.J.J....X.j......Mc......}h..]..m......K....x............L...... ^......#K.L..e.S...!p....B..M.t.='NxHa.....c..M.....s...........N...... _......y?.<....I.i....w.om..........._.........O...............(....h...&. }I.3]u....?I.c...f.....a!"..f..7hh..(....,....0.(..4.h..8....<....@.)..D.i..H&.......@....>.Ti..Xb............#6<.Z.h....l....p.)..t.i..x....|......*....j...&......O>.8...S....6.gA..T...<lr.!.4j...............*....*...>.!.T.......Z. ....=<.H..6....F ...Vk...R....J. .%x@..p. ,.o...2.|..*.$.....k........j.).QV..!.e....yj,. ..........Wl...g....n.k......$.y.......U<.....,..4.l..8...........,.#..P,..|

<<< skipped >>>

GET /flashzt/img/zmxy3/n_mg_bg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:32:07 GMT

Date: Fri, 03 Apr 2015 07:32:07 GMT

Server: nginx

Content-Type: image/png

Content-Length: 1920

Last-Modified: Fri, 14 Jun 2013 09:48:10 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:2 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

.PNG........IHDR.......f.......|7....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:1D872F76D4D111E292D2D069A292083F" xmpMM:DocumentID="xmp.did:1D872F77D4D111E292D2D069A292083F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1D872F74D4D111E292D2D069A292083F" stRef:documentID="xmp.did:1D872F75D4D111E292D2D069A292083F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>_t.8....PLTE......y..G..<..;.....`..b.....t.....}..g..d..c..{..a........~..u..e..p..j..l..k..o..i..r..n..m..w.....x..>..?.....s..v..|.....z..q..s..H..h..@..I..O..=..[..F..V..Z..C..U..R..K..N..L..M.....C..D..?..B........E..Y..S..A..X.._..T..Q..P..^..W..A..:..J..M..f..\..=..a..]..}..:..9.................f..2..q..d........c..j.....*..{..e..<..v..z..^..E..`.....^.....K..x.....d.....a........-..h..|..`..l.....1..k.....................LIDATx....VZQ.E.#I.`.D. *M.4..$.w......^.y..u_c~o0....X.q...A..`.h....9.;_.2.;..g..[.@[e...[..Z.........OS..B.,...3}.b*U...........C.n|HF.I$7..I..5H.J......R.M

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/ico_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:04 GMT

Date: Fri, 03 Apr 2015 09:48:04 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 44

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

GIF89a........@m...!.......,...............;....

GET /flashzt/img/zmxy3_20120913/tgbtn.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:08 GMT

Date: Fri, 03 Apr 2015 09:48:08 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 1672

Last-Modified: Fri, 13 Sep 2013 02:12:53 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a@.....................-. -. .........".'&.)%.($.*......................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:4184B9D9CCF8E111BB4D96CAE4A07F0E" xmpMM:DocumentID="xmp.did:4FCD00351C1411E3913B8A3F3EE50EB9" xmpMM:InstanceID="xmp.iid:4FCD00341C1411E3913B8A3F3EE50EB9" xmp:CreatorTool="Adobe Photoshop CS2 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2A653C2E141CE31180E9A4FB6B745738" stRef:documentID="uuid:4184B9D9CCF8E111BB4D96CAE4A07F0E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,....@.......QTdi.h...Y..%.tm.x.......pH,....r.l:..(4@.Z..@6K.x.`....z..4`.f...x[....x.....!........}_..............`.........._...............................^......a.

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/bg_8.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:32:08 GMT

Date: Fri, 03 Apr 2015 07:32:08 GMT

Server: nginx

Content-Type: image/png

Content-Length: 9570

Last-Modified: Fri, 27 Sep 2013 02:27:37 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR..............P......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:61621FFF271B11E3B6A0AAB95D0E2A6B" xmpMM:DocumentID="xmp.did:61622000271B11E3B6A0AAB95D0E2A6B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:61621FFD271B11E3B6A0AAB95D0E2A6B" stRef:documentID="xmp.did:61621FFE271B11E3B6A0AAB95D0E2A6B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.l......PLTE.b..................oq G........V......l.6......445..........sr....FG......uvw..HCEF........."##Z./...........i.....R.......`..4,Q)<.wvf..\aaqKI.Y..n-cee...Q?1......x68...............UWW.1ondX.............:@.,{..o....RM.......O&....F$..*.4..Nh.....2|...Ta........O...nrr.!...l.....Q.......W..12tzz.[8...{}~P.....knn........{.EbNRR...........]....|............Reij.$#.......P...b..n....-^...._fyoc...D.*...q!#.......f9...d_T5...Cx:OF",1JLL...YUM.........> '....... %..z...~....F...............<>=............82 .............kwL_\...............;'2..........l....Zkg..B.E3.....

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/faspbtn.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:08 GMT

Date: Fri, 03 Apr 2015 09:48:08 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 1723

Last-Modified: Fri, 13 Sep 2013 02:12:53 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89aM...........................-. ,. &.)(. %.(%.(.........................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:4184B9D9CCF8E111BB4D96CAE4A07F0E" xmpMM:DocumentID="xmp.did:4FCD00391C1411E3913B8A3F3EE50EB9" xmpMM:InstanceID="xmp.iid:4FCD00381C1411E3913B8A3F3EE50EB9" xmp:CreatorTool="Adobe Photoshop CS2 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2A653C2E141CE31180E9A4FB6B745738" stRef:documentID="uuid:4184B9D9CCF8E111BB4D96CAE4A07F0E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,....M......`qPdi.h..l...R.tm.x....d..pH,...dR.l:...tJ.V...6..t.X.xL.s.[s9.]o...\N.s.s.=..G.x.t...yq.........ed.....c.............e........c............................

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/libg_2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:42:44 GMT

Date: Fri, 03 Apr 2015 08:42:44 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2223

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89aK.^....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,....K.^........H......*\.._.....`....5I2fD..#.. =..)....'I.D.1......C.oI.-M.8i.._..>w....h.'...t....'N..L.....T.6..e.?$JfF....)Z..L.@....m$.c....)w..@.F...Wn........j.j..@.8{....G@.Qc h.".. i_h.B.`L....@A....P....Q...l00..Ve.%A.L......". ..6h..@^.@..... ....... .0.U..S.....Bi0....$a..................`..jI.s.&.%....br.?......0h....2....#....(".f..a|OX...,......U....h#..hq.L.....@..F.....*........D.H<AC.KV._.4...?p.a.......I8...`Zi..O....|.i%.`4A`..( g..l...M.b..KZ...2:....*.B.mn..$..9I.;"..(.T.... ...h0......E.e....6..BK.4....-...W2>.%.,.........#zA@.MX..."zb....B..!R.J.O\1...Np..e.1.......Mp.#........./..,Kl.2.....0....*.B...!G..'...K..E'......:1.#......NqA..]0E.Z|@2..h..-.h.r~.,`K.b.<s~..A.?u..s~.......;.}^.....,}..c...$.Hm

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/more_boss_s.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:09 GMT

Date: Fri, 03 Apr 2015 09:48:09 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 3201

Last-Modified: Tue, 18 Sep 2012 02:20:38 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a..*....D..^..D..B..J..Y..X..K..L..W..P..M..U..T..Q..M..O..N..U..V..R..S......................................{..............}..|....................e.....~..........................|..`........Y...........k...........].....m..b........z.....|........a.....^.....V..w.....Z..W........\..n...........h...........r..l........o..g..d.....z..u...........y.......................u..w........_.....v..x..D.....o..X..l........o.....d..b...........j....._..s..T..f.......................^..f....................t..[.................h........`..i..y.....c........q.....p.....N..i.....b..O..G..[..]..F..\..I..F..\..^..E..`..C.._..Z..H........................................................................................................................................................!.......,......*......9...Q....*\......#J.H......%.$..!. C..I...C.n-[.....0c..I....8s..I.. .@...J.....$.X.....P.J.J....X.j.JU...`...K....h..].....j...K....x............;...... ^......#K.L.2dc.3k.......C..M.....G.[......c..M.....s..m........N...... _.......K.N......k..};.8.....>........_..".m.o..........C.;/8....&..7...&....Z....&..3.D.... ....Z.....`..$.hb.%8....X..........P..8...(8.x....)..D....5$Y..E...354.@/H..d..8...H8#F..X ...8....$.eG...$.^.(.._.........w..g.58....|...A.X'..6*e..D*...N.`.......l...e.$..^L.d..tIC....A.Hh..(...*...Fq)..X: ....&..jZj..N....n ..)D...4.!m.eF.*..t....~.`......V.I...z..3.H.n.C8....h ......3W8..... .3..!......... .... .34t[...Z....l.....|...jP.....q..\.m..X...6..3.<....>....=g./..2... 4.i..(... l...?.I...

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/more_zb.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:09 GMT

Date: Fri, 03 Apr 2015 09:48:09 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2770

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:2 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a.. .... @....,`.Ei....i..O{..ggw.............x.......jR.......xg....[P.m)........j..*......Qq]..*..@...f.&.....k...N....>h......r...............;..8&.........,. Q.....................p...........6...!.......,...... ......pH,.....Bj.L..tJ.Z...v..^".pd..D...z...<!.|N....BX.9....x..........!.#G".%>......>.`|................%."E"...-...%.{b... .........B#......:...!.{}...........?............{~.~......%.BX......j:.....E.o>@..c...~.3j..B..K'j....D..|"HP..B.. ...!qb.?.f........@...J.....px..r....>H.x..;..e..0Q.M{F...K....H...H.-....,.aB...,...@.-.O....E...... ^......#K^.C-..n5@...3...8........b........c..M....4l..a...../@........=..K... ...N].....k.......f.....x.7...^..y.4,.............4......=..g.t.. .y.%P@........0..2.....\.... ~8@..!......@u.......(C...8#.8...|.}..........v.i.I..t0..C.:.p .M.....`...nH@.`.)&......c.).....!.p.i.t...b.m.."w1d.g.;zdA}.l....-......_5.....c.s..2.0C.b.0]...*j.......d....6`!....$u8..gu.\...p.Qj.)n.......u..0j...y.wji@..@..h..@`..VUp....k...|....".....:.j..B.l....l..:0....K@...)....k.......8.J..'....3.. ...k... ...jU....^ .i.....z.6....0........g......'./....?..3.3h.....[/.7..)..#.........||.....C..|..RK.x...ApU.VE..D.YPp.R.....J<C.......v8.......n.....>.....-.....i.0\....l.0.\ ......w...nv.J]P..l.....p'g.......0t..zQ.....PNq...`..........,..._0.f.0@....z.{.=:.3t.u....).=.~....`m..e.{K<@.C.....n..2.`.........e.j....h..M..Y. V.f.<.ZH{f....4..),|....n@...I......`..lmf.*....-.@`.A.....-j@......b..J...LL...`..rjf~......&z..2....H.22.Y#$..!6,.0.......e.1...

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/bg_9.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:42:41 GMT

Date: Fri, 03 Apr 2015 08:42:41 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 9202

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a.......022/Q\..J..c......uxx.......T!...j._...egh......u......e.UXX....A#.....b.............y]......]aaLuz..........,..4...................G.|oO)...K......w..........c../.........US......@BB.e..g....................L"c.......q.....8..........g...-.Y............)..............K............z~.........%.I"....d>..\........z...i...Z.....X2...2......S3.....6.....z..9.gN.....{'...Y...........<$.....|......>x.lpp.E0......PTT...........f#...mN.Y"....n?...-d....,/..`........E"....^.......^......O3.r..sN.......C ........'9L.......m[@...s...f(..S.............\@.f..#.....`...3.J/xsB:......wM....g.,G..D(..-.......s_QVH.......y..........s..$%%.......P"................V!.............................F......................J0HKKTJ:3b...o.x..........[....._y^\.}.n..t..Vu.j?.........!.......,............_@.H......*\......#J.H.....3j...... C..I....(S.\.r.@.0c.......8s.......@...J....H.*].....P.J.J....X.j....O........X.h..].....p...K....xo..I6.......L...... ^l./..8.3.L.....3k....d.....M.....S.^......c..M.....s...........N...... _.\7hh2...G......k...........O......._.........O..y?..........=.]M5.g...&....6....F..~.Vh...v.`L.I... .(..$.h.......,..!L.....4.h..8.._.:..#..uX..D.i..H&._0J6.d{..9..TVi..X..d.\r.%t.N...d.i...m...?~...p.)..H.I..'..!.|......i.:.(.D..(.. .6..X{:*...V........;.".....D .Zj.w..).....*.....C.;|*....*..............kl........z...F...O.z....y...v{c.......2`...nrL.}\s.1..0.............. ^ ...@#.*.........l....?..1...]..g....S... .,2.}Tw.6..l.1(kc1....V...2..0..3...w...B.....p.......h .....,5..\.2u'...uu

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/c_4.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:04 GMT

Date: Fri, 03 Apr 2015 09:48:04 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 81

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:2 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

GIF89aB......j.....!.......,....B.....(D.............g`x.H....j......LGm.....@..;....

GET /flashzt/img/zmxy3_20120913/t_5.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:06 GMT

Date: Fri, 03 Apr 2015 09:48:06 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 5473

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89aB.6.....{.N...r...........................................y.....j..........................\..................................................1.....T.....@...........|J:.........e..........................I...........................................................$p.............q..........................2y.................d/.[...........Y.....................s.n...............k.....[.g...........}3.......}L..............................................o\.........................................#........................................................;.......u .YH....................%...............................................z....Y.....x.........2................uJ...........&.............w.....9#...........................j...................................!.......,....B.6.....I....E.z..*\......#J.H.....3j....G.9^.. p.. ...[.....0c..I....8s.......@....-.....x......P.J.J....-........`..../HA$c..]...Z$....K....2........U...L...... ^..n...#K..x....yV...2..`.....s...S.F@....3:. ..................N...... _..8....w.....y.x.k..{.......O.....u.....'0.f....>p..V........=.H.~.qI*.&....6....F(...V...#....3P`..c.(..!.P...T.".)...~*.rK&..Q.!.....<....@...1.....c..O'$6..-..)../....Xf.....B.1~..J#~.B...l...l....p.)..t.i....c..|.!.{. ....Z...\$p....Y....BG"..2.4...@...pI...*..................".........@..k.U........&.$BG6v.1..:... k.!...Vk...f....v.........,2......-{.P...(P....k......<~d..(~...&y.@..........D..G,.....kl.,.L.3.....FR....!.$`. ..,.Ze=0.,..0.bH"....!. .@=....!..cG.4'.t=.....J_`..P....1C.A..

<<< skipped >>>

GET /flashzt/img/zmxy3/jcsp_1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:05 GMT

Date: Fri, 03 Apr 2015 09:48:05 GMT

Server: nginx

Content-Type: image/jpeg

Content-Length: 20782

Last-Modified: Thu, 07 Nov 2013 07:12:52 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......d..... hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:44F48F38475111E3BBCCCE2D9E5A3778" xmpMM:DocumentID="xmp.did:44F48F39475111E3BBCCCE2D9E5A3778"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:44F48F36475111E3BBCCCE2D9E5A3778" stRef:documentID="xmp.did:44F48F37475111E3BBCCCE2D9E5A3778"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................4..................................................................................................Q...$..&6....RC4_W.!1A"..a#23d.E..q.bcD.V.Gw.........................#3.aC..4.U..!."B..1Ac.Qb$.q.2.....S.euE&..R...D6............?......2..trGz<..nn...i.3._s;.......z...FVg.&.VFv&f.Q......8G..o{..Wy...J.Zj..<6..$.p.DT ...JR.*Q.I3.6.0..&~M..~.z[...aN.T5..e......a.Z...b..D%%)I(.....E..........tIr.]s...w.. ...==.86.M..IQ.......$...~3..u.@.........A.*1..1..WD..

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/c_5.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:05 GMT

Date: Fri, 03 Apr 2015 09:48:05 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 180

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a.......j.....!.......,...........D.................H...........................fL*......J...df.j............N....{X~....... ......(8..Gx......Hb..)9IYi..y......Y..:JZjz:.P..;....

GET /flashzt/img/zmxy3/zb_nav_20131205.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:42:44 GMT

Date: Fri, 03 Apr 2015 08:42:44 GMT

Server: nginx

Content-Type: image/png

Content-Length: 5455

Last-Modified: Tue, 03 Dec 2013 06:48:22 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR...X...4.....a.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:5A84F4695B4311E3B1C990F5C16B460B" xmpMM:DocumentID="xmp.did:5A84F46A5B4311E3B1C990F5C16B460B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5A84F4675B4311E3B1C990F5C16B460B" stRef:documentID="xmp.did:5A84F4685B4311E3B1C990F5C16B460B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..$....pPLTE.......I.?V..G.........:..=........I........G...........J.....7..|..{..1..o..q.W..[..l&..!..[.U......A.`.....f......f..G..>..&..,..A..c.x8..7.s0..P..W........K.z9...........~.v4...........6..............E.q-..^..r.}=._...6..i..u..n..]..-.i!.y8..@.o4...........a....c!.Y.._.....t9..#..I..R..V....{<..%..&.....x.....y.Q......D..u..E.....L.T...K..U.x7.l/..{...._...e..f..n.Z..W...l..u....i*.U...j..g..(..B..J.t2.o*..7..;...........Q..P..W..'.]......}....|<..v..Y........j..j.....r..........P...<..)..$..N.d..{;..C.....F.c...i.....p.....6..t..p..T.....O..H..d.N...x.\...h.R.....e

<<< skipped >>>

GET /jss/lazy_iframe.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:49:40 GMT

Date: Fri, 03 Apr 2015 08:49:40 GMT

Server: nginx

Content-Type: application/x-javascript

Content-Length: 1268

Last-Modified: Sun, 10 Nov 2013 09:24:37 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive

function F_Resize(h){..document.getElementById(F_FRAME_ID).height = h;..//window.scrollTo(0,$("#" F_FRAME_ID).offset().top);..}..var get_screen_height = function(){.. if(window.self&&self.innerHeight) return self.innerHeight;.. if(document.documentElement&&document.documentElement.clientHeight) return document.documentElement.clientHeight;.. return document.body.clientHeight;..},..get_scroll_top = function(){.. if(typeof(window.pageYOffset) != "undefined") return window.pageYOffset;.. if(document.documentElement && document.documentElement.scrollTop) return document.documentElement.scrollTop;.. if(document.body) return document.body.scrollTop;..},..get_offset_top = function(o){.. var offset_t = o.offsetTop;.. while(o=o.offsetParent){.. offset_t = o.offsetTop;.. }.. return offset_t;..};..function chg_src(){.. var screenH = get_screen_height(), scrollT = get_scroll_top();.. var iframeH = get_offset_top(document.getElementById('CommFrame'));.. if (parseInt(screenH) parseInt(scrollT) > parseInt(iframeH) - 200){.. document.getElementById('CommFrame').src = F_URL;.. $(window).unbind("scroll", chg_src);.. $(window).unbind("resize", chg_src);.. }..}..$(window).bind("scroll", chg_src);$(window).bind("resize", chg_src);chg_src();......

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/t_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:31:35 GMT

Date: Fri, 03 Apr 2015 07:31:35 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 599

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a.......D..s....................!.......,...........H...0.I..8....`(.di.h..l..p,.tm.x..|....pH,....r.l:...tJ.Z...v..z.`. @.....z.n....|N.....~........................................................................................................................................H...J...#&.....#J.H.....3j....... C..I....(S.\.....0c..I..M...a.i....@...J....H.*].....P.J.J....X.j......`...K....D..K.`.Z.p...K....x............)...... ^......#K..x0%...`.......C..M..d.....d.....c..M.6_}....i........N.0n..X._........>.......k....V...z.O.......EN,........w}a.............c....h......B.&....F(.b.&..;....

GET /flashzt/img/zmxy3/bg_3.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:31:35 GMT

Date: Fri, 03 Apr 2015 07:31:35 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 19606

Last-Modified: Sat, 09 Mar 2013 01:57:08 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a1.......<..sN...csS...............t.&0M......y..4.........mY......U..H.........Fh..."..&..9............P.......Z........un.)..*.....).................Ua.........t"V.......X..A.........F.......e........m..s.....*.I.z.i..3H^1.j.........C..q..............K.f......................5d...-.....q[....p...m6....R%.............,..#)..x.K....jTx...................)q.zh3H.......5..gs.............[hM0.....U........ayb...;....P...M..<....."..M.G.........5..p..0......~.1..............H.............o7I@.........l............M; ........E..=.....x.........?I3..0.................?..R.................8.....`Y.....1:.........Y.....*`....X.............................P..W............j. ..?.......=5............>|..lg..t.@.........p.....![..........@.V...z....._..\...........O........B..?!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:C049D57D87B311E2B16482045EDE6CCD" xmpMM:DocumentID="xmp.did:C049D57E87B311E2B16482045EDE6CCD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C049D57B87B311E2B16482045EDE6CCD" stRef:documentID="xmp.did:C049D57C87B311E2B164820

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/b_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:28:08 GMT

Date: Fri, 03 Apr 2015 07:28:08 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 610

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a.......D..s....................!.......,...........HJ1>..I..8....`(.di.h..l..p,.tm.x..............r.l:...tJ.Z.._p.h<...xL.....z.ng|.-.......~.....np.rCt...........Q.@\].............O...B..v........|.Z.D__........&.q..............................u...........]E.u................H..A%... ......#J.H.....3j....... C..I....(S.\.....0....C^..8s.......@...J....H.*].....P.J.J....X.j....Pi5........h..].....p...K....e............L........[i!.y.#K.L.....3k>.X,...C..M.....S.^......c..M.....s...........N...............K.N......k..........O......._.........O.............'..(....h...&....6....F(...Vh...f....B...;....

GET /flashzt/img/zmxy3_20120913/right.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:32:06 GMT

Date: Fri, 03 Apr 2015 07:32:06 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 1037

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:2 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a.......G.....O..B....................c.......................k....................\..@..>...........t................................h..b........w.....a..e...........m..............z.................R...........p...........g...........q..~.......................t...........i..a...........................................................x.................m..............}...............................................}..{.....l..l.....<..................................................................................................................................................................................................................................................................................................................................................!.......,.............<.H...;..*L.&...2...# .B....1b... .2......*i.0`.....$!..`.....00......`^,X....;=.4.a.L.6=.4.9.Q.?......AL...X.c!..#....4 P.:C..Y..$...~T."GHZ..`L.....D]I..Ab..3,.h.z....o"DX.G...3.qx......Hv."bG.9O.Tyy1c.C&.. CC$I..&L.r....$...8.K...;nt>....

GET /flashzt/img/zmxy3_20120913/b_2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:06 GMT

Date: Fri, 03 Apr 2015 09:48:06 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 250

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

GIF89am..................J.....H..R.....c..............3.....g..W........4.....f.....V..j....................!.......,....m.....w.uidi.h..l..p,.tm.x..<;A.IoH,....r.\=0.A.I.Z....W.8...vL...h....4...#M...x.c 4.....................................m.!.;....

GET /flashzt/img/zmxy3_20120913/b_3.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:07 GMT

Date: Fri, 03 Apr 2015 09:48:07 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 248

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a\..................J.....H..R.....c..............3.....g..W........4.....f.....V..j....................!.......,....\.....u.uidi.h..l..p,.tm.x....E..pH,....rYz`(..sJ.Z..,.Pq....xL...(...h....zN... .@@h....................................l.!.;....

GET /flashzt/img/zmxy3_20120913/b_4.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:42:42 GMT

Date: Fri, 03 Apr 2015 08:42:42 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 244

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89aB..................J.....H..R.....c..............3.....g..W........4.....f.....V..j....................!.......,....B.....q.uidi.h..l..p,.tm.x....I..pH,...d.......tJ.Z..B..0(...xL.*..@. .0...|N.0..B#..................................i.!.;....

GET /flashzt/img/zmxy3/zrsp_1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:07 GMT

Date: Fri, 03 Apr 2015 09:48:07 GMT

Server: nginx

Content-Type: image/jpeg

Content-Length: 11256

Last-Modified: Thu, 07 Nov 2013 07:12:52 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

......Exif..II*.................Ducky.......d..... hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:AF608084475911E3A7AFC49BE0AFFEEA" xmpMM:InstanceID="xmp.iid:AF608083475911E3A7AFC49BE0AFFEEA" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4C2A5E3F475111E39230A2E5FDEDE007" stRef:documentID="xmp.did:4C2A5E40475111E39230A2E5FDEDE007"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................4."..................................................................................................Q....6..bC$45.&F..W!1.%A"#.a.q2.9...R..cd.UV8I..........................#3.!Qa..4..1"BCU...A..c.q2$.b...7....rT...S6.............?..U........U.......3..u...}.....n..T.D...t..R.d..\..8..Q.g.^.x...Sj.........U..y...g...5........*mS=..>...!J...=s....]F...z}.X7.M.g.tg.:c.)W.Q..w..W...3..O......L.N..GL|.*.J<...3..u..{u...`..6.....h....^.G....q^..X.n.>.,....3.

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/t_8.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:26:34 GMT

Date: Fri, 03 Apr 2015 08:26:34 GMT

Server: nginx

Content-Type: image/png

Content-Length: 4901

Last-Modified: Fri, 27 Sep 2013 02:27:37 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR.......4.......K.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:54C77830271B11E381D8EC9B4F192540" xmpMM:DocumentID="xmp.did:54C77831271B11E381D8EC9B4F192540"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:54C7782E271B11E381D8EC9B4F192540" stRef:documentID="xmp.did:54C7782F271B11E381D8EC9B4F192540"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>&..'....PLTE...w}~...n....g...........73.........wSN........a............(.l....?..H.............................H.e.|....-............y....L...e.h.f.../.v..u/-.......&....7...k../ .........q5..........l..W.k....n......X.xG...T(.....N,.......K..F....@.-.....s.W.y......)).C.....E.z.nwM............w.eP....%.....x..R..{Pwn...pvv..............$..o...$..2..............H.....v.......... lO,|ue.r.............8tv ..........<]q].^.................~...g..6...............k...u!....j.:..O..................................................j.............................$p.q..N.................2y.......].

<<< skipped >>>

GET /jss/news_footer.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 10:33:26 GMT

Date: Fri, 03 Apr 2015 10:33:26 GMT

Server: nginx

Content-Type: application/x-javascript

Content-Length: 961

Last-Modified: Sun, 04 Jan 2015 02:52:24 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive

var cyl_footer_str = '<a href="hXXp://my.4399.com/joinus/index.html" rel="external nofollow" >........</a> | ';..cyl_footer_str = '<a href="hXXp://my.4399.com/joinus/contact.html" rel="external nofollow" >........</a> | ';..cyl_footer_str = '<a href="hXXp://my.4399.com/joinus/zhaopin.html" rel="external nofollow" >........</a> | ';..cyl_footer_str = '<a href="hXXp://VVV.4399.com/zs/wenwangwen.html" rel="external nofollow" >......[2012]0810-015..</a> | '..cyl_footer_str = '<a href="hXXp://VVV.4399.com/zs/chuban.html" rel="external nofollow" >........(..)..06..</a> <br/> ';..cyl_footer_str = '...................... ............ ............ ............ ............ ............ ............ ............<br>';..cyl_footer_str = 'Copyright © 2004 - 2015 4399.com All Rights Reserved. ........................ ........ <a href="hXXp://VVV.miitbeian.gov.cn/" rel="external nofollow" >ICP....B2-20040099</a>';..document.write(cyl_footer_str);..t>....

GET /jss/zmxy3_20141010.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 10:14:40 GMT

Date: Fri, 03 Apr 2015 10:14:40 GMT

Server: nginx

Content-Type: application/x-javascript

Last-Modified: Sat, 11 Oct 2014 02:18:28 GMT

Transfer-Encoding: chunked

Content-Encoding: gzip

Age: 1

X-Via: 1.1 shb18:2 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

8b8.............Y.o....,...8..)..H9..6=tK..X.....i P..te..HJ.b..).aE..y..2....X..A....a.P.../[.b...w.."%..S......}~......K!..f*...;8....../..s........[.....e.....dJ./...b...m..s7..Z..cS.w...,......X..)..5huy...H]...C.Q.;.K.!`...n.>w;..x-.dW.u.......%.r.f7~..T.;r.d....)......D .m.5.37.&k.......D:.,.`..0Q@v...AG....`..%.v^f,.D .%~'.c)..e.mk..Dh '.K...B.n.....R~....X.s&...P$J...0.T...xOx......T_......y.T......t..huU.)-Y..........W.|..W..........?.......=x....w*.....g......Q"......q.....<qJ.Z.......9.UO......<g......T9Y.......Fi..x.Ve".{>... .;.js...#%.......s..0)Q...)M e.. .....nh..../.n(Q....SR...3....4@..H..5.7...6...3....y~.W..B.I...\..,....s.N2.........3.#..HJ.M...R....V..-...G8..r..l..HW*[B......H.D9w].........PW}.L..Zsn6..U.h2.Dy......e..c..)b,.>r>R..Z...O......t....][u.}./.. .^.lf.gi.H....\..`-..q.~...i....o.H..U..:...kj..Du.H.,.PU........!Nm.cQ...rQW.E.u..c....y.z..@z.....u|.#9xM..d=....[0t,Qq....A...m.._O...!@.$Q.#)k...7B..X...zM.!.&..."L.K..c..C3b.\......7f0.}.EmR..`.....SGuV....8....4.s..aJX..C6..Xj[.......U7."T..@..[.~....*.hg,.....`.....p...".95p.{..g.......'O>....7......O....T.._.............p...@.)..(...9|"..K$.4J........z.|...o....M9i.g..q]..c6.......05.B..O.=p._e.F..Ho..L.4!..Y.v.X.:._..f.w..f*.e4aE..{PQU.....H....]bJ.......ZM....x..z.B}.&W@C&V....E*.P'...$/c/\\22...'E Y_O...$k....VR/.2... ..'_.....@.&j....8...UB.7.U.6I.*..xq......w(t.E....s......H.!./.b(M9&q.m.q.K/./.LrC...k...<|H...B..v..<.(..P...e.......z.^....x.H...."TyW.....i2./L.%#.0...].uz-.:L/...k.5........Zp.N.8

<<< skipped >>>

GET /jss/play_hs1202.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

Cookie: bdshare_firstime=1428057332914

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:47:10 GMT

Date: Fri, 03 Apr 2015 08:47:10 GMT

Server: nginx

Content-Type: application/x-javascript

Last-Modified: Sun, 10 Nov 2013 09:24:36 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=7776000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive

5f9.............W.n.6..n... ..X)..'......t...b.v...%Q..Y4D*...........s...d.u]...S...?~.Gt.T.*D.~.n.3.JE..y......\._-.N...R-K...\.lI............'.... _.q[p.bsNVw.FR.vN"..=.c.i.;...`.q.C.u... .........m..#X.....%(..?.....$*2...):..Ts..........n_N....2...b.u...J^.......&..Eu3`.mH...wnI..m*.....F.B .. ...5A -5.o.4..&...s...r.{.%c..L.`..6A3tB..q|yr..;1k...E.....{g<....x....L........;.vNp:}."H.....IS.t.....g.>c...3S.V.....K....8..b.]..9k...a......y.>..a. ^r._.....\W-6b.e....h.#.p..{D...N.v...:Q......bJ....7.!....j.....T..vR$9On-....Tmy>.e.U...2U7<. cW%V.q......T....d.<H....GZ..h....MHdp..;.{V....c[p...1.R.2..V.&....5.......v k-\....sr...u..n.....M....fK.5...I.].P....'.X....).N....*.y.)p..d,=.).T..-AF..,E.to..eA^.,.9......d.cL.S..:.O.......p....N.hr....hre.....}.-.ZlL/U.J.... .. .Nym..wB.E.D...F....Z.mN.....e.M`...u..h/j.v.'..1Y.k1..#...dL..C.m.{eGj.Qb..}..:...Q..5}aMi.M...].dY@.B......r......Z#..y..B;......$..m\sv.^..\.`...uB0....y.z68..q....0H.,..%..t....).-.6.....N......a.....3.bj......}....Q....n.f...9./_i.|.C.....`|..1..-^G..h..Euk.y9..p..9..G.K.t.Q.8..........$<9u......._.c..<.J.*....:3l.C......^.5........J.%..PT......=.H.;T....aB;f.%.gXw......e.{..|v.@d.......3....[./...k....yH<g..Dp..Eb.O.>.J.RTs.H..xM..@V....?$....s........B..p..@x*..1.....C]4...L%..P.. ...C....:..4...W...}.../.q.]9D3x.......3}....tD3_.....{.)x.C...P.R..B..>..ey.t..B.#..r.....[U.....o.=.6..6...w....g.[.....C.i....2.....c..\_.....C...B:F......).^./.:us....A.."@s.[.Evq4.......4..to.t...O.6Lq..j.......<.N.?..

<<< skipped >>>

GET /upload_pic/2015/1/26/4399_17152503697.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 27 Jan 2015 07:39:34 GMT

Cache-Control: max-age=31536000

Content-Length: 2170

Content-Type: image/jpeg

Last-Modified: Mon, 26 Jan 2015 09:15:25 GMT

Accept-Ranges: bytes

ETag: "80b44c9e4839d01:388"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 kf49:2 (Cdn Cache Server V2.0)

Connection: keep-alive

......JFIF.....H.H.....C....................................................... ...C................ ......*.D.........................................6..........................!.1"AQ..23Ba.Rq.#Cbr.$4...................................3........................!1A.Q."#2Raq..3.....r................?......)..y%...xs....C...@..S.A..-MK..`...iXY...>/......nD.9.........4Fy...U4.O.5..#.R\.T..........fd!..dm...X=.j.t^e..f.2%L.........K...\_.KT.2..o...VQL.~....d.mN..]...T.eq.r7.=kz.....0E5..33c@.}4...42..d.......ZB..1.M.TI$.O...[.$}@z..x..S.h....>..........V..m[].TM$.$.S....xE...,N...Cy*...u..\../.....4...$.1.b...ab.wX......[!KIL..p?..F.|Us..].$=...N,..oe.Z.M3.K2Cr.y&G......Wn..M...........)..3...d..W...@N...7..7....Y.......Z..Of...5A..g#.5.fwSi(..g.....!.Amk.c......uu..*..........S...tp.1S..H,.U..o..,4..K.F5:.5......=.e|..54r...T2$.o-eG..G;.......'v..xN..@. $yoby....\.....#....|_..|L..z5KG..6...B.....7.|.... ...M]..Qs.......lU,.....G....3@..a...,....O......i&.........T.....$.......<.[...'..S.......p.$D.S..k.)....$.2.e.....%...S.6.]..T.....LU:.D.Ogu/]...Y.HXr...G.........#je..1........E.....r....?./G.,.*]._....h..<..E.n-...%>O.T....Y..YQ......rC. ....%.2TL.c?){...... s......0....<...Sug..'..w.o=.....L.Mu....fD\....L..f........l4.....p(...f..N'..2.z.[*JTYeG>... p.Hb.@%.yyzrS.'.R.|>.,t.c.w[O.2.C...sdR[....e....5D...AA..............ND~"..Lp......r.=c.P{..-@...GPp....m...kY.... ......urS..Mna!.......#..X\9.U5N.......4..N..=z...I..r..ak.s.K..#8

<<< skipped >>>

GET /core.php?web_id=30039538&t=q HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 751

Connection: keep-alive

Date: Fri, 03 Apr 2015 10:24:51 GMT

Last-Modified: Fri, 03 Apr 2015 10:24:51 GMT

Expires: Fri, 03 Apr 2015 10:39:51 GMT

Via: cache2.l2de1[611,200-0,H], cache21.l2de1[571,0], cache9.de1[0,200-0,H], cache10.de1[0,0]

Age: 637

X-Cache: HIT TCP_MEM_HIT dirn:-2:-2

X-Swift-SaveTime: Fri, 03 Apr 2015 10:24:51 GMT

X-Swift-CacheTime: 900

!function(){var p,q,r,a=encodeURIComponent,b="30039538",c="",d="",e="online_v3.php",f="hqs10.cnzz.com",g="",h="text",i="q",j="全景统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="1",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a href='" q "' target=_blank title='" j "'>" j "</a>",k.createIcon([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: application/javascript..Content-Length: 751..Connection: keep-alive..Date: Fri, 03 Apr 2015 10:24:51 GMT..Last-Modified: Fri, 03 Apr 2015 10:24:51 GMT..Expires: Fri, 03 Apr 2015 10:39:51 GMT..Via: cache2.l2de1[611,200-0,H], cache21.l2de1[571,0], cache9.de1[0,200-0,H], cache10.de1[0,0]..Age: 637..X-Cache: HIT TCP_MEM_HIT dirn:-2:-2..X-Swift-SaveTime: Fri, 03 Apr 2015 10:24:51 GMT..X-Swift-CacheTime: 900..!function(){var p,q,r,a=encodeURIComponent,b="30039538",c="",d="",e="online_v3.php",f="hqs10.cnzz.com",g="",h="text",i="q",j="全景统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="1",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d))

<<< skipped >>>

GET /core.php?web_id=4073713&show=pic&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 752

Connection: keep-alive

Date: Fri, 03 Apr 2015 10:24:39 GMT

Last-Modified: Fri, 03 Apr 2015 10:24:39 GMT

Expires: Fri, 03 Apr 2015 10:39:39 GMT

Via: cache23.l2de1[873,200-0,M], cache60.l2de1[874,0], cache8.de1[0,200-0,H], cache10.de1[0,0]

Age: 649

X-Cache: HIT TCP_MEM_HIT dirn:-2:-2

X-Swift-SaveTime: Fri, 03 Apr 2015 10:24:39 GMT

X-Swift-CacheTime: 900

!function(){var p,q,r,a=encodeURIComponent,b="4073713",c="pic",d="",e="online_v3.php",f="zs25.cnzz.com",g="1",h="pic",i="z",j="站长统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="1",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.createScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a href='" q "' target=_blank title='" j "'>" j "</a>",k.createIcon([p])))}();HTTP/1.1 200 OK..Server: Tengine..Content-Type: application/javascript..Content-Length: 752..Connection: keep-alive..Date: Fri, 03 Apr 2015 10:24:39 GMT..Last-Modified: Fri, 03 Apr 2015 10:24:39 GMT..Expires: Fri, 03 Apr 2015 10:39:39 GMT..Via: cache23.l2de1[873,200-0,M], cache60.l2de1[874,0], cache8.de1[0,200-0,H], cache10.de1[0,0]..Age: 649..X-Cache: HIT TCP_MEM_HIT dirn:-2:-2..X-Swift-SaveTime: Fri, 03 Apr 2015 10:24:39 GMT..X-Swift-CacheTime: 900..!function(){var p,q,r,a=encodeURIComponent,b="4073713",c="pic",d="",e="online_v3.php",f="zs25.cnzz.com",g="1",h="pic",i="z",j="站长统计",k=window["_CNZZDbridge_" b].bobject,l="http:",m="1",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(

<<< skipped >>>

GET /upload_pic/2015/3/9/4399_18380750073.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga1.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 10 Mar 2015 08:39:38 GMT

Cache-Control: max-age=31536000

Content-Length: 2717

Content-Type: image/jpeg

Last-Modified: Mon, 09 Mar 2015 10:38:07 GMT

Accept-Ranges: bytes

ETag: "80513b21555ad01:388"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zjjhdx38:80 (Cdn Cache Server V2.0), 1.1 kf49:7 (Cdn Cache Server V2.0)

Connection: keep-alive

......JFIF.....H.H.....C....................................................... ...C................ ......*.D.........................................3...........................!.."12AQa.#3B...qRbr..................................7.......................!.1AQ.."2q...Ra....B....#$s...............?.....j<.\LQ.3a..4.q.....h....|.Vz=.hY-.'..y.b .."3`..$....}.jMZ.......s.u....%o....r.(i=..r.....'.'.#^Rr...Kg..E....5...}uE9....yy.V.O.R.....9iV!.D.^.f..9.&?/..;..=N.y.[&......?.b}..:.F.......UsI8r....=......".v=...........T[...&I.~.-N.......1.......W.y0...A..m{B.?..r....[h..........CF.k..!...O.. ...K............."....S...q.j)c1.rZ)*.=-!Y..GS.3.B....R..48....[9....r....2.....(...0S.:.L........VF.....]kd..!uR...N..../R..HB..'....~...Tk..O$r._.....J.....-\EXG.]x..1..R....Sm..FFv[kK".t.i{Z...J.Z*-.#KU'R..R.F.......@.D'.p.....5r.u6..?...U.U..s....PU..........-K/9.,A.%A.M..o.....F...MF........8...5......\...V@%I..OQ.I.......8...5.u9.....EJ..)...Ii.y.?..z..Q..V.Ou.|.=d.=E\@..N:r.>.s....wQ..c.C....^U.....j.k......d.....H..1.I.j .f.v.z...NT..Z..G.q.^.[..-..A..9...Y.. ..)........gDV'.2<..W{i.....Yo.R./...N.*).q..6...&.X.F`T.]..=..(....*.d6.rRPSD..F....q...rI=..U...r...x....6Z..O44Mv.f....."....../ ....#.....!n.>...m..v.q...y........b^.T.m.*RB.......=K.....u$gen.K4..?.:.\ z}VJz.....\i.6....:X..)~......w...dO...S.i..h.H....x...k......;..#..W:.8.......F....&...Z..k.*7........P=.s..7.I...-|\MsVG......s.?OWlh......}......n..s. .|N..@z....*#....z`...Q.m.....\..Y\.

<<< skipped >>>

GET /upload_pic/2012/tjyx/tjrm_img06.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga1.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 27 Oct 2014 07:12:35 GMT

Cache-Control: max-age=31536000

Content-Length: 3160

Content-Type: image/jpeg

Last-Modified: Thu, 01 Mar 2012 06:03:41 GMT

Accept-Ranges: bytes

ETag: "48eab0d71f7cc1:34b"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zjjhdx37:8080 (Cdn Cache Server V2.0), 1.1 kf50:8 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......<......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="xmp.did:7C3C90818062E1119A50B0F09DBE5343" xmpMM:DocumentID="xmp.did:48F37DF662B611E1987FB533819DF614" xmpMM:InstanceID="xmp.iid:48F37DF562B611E1987FB533819DF614" xmp:CreatorTool="Adobe Photoshop 7.0"> <xmpMM:DerivedFrom stRef:instanceID="uuid:02cd31e0-62b0-11e1-a9f2-89007db68855" stRef:documentID="adobe:docid:photoshop:3e3cd8bb-62a6-11e1-b37d-c0893894c906"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................*.D.........................................................................................!1Q2..Aa3."4.qR.....Bb#C....s5E6........................1.AQ.2.!a...".#.q..Br.3.4.................?....6.....2.m...I.;.F.O.&O6..m-4....k>..WM....9...P. ......ex.y6...wh...M.K.X#).-RE.}....b..S..6.*...t.qS.=......

<<< skipped >>>

GET /stat.htm?id=4073713&r=&lg=en-us&ntime=none&cnzz_eid=1424361423-1428055768-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=435416256 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oz.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Fri, 03 Apr 2015 10:35:28 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes

GIF89a.............!.......,...........D..;..

GET /upload_pic/2015/3/6/4399_13510057915.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga4.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 06 Mar 2015 09:23:58 GMT

Cache-Control: max-age=31536000

Content-Length: 2427

Content-Type: image/jpeg

Last-Modified: Fri, 06 Mar 2015 05:51:00 GMT

Accept-Ranges: bytes

ETag: "07ae685d157d01:388"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zjjhdx36:8104 (Cdn Cache Server V2.0), 1.1 kf50:10 (Cdn Cache Server V2.0)

Connection: keep-alive

......JFIF.....H.H.....C....................................................... ...C................ ......*.D...........................................5..........................!.."1AQa..q#$23BR...Cb..................................3........................!1."AQq.2a...B.....r...#R............?..eF.xI....Q.$mE.X..._.......E1H...v`..........{.}..V.m.{.0.t..d.]..bz...5....Y.?&e..)rR.K...$..k.i...SU.l`..d./...`...b.<r.D...|..G.2....N..1.YJ.g....#/.b.9b.>?.3..Zkv....sq..j]..b,.v..t>.{.m.(.k .62..1.!.7j......T.f.92...T~...{...:..;n[.:...g.$(..w.......>eq..|..Y.L.-Fk-.L.*...l.$...\.s.Wd..t..S*...s.T......."u5.....(.x.y..~...V..`......e........4u.d6*..sR...k.lH.p..~./}K.(.n .............1.kD.*.....V..;S...v3u.`....U.V_..E.q.M.A!........D...9G9 ....oe?...0g.r.K...h.Cl!...0u..YnF=Fi....mE..Gz.....f..X.....M.4..F..B..@1..f....).[GP.W.6d........t..V..........|.S.Mz.B.>.. .......eu4....T.s..E....YI.Kqw.....y.....6...9..?1...:.j7Ze..<.....'m.cT.....~~h.p...d.MLr.J....&....%|J.ezIs.ybV...u..>'.....F.2-..........U........5.Qk...._....v...,..`.h{y...%........x%.r....Y..*..F.._.-.t_N.L#U......i.;....T...:.M..#..hz.T..DDO|..l...o?.$&R<~...j.2]e..-.|."......6.E..M^..('-._.....;..I............I.=uR..j.h..d...7.X.hK.~.o..........W....#.>>u>:....67R.c}B.jU]......bF..#..}.eJE:$..Ghb.p.....).....SU.Up..<f....,.EJ..%.jo-.M ..j..n...p.\..Z@.n:.T.$_E..{...2.r../4.. !8...... .. '.a..O.:~x...s...-.Z...m..K...n.........%.. .l;.....vz'c'.LQ.....;

<<< skipped >>>

GET /moeryongshi/images/headerBg.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: news.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 05 Sep 2015 07:20:48 GMT

Date: Mon, 09 Mar 2015 07:20:48 GMT

Server: nginx/1.4.2

Content-Type: image/gif

Content-Length: 228

Last-Modified: Mon, 24 Jan 2011 07:46:00 GMT

ETag: "4d3d2e38-e4"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 zjjhdx32:80 (Cdn Cache Server V2.0), 1.1 kf50:4 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a.. ....................................................................................................!.......,...... ...a.$.dY.h.Vl../%.t]3x..|....0B,......l:%...B.Z...v..z...X@.....:.n.....A............|.............!.;HTTP/1.1 200 OK..Expires: Sat, 05 Sep 2015 07:20:48 GMT..Date: Mon, 09 Mar 2015 07:20:48 GMT..Server: nginx/1.4.2..Content-Type: image/gif..Content-Length: 228..Last-Modified: Mon, 24 Jan 2011 07:46:00 GMT..ETag: "4d3d2e38-e4"..Cache-Control: max-age=15552000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 zjjhdx32:80 (Cdn Cache Server V2.0), 1.1 kf50:4 (Cdn Cache Server V2.0)..Connection: keep-alive..GIF89a.. ....................................................................................................!.......,...... ...a.$.dY.h.Vl../%.t]3x..|....0B,......l:%...B.Z...v..z...X@.....:.n.....A............|.............!.;....

GET /js/bdshare.js?t=3313 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: news.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Wed, 30 Sep 2015 03:38:19 GMT

Date: Fri, 03 Apr 2015 03:38:19 GMT

Server: nginx/1.4.2

Content-Type: application/x-javascript

Content-Length: 182

Last-Modified: Fri, 12 Oct 2012 05:57:24 GMT

ETag: "5077b144-b6"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 zjjhdx40:88 (Cdn Cache Server V2.0), 1.1 kf49:6 (Cdn Cache Server V2.0)

Connection: keep-alive

document.getElementById("bdshare").style.display = '';..document.getElementById("bdshell_js").src = "hXXp://bdimg.share.baidu.com/static/js/shell_v2.js?t=" new Date().getHours();..HTTP/1.1 200 OK..Expires: Wed, 30 Sep 2015 03:38:19 GMT..Date: Fri, 03 Apr 2015 03:38:19 GMT..Server: nginx/1.4.2..Content-Type: application/x-javascript..Content-Length: 182..Last-Modified: Fri, 12 Oct 2012 05:57:24 GMT..ETag: "5077b144-b6"..Cache-Control: max-age=15552000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 zjjhdx40:88 (Cdn Cache Server V2.0), 1.1 kf49:6 (Cdn Cache Server V2.0)..Connection: keep-alive..document.getElementById("bdshare").style.display = '';..document.getElementById("bdshell_js").src = "http://bdimg.share.baidu.com/static/js/shell_v2.js?t=" new Date().getHours();....

GET /c.php?id=30039538 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: w.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 10055

Connection: keep-alive

Date: Fri, 03 Apr 2015 09:12:36 GMT

Last-Modified: Fri, 03 Apr 2015 09:12:36 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache43.l2de1[788,200-0,M], cache64.l2de1[789,0], cache2.de1[0,200-0,H], cache6.de1[0,0]

Age: 4971

X-Cache: HIT TCP_MEM_HIT dirn:2:275617642

X-Swift-SaveTime: Fri, 03 Apr 2015 09:12:36 GMT

X-Swift-CacheTime: 5400

(function(){function l(){this.c="30039538";this.R="q";this.N="";this.K="";this.M="";this.r="1428052356";this.P="oq.cnzz.com";this.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="1";this.A={};this.a={};this.la()}function g(a,b){try{var c=.[];c.push("siteid=30039538");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,k=decodeURIComponent,p=unescape,q=escape;l.prototype={la:function(){try{this.U(),this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:function(){try{var a=this;e._czc={push:function(){return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typeof e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if("[o

<<< skipped >>>

GET /stat.htm?id=30039538&r=&lg=en-us&ntime=none&cnzz_eid=2007449240-1428052356-&showp=1276x846&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1581191383 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: oq.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.6

Date: Fri, 03 Apr 2015 10:35:28 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT

Connection: close

Accept-Ranges: bytes

GIF89a.............!.......,...........D..;..

GET /stat.php?id=4073713&web_id=4073713&show=pic HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s25.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 10072

Connection: keep-alive

Date: Fri, 03 Apr 2015 10:09:28 GMT

Last-Modified: Fri, 03 Apr 2015 10:09:28 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache16.l2de1[0,200-0,H], cache25.l2de1[1,0], cache8.de1[0,200-0,H], cache8.de1[0,0]

Age: 1560

X-Cache: HIT TCP_MEM_HIT dirn:-2:-2

X-Swift-SaveTime: Fri, 03 Apr 2015 10:19:50 GMT

X-Swift-CacheTime: 4778

(function(){function k(){this.c="4073713";this.R="z";this.N="pic";this.K="";this.M="";this.r="1428055768";this.P="oz.cnzz.com";this.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la()}function g(a,b){try{var c=.[];c.push("siteid=4073713");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURIComponent,n=unescape,p=escape;k.prototype={la:function(){try{this.U(),this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},oa:function(){try{var a=this;e._czc={push:function(){return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undefined"===typeof e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if("[

<<< skipped >>>

GET /js/click.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 4399stat.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 03 Apr 2015 10:35:28 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 15 Jan 2014 06:56:45 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Fri, 03 Apr 2015 10:35:29 GMT

Cache-Control: max-age=1

Content-Encoding: gzip

41b............}U.o.6..v.....DT.*...K<-.)6....uOA`0.%3.(....I....EY...A......}p'.3..d..V....Zj..L.#M.<? {.[.hV...~........)......<..el.u.........2H@...T.e.eo...d..[. .A=#mo4..1..u.?t.(]..Dv.:.....@..S.*.q.........4=.Fq.....**....Fm%W....!.....5j`.....U..e. .2P..I~$.f...........Je.<b.F./(.V<.oQ.....b.I.E.^1..)z..0&...T0OU2n...)..} .....a.%...E.......F...-..%ka0>.v.VY.>..I..`.....-g..?....IB^.3.^\......XU...t.....JN......tr.-.t.J..`...H..V.fX.Z.".c.)./ 6......>..M....=.^....igrp.l.m.//.m..vV....=.Y...$A... ... ...7\F....zr?....Ts..G.v.....<\.0>.K..*.g:..0.[...g....Y....o.B.M!..ku..m.am.<=..<a....4r<.x2...&l.."av...............Ya.n(........7.......@.f.._2..U.vQ.z`f.?>~.....9.[n;...l.....=..^`..S..nvH.D.%...d.K...P:K)<V..S....P..=........v.....E.Oi'bKuX.'.Ejk.{pknyH.n.g.t..9......n.y...d..a$...-..z.........,.Z.....Yb..Ov...@^j..TC..a.i].........i.....v..."O.#.C..G...ln..D.........&.C......W.r *.o.......%1U..]..:X.jtD:.......R5"......W...CW9..V...........@.....t.......a..p@|{<...}...j.;....M..}...H...?k.yH...Unc..(Q..Fi.^..t.6..U ..^"...z.F{......0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 03 Apr 2015 10:35:28 GMT..Content-Type: application/x-javascript..Last-Modified: Wed, 15 Jan 2014 06:56:45 GMT..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Expires: Fri, 03 Apr 2015 10:35:29 GMT..Cache-Control: max-age=1..Content-Encoding: gzip..41b............}U.o.6..v.....DT.*...K<-.)6....uOA`0.%3.(....I....EY...A......}p'.3..d..V....Zj..L.#M.&lt

<<< skipped >>>

GET /upload_pic/2012/tjyx/tjrm_img07.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga2.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 02 Mar 2015 10:13:09 GMT

Cache-Control: max-age=31536000

Content-Length: 3257

Content-Type: image/jpeg

Last-Modified: Wed, 29 Feb 2012 09:18:04 GMT

Accept-Ranges: bytes

ETag: "0ae5fac3f6cc1:388"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zjjhdx39:8106 (Cdn Cache Server V2.0), 1.1 kf48:7 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......<......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="xmp.did:7C3C90818062E1119A50B0F09DBE5343" xmpMM:DocumentID="xmp.did:48F37DFA62B611E1987FB533819DF614" xmpMM:InstanceID="xmp.iid:48F37DF962B611E1987FB533819DF614" xmp:CreatorTool="Adobe Photoshop 7.0"> <xmpMM:DerivedFrom stRef:instanceID="uuid:02cd31e0-62b0-11e1-a9f2-89007db68855" stRef:documentID="adobe:docid:photoshop:3e3cd8bb-62a6-11e1-b37d-c0893894c906"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................*.D...........................................................................................!1AQ2.4.a"3..q...BRb.#C...r.c67.......................!1...Q.Aq2..a3...."#.r.Cc$4............?..........rxY7..H.".-.L...4j,f.QW1.U}.).......5.......j....e!/~Ko-.s..E...m..8M.q.SH3.......*..gu- R5....m......H.p....

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/logo.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:31:37 GMT

Date: Fri, 03 Apr 2015 07:31:37 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2503

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89az....................,...M.............Y......R..2..:..I.........R.....f......wC..Z...R ............................r(.....<..0..2....c.z........=...n%Z..A....n.O...|.......R...k..Mv...s2.`..q=..j....i"n...u'........5^.......b...........D.c,........M........d.............l;.f#..3..B........c^.......w.......~-..W....K...b.z-....uC..K..D.K......]....m'.....].......e6.|;......y.....e...w*.....C.e1.E..^......k....z0.....z..{..\.[.....E..j$.e&....o.....M...5..9.v....n....1..6._..Y.<...K.,....s.J.6.....$..0..8..(..4..&..2..:..*.........M.b.....g....h.......P....t.....j..b..>...........F..v..I..w.....6...x...q._-.G..\..B..N..[..p?.p,.t)k....~.h:...L..P............o"..a..ia...k,.{H.f9..e..f.I..e(.C......N........r.g...p.}*..V.}S..D.|*.},.x .............yH....p..l...t......!.......,....z..............8..}P......#J.H1b.*.....q.G......1cG.....F.[<M0c..I....5.. qR...'M...S.O.........'..]......'6i... ..E.rE.E,W....4. .Q.p.....`......A(..*..,B./Z..=..Y|......iY\...[=...6.2.v7.5....i-.......P..p.....l......../..... .A.D.. .Wd^"..P. p....r.o....?C.........C..4.'.....\e..*#/....... k^...K}..a.-u...........c.......^ A..&T.!......X1!..'....&!.......P..A.V8.....y..?.xR..B..K.H"Id....d.Vx.GA.x".O.....&..%...(.?Jx.C-h.)@Fu...I..........L.t.._~....E.J..... n...I.H#. .8...cT:.l&... ."M...1RAb.c.!..A..~..MAv..H....J....A.AP.c.....DFa.qH...S ..x.....QP#.......Z.]v..CA ... ......x..).........%$.[o...4....a/.3.<..#.Z.=...hA8 .W..........3.-0.(....(..3.(..d.(....(.4.@#..\W....A..$...'..H$..(PA.<...G....xH\..H#...-.

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/go_bbs.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:02 GMT

Date: Fri, 03 Apr 2015 09:48:02 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 4339

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

GIF89a...........l......[......[Y.S/...8...z.u.6.-Z)..M..-7b2`......e$..a..................pL...........V......*..ri.d..G..l....D."s...K...Mi..J...............}.z).....U........j.s..r)..H.....E...o3.........8..Y.wm..R7X.UzR.....3.....|.....D...KrF...nP4o."..<.q.5#.7J.....*...............0...zd...)... ....E"H...A........Q.....6..M.. .......|..:.....F.YH/QvKQ<..Q&...g{......"..!.......)...........>...<.d.$S....ia...=FnCAi:..#.....Ec._..0.yAs.o...yi'.v.G...m.j\L........]}s..<.........^..I.E...2....."...ybQ...].Y........ ..5.|a.....%.y...%....V.......QLG..$... Q......,..&.....B..2.sB..S..[.P .....3.c.n.j........T..K..I..5.....P.................R.. ...>_..{.:h=..C..[..i...<=B..."E.....................S..............g..n..w.....E..K........?..L....|......]..`@'...c..QA0...i...!.......,............S.p.'B.~..M.r......J.H.....3j......sHe.$P .88<!..I..8nz.8.1..d.r.......@...J..Q.;.=.B...9;..3......`.<0I_$L....K....h..].......E.....~..y..'VV.1{L...L.d..)^......#K.L........p&..|.vh.........B!. a0O.%../....s............[..8.:..0I..0..Q......`..C1.........O......._.>|>`...0.z..<..4......S... ..a`.......L0...ur`..M......O>.".a'.f....,8@'(j8..,.. .......j.`....#..n....N0G?#...&`4G./a....$xBB......`L!O"x..e..(3.......;x...3..f-h.0.._6...At2.........p...x......E.(v2...F*.......(D.C....&..(..|m..F/r.Y..3....E..A'....M.....0........H;6..K.4..F$.p9..ADa.-*Da.-.,..-V....;.a...X....*c..D.....Xa..3.....X....X...vx.....l...C..-DD.....A..Q(.....2.......C...5..a..v..2...`k2..CC".4`.68...6...E*.... \

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/topbg_20140506.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:03 GMT

Date: Fri, 03 Apr 2015 09:48:03 GMT

Server: nginx

Content-Type: image/jpeg

Content-Length: 53115

Last-Modified: Wed, 30 Apr 2014 03:01:28 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

......Exif..II*.................Ducky..............Adobe.d...............................".....""......""(),)("559955AAAAAAAAAAAAAAA......................*.....*6'""""'603,,,30;;66;;AAAAAAAAAAAAAAA..........."...............................................................................!1A.Qaq.........."2..BRr..b#3..S...C4..cs..$......................!1.QaqA"2........B.#3.Rbr.............?..e.. ..$.:..r..)...$]R....H.=.*.32.C.=8.uS.......NpG.i....:g,"_"..uZ<.r.y.c..qo4.M(%IR.W.3[..-..)...E-..1..|..Qn.....9.E.s.H..9.K....39.Q.bR..3.Rg>a.Z-..s3.b.......rR*.(.U .r..B.vRe.g.b......B.8.2...n....N*ER....U#.1y.SV..r...n.3>..wJ.Z..B........Jf..U.......&j..R.7V*.T6JWD.*.2.Y..$.2.c/C..[O?..*....7......=H.9z[......=^.(..>kV.n=....1\|..........................................................................................................................U6.%..^...s....W..cD..u%Y.$."t..î....J..E..%Alj...d...sI ..b...F..Y**..-.e..h......fj*R...3QP5QVf......Y.......ITZKj....#b..rdrfy..R[\.y. .7b..l.............&..^..fdi...Y.....i.e. # ,..bT#I*F..P. .P...........N|..E6y)....T.&.9..;A..=.j..MT.....ff.%...s.*.......?M...........n....E.....9G.......I.ih.<.}.o;...9ts..,...L.2.0..3QQH.K.b.....LTTR..9.....t.#fjn.r..fti..oM.)$..Rih.CJ1....>. .o...W?.G.....n>..q..y.......|....:.Gc.OF8.....y.......p....xy.1..Vz.-......9....9.\...[..T.JE.%....y.*ER'....uN.R.4..U.,j.]K`..?(......1.3.....Y.,..$6.........**d..D..-Z...#.E.Ji.u.4..ir.3.zC1....W...X......F..H....b.........~i.)..Rc..../....<.../.....M.5...i.b.k..@.h.

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/zj_btn.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 10:14:43 GMT

Date: Fri, 03 Apr 2015 10:14:43 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 1226

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89ag......................................................................................................................................................................................................................................................................................................................................................................................................!.......,....g........>)P.............)>..6(....G...............(6.#;....M...............;#P.M7O.............7M...2O.%N............%.O2..M8. ..I........H.....Vt.....'....8 ..(./b.8q#G. ;~...b...I.<YRc..I.8yRHB...B...3...=w.$...E.H....4...J}.e.3D..5$..8....`.F.K.l..b..%.Vm..c.[.. .m]..L..Y.G.".4..L8......Q\.0c... N<y.d...g......=.. r......hT].u...]...;....s.d=[....S.`P.....H,(R......D."}....._..}:u...{..={.....(..D...\PP....(...........g_.r.._.........`..P.........,....^.@..v.!. ....%.xb.)...\#..b. .....P.^!....... .......D&....J".$.L.iQ.NVY..Q.)..CB.@..\PH..,!..B..f.Q....B..'.k.I'...i..s....t.)(......E..B.<.p...FjQ..\.i..b:...b.)..V...rqz...Fz..<4.B!.4....0a..............{...4...4. ........F ...Vk...Vk..B.@..P....J.p.............. o..*...............,....l...'..._..B.@..B.....'..g....w... ..2......A..C......0..C."...;....

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/bg_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:03 GMT

Date: Fri, 03 Apr 2015 09:48:03 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 791

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

GIF89a..9....................................................................................................................................................................................................!.......,......9....@..c.....r.l:...tJ.Z...v..z...xL.....z.n..G.gC.(...~........................................{............................................. ............F....................................H.......L......#n[(.....3j.Dq... C.t.q...(S..Wr...0c.\7m...8s.l.r....@...)....H..M.......B.J...aR.j...k..^...Kv...h...zv...p...K..].s....7b.......w......N...cj..K.LYW...3k.uy....#u.M..i@.O.^.95......M.v...s...{...c{..N.......=.......K..2:...?Z...........}......_........{/..}k.....,?....._.......&..'.........0.Vh!/..0...vH4...@....xh....p...`p..p.(..4.h..8....<....@.....4.A..;....

GET /flashzt/img/zmxy3_20120913/bg_5_20130716.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:04 GMT

Date: Fri, 03 Apr 2015 09:48:04 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2042

Last-Modified: Tue, 16 Jul 2013 01:47:34 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

GIF89a..C.............................................................................................................\\\....................................................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:74504210EDB611E2B540ACB23FF9BCD2" xmpMM:DocumentID="xmp.did:74504211EDB611E2B540ACB23FF9BCD2"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7450420EEDB611E2B540ACB23FF9BCD2" stRef:documentID="xmp.did:7450420FEDB611E2B540ACB23FF9BCD2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,......C....@R........c.....E..Z....R}:......^.h..*J..m......uR.:...{O}$#..ay...V.W.W.}..X.X.........r.....v.......|......r!..#......v.....N...... ......m.#... .$... #.......... ...................&..8o..y..v...

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/libg_1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:28:08 GMT

Date: Fri, 03 Apr 2015 07:28:08 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 899

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89aS.:...................................................................k.....................................................t.............................q.....m.................m.................~.....{.....q..............x..n....................~.................j.............................................................................................................................!.......,....S.:.........7V...........AM,"...@.. W........... ..U!...9.........R... .......?#..H......I5>.V....V.......V......V.............V.....V.....d%A....88..........N"?r.-...Qc...=f..R$4..Mnd.R.G.-].\.S.I..l> XR'..9}..*.$..E..M:N_M..8>.Z.(UaV.F.8U.).H....V...f.M..v...m.A)d.....m1..K....s...)....|..M<.-..8..sz..dPKf.D.....P...P..,..pp..!..M..kX.#....".0.$F............^..`a...J0.(@......0.n.A.........y....H. =...0....A.........u...G^{*p..."`B...XpD..F(...Vh...f(..4.....L...$.h..(....,.8.%....;....

GET /flashzt/img/zmxy3_20120913/nav_bg.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:04 GMT

Date: Fri, 03 Apr 2015 09:48:04 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 18944

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

GIF89a..6.......7..`..\...........Y..J..Q..a..[........S..j..t........y..`.....Iu.............\..h..m..t..q.....[..|..{.....e.....f.....C..d..u.....~.....#.#j..d..x..............N......}${........u..U..q........3..............n.....]..]..t..Z..b.....g..:...........V..:.......${..}.....f..m.....h.. ..m..]..<...z%......C.....^.."...q ..3.l/f..R..}.....P.....d..n..l..Q..h..R..e..p..i..t.....v.."}..u)............l..a..^..[.....Y...t&k..z../..,......y)D..y..j.....a..Z..I..s.....I.....K..*.....q..h..n.....o.....?...z.W..j..=..Z.....&. .w#P.....m..H...........U..c..U...........R~.V........X........g..g..p..C........'..l..o..&..........#.."F.a...................u<...&.Hg.y.........6.T......W.m......h..\........f..c.....M........o..k....._....................e........i..w...k0...!.......,......6........B......*\......#J.H.....3j...... C..I....(S.\..%.5.j.p.AC..7m....g..<...Jt.Q.H.&=..)..K.:..u...X.j..5 ..^.v......h..5.6m..n......\.t.....l..Ah.....5...'F..1...#;..y....)k..93...Cw.......O.6.:u...c.....l..o........{....x.....O.|.s..c.j....z..M..];....w..........7.>}.........|....................."h`.......6....VH...fh...n.a. B....YW.4...".*.... ....0.hc.8....;....>....@.)d.H....L&...NF...OV)..T^.e.\b..._v...b....d.if.l....jz...|.2.5.XcM6.H......g....g6..I(...*(....'...*.....i..*....BZ(..~.i....i....(..^.....vJ....*....:k...j)........J,....l.......&.....k....[.....,..N.m..R{-..r.m...k....................n...[n....o... ....Kp..4....0.B5.l.1........,..$..r.,..../....2....4.ls.<....@....B.M..C'm..H/.t.P3-..SG

<<< skipped >>>

GET /flashzt/img/zmxy3/bg_7.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:32:04 GMT

Date: Fri, 03 Apr 2015 07:32:04 GMT

Server: nginx

Content-Type: image/png

Content-Length: 6652

Last-Modified: Fri, 14 Jun 2013 09:48:10 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR.......I.....g.......tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:5A051F80D4D211E29B0DCD53E3B7DEE5" xmpMM:DocumentID="xmp.did:5A051F81D4D211E29B0DCD53E3B7DEE5"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5A051F7ED4D211E29B0DCD53E3B7DEE5" stRef:documentID="xmp.did:5A051F7FD4D211E29B0DCD53E3B7DEE5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.^q....;PLTE............j...N..$#.Z..a4V..............d'.:y........b/.D?...........pZ....{.z1...........T..l.cS...l.S...........KZ.....1...f...s..,...Q.......n..5yE.......6.<u..L.G...{.cg...K.Y.H.......qV..l.....R.....Ro...................n.......................P..3.....,..C.........x.................o.....@...~s.............[.....itRNS..........................................................................................................7f.....IDATx....[.F..%.m'....o..`cl.}ih......6I&.........;...`..;3....y..\....WI..?Q.K..^..^..^..^..^..^..^..^..^..^..^..^..^..^..^..^..^..^..^..^..^..^.

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/c_2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:28:07 GMT

Date: Fri, 03 Apr 2015 07:28:07 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 70

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89am......j.....!.......,....m......D.................H........P..;....

GET /flashzt/img/zmxy3_20120913/lmbtn.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:08 GMT

Date: Fri, 03 Apr 2015 09:48:08 GMT

Server: nginx

Content-Type: image/png

Content-Length: 1279

Last-Modified: Mon, 04 Aug 2014 07:28:20 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR...N..........a......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:DF5C3F66120E11E495A2CD5988523C9A" xmpMM:DocumentID="xmp.did:DF5C3F67120E11E495A2CD5988523C9A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DF5C3F64120E11E495A2CD5988523C9A" stRef:documentID="xmp.did:DF5C3F65120E11E495A2CD5988523C9A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>y.@P...cPLTE...............%.(,. ).*,. ...&.)".'&.*).*.........................................................M..x....IDATx....v.0.D.q.]uRw...WVl.6.....H..x.~.....?&r....g*.......J..N......E... ..:......5....{.T.7i~...5........>..........G.p.b.~..5......d.!.}......A.17.X..*.4.Q..Q....?....B.$......;....l.,E.6.u.....8.....cI.......0vYn..!..Y.z..,riW.o^..T.5..~N....o.....`....1...M....IEND.B`.....

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/c_3.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:04 GMT

Date: Fri, 03 Apr 2015 09:48:04 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 84

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

GIF89a\......j.....!.......,....\..... D.............{...H......&a...L.............;....

GET /flashzt/img/zmxy3_20120913/ftbtn.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:08 GMT

Date: Fri, 03 Apr 2015 09:48:08 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 477

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a@.....................,.*...G.F$.*(. #.'......%.(......................................................!.......,....@.......qTdi.h...y..%.tm.x.......pH,....r.l:..(T@.Z..A6K.x.`..k.....z...;ov....#.|\.w...~....a`..............a........_................................^..........`......._....^...............^.........................J.8..@....Tx..C.."J...K...(b.B1....=f..1"..(SZ~I..KK0(].|..e..1Y.......@...Jt(..H.*].....N3H.J....X.j......`...K......4......p...K....!..;....

GET /flashzt/img/zmxy3_20120913/more_boss.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:08 GMT

Date: Fri, 03 Apr 2015 09:48:08 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 3077

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

GIF89a..*....^..D..D..B..J..Y..X..K..L..T..U..P..M..W..Q..O..U..N..M..S..V..R...................................{....................}.................|..e....................Y..............~...........`..W..............V.....z..]..|..w.....a.....d..h..^.....k..g.....r........Y........u..Z..........................|..............m..b.....l........y........o.....j........g...........l.....p..a.....s..q...........\..v.....T........c....._........|..w...........z...........f........^..d..r........o..X...........`........q.....f.....u..M..x........p..O........i.....t..G..[..]..F..\..I..F..\..^..E..`..C.._..Z..H.......................................................................................................................................................................!.......,......*......%.4H.....*\......#J.H........$0... C..I..I;.J.1.....0c..I....8s...s..L.z..J....HY.......P.J.J....X.j....U<....K....h..].....p...E....x............L...... ^......#K.L......i.......C..M.....S........c..M.....s....7.c....N...... _.......K.N.............h....N~..Jb.._.......[....-4..{.T).w...(...Z......E2.$h...E(a2&8. #.f.........\........8.h..,..C2..."..4`..8....a....'...... .. $s..L6.$.E.........T..d.a.(..f.xB...`..c.y&...iF2.4`../....x.)$.|....~.8..-t....$s(....D2...g.'....8.....&*.....'.xR.'..J.i..FX)..v..*...A...P`...l...-....2.!l.P2!...4....>k`..R...J8i...:....:....B`...B..@.6...?4..@=..........6...m@.o2.. P.Tl...#@........T8...J<.p..F... .,r.P.l2..$.... ...Pn.../.a.......!..n.#...... 2..( C.!.!..J3....@-...r...C

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/ico_ann.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:42:43 GMT

Date: Fri, 03 Apr 2015 08:42:43 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 1108

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a.......B.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:573F6AF9FFB211E098C4CA8B9A0ADD05" xmpMM:DocumentID="xmp.did:573F6AFAFFB211E098C4CA8B9A0ADD05"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:573F6AF7FFB211E098C4CA8B9A0ADD05" stRef:documentID="xmp.did:573F6AF8FFB211E098C4CA8B9A0ADD05"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,..................loFK%..V...;....

GET /flashzt/img/zmxy3_20120913/t_lm.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:53:58 GMT

Date: Fri, 03 Apr 2015 07:53:58 GMT

Server: nginx

Content-Type: image/png

Content-Length: 4937

Last-Modified: Mon, 04 Aug 2014 07:28:20 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:2 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR...B...-.............tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:D56F89F8120D11E4997398D7653D7193" xmpMM:DocumentID="xmp.did:D56F89F9120D11E4997398D7653D7193"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D56F89F6120D11E4997398D7653D7193" stRef:documentID="xmp.did:D56F89F7120D11E4997398D7653D7193"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.br....PLTE...Zg....wy.8NcW........9.......................d.......................5../5Rsn.j..JSy..................3F[{..,..9..t..h...........AGhEVh...J..ht..........,.~...~..............k..:..c..-~m...;........(..kj.nl....5.xSd|..................XZ.'....................4..@.t...3..I.....QZ{aR......................Kn~-..0..h..... .b5.....kz....SHt...F..z..t........,..Bt{`g.q........|u.(........Ra.an.......EOp................{.......;.....R..uj....f`.Vw.uz....=|.Ly.<.....=ls...<|x4.~...Yfn...o{....<ah..................><ag.....oc./.y...............ff....m_.W..9............

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/t_6.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:53:58 GMT

Date: Fri, 03 Apr 2015 07:53:58 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 5202

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:2 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89aB.6...................00/............y........O..............\.....................................................j.......................1..............T................................e..@.............................I............................................$p.............q..p).........................................zj......2y................................F3..u....9#.........j;9.................................................gW.P9..........^O.........|J:............KOM............M...{}.YH........................Auq...ug]................................s....................r..k................o\................................................x.].............................................4.....p.......z............j......................................!.......,....B.6.....E..."..y..*\......#J.H.....3j....G.<b.. p.."...[.....0c..I....8s.......@..\..............P.J.J....,........`.....HA%c..]...Z%....K....2........U...L...... ^..n...#K..x....yV......s.....s...S.F.B...5,... T.........o.3(..N...... _.........M..%..B.[.D.........~F)...._.......P.O...C5By.....y .#....h...d....PB...F(...Vh...f..........AF...P..(..". .s!>..8!.... .....$.,.`'.< ..D.i..HJ../(.`".e.s..T.h..IfY.......`...)..3.)...c)b....p.)..t.i..x...=.8...v(b.&..i...\.g......or..){..c.j.....v..............lb....b......%....'.............R).{d.`&......6....F ...Vkm.s.j.%.h{.$..a..A.....,.k=....=.N;C$.......k,...{-8.D./...l...z.jl..r..5.i...NbC...!."s. .. ..e=$.l..$..,)...o......4.l3..XaE.7..D...Ls.V8#..H'...^4...^..D.A...w.4..&s

<<< skipped >>>

GET /flashzt/img/zmxy3/sp_line_1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:05 GMT

Date: Fri, 03 Apr 2015 09:48:05 GMT

Server: nginx

Content-Type: image/jpeg

Content-Length: 2079

Last-Modified: Thu, 07 Nov 2013 07:12:52 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:0 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......d..... hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:3A3844F4475211E3A7C6EBD43CA1FE60" xmpMM:DocumentID="xmp.did:3A3844F5475211E3A7C6EBD43CA1FE60"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3A3844F2475211E3A7C6EBD43CA1FE60" stRef:documentID="xmp.did:3A3844F3475211E3A7C6EBD43CA1FE60"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d........................................................................................................................................................................................................................................Q....R'..r.7!..#$%g2Bb..3c..&fvw.........................&6Q..$d%eu.q..b.#c!Aa2B3.".............?....`6......._I......F...>....&?.u.p...Qw........'....e.}...2....(.c....8.....^.O.......^..X..{.,.@..."h.Y.Z...^.a.z.B......7....W'6...mgYj0.....'...T.0....pkTsRp.$........<B..O....'...t.m.:.X!.kU..p.R..3X...R...i..oh....S..l..X!.kV....G.T.r....q6=....P...N..k.. ...J[..sj.T .

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/t_9.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:42:58 GMT

Date: Fri, 03 Apr 2015 08:42:58 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 5372

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a..4...............................k..$p........f.O.....................w....N..2y....................................................A........]..................................................^......}L.........j...g......%.u ......x....................\.............s0.......z.......g...................z......y.......gN...................................................J............z.....x......z.........[.....................I................[...........(..........................;................j...*......l.................b......uJ..................zzw.........................}3........v......4..............l..f..T.G..x....."............R........X...Y......(...et=...{...............d/.................................j............................................!.......,......4......QrD...x..*\......#J.H.....3j...... C..I....(S.\.....0cf|e..#J.o5bTk...@...J....H.*].....P.J.J....X.j......`...K....h.........f..K....x............|uV#G...#......#K.L.......ct,....C..M.....S.....?..c..M.......k./.......N..c... _.......C.N...................}......_o.<....../.=......?..\}..(....h...&....6....F(...Vh...f....v... .(..$.h..(J..{)....0.(..4.h..8....<.......`(G.Q...X...L6...PF)..TVi..Xf...\v...`.)..d.i.._....g....S....t.i..r.)e.@...8.H`F.H.q..y..e..6....F*...Nj...f....v:i.Aa)........TPH$.......... ].!.......... ).. ....k...&....6....F ...Vk...f....v..... .......YHbI..t.....ZJ..........2......:.......8.......r...G,...Wl...g....w.1...tl/..#I........Q/...KL...\.%5|.....QC..(...5.].#.(./.L.p..P..E.5Dm..ACq..\w..

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/libg_3.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:06 GMT

Date: Fri, 03 Apr 2015 09:48:06 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 542

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

GIF89af......U.].........!.......,....f............#...........H..).......r...@.v........".8L.u..`..J......j...........0N..Zf.la.......s-5.......X.g.g.......6.W.YI.7Ia...h..Z%y.Z...dZ....:....*..Z..K.kI.[y....)..k...lH..\....<..l.(.}.y.}...N.M.(.xN..>g.>V...^L....5....O...X...........l(..3..%R.S..E...7^a......GJ.yQ...&Ouly.^ ..^.......,[....bO.?...8tdQ.G!&...`..OC..9Ua..Waf=.UgW.2oF..t,..fI.U..*[.h....1.L... Y...`.....;#.b.N.;~.$.....S.LC2..(,s...3..!4.>.A4...W.n.z4...g..l.....'....7....'.n\.....3g..yg..}S...:v......]9.......!......(..;>....

GET /flashzt/img/zmxy2/icon_keys.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:05 GMT

Date: Fri, 03 Apr 2015 09:48:05 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 8973

Last-Modified: Sat, 09 Jul 2011 02:16:23 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89ad.............o.QFV............XZobev......8Fu.........P|....^j.......-Dn... F.(Q.W..,Hx?`.dt.HP]r..r..p..V...........T..f..y........Q..[.....l..{.....a..x................................3.3f.f3f3............S.E/.....3..f.3............T....rf..3f.f.3..f...?u.^..s..k....w..... ........3......../...........:..(..9..f............................................................}{f......................................3............~zn.......................3..f.......................i..w...........p.....cwQ".~DzY0..p..s.......hB..X..y.....3.f3........t.V!.......B..P!kD#..Z......uA.h:._A).jN.}g.......H!..p.....................mmmfff.............................................................................................................................................!.......,....d..........v.`....*\......#2<2."...3j..q.E. C...q... ...b....Zb.DI.&B*Yr...1...Zl.5.3K.0_...bC...P...Ju#N._.....j..S...H....[.>..v.[.e..E..kW.o..4..l.2i......@#Je...um.*..O......O2k.`$r.)>...M..."..6.`w..._......m.^....v...v.F..[...N...>......3.z...$..j....u.......].......J~...b.....~|g..)..>.......y6.g...&....6....F(...V..A.Yh.E.i.RI...b..)..K-.....i..O.i.SN ....I..#RGe1F.6....Ph.UVa..$BCr5Z.s..d.M..e.J.).....e.g.....P...E.8..Z...e/y...t.1.....Di|....d...h........Vn........(vN.:]..i..t.A.)..PZ^y.!*^.....x.M....z...y."._3..W ...8 ... ....k...&...6ax...U4".......F..3.......d.O..J..>.....&.-.8..hT............kc.6<...`m.).U......;!.....W\.`..fF.pc..i..,...eP.I'g.....}.yZ..K..k.......G.n0......{3...7.WB..s.EKG.q..Lb

<<< skipped >>>

GET /flashzt/img/zmxy3/n_zm1.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:28:06 GMT

Date: Fri, 03 Apr 2015 07:28:06 GMT

Server: nginx

Content-Type: image/png

Content-Length: 7680

Last-Modified: Sun, 17 Feb 2013 05:36:18 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR...l...A.....[.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:FDB69C70710011E29052A0DAA111BA9D" xmpMM:DocumentID="xmp.did:FDB69C71710011E29052A0DAA111BA9D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FDB69C6E710011E29052A0DAA111BA9D" stRef:documentID="xmp.did:FDB69C6F710011E29052A0DAA111BA9D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...Z....PLTE...Xe....RRRz.....=Jj......}}}y.................1pk......jjj:..vv.......;;;-QXXXX]..3.................,,,...333......ft....)..so....19S.....................nnnDKk...I..G..b........FVy...uuu......R`y*..zzz...aaalk.lv....qqqMMM(.|...3..QV|HHH...eee.........DDDAAA...(.t...\\\'..<..&&&...............an.......&..WY.:..[j.6.x...kg.Duy......Jhz..._`....!!!ry.5..;..3.....p|.D:`CWmajx...JNt...3..V..zs./..g.....;.tbQ.Us....mz.RDt7..9.....Z..hd....3..~w.rl....hn....... .t......cg.&.ldp....gh...........................n...........t.........~wG..Q..Y........cjq...i..m_..................lO..

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/bg_4.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:32:06 GMT

Date: Fri, 03 Apr 2015 07:32:06 GMT

Server: nginx

Content-Type: image/png

Content-Length: 3863

Last-Modified: Fri, 12 Jul 2013 05:47:46 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR.......W.....q..C....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:FC023941EA9711E2ADE9A0F6B57AB29A" xmpMM:DocumentID="xmp.did:FC023942EA9711E2ADE9A0F6B57AB29A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FC02393FEA9711E2ADE9A0F6B57AB29A" stRef:documentID="xmp.did:FC023940EA9711E2ADE9A0F6B57AB29A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...4....PLTE...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/left.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:28:07 GMT

Date: Fri, 03 Apr 2015 07:28:07 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 1036

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:0 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a..........G.....O..B...........c..............z...................................@........k..t.....\..>.....m..l..}........h........a...........b.................i................................p...........................................................e..}.................w.....t......................................m...........~.....a.............................{..T..l....................q...........g.................<...........................................................................................................................................................................................................................................................................................................................................................!.......,...................F..2*@P...."DXA......9.0.L.6`.$Ap....Z.,X......2Z......!.......8a.$.!............9#.d...G.?1.<..##..W..9D'....2...CM..8..P...WD5.\(q....T..........*xs'..D_.L.ZW..(H,X.S........ ....Rv.=....>@....3.F.M..........L.PG..<...T..@@.;....

GET /flashzt/img/zmxy3_20120913/t_2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:42:41 GMT

Date: Fri, 03 Apr 2015 08:42:41 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 4750

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89am.4................4........D.....[.....LLl...9..t..k..Iv....C........4.g...B........d..3.Fk..x.....l..I.....`.%u...........H}..........:k.......?8d=..;.....<..2y....s..;JlT..C..ux.nhp:..:.....].....G6.......Yf....=.....? y...W.....D..O..y..:Y.U........;........[..Mc.<..<v....S........9.....H.....`........=.....hVlMi.....~.A..<'V............;........Wx....JH....3.....e.....3.,...Tl.X?Xb..B\.;d..sxe}....`..{37@.....K..v..A...DG[d|Ae....hr.]..;..N..;..:..R\....<..9.q9.....@.....=..I.....o..Kr.......<*.6..?..C........e}.......A..RN....F_.>...........4....................$p.q.................................................................{.....S.....=.....EW..........3..9..Y..............Ns.e..=.Q...w..~..EC.......QD...._o.j............................................!.......,....m.4........vCC....*\......#J.H.....3j.......5..&..'....[.....0c..I....8s.......@......)..L. .....P.J.J.*..Im..g....`...K...[7P.].....pw.(./...x..e.........{p.....G-......a2.L.....i....L...C.v.yf.AA6.d..Z.6.c..\X....o......G..1...L51.vD........K.N......k.......jC.gg.]..<$.. .v.@hnOs..F.PUL9........(...Z.^<......*.I.(.C.$;....c.1..}D3. .,q..&.@..s....,....0.(..4.h#......<..`.>..#..&.c4m.3...4yJ......., .6]4y.._4.....8@.c.." .0.A.f....p.).......x.y'.......4....$...wP.H.<4@@........i)......Lhz..4....yF...y. .>..`........w..K-............ ....K.....F......p...).. ...6P...t..........:......... ..xF ..0.....b).L.;.....p...l...'.....i...G.p. dyA..^......h. .1...H.J'.....r..r........*..77.q.L@\....KB.&

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/t_3.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:42:41 GMT

Date: Fri, 03 Apr 2015 08:42:41 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 4560

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a\.4.....}l...O...uu........................Gqo...............k.I2.#...........{H......................v............z......yo......O...dd:..............'........]....v.tg...............{....n..r....ZZ................jj.......wl..v.......................r....yq..z............1.....,hhk..............e||...'....x........s.zj...A...|m.sce......|{.............m^..p..q........u...............................}n........u...........o...................i[..q........................$p..........q....p............2y...........................p..q...................................................................................|........W..yc.................&p............m..........vf....xht..............w.d.o`..~...............H...wjj............................................!.......,....\.4......(..E@.x..*\......#J.H.....3j...........C.@.x........0c..I....8s.......@...Z..0<.J.. ....P.J.J......%......`...K.,O|x..2.....p..,d....x......A.......!.... .ix.....7.L..e../k...j...C..iX....S.^}.W6q.0..!.....s...........N..q..J.G-.B.............k...x.x.....O..y9.....a...*...!(...................h y... ..}.........Ha^.{.......B..b.....B..(....,.. >0.(....pA8g.@..0j.c.....{?....H..A......I...)j.h..3D... ....`.)&.Sf9#.XD...l....p.)..t.i../.... ..M......6.".....$.E....X...>XpR...0...i.ai.X..F.3..$...........3.......c.............. ....c.......0.`C.5..C.Q.B.........._. $.,.jp..<...B.)..E........ .........../.....3`...Nr.....p...G,...Wl...g....w.q..k C......&....k..J(..3H.`..a Ex _......i......;C./.`0./.L..IC.,..`...V.C

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/t_4.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 07:31:35 GMT

Date: Fri, 03 Apr 2015 07:31:35 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 5530

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

GIF89aB.6............e.........O................................y...............j........................................].............................1........T..k..........................e........@.................I...............................................$p..........q.........Y...........z..............g...............v............2y...................gN.sro...............KOM.........ab`......................................~...9;9........].....2...............................................................................uJ...................................).....................................~.................y............................ug]..................................g.............|J:.j......................j.........................................!.......,....B.6.....M..."..y..*\......#J.H.....3j....G.;b.. p .!...[.....0c..I....8s.......@....L............P.J.J.............`....OH.$c..]....$....K....2........U...L...... ^..n...#K..x....yV..9r..^.....3...S.N. G..7:.[.!.........N.8.(Q2.S.$Jy.....V....K.N......k....w.?^......._....1.....W.....$v....ea..5s.8..y.h`..@..$hH.. ....|.Vh...f....u.a(^0rC*.ihbv....=,... ..2...\3.2dL"..<........2...K~.....L6...PF)..TVi..X*...#.s..7\...c.i..e.`...d...m....-F'.:...... .....*..d... ....(......F*...V.b......c..O'h.Zf-LXj*.s....q*9.....B. ..S.......[..M..8..--.j...&....6....F .....O7.d.-!..X./.. n..d......n.....#s.!.:..C..[......k.2i.....,....'....&.........."...t......j.....?..c2>...H.m|A.(0..3.i.1. .....'....@.-..D.m..H'....xqq..0....\.E-......,..

<<< skipped >>>

GET /flashzt/img/zmxy3/new_icon_1.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:07 GMT

Date: Fri, 03 Apr 2015 09:48:07 GMT

Server: nginx

Content-Type: image/png

Content-Length: 2647

Last-Modified: Tue, 12 Nov 2013 08:28:28 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:1 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

.PNG........IHDR...(...(...... H_....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:17A6F24A4B7411E3948596CDF3D1624D" xmpMM:DocumentID="xmp.did:17A6F24B4B7411E3948596CDF3D1624D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:17A6F2484B7411E3948596CDF3D1624D" stRef:documentID="xmp.did:17A6F2494B7411E3948596CDF3D1624D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>W..y....PLTE.............2V............................_.2.....................~..k..h.......................Kx.8Z.,H....../..I...;\....*A.............W...........d..........................6R....w..Ff.*?...................>\...-......Da..................................Qt.Gb..................................@V..........4G.f....,...x..=P................Nf.......d.....y..EY..........}..AR.<L*YgE..m............{.......................MaY...v...........Yk................9ED..D|......................Y..C..Y..*GIj..Y..@..X..'RLW..A|sY.yW..'F<...)>6...............'<-k.v...C]J{.....CZ

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/b_5.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:48:07 GMT

Date: Fri, 03 Apr 2015 09:48:07 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 317

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

Cache-Control: max-age=7776000

GIF89a.......I..............c...........R........X........g.....3..f..............4..W..j....................!.......,...........`..di.h..l..p,.tm.x..|....pH,....r..e$..tJ.Z...v..z.....x0,..z.n....|N.. ..@a...........................]..................].............................................................!.;....

GET /jss/unilogin_package.js HTTP/1.1

Accept: */*

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 09:06:04 GMT

Date: Fri, 03 Apr 2015 09:06:04 GMT

Server: nginx

Content-Type: application/x-javascript

Last-Modified: Sun, 10 Nov 2013 09:24:36 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=7776000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 shb18:2 (Cdn Cache Server V2.0)

Connection: keep-alive

607.............X[o.G.~...a..-E^.P%........a".f.w..i.;..Y.....i....@....hR.i.4......U_...TU....3.u..y.g..o.s.3c...!...R..]..?v.D^'.L....g...[1. ..EYGs.Z...YL'.fs......Y.q.7.&.l.jit..j(..S.R.....&.(J.=6@.).........<...b.......U.U/ ....]..oI."&.K..#J{..j\.x,IC\.T|w.].<..R.v..mHjt...._av...$.B..5.r....A(r..<%tV.D..3..8._1.....L.U.....kMk..MR.7$y.".M...2/a. ..($(s.R..dY.N..kL...\..$l:4.....Y.{....J<...n"H..T..,.r)...es.... ...W.y.8..2.- ..WfF.x.2^...y.......u...B..CF*!FL.B%..F.....3>..T.>.%8(.9Z..)54..t......i....k...../....g. L.....6.).l..@.......(.#G...-2..>.u....{Hg.....&..5#%].-.>7....r}P.......Mr...axO..xu..F.y..eU4}...$......)P....Z..8..4.\..........?.G.....y....Y%..)...m.@)..I{...<...[t.Q.g!..` M.."....>.O.s...T.z....%......C.@0.......\...tc..o?.0..A..[|f?....].....^P1.pE....2$..X"sL.!d\B.Hv.w.]..U..8q..mG3.R,*U......n..*.(Qgsy.uu...F{......a......`..gw.~.......?....k.....v....F...#.......l..e..4...2...&....*...^.....0..d.......a.6..oR...j........v...=X....j...........;...(..8..w... %%QA..aS.T -,..]dFY..,..d..~..jF.D.0...................=......... ..//..?.r......KOW.........>.\..W...Nkw.....m..C(..~...~"z.(*}7.X.uJy.f.sN.*=..53z.Q.Sgl.Y.m.DU..........c.cG.^........yI...r.,...#U.'.Xp...../..;...O.~j.....t....l.|.}.ft...{....U.WdZL..\x...n.....h.. .....W..d.....q......U..hk.W|9......Ymon...t..........m{..._.X_....\.2.....c.K.....H..F.m.7.w.rR.:...u.G.c9%z..t..R. Yh.rLU....../.ZPD"~.n .o.1..l...d........._....V?....4..F.)l....kt ....O.eC...q......0.;..J.....;....;`c..o........Ej

<<< skipped >>>

GET /flashzt/img/newaobidao/ico.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:22:54 GMT

Date: Fri, 03 Apr 2015 08:22:54 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 1100

Last-Modified: Fri, 04 May 2012 07:53:01 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a.............!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:2C2150B595BE11E1B9E0EBB92F9208F0" xmpMM:DocumentID="xmp.did:2C2150B695BE11E1B9E0EBB92F9208F0"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2C2150B395BE11E1B9E0EBB92F9208F0" stRef:documentID="xmp.did:2C2150B495BE11E1B9E0EBB92F9208F0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,...........D..i......;HTTP/1.1 200 OK..Expires: Thu, 02 Jul 2015 08:22:54 GMT..Date: Fri, 03 Apr 2015 08:22:54 GMT..Server: nginx..Content-Type: image/gif..Content-Length: 1100..Last-Modified: Fri, 04 May 2012 07:53:01 GMT..Cache-Control: max-age=7776000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 shb18:1 (Cdn Cache Server V2.0)..Connection: keep-alive..GIF89a.............!..XMP DataXMP<?xpacke

<<< skipped >>>

GET /flashzt/img/zmxy3_20120913/sy_ico.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

Cookie: bdshare_firstime=1428057332914

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:42:44 GMT

Date: Fri, 03 Apr 2015 08:42:44 GMT

Server: nginx

Content-Type: image/gif

Content-Length: 2053

Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT

Cache-Control: max-age=7776000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a8............o{.dpv.47....tz....KO.35..............................................................................................................................................................................IPT........................t.....q..|...............IL...."#...............dqx......................HL.HL.........6<?.........FMQ....ILs...sy.........prs...............frw............>>>r~.............{...........334..........................................................GJ.;>..............................................dh.........SSS.........q|..y....OOOccc.......................................mop......___...s}..........................kp.szu.........|.......................................................................................................!.......,....8.......}.x.......*\.....>N...B....2j......./*Y....!?>x..b...0c..I.&K..~...r..~@...J.....L..YP..~.\..J....X.fu..........D..|h..]...[.f.....`?~g ...7M..Q...L...{..I......,*..G.r.G.XQ.D.....>....E..86..{.....=.j.(..J.[....7.......{.p..j.[\PE.z...!B...qXNi."..5_.....O^......W/O..z.T..A..<.n.M[...3p...@(.L.I..&..q.).`..(H.<...CA-L O.!....z$..6..r.....".,..b....B..L.BA.@0...\.H }.2.0..!........4.d.1>)...`0.....!......<..L,...L.....).8...n....r.i...0.A..q....\...sl.F..L.....p...B.c..D.@..\....pP.<!......j...P.D..Pb..........*.... OAAtp......&....0g@.........B.O..JK...D.....Q...\ B.R....^.R..~|..... .?..;.q.F ...P...I.S....l...'.....[D<I...?.X.@>.D`...w... ..q..8`..#.........0.,..4......1..70...

<<< skipped >>>

GET /jss/4399.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.4399.com

Connection: Keep-Alive

Cookie: bdshare_firstime=1428057332914; cookie_hs=4399.com|||%u9020%u68A6%u897F%u6E383%u4E4B%u5927%u95F9%u5929%u5EAD%u7BC7||78072||0

HTTP/1.1 200 OK

Expires: Thu, 02 Jul 2015 08:51:21 GMT

Date: Fri, 03 Apr 2015 08:51:21 GMT

Server: nginx

Content-Type: application/x-javascript

Last-Modified: Sun, 10 Nov 2013 09:24:38 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=7776000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)

Connection: keep-alive

386.............U.j.@.}V.....H. .>&U .B..)4/..#[ {SYkV.......O./tf.b.v...y.z...........v.k.'...&*.z....x..U.. V...\q^..b...y..#.U...f....x.VOb.....k..M6.....iC9.KJ.2./..2z.u!...W.`....k.L..).[U.C.%..h.$q..*....wphI........MEmC>`&.M/'z.:.eUM.\...7k.=..|....e.u..2..5. j^...KW..%*.`.|......>...\.....7.zT.)8.'bzA..I...H.<.<c..a.K.^...|..#....3.{G.<.E.#.9.o.......&>.tl.1...).9.H.;$'...X.M*<.Xp.....>'....IO.6.}.n.~x....T...?2xp.M....|F2..>.U..U.oj..C...i.R...}...U~.&.1!...Ma.q_67uG.K.c...wA...{..S...V-.j..]"..M......l>n.....|.!..k\{g..8... t..Kv.R[....>...^.<.tb..K...d.6.h..0.....k|....x@s....l....S<.E1..2/....v.zCCq.T..5.....x..,F..c1I....J.Z.#.......#.\.z...}.\.A.... ..;.......&..c..r........9.,.....]Y..\..W.....F.....?.m...$~c..8i..<CQh.C........2....o..?.N[.Os..2.>....4.....b;....{...@w. ..O.Y..#\a.]..k.I.....YJ....%...n.k`......x..O..]g..^.7.......8...=...3c.........^...?t......c.....J...Z'.s.....0..HTTP/1.1 200 OK..Expires: Thu, 02 Jul 2015 08:51:21 GMT..Date: Fri, 03 Apr 2015 08:51:21 GMT..Server: nginx..Content-Type: application/x-javascript..Last-Modified: Sun, 10 Nov 2013 09:24:38 GMT..Transfer-Encoding: chunked..Cache-Control: max-age=7776000..Content-Encoding: gzip..Age: 1..X-Via: 1.1 shb16:2 (Cdn Cache Server V2.0)..Connection: keep-alive..386.............U.j.@.}V.....H. .>&U .B..)4/..#[ {SYkV.......O./tf.b.v...y.z...........v.k.'...&*.z....x..U.. V...\q^..b...y..#.U...f....x.VOb.....k..M6.....iC9.KJ.2./..2z.u!...W.`....k.L..).[U.C.%..h.$q..*....wphI....

<<< skipped >>>

GET /upload_pic/2012/tjyx/tjrm_img09.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga3.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 27 Oct 2014 07:12:36 GMT

Cache-Control: max-age=31536000

Content-Length: 3085

Content-Type: image/jpeg

Last-Modified: Thu, 01 Mar 2012 06:03:42 GMT

Accept-Ranges: bytes

ETag: "8086cdd71f7cc1:34b"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zjjhdx39:8104 (Cdn Cache Server V2.0), 1.1 kf49:9 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......<......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="xmp.did:7C3C90818062E1119A50B0F09DBE5343" xmpMM:DocumentID="xmp.did:490DB7D562B611E1987FB533819DF614" xmpMM:InstanceID="xmp.iid:490DB7D462B611E1987FB533819DF614" xmp:CreatorTool="Adobe Photoshop 7.0"> <xmpMM:DerivedFrom stRef:instanceID="uuid:02cd31e0-62b0-11e1-a9f2-89007db68855" stRef:documentID="adobe:docid:photoshop:3e3cd8bb-62a6-11e1-b37d-c0893894c906"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................*.D.......................................................................................1.!Q..A"2..aq..r3..Rb.#C4...B..D^..........................!1.AQ.aq.."2..........BR#br..3C.............?..nq^.....m......./.a...PGR.y.W.xH........F...&..k.K-..dw.h:7.x..\.@.p...;A..~6.q8...<.%}.{.a..[w...im..9b.j

<<< skipped >>>

GET /static/js/bds_s_v2.js?cdnversion=396683 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bdimg.share.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.7

Date: Fri, 03 Apr 2015 10:35:24 GMT

Content-Type: text/javascript

Content-Length: 9992

Connection: close

ETag: "870930959"

Last-Modified: Fri, 27 Mar 2015 08:22:03 GMT

Expires: Fri, 03 Apr 2015 10:53:20 GMT

Age: 724

Cache-Control: max-age=1800

Accept-Ranges: bytes

Content-Encoding: gzip

Vary: Accept-Encoding

Ohc-Cachable: 1

...........|.r.......;liQ.7.`d..2x.._.Mw..!@...@..4.1..11....m>ab.i>g..gLfU......9...RUVUVVVV.J..{0..Nt.P...f.`....5.(...".W....QZ?@...m<.4t..%...[.....z..........G.#.....jn.>..~.....|....i.......wU..K..M.2.D...{,...[..Qx....H..#.gx7..I.}.5. ..........{..yp...2....?.......3..=.#.{.w..........p}{[.....z .P.Y.V....K..b.H./..=..`\oa...... (..L..U..-g.#.7....R.'.1V..?....;..;{.z..w..o.....cAI..0.....@8....?......j.C.C..K..c..E.......q,.=....Os....h..h..h;..2'.eND.......;....a.,...'...Da.....a?X-U..Iw.-....[.o......>@w5..;..F.Vs.6...m^Uj.3(z...h....g@a.ya@........1..d.xP.....K[..5..: ..{.SC..s.@ .'...<.........K[...O.............{9......fS`..Z...q.5Z2.j......L6.[s!.....m..he..D?.CD.-:.L.......{.M.ax..q.......S.&8.@\..4..g{d.5.]......s...`..pIM.......F0?.b'.ts.....|..a..{../B.4....fX./.........KooW....K|M."..........U..=.....2.....|o....H-.*..yc"...6......]..{..[...N....$.... .A.2R..[]...8k..)a..v.........!..d..M...L[.>...........:.T>....8.......T.....f..h^..]...g.7...0.....5......H\...\...Z.. ..>N..?....xXa...<..s.:$X.@3.|2.B.H....HTTP/1.1 200 OK..Server: JSP3/2.0.7..Date: Fri, 03 Apr 2015 10:35:24 GMT..Content-Type: text/javascript..Content-Length: 9992..Connection: close..ETag: "870930959"..Last-Modified: Fri, 27 Mar 2015 08:22:03 GMT..Expires: Fri, 03 Apr 2015 10:53:20 GMT..Age: 724..Cache-Control: max-age=1800..Accept-Ranges: bytes..Content-Encoding: gzip..Vary: Accept-Encoding..Ohc-Cachable: 1.............|.r.......;liQ.7.`d..2x.._.Mw..!@...@..4.1..11....m>ab.i>g..gLfU......9

<<< skipped >>>

GET /4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s8.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 02 Apr 2015 12:39:00 GMT

Server: 4399SERVER

Last-Modified: Wed, 01 Apr 2015 02:52:41 GMT

Accept-Ranges: bytes

Cache-Control: max-age=31536000

Expires: Fri, 01 Apr 2016 12:39:00 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1167

Content-Type: text/html

Age: 78973

Via: http/1.1 4399SERVER (CDN CACHE V1.0), http/1.1 4399SERVER (CDN CACHE V1.0)

Connection: keep-alive

...........VMo.E.>7R..v*$.......o.c;!(M......w.....lvf...pF.UU...$UQ%J....RTPA.{@.ygv.l.....03....<..6ov.......... .....r.@&..U..wz.t.Z(......>..............)q.(.....H.&.........j...9=....~>.........}q...........q.z...O.=..`zjHb...(.6m.J..xdXF.T.K7yDC?. .....:.1x......$.........?.....J.6..*..8.r1M..N3WS.KF...D%u..._6q*...Jb......$..X!0g.......P.......L...C..S}.7...a.}oy.g..V.6[K.7@2Dl[.W ................@.M.ZO...".u..xym..'..0...e.......lc....yN....'..<....L..g....................R.nwc.^/.....<}.-~..(...........?..J...\%...&..w.....e.(....B.M..#...<.T..GH%...IlS...D....)...cF.G..f.Q-..{....l......h.*..C.\,.K.R..`..#..36.\J..$.G.*"....-%.r..w...\M. D...C....h.X(.2.....M'&..$....e..o......<.B*.fW.A$........|..J;.....PD....F1..K..Sm..C.w,.J.......w...W...QUtc..W|H......;.....y....<p..;n...1m.x...XS..(.d....P.6....'..0.Jf3.....vg..5[.Z.,...Y.-.1....le.Z..".C..&tq.(d.8.........M......3"C &...J.:... .......=S.).g....B.b...........@...T..>.1$,..n0,........n.G&..e..^.G...6..mSu72..Fd,.....TB......3.l..F..}....)k....$...X....~A3.G..E.].]*......Ez.I.1.&..x.....U...q..../.....l..fz.i....@..l.K'./.q.....M=....m...;.../.5......m.lI....".Q.{.........-....@.c.<.......

<<< skipped >>>

GET /4399swf/js/chkDomain.js HTTP/1.1

Accept: */*

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s8.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 03 Apr 2015 10:04:42 GMT

Server: 4399SERVER

Last-Modified: Fri, 17 Sep 2010 03:21:31 GMT

Accept-Ranges: bytes

Cache-Control: max-age=31536000

Expires: Sat, 02 Apr 2016 10:04:42 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 352

Content-Type: application/javascript

Age: 1833

Via: http/1.1 4399SERVER (CDN CACHE V1.0), http/1.1 4399SERVER (CDN CACHE V1.0)

Connection: keep-alive

.......... K,RH.../-R.UHK.)N...*..&....].s.3..R.J.%%.V.....z&...z...J:0QL......4u("..z.5.[...b.......8?.....aE,.w.%E>...%.. ...'................ 3M.$.@..<3/%.\....3-.HA..;...:..9..rR..K2.....J9........Z.....': V.........%E..8....&f...@.....0E.b........%../,.|....k.>..g...G....W.9.tv..z....7..8}..w....'^o.wu....g?......g[....z...#..l9.LQI...Z...F.*...HTTP/1.1 200 OK..Date: Fri, 03 Apr 2015 10:04:42 GMT..Server: 4399SERVER..Last-Modified: Fri, 17 Sep 2010 03:21:31 GMT..Accept-Ranges: bytes..Cache-Control: max-age=31536000..Expires: Sat, 02 Apr 2016 10:04:42 GMT..Vary: Accept-Encoding..Content-Encoding: gzip..Content-Length: 352..Content-Type: application/javascript..Age: 1833..Via: http/1.1 4399SERVER (CDN CACHE V1.0), http/1.1 4399SERVER (CDN CACHE V1.0)..Connection: keep-alive............ K,RH.../-R.UHK.)N...*..&....].s.3..R.J.%%.V.....z&...z...J:0QL......4u("..z.5.[...b.......8?.....aE,.w.%E>...%.. ...'................ 3M.$.@..<3/%.\....3-.HA..;...:..9..rR..K2.....J9........Z.....': V.........%E..8....&f...@.....0E.b........%../,.|....k.>..g...G....W.9.tv..z....7..8}..w....'^o.wu....g?......g[....z...#..l9.LQI...Z...F.*.......

<<< skipped >>>

GET /4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s8.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 03 Apr 2015 08:17:59 GMT

Server: 4399SERVER

Last-Modified: Wed, 01 Apr 2015 02:52:52 GMT

Accept-Ranges: bytes

Content-Length: 3086497

Cache-Control: max-age=31536000

Expires: Sat, 02 Apr 2016 08:17:59 GMT

Content-Type: application/x-shockwave-flash

Age: 8236

Via: http/1.1 4399SERVER (CDN CACHE V1.0), http/1.1 4399SERVER (CDN CACHE V1.0)

Connection: keep-alive

CWS.R.2.x....<...?>...53.A..."....N.BR.i..d.hf..R...J."*.F.m..)Ei...*.....kh...........].=...=..s.}.(.@..F@b..T.......!u.5.@.*`......$DsyB;.M..)..........[....&f...&..&..F.a$L....F<...{|...0L...q.<........M.0<* ...1...>$ ...eG.y".............."{fL......3I0.F.....ql.p.S.9..7#.G..q...,~([...N...q......`......c.L..q.?.$F.g.....a(...].!bbC..a$[`.........M.x..l...7...k.2y..............)b.{3.:.f.:..fV.i`..&.#.a.l.=.E.%i*...{;.F.T.@.,.G.?Jw...`..h1.6....(...--lm..<x..0..8.@@pv.9...PK..*iv.....'..?.I{b_U]]-q..{.Q.......c..6?y..?.k........gZ..:...eY.....T..gd.Q9..6.s.........`%.|...kB... .A./....1I9.|.E..u..\..wL]]....g....5k..\...;J..x.2.........]........Ll\2xc.e...i.G.[..!....r..AE{...C.6..?wR..`..E.4.W5,..K0#.ddz.g.H.d..KC.......e..dW>IMV.iG.^...O..E(...........?x)d.......s......1.e~..\9....$.Q.[1...&...wX...29x...O.. .... ..ZUW ......v....&}.X[;...F.=.~.p1mmH........./..hL._.m....x...`B..M.....ISw|..3...r..T.).F..2..MA........|.$6..U..)_N]..3.:..$...s......'.}h..[..~....No?...5....v....|..|../...........W..5u....o..0.<I.w..u.fS......d.S .m.5....T.@.....l.....{..P.Hq...w..*..P...o...0..-.Z.`s.e.2..].O..x.I1q,7jH..Pg.p.....r]GUU&.H.?.yx...Y.d...S.../...r...GO....>o.........e.{...M.*._....}....B.....d.Z~r.n.x..k....`........v... .lm.K......{v#.|...;.....G....;..~..|.`k.H...st\.....c.)[...?..Q.]j.e......o.....G.>..k*.^.......C......V....o..l........7l./.y.....~......ki....[>.a.u.l..... ....55E...C.....f.<..zo..X....6..c..'.g$.#.}..g...#O..?|.;..AE....O..0..L....5.`fr.7dz.NKo..n.yg.

<<< skipped >>>

GET /static/js/logger.js?cdnversion=396683 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bdimg.share.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.7

Date: Fri, 03 Apr 2015 10:35:21 GMT

Content-Type: text/javascript

Content-Length: 2404

Connection: close

ETag: "862505693"

Last-Modified: Fri, 27 Mar 2015 08:22:03 GMT

Expires: Fri, 03 Apr 2015 10:44:49 GMT

Age: 1232

Cache-Control: max-age=1800

Accept-Ranges: bytes

Content-Encoding: gzip

Vary: Accept-Encoding

Ohc-Cachable: 1

...........X.o.8.. .Q.....d.......{..E.6...1.E.l52..('...~....;mq(....9.o..zjp.|^{J...(v...;..'..I....E.X.v.e.}.7. .."....DZ.... ...t..u./..0Q...A$..!..!.I8....Eg...d84.....5&.Y{......T(.`):.J'...%l....&... Z*.s%....D."CB.N..........he.\8.. ..Mg.....hT. ..r...B9........#y......r.....1.r..-..-.zC;.n{........mwd.....1v.u3.V..-K:k.q._...*.....b...~1.;.a.>..4lB.......|1a......g.\.b...../Y.P..R...,..n8."._`.......eMH.VuJ}..3..2[G..H.!bGfw..}.o..z*....BG.....M ...)e...,Z.....1?.0.....^.`u.Aw..W.F$........%...Z...F3.5..L#...d....;...6........^.yF...g...Ar....GS...../vwe...w...?&...Jn.t3.&..-....A...".{Z.......(.j.?kO....;........yV......W...(.. m.. .../..d..~~1...N...V.N../...r..YF..?...;.M.8...3r......{.Y.p....[&}.oj..._bq .^V0E..-......"...M|.|......G@R........WI....kY..1d..O.wh..C.^.ca$2....J`...X2....U...z8.c....kj..`..<....D..J%..Y.......9...fs.?.p..mN..tU.....Qs....k$.U.F@...^QT...........%...P.....c!....QA..q .F.ub..|sE.../)...g .P..5b..X..c.kk.......,eA.p..jE.E.$..Y. _G..D0. .k....5dV..#. ...0......p.iq..ZdN(........A.*^.rd......L.....2!..y..>%...H.TH.c.e,a9u. .N.SI....x..H...kt{[.."...... .-........i.!\............r.J.'......C.>..)=ys...%..&n..E.c............$J.c8....(.aH#.....1.\l......~%0.{..;D*.FU....!Tz.h...... .p..8..z*.c.:........[..3..^..-...1z....0.....J6b.6..Ob..>u.M....S7Gh...Ai...Nd,.?.M..........y....#..|.....n...............j.......s........k}R....?.3.@....'........`UW.3X,.dv...!...U.|b.......L.k..g._."..&G.|..f...$....P. I/.#6..0$...............~...O6.....}.Zx... x...}.h.B.').y}..

<<< skipped >>>

GET /v.gif?pid=307&type=3071&sc=996,4797,1276,818&desturl=&apitype=1&linkid=i81ggq5vtls&velo_load=5734&velo_cssload=1125&velo_jsLoad=4672&cite_uid=480925&cite_type=1&cite_mini=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: nsclick.baidu.com

Connection: Keep-Alive

Cookie: BAIDUID=A076B2452879CC15DCC87F4B01606827:FG=1

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=0

Content-Length: 0

Content-Type: image/gif

Date: Fri, 03 Apr 2015 10:35:31 GMT

Etag: "4280832337"

Expires: Fri, 03 Apr 2015 10:35:31 GMT

Last-Modified: Fri, 23 Oct 2009 08:06:04 GMT

Pragma: no-cache

Server: BWS/1.0

HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=0..Content-Length: 0..Content-Type: image/gif..Date: Fri, 03 Apr 2015 10:35:31 GMT..Etag: "4280832337"..Expires: Fri, 03 Apr 2015 10:35:31 GMT..Last-Modified: Fri, 23 Oct 2009 08:06:04 GMT..Pragma: no-cache..Server: BWS/1.0..

GET /upload_pic/2012/tjyx/tjrm_img011.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga4.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 27 Oct 2014 07:12:36 GMT

Cache-Control: max-age=31536000

Content-Length: 2384

Content-Type: image/jpeg

Last-Modified: Wed, 07 Mar 2012 08:25:57 GMT

Accept-Ranges: bytes

ETag: "607ae2eb3bfccc1:34b"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zjjhdx37:8080 (Cdn Cache Server V2.0), 1.1 kf50:8 (Cdn Cache Server V2.0)

Connection: keep-alive

......JFIF.....H.H.....C.......................................................""""""""""...C................ ! !!! !!!!!!!!"""""""""""""""......*.D..........................................6.........................!..."1AQB..2a..#$3q..5Rr..................................6........................!1..AQa."2q.....#b..3BRr................?......K.KH=....p..AV..<.......y.XHFa...`.hU...5..7.v<...Tr!=..#].x 4.o.....F...:..KD.......K.7..A.v.....X('.....\.....)^.F[..<c.^.....|W.I.x.I..V........6....S.7;QPy.....om.E(k3.........}2.^VV@..O9........:..J..5.(...C...;.V5...s.|*.N..].tu......J.m.]*..F.ED..VBQ%.K.^.O>...~..t$U......3.......TU4..ER.....7..?.h.ZF..C.K#d.!6....-b..{.q...|.m....q.T8.2..)..&.I...}....:.T^..9N.h:_2..uU..................Th.UT....3..K.qq${.p.6....L(0VP..Qt.D..r.~....TV.#y...m...:...y..8_N>t.....Q5....W|... ...-..>...R.:..E....s..v.=.......c.... .n..7..$J:....i..'...b....=.;8_......:**.5.9....)./....q..........{U.E.p..3C/.nLqSN..8.g.......a...f...S...-........$..d.nJ!n....j./..$5.%....1'[qJv..........$.Ff..N'o.{'.....%.zz.JX..Nq.@..7P.....P..........Ur..*.....l|.Y.%A..-...g7..Aobx.h.w..~....z"~)WtR.Q..).......D.%x...r.?.....x.&.....u[...o.....B..(!..b.PUGb.....eX.........,........Q.[k..6.[<..ox..{uu....V.....a..e'rM&p.P.FTcZ.....U...i....&u%..m}.2Alj....).=...r.:;nee..Ge.......C:BuMVJ..R.kn.ISi.U..\.;@...w**.]....#.....3._.-d...1...(.K..........M........\.<s..B.Q ...].n..n.f.;..ku .....::.[..m$...h...O..{?_..M.@".@6.F.l.;..r.S.;...UW..jd..%.....M..Q.}ydM...o

<<< skipped >>>

GET /img/pic.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: icon.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 719

Connection: keep-alive

Date: Fri, 03 Apr 2015 08:46:54 GMT

Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT

Expires: Sat, 04 Apr 2015 08:46:54 GMT

Cache-Control: max-age=86400

Accept-Ranges: bytes

Via: cache1.l2de1[760,200-0,M], cache21.l2de1[761,0], cache1.de1[0,200-0,H], cache5.de1[1,0]

Age: 6515

X-Cache: HIT TCP_MEM_HIT dirn:2:262176804

X-Swift-SaveTime: Fri, 03 Apr 2015 08:46:54 GMT

X-Swift-CacheTime: 86400

GIF89a2.........f..3...33....................................................................................!..NETSCAPE2.0.....!..Powered by AFEI.!.......,....2...... !.di.hjBl..p,....x......`P.(...GR.D6...CH....,..@8.... -..EQc.8...........`...."....................~"..H........H......"...$....#.........."..........."Z.......*...%!.!.......,....2...... !.di.hjBl..p,....x..|....p r..H.C.\&.H.tJu...#b......7..W.h.......7..l..v..-....."....................~"..I........I......"...$....#.........."..........."\.......*...%!.!.......,....2...... !.di.hjBl..p,....x..|....p r..H.C.\&.H.tJu...#b......7..W.h.......7..l..v..-....."....................~"..I........I......"...$....#.........."..........."\.......*...%!.;HTTP/1.1 200 OK..Server: Tengine..Content-Type: image/gif..Content-Length: 719..Connection: keep-alive..Date: Fri, 03 Apr 2015 08:46:54 GMT..Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT..Expires: Sat, 04 Apr 2015 08:46:54 GMT..Cache-Control: max-age=86400..Accept-Ranges: bytes..Via: cache1.l2de1[760,200-0,M], cache21.l2de1[761,0], cache1.de1[0,200-0,H], cache5.de1[1,0]..Age: 6515..X-Cache: HIT TCP_MEM_HIT dirn:2:262176804..X-Swift-SaveTime: Fri, 03 Apr 2015 08:46:54 GMT..X-Swift-CacheTime: 86400..GIF89a2.........f..3...33....................................................................................!..NETSCAPE2.0.....!..Powered by AFEI.!.......,....2...... !.di.hjBl..p,....x......`P.(...GR.D6...CH....,..@8.... -..EQc.8...........`...."....................~"..H........H......"...$....#.........."......

<<< skipped >>>

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.api.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 03 Apr 2015 10:35:21 GMT

Content-Type: text/xml

Content-Length: 570

Last-Modified: Mon, 28 Jul 2014 09:59:57 GMT

Connection: close

ETag: "53d61f1d-23a"

Accept-Ranges: bytes

<?xml version="1.0"?>..<!DOCTYPE cross-domain-policy SYSTEM 'hXXp://VVV.macromedia.com/xml/dtds/cross-domain-policy.dtd'>..<cross-domain-policy>...<allow-access-from domain="*.4399pk.com"/>...<allow-access-from domain="*.4399.com"/>...<allow-access-from domain="*.4399.cn"/>...<allow-access-from domain="*.my4399.com"/>...<allow-access-from domain="*.4399.net"/>...<allow-access-from domain="4399pk.com"/>...<allow-access-from domain="*.4399api.com"/>...<allow-access-from domain="imga.4399.com"/>...<allow-access-from domain="imga1.4399.com"/>..</cross-domain-policy>....

GET /flash_flow/log.js?g=100015389&u=774c0f21700953182032bf6a9cddba0a&r=65945896 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.swf/[[DYNAMIC]]/2

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.api.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Fri, 03 Apr 2015 10:35:25 GMT

Content-Type: application/x-javascript

Content-Length: 0

Last-Modified: Thu, 05 Mar 2015 08:08:31 GMT

Connection: close

ETag: "54f80eff-0"

Expires: Fri, 03 Apr 2015 10:35:26 GMT

Cache-Control: max-age=1

Accept-Ranges: bytes

GET /xml.php?ran=48787.24794834852&gameid=100015389&url=http://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.swf/[[DYNAMIC]]/2

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.api.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 03 Apr 2015 10:35:25 GMT

Server: Apache/2.4.7 (Unix)

Content-Length: 574

Connection: close

Content-Type: text/xml; charset=utf-8

<?xml version="1.0" encoding="UTF-8" ?>.<config><entry id="62872" category="brand" time2skip="12"><item src="hXXp://cb.baidu.com/ecom?di=62872&tm=BAIDU_CLB_XML&asp_url=4399.com&return_type=1" click_base="hXXp://stat.api.flashgame163.com/brand.php?url=" /></entry><entry id="999" category="google" time2skip="12" channel="0000000398,game398" pubid="ca-games-pub-9606551472994074" /><entry id="999" category="combrand" time2skip="12" width="640" height="640"><item src="hXXp://cdn.comment.4399pk.com/control/4399.swf" link="" bgcolor="0xb5e9f9" /></entry></config>..

GET /static/js/shell_v2.js?t=13 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bdimg.share.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.7

Date: Fri, 03 Apr 2015 10:35:20 GMT

Content-Type: text/javascript

Content-Length: 571

Connection: close

ETag: "2171128783"

Last-Modified: Fri, 27 Mar 2015 08:22:03 GMT

Expires: Fri, 03 Apr 2015 11:05:19 GMT

Age: 1

Cache-Control: max-age=1800

Accept-Ranges: bytes

Content-Encoding: gzip

Vary: Accept-Encoding

Ohc-Cachable: 1

...........SQk.0.. ...D..n...3...A..Z.RJQ..."[F.x...}..7i;..........s .d..J. ;..].........I...........n..%.d......|.SVn*.1.k.H[5.......{......%e=..]H..P....k..jpl..]#8...@..U.#.=....7.....B."..l-B6...6L..^&`.".....!.....j59.A...VVm..w.Yc(1.F.z)P...u.p.........R..(..R..0;..~..P....B..?%..#.aDY...2;!@...[9...`...........}..=vPc4..P...@.I.. ,]p.d.|.....K........(nE..B..G...5.Z.\4..*/.Qt1.1l..c]O..w.k..{..7a..`..... .......0R..aL[4...k[..........H...U.}.^..6<....i.<.........>.@.9..Xr....=e.....a...V..7E.J.VO...(.....'..~.?&}....|.._._.1._...H....i<N.uP......`.o...;o.....

GET /resource/ucenter.js HTTP/1.1

Accept: */*

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin.3304399.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 03 Apr 2015 11:34:19 GMT

Date: Fri, 03 Apr 2015 10:34:19 GMT

Server: nginx/1.4.1

Content-Type: application/x-javascript

Content-Length: 42683

Last-Modified: Sat, 14 Mar 2015 09:57:58 GMT

ETag: "55040626-a6bb"

Cache-Control: max-age=3600

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 zjjhdx38:8106 (Cdn Cache Server V2.0), 1.1 kf48:10 (Cdn Cache Server V2.0)

Connection: keep-alive

uni_login_type_key = "loginType";..uni_login_username_key = "username";..uni_login_uid_key = "uid";..uni_login_nick_key = "Pnick";..uni_login_qqnick_key = "Qnick";..uni_login_puser_key = "Puser";..uni_login_ptusertype_key = "ptusertype";..uni_login_phonebinded = "phonebinded";..uni_login_lastLoginDate = "lastLoginDate";..uni_login_lastLoginAppGame = "lastLoginAppGame";..uni_login_lastLoginTime = "lastLoginTimeStamp";..uni_login_type_qq = "qq";..uni_login_layout_horizontal = "horizontal";..uni_login_layout_vertical = "vertical";.....var unionLoginProps = {};..function getCookieValue(propKey, defaultValue){...uniCookie = JK.Passport.get();...if(!uniCookie)....return defaultValue;...return uniCookie[propKey] || defaultValue;..}..UniLogin = {};..UniLogin.getUid = function(){...return getCookieValue(uni_login_uid_key);..}..UniLogin.getUname = function(){...return getCookieValue(uni_login_username_key);..}..UniLogin.getUserType = function(){...return getCookieValue(uni_login_ptusertype_key);..}..UniLogin.getQnick = function(){...return getCookieValue(uni_login_qqnick_key);..}..UniLogin.getNick = function(){...if (!UniLogin.getUid()) return null;...var nick = getCookieValue(uni_login_nick_key);...if (!nick) {....return null;...} else {....if (nick.replace(/[^x00-xFF]/g,'**').length < 2) {.....return null;....} else {.....return nick;....}...}..}..fetchNickTryCount = 0;..UniLogin.fetchNick = function(callback){..setTimeout(function(){....if (!UniLogin.getUid()) return;....var nick = getCookieValue(uni_login_nick_key

<<< skipped >>>

GET /flash_flow/view.js?g=100015389&u=774c0f21700953182032bf6a9cddba0a&s=35b04bfb5551774272942c9d98036044&a=13&r=52209393 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.swf/[[DYNAMIC]]/2

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.api.4399.com

Connection: Keep-Alive

Cookie: _4399stats_vid=14280573350542688

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Fri, 03 Apr 2015 10:35:39 GMT

Content-Type: application/x-javascript

Content-Length: 0

Last-Modified: Thu, 05 Mar 2015 08:08:35 GMT

Connection: close

ETag: "54f80f03-0"

Expires: Fri, 03 Apr 2015 10:35:40 GMT

Cache-Control: max-age=1

Accept-Ranges: bytes

GET /upload_pic/2012/tjyx/tjrm_img08.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 02 Mar 2015 10:13:10 GMT

Cache-Control: max-age=31536000

Content-Length: 3177

Content-Type: image/jpeg

Last-Modified: Wed, 29 Feb 2012 09:18:04 GMT

Accept-Ranges: bytes

ETag: "0ae5fac3f6cc1:388"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zjjhdx40:88 (Cdn Cache Server V2.0), 1.1 kf48:5 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......<......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="xmp.did:7C3C90818062E1119A50B0F09DBE5343" xmpMM:DocumentID="xmp.did:48F37DFE62B611E1987FB533819DF614" xmpMM:InstanceID="xmp.iid:48F37DFD62B611E1987FB533819DF614" xmp:CreatorTool="Adobe Photoshop 7.0"> <xmpMM:DerivedFrom stRef:instanceID="uuid:02cd31e0-62b0-11e1-a9f2-89007db68855" stRef:documentID="adobe:docid:photoshop:3e3cd8bb-62a6-11e1-b37d-c0893894c906"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................*.D.......................................................................................!1.AQ2.3..".4aqBb.R#$D...r...CSE.6.......................!1..A..2...Qaq.".Bb#C......$..R............?.-.....X.r...\.SO..u...n..r.@.l.K.}...C......k.p...\)...;mB.y54.Z.I..C..<n4{....?...U.k...N...{....mk.A....Hy....

<<< skipped >>>

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cb.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Connection: keep-alive

Content-Length: 2765

Content-Type: text/xml

Date: Fri, 03 Apr 2015 10:35:27 GMT

Etag: "551e5580-acd"

Last-Modified: Fri, 03 Apr 2015 08:55:28 GMT

Server: nginx

<?xml version="1.0"?>..<!DOCTYPE cross-domain-policy SYSTEM "hXXp://VVV.adobe.com/xml/dtds/cross-domain-policy.dtd">..<cross-domain-policy>.. <site-control permitted-cross-domain-policies="master-only"/> .. <allow-access-from domain="*.4399.com"/>.. <allow-access-from domain="*.baidu.com"/>.. <allow-http-request-headers-from domain="*.4399.com" headers="SOAPAction"/>.. <allow-access-from domain="*.4399.net"/>.. <allow-http-request-headers-from domain="*.4399.net" headers="SOAPAction"/>.. <allow-access-from domain="*.4399api.com"/>.. <allow-http-request-headers-from domain="*.4399api.com" headers="SOAPAction"/>.. <allow-access-from domain="*.4399dmw.com"/>.. <allow-http-request-headers-from domain="*.4399dmw.com" headers="SOAPAction"/>.. <allow-access-from domain="*.4399er.com"/>.. <allow-http-request-headers-from domain="*.4399er.com" headers="SOAPAction"/>.. <allow-access-from domain="*.4399pk.com"/>.. <allow-http-request-headers-from domain="*.4399pk.com" headers="SOAPAction"/>.. <allow-access-from domain="*.4399pk.net"/>.. <allow-http-request-headers-from domain="*.4399pk.net" headers="SOAPAction"/>.. <allow-access-from domain="*.5054399.com"/>.. <allow-http-request-headers-from domain="*.5054399.com" headers="SOAPAction"/>.. <allow-access-from domain="*.baomihua.com"/>.. <allow-http-request-headers-from domain="*.ba

<<< skipped >>>

GET /ecom?di=62872&tm=BAIDU_CLB_XML&asp_url=4399.com&return_type=1&ran=9822.47437350452 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.swf/[[DYNAMIC]]/2

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cb.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: post-check=0, pre-check=0

Connection: keep-alive

Content-Length: 233

Content-Type: text/xml;charset=UTF-8

Date: Fri, 03 Apr 2015 10:35:27 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Fri Apr 3 18:35:27 2015

P3p: CP=" OTI DSP COR IVA OUR IND COM "

P3p: CP=" OTI DSP COR IVA OUR IND COM "

Pragma: no-cache

Server: nginx

Set-Cookie: BAIDUID=A076B2452879CC15DCC87F4B01606827:FG=1; expires=Sat, 02-Apr-46 10:35:27 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1

<?xml version="1.0" encoding="utf-8"?><adm xmlns="hXXp://cb.baidu.com" xmlns:xsi="hXXp://VVV.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="hXXp://cb.baidu.com hXXp://cb.baidu.com/xsd/BAIDU_CLB_XML.xsd"><status>0</status></adm>.HTTP/1.1 200 OK..Cache-Control: post-check=0, pre-check=0..Connection: keep-alive..Content-Length: 233..Content-Type: text/xml;charset=UTF-8..Date: Fri, 03 Apr 2015 10:35:27 GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Last-Modified: Fri Apr 3 18:35:27 2015..P3p: CP=" OTI DSP COR IVA OUR IND COM "..P3p: CP=" OTI DSP COR IVA OUR IND COM "..Pragma: no-cache..Server: nginx..Set-Cookie: BAIDUID=A076B2452879CC15DCC87F4B01606827:FG=1; expires=Sat, 02-Apr-46 10:35:27 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1..<?xml version="1.0" encoding="utf-8"?><adm xmlns="hXXp://cb.baidu.com" xmlns:xsi="hXXp://VVV.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="hXXp://cb.baidu.com hXXp://cb.baidu.com/xsd/BAIDU_CLB_XML.xsd"><status>0</status></adm>...

<<< skipped >>>

GET /static/css/bdsstyle.css?cdnversion=20131219 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bdimg.share.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.7

Date: Fri, 03 Apr 2015 10:35:26 GMT

Content-Type: text/css

Content-Length: 2021

Connection: close

ETag: "3345533376"

Last-Modified: Fri, 27 Mar 2015 08:22:00 GMT

Expires: Fri, 03 Apr 2015 10:56:10 GMT

Age: 556

Cache-Control: max-age=1800

Accept-Ranges: bytes

Content-Encoding: gzip

Vary: Accept-Encoding

Ohc-Cachable: 1

...........Z.....~.5.E...../..6...w.A...EY.H...3.1........m.....ER.x.. ...L.....U..........|..........].699P.X<...F.$......@...C.|...vF.Y,9..i..})hT...%9.Y.9qM..U....R.-.....?..(giJ...fUJO........-/#.>.......Fn........qKO.M......ae..-.....a.z.ET......}R....2^.8v.C..Q.Y....U.K....P.m?x..Bl......d...h..3V.]#R.9.f..v.|..a....C*V9...~.RU-_..Y....8.;*#7.O.=A............{"....".e..3e...V.....-.#W.6.`...K.5N.&S.....8!............RM9..........j.~...Vv..L.H....wy#D.#...x;...i...NKlol...04:C...`...)k...DI.w...rD........0._.!w..C....O...l......3`O_^....X.Q..Z{p..I...|a......I.Z..V.9.].s..`... ..kyA...b..V&.^3rl....R.a......*8..7{]..y..4D........(zG.lf........gL.B.y..l..#.K}..*O.6......C..b...dO...Y...o........z......`U.>...v<U.<e...r.......3B..`2zQ..u.{.4....5F7S..8P...-.4B..[.. >.b,.8...V..>..P.'...Q..@..H..j...]\fJ4j..E...p......m....B8;iQ.K...BpZ......_..o)>a..-pV.BIST.x.|KO^j_.V.........:h..4..19.8.u...ug!..-.,3<.sV..x. ........l.....&.z...p. .e.7:.....B.F.t%. ,...T{.(..5j'.W.".j....I67Z.../OC....B.'.....o79...r?..]..q.,..[......?.#.UFl.....D.........i.<;..qv_..h.....=x. .x|p......[.w....lwg...;`...;..P....Z..m.........G).....].y!.E.z.t.<#% ^.....;0R.*{....s.U.0..!k.&.2._4........no'...p..c5.... ..lv_7$`...".E!4..u..v........`55S9..^...^p?.].P....Zo*}.j..~....P......P....?*.=.M...c.p..x.v..O.&U.............tX.I3.^hM.Wg....^..j......2%.X.:.On.34;.q..(p..qJ.....I8.. ....a..E:$..3aGq...j=......h...^zm.....v _.9........oPE.}0h.|.<O..........]A..-.-b.!.N.....M... 3..7?.Q_....KW`.5 b.].~.

<<< skipped >>>

GET /static/images/is.png?cdnversion=20131219 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bdimg.share.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: JSP3/2.0.7

Date: Fri, 03 Apr 2015 10:35:27 GMT

Content-Type: image/png

Content-Length: 12294

Connection: close

ETag: "568935178"

Last-Modified: Fri, 27 Mar 2015 08:22:00 GMT

Expires: Tue, 07 Apr 2015 07:13:45 GMT

Age: 271302

Cache-Control: max-age=604800

Accept-Ranges: bytes

Ohc-Cachable: 1

.PNG........IHDR.......<.......5*....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:FB2478DF60B711E38EB0C15A38F52D2D" xmpMM:DocumentID="xmp.did:FB2478E060B711E38EB0C15A38F52D2D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FB2478DD60B711E38EB0C15A38F52D2D" stRef:documentID="xmp.did:FB2478DE60B711E38EB0C15A38F52D2D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.Yl.....PLTE......."..j0..o............hm.. ..N......k.1...P.dW.G/....D2....e..xV..0..........{..u.%y..............LlG...-0\....!v............C.....q.f.....667...#..6y.Kl.....p.X...............OM.30.........HTTP/1.1 200 OK..Server: JSP3/2.0.7..Date: Fri, 03 Apr 2015 10:35:27 GMT..Content-Type: image/png..Content-Length: 12294..Connection: close..ETag: "568935178"..Last-Modified: Fri, 27 Mar 2015 08:22:00 GMT..Expires: Tue, 07 Apr 2015 07:13:45 GMT..Age: 271302..Cache-Control: max-age=604800..Accept-Ranges: bytes..Ohc-Cachable: 1...PNG........IHDR.......<.......5*....tEXtSoftware.Adobe

<<< skipped >>>

GET /uploads/userup/1504/021615139200.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 29 Sep 2015 08:36:19 GMT

Date: Thu, 02 Apr 2015 08:36:19 GMT

Server: nginx/1.4.2

Content-Type: image/gif

Content-Length: 22573

Last-Modified: Thu, 02 Apr 2015 08:15:13 GMT

ETag: "551cfa91-582d"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf48:4 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a..0........L..p&..#Vl.....i..~.j....=......kx~...Jk...qwZ .i.k.~...f.....ku......=..F,../Cc..f..T.............,[......R..M.....8.....F......Z.%[..vY.......i.........Uy..".....M..j.........."..qPNP..8h....&..`q.....GW.CVs..9|..-o.........E........b.............r....'_.,..Wgt...354..G.W....-...........dx.{i>..f.....&......a.......5E........g..Q:1'.....hWGj<.@i...Q%....U7..........1......X|..K!...T..c.....p..M,...qx..=....l...v......1.]....#...z....!...,...bP..............;BV.X~.......0../........}.u...^........s....r.....|.wCj.....7.......C..^...\.....edf:.. {.X]H...{...........s...Q....,.."..=AG...............?]...`.....b..#...H......Y.4......:.G...N........hx..1.....5...................<y..p.b.D "(.....Y.....D...,........_............'.....h..`...n.....,N.e..t.....!..NETSCAPE2.0.....!.......,......0........H. .F].*L.h..=..%ld.....3j....G.hH.XA..H4.S.Ts....J>z`.....8s.......@...J....H.*M.....j......".**...'..(........)n...T!G..W&..B........Y.$..x..........O.a.....!v.8........{..f..h.l.Q....S.^......c.....M...v.s...bG.LQP.N.On.GY....[....;7....E.........;.FA....%..8...\..)...R.f....4}.tG...(....h.......5I..G...U...q....@.3.0......D'5...".=..A.mGRg ..Qa.\.B..<...9.PC.@VP....0W..!T.C.M&...!..v... .6)....v...`.)fP.9...Pb.$V98qK..H!'..|.....B...`Qb\....}".Z(.......6....F*...Vji.S).."5.....0...N....X.A..b .@*.....|.ND.C.I4.C....c..%..).G...!.Pb{.r.~.q.....4...f...JQ.../...A....oK..@..03.&.(..%w...p.@..#5.`d.u). .M...} ...9,4....G,...Wl...;|N.Ut..a.].)# .bA...j...."...xb...Q..a.6..b..'.b=7..y.. .d.

<<< skipped >>>

GET /uploads/userup/1405/10163ZO2N.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 25 Apr 2015 07:55:47 GMT

Date: Mon, 27 Oct 2014 07:55:47 GMT

Server: nginx/1.4.2

Content-Type: image/jpeg

Content-Length: 3450

Last-Modified: Sat, 10 May 2014 08:39:07 GMT

ETag: "536de5ab-d7a"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf49:2 (Cdn Cache Server V2.0)

Connection: keep-alive

......JFIF.....H.H.....C....................................................... ...C................ ......K.d...........................................8..........................!1."AQa..#2q..BR.$r.3...D...................................*.......................1..!."AQ2a.#3.Rq.............?.I...5...R..|Fe...9..l.fG..t.&...).Q..1%Z.......<u..@. ........55lu[9H..]~..8.i...._.............V.H..L.l..[......i..7.}..PqM5.....D*##...6...o.tr}..-...c....x.'.PNV2.o.u,....w...Wu(a......*..z..8.L........] .B..k..f..4..-.?]^......b[.........N...0.#...........n2..k...a..YNi......4.X.....K.......:...q4.-.y.lJ........|..q....#M.*>$...p..Uy..)(s......p.}5......a.;...Y..~....k....<$.I..W.M.." }.............M]Ah..S..A..t..Ly.........G.=U..s..TQ...2ZO....x..9l.s.{5....85f.... ...(..y...h....%~.......v...P........... .... (,5W...PU{...q.`yr$.(..I.....!yI..v...s..s....JZ....bpo../...{J.........U_..{N.q_e.?e. ....|...}A.........m...].MU.W...H.;....&K..Y.?....\.<Xq..V....ez:!R.7.......G.......|..t..|\.U9kQ@.W....L.v.......\w..._.#y.jUo......-"...u...Y$x...%?...Y[lu[...x...2.Q.C)C...1.^=..)"..8...0.5..).,...%$.R..j....H.o/Vm ".d.tM...,..R...c ...l...)..g).Xo.jh.{v.....rG.vI......}N..z..".....s........Z...4{.@..y..?.S.[.,.cC.i!.n..l.j.....i.s..2uM*./..z.\8...&....?...`..b.....M.q....5}..%E.u.{...x.C.]..-.k.[.wHu?e._...7.5..OME~.SE..........[=p9t.S.>..n.......,h-..T.h.~.x..O9.w..?..s....f=....l..>.. .d.UB...S........F...Yd.1.....w......K......2....u.*....".....

<<< skipped >>>

GET /uploads/userup/1405/1016395W521.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 25 Apr 2015 07:55:47 GMT

Date: Mon, 27 Oct 2014 07:55:47 GMT

Server: nginx/1.4.2

Content-Type: image/jpeg

Content-Length: 3992

Last-Modified: Sat, 10 May 2014 08:39:58 GMT

ETag: "536de5de-f98"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf50:10 (Cdn Cache Server V2.0)

Connection: keep-alive

......JFIF.....d.d......Ducky.......<......Adobe.d.................................................................................................................................................<.P.......................................................................................!...1.A"2..Qa.#.q.BR3$4r.SD........................!1A.Qa"..q....2...BR..r3..b..#............?...)......-....\iMP@D..z.L..6.....$'7...3..xe.`m.m.....y("...D^..4.p.KZ.x0QQ..|....#N..KEZ..#.,.|....U.....b..../T.......2..4B..^...G..6c.T.V..v..B....hZ0yjUj.(.u)..|..B!F...Pc0..]<....W.ml.T)..1./q~C..8.R.P.V.2....TD.?......H-..3.&.9]..L..R.pZk...2.".....D. O......l]H...8d..n....q.y.E...QQZ...<...8F.......i.....9.y...d.n.UI.\.....j.....M.*..l..y....i...#.f.]H..3.].hI.).6.Sq.q.U..tW.L. Pp.UAU_......*o......b...&....21:k..;F..UTU.*..Z.....,...D.A...e....(..%.#.v.W....(l"U5..../-....n..ZFD..0..n..9z*.v6.c'2:.E..W...$47...Rnd...WQ..(.%..\..JS,%wqNs3..J .......U*Q.A.m.L_..\...f=.&...(...G.....O.6...*.S,.....cF".H....4..&."2..H^Ba....w............!.!..r;N..R..G%...g .!7.|..7".A2t........Zn.i.]e..*. O.=8.........i.}..Q..Z!...8...8....xg..;.js8.J.*..d.......t.!.. ..B..CS%.1.)\...shi..S..Q..;/.r.m...Ga.......8([n..........?....8.KH\...r....A..&Z.o....k........:T..N.a.....-... ......u..3.....P=!...Dq...&r.....k..D. ..z....><U:4..........?.s..,C.x7-.&A.!...t.......H.k..%U..R....$..3..$..."?.....5\|&......E%wR..S2RR.,.pc.h.?./......&q...k.rh.zj.9@.c... ...TO.<{.N..F(_qN.....(.m..?....y....!.v...^.<9".0....Z.!.<0X..1..#.?..r

<<< skipped >>>

GET /uploads/userup/1503/31151042OF.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sun, 27 Sep 2015 08:12:04 GMT

Date: Tue, 31 Mar 2015 08:12:04 GMT

Server: nginx/1.4.2

Content-Type: image/jpeg

Content-Length: 20058

Last-Modified: Tue, 31 Mar 2015 08:05:13 GMT

ETag: "551a5539-4e5a"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf49:10 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......M......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:77C0F0CBD77A11E4BA4C87D4A702DF08" xmpMM:InstanceID="xmp.iid:77C0F0CAD77A11E4BA4C87D4A702DF08" xmp:CreatorTool="VVV.meitu.com"> <xmpMM:DerivedFrom stRef:instanceID="6DC0DA047737052A29C3698A8E212555" stRef:documentID="6DC0DA047737052A29C3698A8E212555"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................[...............................................................................................!.1"..AQ2.aBq.R#3.....br.S$5U.........47.CcT...%.V.W........................!1..AQ.aq"......2...BR..b.#4..r.......3C$%&............?.H...d9.".x....AuqB4&.w,..=VR....J..hS........An..85...|......w..;d<f.BM.u.$..o....=!..*E@O.C..8........Y...$n2....).x.=g..2/a..b..#...3r.n.q..f.grHQ..T...CE..._.X..c.iT4=.ci<......"........8...W._Z.dnG...e....(.....bC..VJ............P?..!at`..../.|.....Y..r...j..

<<< skipped >>>

GET /uploads/userup/1404/0913524M015.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 25 Apr 2015 07:55:47 GMT

Date: Mon, 27 Oct 2014 07:55:47 GMT

Server: nginx/1.4.2

Content-Type: image/gif

Content-Length: 84

Last-Modified: Wed, 09 Apr 2014 05:52:47 GMT

ETag: "5344e02f-54"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf49:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a...................!.......,..........%T..j......i.....d.8...._....4p,....B..;....

GET /uploads/userup/1504/031G3106195.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Wed, 30 Sep 2015 10:04:17 GMT

Date: Fri, 03 Apr 2015 10:04:17 GMT

Server: nginx/1.4.2

Content-Type: image/jpeg

Content-Length: 108881

Last-Modified: Fri, 03 Apr 2015 09:13:10 GMT

ETag: "551e59a6-1a951"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf49:4 (Cdn Cache Server V2.0)

Connection: keep-alive

......JFIF..............Exif..MM.*.............................b...........j.(...........1.........r.2...........i...............LK@..'..LK@..'.Adobe Photoshop CS4 Windows.2015:04:03 16:37:49........................................2...........................................&.(.................................n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?..:..A.>......Au......mmw.......Vk.....YE.6.=J.m..3....u....^.......... .....<7.........\.../....].....}......`...~......g.=...U....~...[.....1slp.\..N....]\4.=..C....}<......./o.\..g.o._...q_O....5.^,q...\F..n..Z..{.O.3..`.~.^...9.{=.v.........~I3...`.:..}....e6.W]..m!.f.^..._,.....5...}_...*....s....n...........^..o.K...{...../......n!..KX\s.....*.G...g..=...,.X......mk=...c.V......:...x:JC.]k...LC..=./...G....}...&..C..c.~...^.77[.Eg.....}O.%.]...^_..R'8.C...kQ..v3..._.....5$.._...o...T]..~.}x.O.....km......S.-...m.....k.....s}koo.>..._O.[........1s~.6..7~...k.......z.....W...../.~..u...[.......c......9.yh.C.......{,.....es..R^X.]U...!..a

<<< skipped >>>

GET /upload_pic/2014/12/13/4399_14511864345.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga1.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 13 Dec 2014 09:57:15 GMT

Cache-Control: max-age=31536000

Content-Length: 3766

Content-Type: image/jpeg

Last-Modified: Sat, 13 Dec 2014 06:51:18 GMT

Accept-Ranges: bytes

ETag: "0371c32a116d01:388"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zhenjiang73:8110 (Cdn Cache Server V2.0), 1.1 kf50:5 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:521477EBC4BEE211A9ABA97F4D7E1974" xmpMM:DocumentID="xmp.did:A68027B2639C11E3B419F96B26ADCADB" xmpMM:InstanceID="xmp.iid:A68027B1639C11E3B419F96B26ADCADB" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:77A545A49A63E311BE81F90E8C1E3C0E" stRef:documentID="xmp.did:521477EBC4BEE211A9ABA97F4D7E1974"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................*.D........................................................................................!...1Q"4A2.56.a3c7..b.#C$TEe.BS..%..G.8.....................!.1A...Qaq......"2B....3.Rr..CD............?.NKu...E........T...m.5..9....d).z~.Z.Zo.L.0.-..)..r".....o(!F.R*..F.f....w%G..4......v..f..2...)........j.,....HQ)m .....J<.k2j......f.k.6.*..s>..[......Sn.6..T.o.f....[TO.W!$..e.........(A.'o0.j ..

<<< skipped >>>

GET /upload_pic/2015/3/12/4399_17485812405.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imga1.4399.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 12 Mar 2015 17:06:50 GMT

Cache-Control: max-age=31536000

Content-Length: 3665

Content-Type: image/jpeg

Last-Modified: Thu, 12 Mar 2015 09:48:58 GMT

Accept-Ranges: bytes

ETag: "0e1bac2a95cd01:388"

Server: Microsoft-IIS/6.0

Age: 1

X-Via: 1.1 zjjhdx40:8106 (Cdn Cache Server V2.0), 1.1 kf49:5 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......<.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5D0F06563000E411852EB53B0A44B31E" xmpMM:DocumentID="xmp.did:04DB1C99C89A11E488D2C85CA5C73E70" xmpMM:InstanceID="xmp.iid:04DB1C98C89A11E488D2C85CA5C73E70" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4CF0251A4B33E411981CFDB0683AC9B4" stRef:documentID="xmp.did:5D0F06563000E411852EB53B0A44B31E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................*.D......................................................................................!..12.A"3..Qa4..B#6..Rbrc$5q..S.DduF......................!1...AQaq"......2..BRr..3..#C.4.............?...h.........sF4.r....jM.Z.w....i\.H=..WM....{...U...@y....F.C..5..`...1E.B.-*%Q......N.......w[}...E..i....Fxa8."! ."h.........6......)J...`......m..o.X.qG......."J... ..:...\.EMT.;0.Zy...R.n...Ra......eI

<<< skipped >>>

GET /control/A4399dv_base.swf?20150324 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.comment.4399pk.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 03 Apr 2015 10:35:24 GMT

Server: nginx/1.0.4

Content-Type: application/x-shockwave-flash

Last-Modified: Mon, 23 Mar 2015 03:02:36 GMT

ETag: "53822c1-e0b6-511ebe5ec2b00"

Accept-Ranges: bytes

Content-Length: 57526

X-Via: 1.1 ami5:7 (Cdn Cache Server V2.0)

Connection: keep-alive

CWS.C...x....`...6.Y.4Z.Wl.........&..!....[\.rC. Kk[A.|.....}oz'...{..wr.{...........@...<...L;s...zM..&/o.@^...W_4)//.?%O..............X...k...Tj...z...U..V%.....-ZT]..z..y.1....Bk...i3w....F8..HE.q..C......3.\#.t......2...cz..O.....#.H..'....v.......eW.f.....Z......BF.N....&.M.....D..k..k|....."..B.#.Bw..f.RW......Dd0..z..H........E.>=..`|U<.Z....8...J%rcX~....{.C.......v..C)}..P.7..\......d..N.#Z..A...W_...S^..q....l.a..:..{.......&.....P4.w.....<..z..~}~^a^U..,.O$/x.........|..-.m..Y.w.....,...t..m...if....._.l[X.u...;..{.vv.k...|...\.......\}.Z....|....o.3...?{X.....d??v.....<.....=.|....Z......,...s.RO:...].^q....\.....~u.k..o.cc.=.~..y.....8..w?/8...ot...3O........>:. ..7.r.r.q.?...yw].}.....|........=...y.q.K..q...3_.....7\....qO.~~....^=..;.G.~.'......../...y..?|.8....*x....v]~.oo......._.....G...!....y1..w...{...M......~x..............b.C.]t~.i..<]...g.p.~.S..<x..W8N<.....l.wc..w.p..........7~Sp.a..s...y_.......7...'.;/~.%..K.|#....8.w~.....Y......|..p....l...Y"._.o..S....GL.*}...=@....&GG*.......=V....1R....L...K........Tq...LFS..d2...=.......H...."Qc .....gk.~z8.h......_/..CQ}.._..G.4=\..~]..w..Q....0.v..v0........O&C.va.......9dA...*..i.j$S.).KC.^..^..H..t...bV.........#R.)....I._>=x. ...U.....AL.......-.........hL....D..h..k....64.Yg...a#..{....D<..I..F...P:..v=.....=...p.....F*......B..Ea./.T.L.!Kre.V9F..N.1.I...i....)..]...EO*.HQ#.N..uC...f..d-{.D....p...I...ru.7......].N..hEW}T..Pr.7v.F..j.xx... =....h.Ic...=.....X*:.J..u.@3{)4............t-.."..n.C]...u.>..

<<< skipped >>>

GET /flash_ctrl_version.xml?ran=33756.68819062412 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat.api.4399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.1

Date: Fri, 03 Apr 2015 10:35:22 GMT

Content-Type: text/xml

Content-Length: 530

Last-Modified: Tue, 24 Mar 2015 07:00:08 GMT

Connection: close

ETag: "55110b78-212"

Accept-Ranges: bytes

<?xml version="1.0" encoding="utf-8"?>.<resInfos>..<info resName="zwsf">hXXp://cdn.comment.4399pk.com/control/zwsf2-3.gif?20120719</info>..<info resName="ctrl">hXXp://cdn.comment.4399pk.com/control/ctrl_mo_v4.swf?20140327</info>..<info resName="ads">hXXp://cdn.comment.4399pk.com/control/A4399dv_base.swf?20150324</info>..<info resName="ctrl_v5">hXXp://cdn.comment.4399pk.com/control/ctrl_mo_v5.swf?20140327</info>..<info resName="tools_as3">hXXp://cdn.comment.4399pk.com/control/open4399tools_AS3.swf?20130617</info>.</resInfos>...

GET /control/ctrl_mo_v5.swf?20140327 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.comment.4399pk.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 03 Apr 2015 10:36:05 GMT

Server: Apache/2.2.22 (Unix)

Last-Modified: Thu, 29 Jan 2015 06:39:28 GMT

ETag: "4c0343-64b40-50dc4bfe8a800"

Accept-Ranges: bytes

Content-Length: 412480

Content-Type: application/x-shockwave-flash

X-Via: 1.1 ami2:0 (Cdn Cache Server V2.0)

Connection: keep-alive

CWS.Jh..x...uX.[...,...PP..(H7..Jw#.hX..S...0@P....ABJ..T.ER......Qw....s.?.u..{.5..c.c.1k?..."......D.....A..J...A...vb:.JH?W.7/1.M....q..........F{............s.../.7......3.........tt.8.....V.ho.$..O.~....u....E[..m..<~V.<|..<X;@IL..e.A{....R.X-......R..m......\...B.<...C{...'...... .%..../&.'.... ".....?4.4UGa.l.0V...q..q...............t.6G.:...W...DJ.......TW..=....K........^z..(.................%7/.........p;:..]P...........(..''.$,'...pA._H^............vE.a~Z...X.C._.4=...AN..UE.!a!.AAQ!.YE....J"r.....@......?... ....e...v.G.......)I._]..&.........W..../k..;..../k...n.W......~..Ni[..2.....^vlmxP.(.7/..|.*ak#f..t..HY...8.Xa...qy9.m.}.|P\v..C..w.....s..BB.8...u4.`QD@.6(7......8`...7.Ad.......(I......8 ....<....SJ..e.CbJ....]' @..H.|.&... \.?......RL/...7y...`^.qM)....nT.5.....~Z..{.PKe.R...BX.b....... %W......|..;...!0.tbZ.,....Lm.....R.....R{...!.qu....5.hW...X..?Z_z...V.r...0..1.K.g.%/...L...............PQ116.I....?..L...Y\....4jq......-4.}.L...!.......4}}.....qw.....h..9..8....LNN....h....1...}i...OIY.....(Occ.....FFFZ.[`m\6.|..YLTd......N...vt_ooTl,.......QqppX{{.KNMME4}=..]2..R...A.s.......{g.....}......`\]...x.....^...vw/.~.lz..M.`m........q..t...._y.....o... ..a.)........}..g4oP.....y...._..0<#...KQW...^.7'..G.W....o....OBB...`c.3c4...C.."..,..&.OJ........=..... %.\.E..h.l. ..............PT|..}..t.n..b....w...O.....A.%..ll2f...........'.$d.}.....z.;3......s^....I.}a..D..........o..66.0;.Yut.E^(..*..6Tz?.....P.l5..t._.:Bjhogw...A.]mq........../..v../..o..:...^...u.4sJ...$..B\.k...)c

<<< skipped >>>

GET /pagead/scache/googlevideoadslibraryas3.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.swf/[[DYNAMIC]]/2

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: application/x-shockwave-flash

ETag: 11807225191275159026

Date: Fri, 03 Apr 2015 10:21:55 GMT

Expires: Fri, 03 Apr 2015 13:21:55 GMT

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 5262

X-XSS-Protection: 1; mode=block

Age: 812

Cache-Control: public, max-age=10800

Alternate-Protocol: 80:quic,p=0.5

CWS..%..x..Zi|....5G.....$@.H .....B0.B .....=R.......9.J.@....q..I....s...........lv7..7...z.......Q.....z....{.}.9..X.........1v..e`.;..t...<...D..FG..l6...z......-..Lk..C.Z.:Z;:.....Kd.K..LCS...O....T6.Lx.X.&s.#MM......T..3T.C.ZL.k.l.......C].d:.f{.T*...\]......]...j......[..|N6..i=.p2.y.b.%O...<.@..../...b.*...J.[S.d8."."....r.W...c....{r....Es.e......M.FX<......:........a...z.P.s......nZ....k.].P.zX_..........<..S..".m........9=.L...i5...E.i5=7..t.%.Z:..4......Q~.HZ.k....0..H......t41#...A-..MF.EFhZ.Y.Og?...r..7R....\.`.r.>-....dLS..9-...2..h\K.......-....LK..........L*...#............rnUJ.e..$..Y..Pcei.U9-...3c*m=S.MD....-.'..WF..i....K.a--........M.....t"J..9...%......W.`kK.%......d...-..X.z....Y..O:.[Z.h.....6-q..&.;.7.~-..ei.......0.ji,.Rc. ....M.'.l..jIqZ.%..A-..X.1..N'.'.D8F~....].>D.:.....3.e..K..K.AqkK.....&o7b..._"........9U.L..,9.....T7...2..V.......JU....?....v..7..C<.s.2........g#..m..v<..K'gh..jR.,.Uc....P......%.M................ke..X...R....\.....,.od.......JP...y.ApY> 2$...(r}..Q.7......f..U..CU.......?...J".\X... ...8N.d....B.3c.6 ..l......V...W.u.4...h...Rl6..u.PM.o.F2.c...5[4.....M-=.. ,=.N....l..*......zK{..`.L=.U..W.<q.........X2F..f."W........WU. ....~R!Mx.k..]w."#P._..)F.p.|.[qk%...Z)=.BZ.7.O.....M:....._-..'..(.Q......Bz...B.r.a.D..1I...X4.3.A.rk.y....5....r&.b...J.!..L9O.U.q...aS=w?m.|P.....}}..}..oht[../j..P.......?.*V.....}.s.g....~.t.<:..;1$.N.......M....Bu.H......Eg.Y...........f...?n...'.'.F...F'......!.........~........K$..x..j.'...1z.....{R..

<<< skipped >>>

GET /pagead/scache/googlevideoadslibrarylocalconnection.swf?googleConnection=_google_video_ads5383778685454967769 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://pagead2.googlesyndication.com/pagead/scache/googlevideoadslibraryas3.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: application/x-shockwave-flash

ETag: 6929205652577795390

Date: Fri, 03 Apr 2015 10:35:28 GMT

Expires: Fri, 03 Apr 2015 13:35:28 GMT

Cache-Control: public, max-age=10800

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 159574

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.5

CWS.....x....X...8.....)...b..E..U..<@........wG..1j.EM.jlQco...-...=&..Xc.....iw.........M............Y...-...X{;...&O.ohDY...D.....a..}..#.-Bu...Yl.'L,...P.w..P...WZZ.[..W..................//4..:..[z.[xzb..*.B..2@..,...UT..`@J._g..~....<G[l...0 .."..6hT.Y......gz.\... .Q).*.g.F^....1.P.~&u...QM....,....>..-(..5.n.W.x....~......R...0.ac..y0G.......jA..K.M.D.....65}@.o.M m~...n.......o...S...dM.i..Pu........<......C....jG...9.....t...I7...S?..5r...................t..y....c....B....b.._:..:t....,.$..=}:.K......6k.,.O....}.=Y...:>.....W.....%%%..>}:-(8x...k.].v....~z..c.._.?.>....W.^..3.p.W_}..G..}C.........c.F.&zQZ....?^o..b...#w.z..............>...S...'..*....>;..)lz.V....?...6...w.l&.x.l... ....r..y.w...II..4........3%oo..I...k./...E....].............x|K...7k..|}[...q.x....Zvx.{........6..-G.I~3Ff.<v~...._R...v....m.........'....h..M..........n......~.?........O..?sGh.t....._&...l...q.T...}....'.#F..|YU..R..W..T........9........;{....o4..t...W.^.:w... WN..........[.........F...k...f.C.?.^2.........=...........?...KXXXF......w......fGO.)._.......#.u.z0..........bD.YO..M..w..&......587`.4.....^.~...s.p[.>..?.?.n-....e...s...x..._.)e 3...V~......5k:..#... ....V.O8)D .l....(!.....?.&{7..uw<l....b6fp.L43..t2....e.d*4.....ma.N^..V.j..S. .SgG........D... :....]..V{..~...G.wI.:.ZE....$tMbRS....k..I...V...8.P.H;....CL#.M"..M#....L"xgM#&.F..D.....#A]..F...`..Ym&A.....{..6k.C6....k.......TUmf..D0...I...b..}M.W.qfs...[...4d.. ...(3.l.g.............e[..,.(.H...,...W;.`2D..I..... A..I6...

<<< skipped >>>

GET /pagead/yt_blacklist_domains.txt HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://pagead2.googlesyndication.com/pagead/scache/googlevideoadslibrarylocalconnection.swf?googleConnection=_google_video_ads53837786854549

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/plain; charset=UTF-8

ETag: 11558414291007081692

Date: Thu, 02 Apr 2015 19:38:42 GMT

Expires: Fri, 03 Apr 2015 19:38:42 GMT

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: cafe

Content-Length: 254

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=86400

Age: 53808

Alternate-Protocol: 80:quic,p=0.5

..........M.Mn. ...=K..tS..1..7..C.w.&8..j......}GC. ....}&j.Ph.pF. .7.";..Fp.......0...1...%...N8..Z.:.A. ...h`.....yd$.l..4.....tZRe...aN6.B..-.......5..=..-.$....s.{f$...l......_......n..%....o..........#...9..Tw.0..\`.u..'cKD.P~..Q...8...............HTTP/1.1 200 OK..P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"..Content-Type: text/plain; charset=UTF-8..ETag: 11558414291007081692..Date: Thu, 02 Apr 2015 19:38:42 GMT..Expires: Fri, 03 Apr 2015 19:38:42 GMT..X-Content-Type-Options: nosniff..Content-Encoding: gzip..Server: cafe..Content-Length: 254..X-XSS-Protection: 1; mode=block..Cache-Control: public, max-age=86400..Age: 53808..Alternate-Protocol: 80:quic,p=0.5............M.Mn. ...=K..tS..1..7..C.w.&8..j......}GC. ....}&j.Ph.pF. .7.";..Fp.......0...1...%...N8..Z.:.A. ...h`.....yd$.l..4.....tZRe...aN6.B..-.......5..=..-.$....s.{f$...l......_......n..%....o..........#...9..Tw.0..\`.u..'cKD.P~..Q...8.................

GET /uploads/userup/1309/121055423955.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 29 Aug 2015 11:15:47 GMT

Date: Mon, 02 Mar 2015 11:15:47 GMT

Server: nginx/1.4.2

Content-Type: image/gif

Content-Length: 2946

Last-Modified: Thu, 12 Sep 2013 02:55:42 GMT

ETag: "52312d2e-b82"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf48:1 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a........r..P.....O........n.M'..j.......U.l.....m.iNq:..0....f..\;j...h"....u.....~..H.f......W.....F.\sX.Y.y......{......;.6..a... ..-...z\..k..M.rV..G.sP.g.%.y.....Q..b..t..R.k...k w...L... ....X:.y#.p..k...2.P.|./..5..'..$..@B`.....A.K.-.E"........~.....f.............iIw..k..V..u.uh..V.....4..p.......I8.......nKfI-...............jYIyhV.!..d.....S...................\'@P,`............f3.!.......,............~...h#te\.\el#...............9\?...N..?mea...~..O.Kx;.;R...O;....~.OR.........K.KR..K..O...........R..........?.......'L1..........H.........@........`..z..........B..Ir$..'=.D..d..*c.T.2$L..az...........@A04{...h.....t.......X.j......`.f....._l..a..)T{N..L.K....x......_.. ....^..o.U0......#K.L.....#.@.."............O.i..Hk....>..B...q.v......Q...[.......].....S.......{.p..q...N.:a.....2*..PA.....W.r.H........?...!!..@.1E{....|......!q^...P........V.E........a..I...<....x(Hx...$...|..#..T.B.WTq..z`...H.y...z4.G.!XA...u...8....U...}T.QE.d^.G.?..G.8T.....(..>..@.Z....|. .a/....rV...xX...{(...{$.A....(.H....X....V....;v...x....|.@..h@...7....E=....8.............^....2....Q....QT.@.O%..............:y*..Z.c.f....P.....\1.....*.S..*.{P.*.X.AE.8..n........ ,....$..!.0..."Qg.[H....b{..(.|..=..C.U.qp...1.....B.}..GQ.6..............X1..n:......i. .8..8\q.......S......B..H.........>.,r.Q.........:..2....*..:...W.........}|.....`..T..&.8.L....a........h...T....dk`.....j......J(...=.mw.......7.|.|V }...P..n...............P{_9..d....j@.....n...p...X....#...|.].rT...pm......14..x>X.....hAOz....6.Ai5..

<<< skipped >>>

GET /uploads/userup/1405/101634512c8.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 29 Aug 2015 10:49:05 GMT

Date: Mon, 02 Mar 2015 10:49:05 GMT

Server: nginx/1.4.2

Content-Type: image/jpeg

Content-Length: 5179

Last-Modified: Sat, 10 May 2014 08:34:51 GMT

ETag: "536de4ab-143b"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf48:5 (Cdn Cache Server V2.0)

Connection: keep-alive

......JFIF.....H.H.....C....................................................... ...C................ ......K.d...........................................<..........................!.."1.2A.#BQaq.3....$r..RSb.....................................5........................!1A.."Qaq..2.........#B.3R.............?._q..B.......H..........H...Q.....T...<7T#<....GC.B.X..E.y.T.e.J.S...*h...,.A(Y.....Im.o-.....m.....q.YP...T.\@#...P.O....~%0X...BAV..LT?5.t...H..2.......'...^IUuX.y......]A>D|....N%..2...%.n!Xj##...>.^....p..V.G....RK.r...g.....B..t.y@ |...Q..g|.>j......B.Q.......!.ZZC.R..._....6.O.L;].B)...Z.^.C.........Ol...C%^d.*..`...c*%.~..[.:.....[.|@v......e...f4ki.S.en..~hPV....j...pg.C..cen.C..c.5e.D..m..w..@..........mg...=.'.2..^......1..D...........#....u7U.e.I..>..<..^]...l.\.....l.PYp.......8.6.t.o2.........Zz.._....y..;..A.....(.B@P. .._..b....R..\..:.`.x.m=.t....:2...rP..Q..X.8?.i..U*....4N.f4..VY.2*.4.q.`....-_e.U.G...9.......R.m......~.......A.L.q...iRe>b.<....F.Q.}0...<....|-..[.......U.6U%d..".La.......8.T.Z.R...1Qs.}...ogH=..F.{...p.$.S.T.......>.E...$.j^.....7I.~b..=.%e...ruo..[,...oOiK.. ...P=...........M.3R.......%.3.hJ<.?.M....4.D...u?.#.)er.u%qb...oeh.n......6.........d.~..D.S*..nLQ...M{6.s...T\....).l1.L.$a8.k' <..v...(...X..s....u.G[.i,....HBI..}~x....q..&fN....Uj.9o..2c.[...- .A.EB...:;{.....&3\}. ..)...A.4..Y..N...cW....WI..B..."......n....w..u.=.%.D....bS...-JQ.-....;z..v......U....H..<TG",vR.

<<< skipped >>>

GET /uploads/userup/1502/02104939B23.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sun, 02 Aug 2015 09:02:43 GMT

Date: Tue, 03 Feb 2015 09:02:43 GMT

Server: nginx/1.4.2

Content-Type: image/jpeg

Content-Length: 2985

Last-Modified: Tue, 03 Feb 2015 08:00:53 GMT

ETag: "54d08035-ba9"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf50:0 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''......>.R.."......................................................................................!.1A2Qa"R.q#3S........Bbr.T%$U.......................!..1AQaq"2....R...Bb#...S$T.............?.N.k.jP.Z..5.(...[..;}.."6${=.9..H...\..FI..l.....\,.. Q*3..sV^..k}....2...1\.N.f.<.%} Q.t...-......,[.>2\1...p.L>o.......(.%.@..ESJjvo2o%......x."....q.$.]y..A..y)......r.1*.$Y.N.T.w.p1@.....;...\^..Kx.....N......a.3{..F-.[.%v.R...L.^0...L.....#...`.'.i3.V......d.....:.2`.`c.J8.r.4[..h...k9.S....n...Z'R.....5....]P......L.....lK.9A.f....5*M<.......K3u&.gL.....).H..n..m.,........N8.%[j...M..]#s<.?.Y. ...8..]..*G.f..B.4..........O.SL_.s.q~..@.{>.M'..?!.S.Y...U"vj...X...S."......|...."...t.......m..UW..O.#..f-..b....1..q..._.O.h.l%.P.....|..h..9.N2.<...M...h@;...".w...?..e,m....$.Z....-.....L{.u......-,u.d..v.#.&.."Y.....0....0..6.$.y.p#...#i1..4..Y|V.R..............b....mOb..I.....yb.;.dn..I$I.....#)..j...."!..VP%.](&B..j:...]..l...y[...B.316c}*9w.US~W.9.\Z...{...-..!./..42.H..6....Cq.8{..5..g..I.l.D"f.,T..*.lr&..l...z.....t_1...).e....!.H......9*.....F.F...@....A....{r...........[.2..%.........$..'....q..r...X|]......E........V.7.......O.m.5..........Ex....Z..R.......B3.6...|..h........7...C..q...;<G.......NW..6....oW.}....MI.;......Z?..){#[...Y*P..O.'.jI.g...'.^...&V.....4.....zj...(..I..fF:._.ii....g.

<<< skipped >>>

GET /uploads/userup/1504/011K053B24.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Mon, 28 Sep 2015 10:16:52 GMT

Date: Wed, 01 Apr 2015 10:16:52 GMT

Server: nginx/1.4.2

Content-Type: image/jpeg

Content-Length: 44898

Last-Modified: Wed, 01 Apr 2015 09:50:53 GMT

ETag: "551bbf7d-af62"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf48:9 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......>..... hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:A83BBCD4D85411E485C2DE5CEF4E7632" xmpMM:DocumentID="xmp.did:A83BBCD5D85411E485C2DE5CEF4E7632"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A83BBCD2D85411E485C2DE5CEF4E7632" stRef:documentID="xmp.did:A83BBCD3D85411E485C2DE5CEF4E7632"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................Z..............................................................................................!1A"..Qa2.q.#..BRr..b..3.$..6V....CS.4tUe.........s.T%5u7c....d.....F.......................!1.AQ.aq.."2......BR...r..b..#3S4.......Ccs.5.$DT.............?.s..|1."4Dh....#DF...."4Dh....#DF....".Hf.#K. .nB........8..nc.BA.^G..H.B..sEE........*W.iq.. ....V..6.d....XTW.=F.k........8.yW..`...".$..I.....*.....<qM....9.F.-.4.=...P.;$$4.......dih)....{X....;Y..\<n..z

<<< skipped >>>

GET /uploads/userup/1503/061109192641.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Wed, 02 Sep 2015 09:42:07 GMT

Date: Fri, 06 Mar 2015 09:42:07 GMT

Server: nginx/1.4.2

Content-Type: image/jpeg

Content-Length: 30056

Last-Modified: Fri, 06 Mar 2015 03:09:19 GMT

ETag: "54f91a5f-7568"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf49:3 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......d......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:a25ba82b-f752-f246-a4cd-0aa3c0176952" xmpMM:DocumentID="xmp.did:9C1C95F7750E11E4999A90CBF8BD0F69" xmpMM:InstanceID="xmp.iid:9C1C95F6750E11E4999A90CBF8BD0F69" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5b63e310-9343-e14a-a1fc-e0b9f0cd2399" stRef:documentID="xmp.did:a25ba82b-f752-f246-a4cd-0aa3c0176952"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................Z....................................................................................................!1..A"2.Q34.6a#cd5.7qBRbC..8...S$9...TUefx.r.D.........................!..1A.Qa"..q.2....B3....#..R4......$5.br.CStu.8.cs....E.6v.w............?........G%.....W.YL &.c...(..1..*.j...<t.`A..W.4..0K..O.dq......C..-.pvH.....f.4...,=a....c.../RT....\.Y.LL.].V...u....[:.....(...B. Z

<<< skipped >>>

GET /uploads/userup/1302/1Q62S330N.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 29 Aug 2015 11:15:46 GMT

Date: Mon, 02 Mar 2015 11:15:46 GMT

Server: nginx/1.4.2

Content-Type: image/gif

Content-Length: 5566

Last-Modified: Mon, 18 Feb 2013 08:28:33 GMT

ETag: "5121e631-15be"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf48:5 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89aq.N....3.....................W.....CFf.....R...f.ff..e..D...X.....h.U...K.U.f3.......lbX5Y.g.g....E..ff&.....333..E..?..3V......3..........Q.Q.k$f$....v::......l[(@>..DDN{N..w.g..s..,..#........t>..I.......V.........O......q..v....s.}....$.$c.c......3f3.s.......*=...k....8.8.7.F$~....I.6/.W....J......aYp!(.......c.U#.....W*........V.t.O`...........//....xx.G......M..z.1..x.R.R.ss.e2........D.}'..........\\....X..s1B........~m. .....D ..........-....'.......AA...{;...6......x$.U......e..xx.hN.....!I=>)=#....OO3z.......U>(.wQ......%'6....f.....V..E..u%.....opa......XpCD.. ..s...:.:.O.V*(.!&.Za{s1._....]......=.....v....e....J.....o....r..f..../'..I...o.......W[....w8..G......poo.....^....zWS..j..:.....fH....t..n.n........!..w#.@.....1..m.....j....{..c..qq../W@.......!.......,....q.N........H......*\.. .2...SE%..e..4..........RK.?qT0\<0....0=Z../..n..`..#..;.b..)a....x\k5.^#jQ...f..U..F.j(CF..C.T;....)E...v..B.O.0$t...c<...w....j4....pA6.*....g.[h..\d... CNh.R.../....l..?8eN..r..*.7.h...P..)j.$D@...'2k.;...c....T......l9`.D..<bA.....?.k$..$(..H.5./N...xC.9.n.'$.. .../,....p[.......0sJz.i.T1jp../.x..}B.R... s..a..V,..SM-...Jr...../.....<Q.&.AR..0......../A4...C.w.3BX`.-.|...(.p.7j... .H.....x.......<...,...D^..r..a....B4..!....n~\3.(-.P.5....yA......(.>....G*D.......2.<..4u4..(.@.....@.3z6..G $.s...<@.5.p(fp..q.Gp...&.hF....AA-N.z.....F.)..J....G..t........$.'....2,Gj...8.H..9.8...R.....H1m-..`..~x0....q....b.*.A....HC...n...\.2I.T.p......4Rtr.......`$....,........G.d1.2...

<<< skipped >>>

GET /uploads/userup/1209/1GQ340U13.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.4399.com/flash/78072.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: newsimg.5054399.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 25 Apr 2015 07:55:48 GMT

Date: Mon, 27 Oct 2014 07:55:48 GMT

Server: nginx/1.4.2

Content-Type: image/gif

Content-Length: 527

Last-Modified: Mon, 17 Sep 2012 10:13:40 GMT

ETag: "5056f7d4-20f"

Cache-Control: max-age=15552000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf49:10 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89aV...................................................................................%..................!.......,....V.......aHdi.h..l...ALtm.x..|....pH,....r.DV...tJ.Z..lU..z../8C...aA..n..f.:..s..<....3~y..zt{.{.............d...t...|.........................f.e.d..|.........e...........f........e.......d..f...t.........|.......q... ....|...{..a....@|(..D......."...3.t...I.|P...s.@../[..Is.M.3q&ki....@.....hQ.H..].....O..........\.s. 0.]3T.*v,..].V......p...K..]...............7..... ^......#/NP.A...3k.......CgFP ..;HTTP/1.1 200 OK..Expires: Sat, 25 Apr 2015 07:55:48 GMT..Date: Mon, 27 Oct 2014 07:55:48 GMT..Server: nginx/1.4.2..Content-Type: image/gif..Content-Length: 527..Last-Modified: Mon, 17 Sep 2012 10:13:40 GMT..ETag: "5056f7d4-20f"..Cache-Control: max-age=15552000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 kf49:10 (Cdn Cache Server V2.0)..Connection: keep-alive..GIF89aV...................................................................................%..................!.......,....V.......aHdi.h..l...ALtm.x..|....pH,....r.DV...tJ.Z..lU..z../8C...aA..n..f.:..s..<....3~y..zt{.{.............d...t...|.........................f.e.d..|.........e...........f........e.......d..f...t.........|.......q... ....|...{..a....@|(..D......."...3.t...I.|P...s.@../[..Is.M.3q&ki....@.....hQ.H..].....O..........\.s. 0.]3T.*v,..].V......p...K..]...............7..... ^......#/NP.A...3k.......CgFP ..;..

<<< skipped >>>

GET /resource/css/base.css HTTP/1.1

Accept: */*

Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/qmv16.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin.3304399.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Fri, 03 Apr 2015 11:17:52 GMT

Date: Fri, 03 Apr 2015 10:17:52 GMT

Server: nginx/1.4.1

Content-Type: text/css

Content-Length: 29379

Last-Modified: Wed, 02 Apr 2014 07:29:04 GMT

ETag: "533bbc40-72c3"

Cache-Control: max-age=3600

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 kf50:2 (Cdn Cache Server V2.0)

Connection: keep-alive

@charset "utf-8";../* CSS Document ..Use for:...Version:.1.0..Date:..2011/08/10..Author:..f2er..Update: 2012/05/03..*/...login_embed_iframe{border:none; width:100%;}...login_embed_iframe_hor{border:none; width:100%; height:100%}...login_horizon{height:31px; line-height:31px; /*padding:9px 0;height:12px;*/}...login_vertical{width:600px;} /*modify by qf 05-03*/../*............*/...mt5{ margin-top:5px;}...mt10{ margin-top:10px;}...mt20{ margin-top:20px;}...w256{ width:256px;}..#popup_login_div{ width:400px; margin:0 auto; padding: 16px 0; }..#popup_reg_div{ padding: 0 0 16px 0; }../*............*/...login_horizon legend,.login_vertical legend,.login_module legend{ display:none}../*login_horizon*/...iptw1{ width:73px;}...iptw2{ width:154px}...wtc{ width:352px;}...wframe{ /*width:620px;*/ width:530px;}...wframepwd{width:280px;}...login_horizon a,.login_vertical a{ color:#1278c0;vertical-align:middle;}../*......chrome..@media screen and (-webkit-min-device-pixel-ratio:0){.. .login_horizon a,.login_vertical a{...vertical-align:top;.. } ..}*/...login_horizon a:hover,.login_vertical a:hover{color:#ff5712}../*login_horizon*/...login_horizon .login_hor,.login_horizon .login_btn{ float:left; margin-right:10px; display:inline;}...login_horizon label{ color:#333}...login_horizon .login_ipt,.login_vertical .login_ipt{ border:1px solid #ccc;/* width:144px;*/ padding:2px 3px; background:url(../images/spriteV2.png?v=131127) repeat-x 0 -31px; height:22px; line-height:22px;}...login_horizon .ptlogin_btn,.login_vertical .ptlo

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1092:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

t$(SSh

t$(SSh

~%UVW

~%UVW

u.hX_v

u.hX_v

u$SShe

u$SShe

SkinH_EL.dll

SkinH_EL.dll

{A068799B-7551-46b9-8CA8-EEF8357AFEA4}

{A068799B-7551-46b9-8CA8-EEF8357AFEA4}

{A0005538-9391-4dd9-B4D6-8EB7B9360F08}

{A0005538-9391-4dd9-B4D6-8EB7B9360F08}

72 00 65 00 73 00 73 00 31 00

72 00 65 00 73 00 73 00 31 00

72 00 65 00 73 00 73 00 33 00

72 00 65 00 73 00 73 00 33 00

\Cheat.Engine.6.2\cheatengine-i386

\Cheat.Engine.6.2\cheatengine-i386

\SkinH_EL.dll

\SkinH_EL.dll

C$%cmb

C$%cmb

.ppM|

.ppM|

aZ.mO

aZ.mO