MD5: 04ad700e3a44ca7c59d6eafb5205c847
SHA1: e1f81811143aa923642da0492e84bef9f3216deb
SHA256: 143079948f96f881a9958e05903b762a31ee8d4249ccecb5b61265f750f7f8a8
SSDeep: 98304:2Nh2e0nFrgsV87TcmWYcmW4PxDsGNIHcmWDcmWZ:rnn9GTDNDl2bHD DC
Size: 4911104 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2015-07-15 08:18:22
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:632

The Trojan injects its code into the following process(es):

lore.exe:484
adlll.exe:224

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process lore.exe:484 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\d7wtWVZErbEAAAAAAAAuj2mMZr0392[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tanx[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\NjM0YWQxNGQtOWIzNy00Yjg1LWI4MjMtZGNmOWJlZTM4ZDU1[1].jpg (7254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA09UJ49.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1501809610_1465004462[1].jpg (4548 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\headfoot.mix[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\j[1].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[14].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\72578111[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAMJWHAJ.gif (35 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\www.yy[1].xml (2170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1391682584[1].htm (39336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1391682584[1].htm (21156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\defaultScene[1].swf (7730 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CANF59GE.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[13].gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\MGFhN2YyZTEtZWM1YS00MWJiLWFkZjAtNWYyYTExZDQzNTg0[1].jpg (6172 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (942 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAIYBNDS.gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tanx[2].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tz0M9Vahn78AAAAAAABHwm5wG-M269[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\studio[1].css (34225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\yy[1].htm (2241 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\hm[3].js (363 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[12].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\user[3].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[20].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAYV81I1.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\j[3].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[9].gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\core[1].htm (52522 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\w-head-sprite[1].png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yy[1] (720 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\duowan[1].js (1681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\hm[2].js (1370 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\login-close[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\udb.sdk.getmm.min[1].js (1 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (184 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (547 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\user[6].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CASXWV8F.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\icons-index[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAMNW3JS.gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (29204 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\72578111[2].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ZTE4NDIzY2MtZDA5OS00YjQzLWI2NGUtMzBmODc3M2ZmMzQz[1].jpg (20881 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yy[1].txt (3048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAAZ05I3.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1391682584[2].htm (7791 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\c2.web.yystatic.com\r\rc\yycomscene\main\1\11\main.swf\main_guest_sobj.sxx (484 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\liveCard[2].swf (5559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\main[2].swf (608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hm[3].js (1243 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hm[2].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\udb.sdk.pcweb.embed.min[1].js (1228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\StatisticsAction[2].json (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\detail[1] (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\j[7].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\require[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\w-liveplayer-sprite[1].png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\72578111[4].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\72578111[3].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\icons-leftMenu2[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\72578111[2].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CATRZ9O8.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\d7wtWVZMVGYAAAAAAAAsUBB5Ylo338[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[2].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\w-liveplayerToolBar-sprite[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\72578111[1] (1846 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAQPZDGK.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\2wm[1].png (392 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\alpha-bg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\loading-white-mini[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\72578111[1] (791 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\OWJjZjY1NjYtY2U4OS00NzkwLTg4M2MtM2QxNjY2ODkyMWQx[1].jpg (7658 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[9].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[12].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[2].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[21].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\headfoot.mix[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\72578111[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\StatisticsAction[3].json (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yy[1].htm (1573 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\72578111[5].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\j[11].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAZA9C1X.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[15].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\user[7].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\default_load[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tz0M9VahqFgAAAAAAAAk6C0I27c747[1].jpg (1870 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[11].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[5].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\yy[1] (376 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\c[1].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\YzY1ODZlNDQtN2M1Ni00MmFlLWI0NGMtNmQ2ZjhhNjIwYjM5[1].jpg (4491 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\studio[1].js (66337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[1].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA096DCX.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[10].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAN6QHRF.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[6].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[3].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\headfoot.mix[2].js (1216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\StatisticsAction[1].json (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[3].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\user[8].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\user[3].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\liveBaseSceneConfig[2].xml (918 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\udb.sdk.pcweb.embed.min[2].js (136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\136724[1] (1968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[7].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\user[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (374 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\controlBar[1].swf (5162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CANLHVD7.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\crossdomain[1].htm (260 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\72578111[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\default_portrait[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\j[15].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAMZIFY1.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\user[5].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hiido_internal[1].js (6553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[7].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[12].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\72578111[3].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1391682584[1].htm (32000 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\MGU2NTExZWItYTI1Mi00N2VmLTg5NDgtOWUwY2UxNGUzMjQ2[1].jpg (8964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\detail[2] (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAA7WBV4.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\yy[1] (720 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\xelogin.sdk[1].css (667 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\w-liveplayer-sprite-p24[1].png (932 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\YjRkNjY5ODUtMWEyYy00MTQxLThlYjAtZjRhMzYzMjAwNTEw[1].jpg (7224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hm[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAG3BNEC.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\d7wtWVcpnn4AAAAAAAAsxTKw0FU569[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAXXR7JF.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\headfoot.mix[2].css (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hm[2].js (363 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.yy[1].xml (1240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAUV45EB.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[10].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\72578111[1] (3977 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\liveplayerInline[1].js (145 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yystatic[2].txt (365 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\NDQ1NzI4OTctZjBkMi00NzRkLTk4OGItYWRkN2NjZWU4ZjY4[1].jpg (4364 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[15].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[9].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\icons-menuclose[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hm[2].js (726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\main[3].swf (16377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\w-liveplayer-sprite[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\gradeIco[1].swf (290 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[8].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\user[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1391682584[1].htm (17911 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yy[2].txt (758 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c[1].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tz0M9VbtNkMAAAAAAAA9VFYDCvU355[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[14].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tanx[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (2045 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tanx[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[2].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\user[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\72578111[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\require[1].js (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\keywords[1] (34039 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\detail[1] (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\udb.sdk.getmm.min[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hm[1].js (784 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[16].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\72578111[1] (2379 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAJECRZD.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\user[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ShowBackground[1].swf (1634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\72578111[4].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\detail[1] (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[6].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\crossdomain[2].xml (260 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\StatisticsAction[1].json (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\user[6].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\danmaku[2].swf (4845 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\136724[1].htm (1002 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[19].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\hm[1].js (2852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\NTk0MmFiOTYtMDEzOS00M2RmLTk2NzQtYWQ5NjhhZGU3MzQw[1].jpg (5753 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hm[1].js (363 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yystatic[1].txt (189 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\login_btn[1].png (392 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.yy[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[7].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hm[2].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\udb.sdk.pcweb.embed.min[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\detail[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1391682584[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\core[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\require[1].js (0 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\www.yy[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1391682584[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hm[3].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\yy[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\w-liveplayer-sprite[1].png (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\136724[1] (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yystatic[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\72578111[1] (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tanx[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yy[1] (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\c2.web.yystatic.com\r\rc\yycomscene\main\1\11\main.swf\main_guest_sobj.sol (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\crossdomain[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tanx[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1391682584[2].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\StatisticsAction[2].json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\keywords[1] (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\headfoot.mix[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\loading-white-mini[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\w-liveplayer-sprite[2].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1391682584[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\StatisticsAction[1].json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\hm[2].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\hm[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\studio[1].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1391682584[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\StatisticsAction[3].json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\StatisticsAction[1].json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\headfoot.mix[2].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yy[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hm[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hm[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\yy[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yy[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\udb.sdk.getmm.min[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\72578111[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\detail[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\StatisticsAction[1].json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\alpha-bg[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hm[2].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\duowan[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[15].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\72578111[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\headfoot.mix[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\yy[1] (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yy[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\72578111[1] (0 bytes)

The process adlll.exe:224 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[1].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAZ9H3MQ.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[4].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\liveCard[1].swf (6435 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[10].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[18].gif (35 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\www.yy[1].xml (1196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\MTMyYjhhMzYtODhjNS00MmJhLTk1M2ItNzBkY2YzYzVhMGMy[1].jpg (10986 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\StatisticsAction[1].json (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAG5EPK1.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[11].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAS1ALZW.gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (374 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\default_portrait[2].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\86415000[1] (2639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\j[6].gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (1413 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\N2FjOGQ3MGItODQxYS00ODA5LThkOGQtMWZmNWE2MWI1NzM5[1].jpg (2600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\crossdomain[1].xml (199 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\86415000[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\j[4].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\86415000[4].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\d7wtWVI1Ol0AAAAAAAA5sxARP9E766[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[5].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hm[1].js (2399 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\w-liveplayer-sprite[2].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\j[14].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAYJKPYF.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1371549646[2].htm (10365 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CATFNP7P.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\danmaku[1].swf (4770 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tz0M9VcuazEAAAAAAAAvAhGaUQY835[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\yy[1].htm (1681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\hm[1].js (755 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\j[2].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CADR717H.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\main[1].swf (4121 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAILCVYX.gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\user[4].gif (43 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (547 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\user[2].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (23036 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (357 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tz0M9VZdRP8AAAAAAABOGkURMpY256[1].jpg (3384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\udb.sdk.pcweb.embed.min[2].js (136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yy[1].txt (522 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\d7wtWVcggoIAAAAAAABEjk6S4z4003[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\c2.web.yystatic.com\r\rc\yycomscene\main\1\11\main.swf\main_guest_sobj.sxx (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\86415000[2].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\j[9].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hm[2].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[5].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAWDQ7S5.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1371549646[2].htm (7095 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.yy[1].xml (2436 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1371549646[1].htm (40733 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\w-liveplayer-sprite-p24[1].png (932 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\liveBaseSceneConfig[1].xml (918 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yystatic[1].txt (365 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\86415000[2].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\user[3].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[14].gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\86415000[2].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[17].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\crossdomain[1].htm (260 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\user[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\user[4].gif (43 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\c2.web.yystatic.com\pcInfo.sxx (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tz0M9VcXMfcAAAAAAABR2ACo4I4351[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[3].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\main[1].swf (14457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\defaultScene[1].swf (6016 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\210075[1].htm (816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAN6QHRF.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\w-liveplayer-sprite[2].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\NmRhYmZjOTAtYWFiOC00ZDAyLWFhOTUtMmIwNDI3OTk0YTgz[1].jpg (10690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yy[1].htm (292 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAY38DQF.gif (35 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#c2.web.yystatic.com\settings.sxx (220 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1264046092_1465050091.600552[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\login-close[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\playui[1].swf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\j[8].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\duowan[1].js (1681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[16].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\yy[1] (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[4].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\j[10].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[7].gif (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\udb.sdk.getmm.min[2].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\86415000[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\core[1].htm (43686 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tz0M9VdPA9EAAAAAAAA61AG8C_o574[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\keywords[1] (6303 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CASDU7O9.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\crossdomain[1].xml (263 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\StatisticsAction[1].json (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[13].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\tz0M9VcY1jwAAAAAAABER38yZBk347[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hm[3].js (363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\user[4].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\headfoot.mix[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\86415000[3].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\j[13].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\icons-index[2].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\w-liveplayer-errbg[1].jpg (3629 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hm[3].js (363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\StatisticsAction[1].json (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\user[5].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\w-liveplayerToolBar-sprite[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\86415000[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\user[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAW16FG9.gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yystatic[2].txt (365 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[4].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ZGI4OGIzN2ItYjAzZS00NGFkLWEyNTQtZjQ1YjFhMDg4YzY4[1].jpg (6127 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\loading-white-mini[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAGH2L1A.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\YzczODkwMjMtNmJmZi00ZjBiLTk0NDYtNTcyNGVlOWYxODQ4[1].jpg (4902 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[11].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tanx[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c[2].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[1].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CABF5L8E.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\user[2].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\detail[1] (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hm[2].js (726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\require[1].js (1405 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\studio[1].css (29631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\86415000[1] (1590 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\user[9].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\MTQxYmJhMjMtODRkMi00MDU2LWI4ODktYzk3MDFkNGJhNWIx[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAVQ0FB1.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[8].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAM7W161.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\j[5].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\w-liveplayer-sprite[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA3RHP4Q.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1371549646[1].htm (20099 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\NjBhMWM0YjktYTY0ZC00MDI4LThkZGUtM2RjNzI1NGU1MGQ3[1].jpg (1928 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yy[2].txt (3033 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tz0M9VcDglUAAAAAAAA0AFVcLuE178[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\icons-leftMenu2[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\udb.sdk.pcweb.embed.min[1].js (1228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\detail[2] (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\user[3].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\default_load[2].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1371549646[1].htm (19609 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\udb.sdk.getmm.min[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1371549646[1].htm (23407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-1.11.1.min[1].js (46001 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\j[8].gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tanx[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\StatisticsAction[2].json (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\yy[2] (360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CALR91OA.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\86415000[5].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hm[1].js (2323 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\StatisticsAction[1].json (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\210075[1] (2522 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[6].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\86415000[1] (1573 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\j[12].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\headfoot.mix[2].css (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAO1YN8B.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\j[13].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hiido_internal[1].js (6553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hm[1].js (3209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\86415000[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAC1AV45.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\alpha-bg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\86415000[1] (2401 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hm[4].js (363 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA0TQROP.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\require[2].js (123 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[15].gif (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAHYJJ56.gif (35 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hm[2].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\liveCard[2].swf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\w-liveplayer-sprite[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\udb.sdk.getmm.min[2].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hm[3].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yy[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1371549646[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\StatisticsAction[1].json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\require[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1371549646[1].htm (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\w-liveplayer-sprite[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\StatisticsAction[1].json (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1371549646[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\yy[2] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\headfoot.mix[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\icons-leftMenu2[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\liveBaseSceneConfig[2].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\udb.sdk.pcweb.embed.min[2].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hm[4].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yystatic[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\w-liveplayerToolBar-sprite[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\86415000[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\danmaku[2].swf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\keywords[1] (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\c2.web.yystatic.com\r\rc\yycomscene\main\1\11\main.swf\main_guest_sobj.sol (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\w-liveplayer-sprite[2].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\default_portrait[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1371549646[2].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\StatisticsAction[2].json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hm[2].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\yy[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\udb.sdk.pcweb.embed.min[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hiido_internal[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\require[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1371549646[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\defaultScene[1].swf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\210075[1] (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hm[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\hm[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\86415000[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\StatisticsAction[3].json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\StatisticsAction[1].json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\w-liveplayer-sprite-p24[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yy[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hm[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\hm[2].js (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#c2.web.yystatic.com\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\login-close[1].png (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\yy[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\detail[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\default_load[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\icons-index[1].png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hm[2].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\86415000[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416 (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.yy[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1371549646[2].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\86415000[1] (0 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\www.yy[1].xml (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yystatic[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hm[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yy[1].txt (0 bytes)

The process %original file name%.exe:632 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\adlll.exe (12289 bytes)
%System%\lore.exe (12289 bytes)

Registry activity

The process lore.exe:484 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "lore.exe"

[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "C:\Windows\System32\oleacc.dll"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1434625514"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A DE BA 00 90 95 0F F7 A8 FC 26 C6 B8 02 90 56"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Play_Background_Sounds" = "no"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"lore.exe" = "C:\Windows\System32\lore.exe"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process adlll.exe:224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current]
"(Default)" = "%SystemRoot%\media\Windows XP Start.wav1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016060420160605]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016060420160605\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016060420160605]
"CachePrefix" = ":2016060420160605:"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "adlll.exe"

[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "C:\Windows\System32\oleacc.dll"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1436931101"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 9A B3 2B D1 D1 C4 79 ED 62 C9 F7 CD 98 DC 6B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016060420160605]
"CacheOptions" = "11"
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016060420160605]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Play_Background_Sounds" = "no"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"adlll.exe" = "C:\Windows\System32\adlll.exe"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041520140416]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:632 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F A2 42 84 4B 6E 1C 6A 5E 9B DB E1 46 77 9C F5"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: ?????????????????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: Chinese (Simplified, PRC)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://www.yy.com/210075	221.228.79.225
hxxp://c1.web.yy.com/r/rc/main/main/1/46/main.swf?type=yyscene&topSid=85593777&subSid=85593777	171.91.157.135
hxxp://www.yy.com/136724	221.228.79.225
hxxp://c1.web.yy.com/r/rc/main/main/1/46/main.swf?type=yyscene&topSid=45937111&subid=45937111	171.91.157.135
hxxp://duowan.xdwscache.ourglb0.com/pc/js/lib/jQuery/jquery-1.11.1.min.js
hxxp://duowan.xdwscache.ourglb0.com/pc/css/studio.css?20160603212726
hxxp://duowan.xdwscache.ourglb0.com/pc/css/headfoot.mix.css?20160603212726
hxxp://www.yy.com/crossdomain.xml	221.228.79.225
hxxp://duowan.xdwscache.ourglb0.com/duowan.js
hxxp://ylog.hiido.com/j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062548411&wd=0&passport=&sns=null&pcmb=1&pl=http://www.yy.com/136724&v=T20160526.01&rnd=0.207941949396607371465062548411	14.17.112.237
hxxp://duowan.xdwscache.ourglb0.com/hiido_internal.js?siteid=www@yy
hxxp://ylog.hiido.com/j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062548583&wd=0&passport=&sns=null&pcmb=1&pl=http://www.yy.com/136724&v=T20160526.01&rnd=0.207941949396607371465062548583	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062548286&wd=0&passport=&sns=null&pcmb=1&pl=http://www.yy.com/210075&v=T20160526.01&rnd=0.207941949396607371465062548286	14.17.112.237
hxxp://res.udb.duowan.com/lgn/js/oauth/udbsdk/pcweb/udb.sdk.pcweb.embed.min.js	222.73.61.81
hxxp://cm.hiido.cn/cm/user?time=1465062548&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	113.107.236.195
hxxp://www.yy.com/cm/user?time=1465062548&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	221.228.79.225
hxxp://cm.hiido.cn/cm/user?hi_tc=1&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&	113.107.236.195
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/136724&isnew=1&hsid=0.4559120123177925&io=1&ut=1465062549724&rnd=0.90377522127779441465062549724	14.17.112.237
hxxp://duowan.xdwscache.ourglb0.com/pc/js/headfoot.mix.js?20160603212726
hxxp://www.yy.com/cm/user?hi_tc=1&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&	221.228.79.225
hxxp://duowan.xdwscache.ourglb0.com/pc/images/default_portrait.jpg
hxxp://res.udb.duowan.com/lgn/js/oauth/udbsdk/udb.sdk.getmm.min.js	222.73.61.81
hxxp://duowan.xdwscache.ourglb0.com/pc/images/2wm.png
hxxp://duowan.xdwscache.ourglb0.com/pc/js/liveplayerInline.js?20160603212726
hxxp://duowan.xdwscache.ourglb0.com/pc/images/components/w-head/images/w-head-sprite.png?$cssjsdate
hxxp://duowan.xdwscache.ourglb0.com/pc/images/components/w-leftMenu/images/icons-menuclose.png
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/210075&hsid=0.4215254752462996&io=1&ut=1465062550068&rnd=0.90377522127779441465062550068	14.17.112.237
hxxp://duowan.xdwscache.ourglb0.com/pc/images/components/w-leftMenu/images/icons-leftMenu2.png
hxxp://duowan.xdwscache.ourglb0.com/pc/images/components/w-liveplayerToolBar/images/w-liveplayerToolBar-sprite.png?201605261526
hxxp://duowan.xdwscache.ourglb0.com/pc/images/default_load.png
hxxp://duowan.xdwscache.ourglb0.com/pc/images/components/w-liveplayer/images/w-liveplayer-sprite-p24.png?201605261526
hxxp://duowan.xdwscache.ourglb0.com/pc/js/lib/requirejs/require.js?20160603212726
hxxp://duowan.xdwscache.ourglb0.com/pc/images/components/w-chatroom/images/alpha-bg.png
hxxp://duowan.xdwscache.ourglb0.com/pc/images/icons-index.png?20160505002
hxxp://res.udb.duowan.com/lgn/css/oauth/udbsdk/xelogin.sdk.css	222.73.61.81
hxxp://duowan.xdwscache.ourglb0.com/pc/images/components/w-thirdpartyLogin/images/login-close.png
hxxp://ad.wagbridge.tanx.com.gds.alibabadns.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=buCLmnR1GIMVgMVaX93GCw==&hi_cmuiv=0.6&
hxxp://hm.e.shifen.com/hm.js?c493393610cdccbddc1f124d567e36ab
hxxp://ad.wagbridge.tanx.com.gds.alibabadns.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=yzwRC8sZVk qFEJH3ShePQ==&hi_cmuiv=0.6&
hxxp://duowan.xdwscache.ourglb0.com/pc/images/components/w-thirdpartyLogin/images/login_btn.png
hxxp://duowan.xdwscache.ourglb0.com/pc/js/studio.js?20160603212726
hxxp://weblbs.yystatic.com/s/72578111/72578111/yycomscene.swf	171.91.157.237
hxxp://weblbs.yystatic.com/s/86415000/86415000/yycomscene.swf	171.91.157.237
hxxp://www.yy.com/	221.228.79.225
hxxp://duowan.xdwscache.ourglb0.com/pc/images/loading-white-mini.gif?201605261526
hxxp://duowan.xdwscache.ourglb0.com/pc/images/components/w-liveplayer/images/w-liveplayer-sprite.png?201605261526
hxxp://log.gds.mmstat.com/cm.gif?url=http://cms.tanx.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=yzwRC8sZVk+qFEJH3ShePQ==&hi_cmuiv=0.6
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=646224961&si=c493393610cdccbddc1f124d567e36ab&st=1&v=1.1.26&lv=1&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站
hxxp://log.gds.mmstat.com/cm.gif?url=http://cms.tanx.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=buCLmnR1GIMVgMVaX93GCw==&hi_cmuiv=0.6
hxxp://duowan.xdwscache.ourglb0.com/group16/M00/BC/E7/tz0M9Vahn78AAAAAAABHwm5wG-M269.jpg
hxxp://duowan.xdwscache.ourglb0.com/group16/M00/CB/2B/tz0M9VbtNkMAAAAAAAA9VFYDCvU355.jpg
hxxp://duowan.xdwscache.ourglb0.com/YzY1ODZlNDQtN2M1Ni00MmFlLWI0NGMtNmQ2ZjhhNjIwYjM5.jpg
hxxp://duowan.xdwscache.ourglb0.com/group16/M00/BC/E9/tz0M9VahqFgAAAAAAAAk6C0I27c747.jpg
hxxp://duowan.xdwscache.ourglb0.com/MGFhN2YyZTEtZWM1YS00MWJiLWFkZjAtNWYyYTExZDQzNTg0.jpg
hxxp://duowan.xdwscache.ourglb0.com/ZTE4NDIzY2MtZDA5OS00YjQzLWI2NGUtMzBmODc3M2ZmMzQz.jpg
hxxp://duowan.xdwscache.ourglb0.com/group16/M00/DA/69/tz0M9VcuazEAAAAAAAAvAhGaUQY835.jpg
hxxp://duowan.xdwscache.ourglb0.com/group16/M00/AB/90/tz0M9VZdRP8AAAAAAABOGkURMpY256.jpg
hxxp://duowan.xdwscache.ourglb0.com/MTMyYjhhMzYtODhjNS00MmJhLTk1M2ItNzBkY2YzYzVhMGMy.jpg
hxxp://duowan.xdwscache.ourglb0.com/group16/M00/A8/67/d7wtWVZMVGYAAAAAAAAsUBB5Ylo338.jpg
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=86415000&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062552&username=	14.17.112.237
hxxp://duowan.xdwscache.ourglb0.com/1264046092_1465050091.600552.jpg?ips_thumbnail/4/0/w/363/h/330/format=jpeg
hxxp://duowan.xdwscache.ourglb0.com/group16/M00/D0/82/tz0M9VcDglUAAAAAAAA0AFVcLuE178.jpg
hxxp://duowan.xdwscache.ourglb0.com/YzczODkwMjMtNmJmZi00ZjBiLTk0NDYtNTcyNGVlOWYxODQ4.jpg
hxxp://duowan.xdwscache.ourglb0.com/N2FjOGQ3MGItODQxYS00ODA5LThkOGQtMWZmNWE2MWI1NzM5.jpg
hxxp://duowan.xdwscache.ourglb0.com/group16/M00/C5/F0/d7wtWVcpnn4AAAAAAAAsxTKw0FU569.jpg
hxxp://duowan.xdwscache.ourglb0.com/NjM0YWQxNGQtOWIzNy00Yjg1LWI4MjMtZGNmOWJlZTM4ZDU1.jpg
hxxp://duowan.xdwscache.ourglb0.com/OWJjZjY1NjYtY2U4OS00NzkwLTg4M2MtM2QxNjY2ODkyMWQx.jpg
hxxp://duowan.xdwscache.ourglb0.com/group16/M00/C4/E8/d7wtWVcggoIAAAAAAABEjk6S4z4003.jpg
hxxp://duowan.xdwscache.ourglb0.com/group16/M00/A7/1F/d7wtWVZErbEAAAAAAAAuj2mMZr0392.jpg
hxxp://duowan.xdwscache.ourglb0.com/group16/M00/9E/CC/d7wtWVI1Ol0AAAAAAAA5sxARP9E766.jpg
hxxp://duowan.xdwscache.ourglb0.com/NmRhYmZjOTAtYWFiOC00ZDAyLWFhOTUtMmIwNDI3OTk0YTgz.jpg
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=72578111&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062552&username=	14.17.112.237
hxxp://duowan.xdwscache.ourglb0.com/group16/M00/D5/3D/tz0M9VcXMfcAAAAAAABR2ACo4I4351.jpg
hxxp://duowan.xdwscache.ourglb0.com/group16/M00/E1/52/tz0M9VdPA9EAAAAAAAA61AG8C_o574.jpg
hxxp://ad.wagbridge.tanx.com.gds.alibabadns.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=yzwRC8sZVk qFEJH3ShePQ==&hi_cmuiv=0.6&cna=jwLaD3iTjxECAcLyYNpUr7X5
hxxp://duowan.xdwscache.ourglb0.com/group16/M00/D5/AE/tz0M9VcY1jwAAAAAAABER38yZBk347.jpg
hxxp://duowan.xdwscache.ourglb0.com/NjBhMWM0YjktYTY0ZC00MDI4LThkZGUtM2RjNzI1NGU1MGQ3.jpg
hxxp://duowan.xdwscache.ourglb0.com/ZGI4OGIzN2ItYjAzZS00NGFkLWEyNTQtZjQ1YjFhMDg4YzY4.jpg
hxxp://ad.wagbridge.tanx.com.gds.alibabadns.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=buCLmnR1GIMVgMVaX93GCw==&hi_cmuiv=0.6&cna=kALaD7rWWhICAcLyYNokUOf8
hxxp://ad.wagbridge.tanx.com.gds.alibabadns.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=buCLmnR1GIMVgMVaX93GCw==&hi_cmuiv=0.6&cna=kALaD6m0UlUCAcLyYNpLlIs0
hxxp://duowan.xdwscache.ourglb0.com/MTQxYmJhMjMtODRkMi00MDU2LWI4ODktYzk3MDFkNGJhNWIx.jpg
hxxp://duowan.xdwscache.ourglb0.com/1501809610_1465004462.jpg?ips_thumbnail/4/0/w/363/h/330/format=jpeg
hxxp://duowan.xdwscache.ourglb0.com/NTk0MmFiOTYtMDEzOS00M2RmLTk2NzQtYWQ5NjhhZGU3MzQw.jpg
hxxp://www.yy.com/cm/adx/tanx?tanx_ver=1&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=yzwRC8sZVk qFEJH3ShePQ==&hi_cmuiv=0.6&tanx_tid=WVXU1KqJTQU=	221.228.79.225
hxxp://dw.dlmix.ourdvs.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=86415000&subSid=86415000&newtuna=1&referer=http://www.yy.com/210075
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&act_type=201&source=0_0&time=1465062553&username=	14.17.112.237
hxxp://duowan.xdwscache.ourglb0.com/MGU2NTExZWItYTI1Mi00N2VmLTg5NDgtOWUwY2UxNGUzMjQ2.jpg
hxxp://cm.hiido.cn/cm/adx/tanx?tanx_ver=1&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=buCLmnR1GIMVgMVaX93GCw==&hi_cmuiv=0.6&tanx_tid=zSgTVhBnj3I=	113.107.236.195
hxxp://cm.hiido.cn/cm/adx/tanx?tanx_ver=1&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=buCLmnR1GIMVgMVaX93GCw==&hi_cmuiv=0.6&tanx_tid=mh7AnrnlrII=	113.107.236.195
hxxp://dw.dlmix.ourdvs.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtuna=1&referer=http://www.yy.com/136724
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=2719,2719&et=3&fl=11.6&ja=1&ln=en-us&lo=0&nv=0&rnd=510011058&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=1
hxxp://www.yy.com/cm/user?time=1465062555&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	221.228.79.225
hxxp://duowan.xdwscache.ourglb0.com/NDQ1NzI4OTctZjBkMi00NzRkLTk4OGItYWRkN2NjZWU4ZjY4.jpg
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=4890&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/210075&hsid=0.4215254752462996&io=0&ut=1465062554974&rnd=0.90377522127779441465062554974	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062555036&wd=0&passport=&sns=null&pcmb=1&pl=http://www.yy.com/210075&v=T20160526.01&rnd=0.207941949396607371465062555036	14.17.112.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062552&nv=0&rnd=389553210&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/210075&hsid=0.4215254752462996&io=1&ut=1465062555755&rnd=0.90377522127779441465062555755	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&act_type=201&source=0_0&time=1465062552&username=	14.17.112.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=1&rnd=461872113&si=c493393610cdccbddc1f124d567e36ab&st=1&v=1.1.26&lv=2&tt=传奇人生-正在直播-中国领先的直播网站
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&act_type=201&source=0_0&time=1465062556&username=	14.17.112.237
hxxp://weblbs.yystatic.com/crossdomain.xml	171.91.157.237
hxxp://weblbs.yystatic.com//get-data/86415000?subSid=86415000&type=yycomscene&referer=hxxp://www.yy.com/210075&_=23019838	171.91.157.237
hxxp://weblbs.yystatic.com//get-data/72578111?subSid=72578111&type=yycomscene&referer=hxxp://www.yy.com/136724&_=32552383	171.91.157.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=1188,1188&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1791133847&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2
hxxp://cm.hiido.cn/cm/user?time=1465062557&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	113.107.236.195
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=8078&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/136724&isnew=1&hsid=0.4559120123177925&io=0&ut=1465062557818&rnd=0.90377522127779441465062557818	14.17.112.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=134596779&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=传奇人生-正在直播-中国领先的直播网站
hxxp://ylog.hiido.com/j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062557880&wd=0&passport=&sns=null&pcmb=1&pl=http://www.yy.com/136724&v=T20160526.01&rnd=0.207941949396607371465062557880	14.17.112.237
hxxp://dw.dlmix.ourdvs.com/r/rc/yycomscene/core/1/19/core.bmp
hxxp://87.245.198.80/c2.web.yystatic.com/r/rc/yycomscene/core/1/19/core.bmp?wsiphost=local
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=72578111&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062558&username=	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/136724&hsid=0.4559120123177925&io=1&ut=1465062558583&rnd=0.90377522127779441465062558583	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=86415000&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062555&username=	14.17.112.237
hxxp://weblbs.yystatic.com//get-data/72578111?subSid=72578111&type=yycomscene&referer=hxxp://www.yy.com/136724&_=15580213	171.91.157.237
hxxp://87.245.198.80/crossdomain.xml
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&act_type=201&source=0_0&time=1465062558&username=	14.17.112.237
hxxp://www.yy.com/statistics/StatisticsAction.json?uri=studio_ie6_windows xp&value=1	221.228.79.225
hxxp://dw.dlmix.ourdvs.com/r/sc/yycomscene/defaultScene/1/76/defaultScene.swf
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=6953,6953&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062552&nv=0&rnd=1721426335&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2
hxxp://www.yy.com/cm/user?time=1465062562&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	221.228.79.225
hxxp://www.yy.com/statistics/YycomPageLoadTimeStatisticsAction.json?uri=head-headfoot.mix.css&time=32	221.228.79.225
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=6953&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/210075&hsid=0.4215254752462996&io=0&ut=1465062562724&rnd=0.90377522127779441465062562724	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062562786&wd=0&passport=&sns=null&pcmb=1&pl=http://www.yy.com/210075&v=T20160526.01&rnd=0.207941949396607371465062562786	14.17.112.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1720588834&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=6063,6063&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1064664793&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2
hxxp://weblbs.yystatic.com//get-data/86415000?subSid=86415000&type=yycomscene&referer=hxxp://www.yy.com/210075&_=10871583	171.91.157.237
hxxp://cm.hiido.cn/cm/user?time=1465062564&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	113.107.236.195
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=5406&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/136724&hsid=0.4559120123177925&io=0&ut=1465062564005&rnd=0.90377522127779441465062564005	14.17.112.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=594117554&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=传奇人生-正在直播-中国领先的直播网站
hxxp://weblbs.yystatic.com//get-data/72578111?subSid=72578111&type=yycomscene&referer=hxxp://www.yy.com/136724&_=20658772	171.91.157.237
hxxp://ylog.hiido.com/j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062564114&wd=0&passport=&sns=null&pcmb=1&pl=http://www.yy.com/136724&v=T20160526.01&rnd=0.207941949396607371465062564114	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&act_type=201&source=0_0&time=1465062563&username=	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=86415000&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062563&username=	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=72578111&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062564&username=	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&act_type=201&source=0_0&time=1465062565&username=	14.17.112.237
hxxp://dw.dlmix.ourdvs.com/r/sc/yycomscene/defaultScene/1/76/liveBaseSceneConfig.xml
hxxp://duowan.xdwscache.ourglb0.com/pc/images/components/w-liveplayer/images/w-liveplayer-errbg.jpg?201605261526
hxxp://dw.dlmix.ourdvs.com/r/rc/yycomscene/core/1/19/playui.swf
hxxp://cm.hiido.cn/d.gif?sed=ac2d7764b9edb680&te=2&rl=yycomscene&td=0&ip=null&sd=72578111&sbd=72578111&ud=null&ot=1465062568&dr=0&wy=cc515ea9f79d46d0a143e95390998e1b&rf=http://www.yy.com/136724&sr=0&cd=0&ui=0.20794194939660737&in=null	113.107.236.195
hxxp://dw.dlmix.ourdvs.com/r/sc/yycomscene/defaultScene/1/76/liveCard.swf
hxxp://dw.dlmix.ourdvs.com/r/sc/yycomscene/defaultScene/1/76/danmaku.swf
hxxp://www.yy.com/live/detail?uid=0&sid=86415000&ssid=86415000&_=1465062569880	221.228.79.225
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=7015,7015&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=175963089&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2
hxxp://www.yy.com/cm/user?time=1465062570&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	221.228.79.225
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/210075&hsid=0.4215254752462996&io=1&ut=1465062570489&rnd=0.90377522127779441465062570489	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=110&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/210075&hsid=0.4215254752462996&io=0&ut=1465062570614&rnd=0.90377522127779441465062570614	14.17.112.237
hxxp://www.yy.com/live/detail?uid=0&sid=72578111&ssid=72578111&_=1465062570755	221.228.79.225
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=385932941&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站
hxxp://dw.dlmix.ourdvs.com/r/sc/yycomscene/defaultScene/1/76/controlBar.swf
hxxp://ylog.hiido.com/j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062570693&wd=0&passport=&sns=null&pcmb=1&pl=http://www.yy.com/210075&v=T20160526.01&rnd=0.207941949396607371465062570693	14.17.112.237
hxxp://cm.hiido.cn/g.gif?sed=8540687eb08eaa51&te=2&rl=yycomscene&td=0&ip=null&sd=72578111&sbd=72578111&ud=null&ot=1465062571&dr=0&wy=cc515ea9f79d46d0a143e95390998e1b&rf=http://www.yy.com/136724&sr=0&cd=0&ui=0.20794194939660737&in=null&lk=0&res=null&ra=null&hz=null&fs=0&mid=null&hid=null	113.107.236.195
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/210075&hsid=0.4215254752462996&io=1&ut=1465062570708&rnd=0.90377522127779441465062570708	14.17.112.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=6797,6797&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1429594728&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2
hxxp://cm.hiido.cn/cm/user?time=1465062571&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	113.107.236.195
hxxp://ylog.hiido.com/j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062571630&wd=0&passport=&sns=null&pcmb=1&pl=http://www.yy.com/136724&v=T20160526.01&rnd=0.207941949396607371465062571630	14.17.112.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=2114723665&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=传奇人生-正在直播-中国领先的直播网站
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/136724&hsid=0.4559120123177925&io=1&ut=1465062571677&rnd=0.90377522127779441465062571677	14.17.112.237
hxxp://stat2.web.yy.com/crossdomain.xml	183.61.143.81
hxxp://weblbs.yystatic.com//get-data/86415000?subSid=86415000&type=yycomscene&referer=hxxp://www.yy.com/210075&_=31637856	171.91.157.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=86415000&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062572&username=	14.17.112.237
hxxp://weblbs.yystatic.com//get-data/72578111?subSid=72578111&type=yycomscene&referer=hxxp://www.yy.com/136724&_=19990055	171.91.157.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&act_type=201&source=0_0&time=1465062572&username=	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&act_type=201&source=0_0&time=1465062573&username=	14.17.112.237
hxxp://cm.hiido.cn/d.gif?sed=2721b1f0627548b7&te=2&rl=yycomscene&td=0&ip=null&sd=72578111&sbd=72578111&ud=null&ot=1465062575&dr=0&wy=cc515ea9f79d46d0a143e95390998e1b&rf=http://www.yy.com/136724&sr=0&cd=0&ui=0.20794194939660737&in=null	113.107.236.195
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=72578111&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062572&username=	14.17.112.237
hxxp://stat2.web.yy.com/c.gif?act=webyysceneload&rel=yycomscene&ver=1.19&ref=http://www.yy.com/136724&tlt=0&took=1844&ip=194.242.96.218&time=1465062576505&wyy=cc515ea9f79d46d0a143e95390998e1b&sid=72578111&sidsub=72578111	183.61.143.81
hxxp://dw.dlmix.ourdvs.com/r/sc/yycomscene/defaultScene/1/76/gradeIco.swf
hxxp://dw.dlmix.ourdvs.com/r/sc/yycomscene/defaultScene/1/76/ShowBackground.swf
hxxp://www.yy.com/video/keywords	221.228.79.225
hxxp://cm.hiido.cn/d.gif?sed=e17f0f1299ae37ae&te=2&rl=yycomscene&td=0&ip=null&sd=86415000&sbd=86415000&ud=null&ot=1465062575&dr=0&wy=cc515ea9f79d46d0a143e95390998e1b&rf=http://www.yy.com/210075&sr=0&cd=0&ui=0.20794194939660737&in=null	113.107.236.195
hxxp://www.yy.com/live/detail?uid=0&sid=72578111&ssid=72578111&_=1465062578318	221.228.79.225
hxxp://stat2.web.yy.com/c.gif?act=webyylogin&uid=2105266317&rel=yycomscene&ver=1.19&ref=http://www.yy.com/136724&took=4047&pp=null:0&ip=194.242.96.218&time=1465062578599&wyy=cc515ea9f79d46d0a143e95390998e1b&sid=72578111&sidsub=72578111&hiido_ui=0.20794194939660737	183.61.143.81
hxxp://cm.hiido.cn/g.gif?sed=302d848f8da56965&te=2&rl=yycomscene&td=0&ip=null&sd=72578111&sbd=72578111&ud=null&ot=1465062579&dr=0&wy=cc515ea9f79d46d0a143e95390998e1b&rf=http://www.yy.com/136724&sr=0&cd=0&ui=0.20794194939660737&in=null&lk=0&res=0_0&ra=null&hz=48&fs=0&mid=null&hid=null	113.107.236.195
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=7687,453&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1791280354&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2
hxxp://cm.hiido.cn/d.gif?sed=2721b1f0627548b7&te=3&rl=yycomscene&td=0&ip=null&sd=72578111&sbd=72578111&ud=null&ot=1465062580&dr=5&wy=cc515ea9f79d46d0a143e95390998e1b&rf=http://www.yy.com/136724&sr=0&cd=0&ui=0.20794194939660737&in=null	113.107.236.195
hxxp://cm.hiido.cn/cm/user?time=1465062579&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	113.107.236.195
hxxp://www.yy.com/live/detail?uid=0&sid=86415000&ssid=86415000&_=1465062579443	221.228.79.225
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=7235&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/136724&hsid=0.4559120123177925&io=0&ut=1465062579583&rnd=0.90377522127779441465062579583	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062579677&wd=0&passport=&sns=null&pcmb=1&pl=http://www.yy.com/136724&v=T20160526.01&rnd=0.207941949396607371465062579677	14.17.112.237
hxxp://cm.hiido.cn/g.gif?sed=c441386191746fb5&te=2&rl=yycomscene&td=0&ip=null&sd=86415000&sbd=86415000&ud=null&ot=1465062580&dr=0&wy=cc515ea9f79d46d0a143e95390998e1b&rf=http://www.yy.com/210075&sr=0&cd=0&ui=0.20794194939660737&in=null&lk=0&res=0_0&ra=null&hz=48&fs=0&mid=null&hid=null	113.107.236.195
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=8984,47&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1518234277&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1978565649&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=传奇人生-正在直播-中国领先的直播网站
hxxp://www.yy.com/cm/user?time=1465062580&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	221.228.79.225
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=8890&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/210075&hsid=0.4215254752462996&io=0&ut=1465062580099&rnd=0.90377522127779441465062580099	14.17.112.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1100045455&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站
hxxp://ylog.hiido.com/j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062580286&wd=0&passport=&sns=null&pcmb=1&pl=http://www.yy.com/210075&v=T20160526.01&rnd=0.207941949396607371465062580286	14.17.112.237
hxxp://weblbs.yystatic.com//get-data/72578111?subSid=72578111&type=yycomscene&referer=hxxp://www.yy.com/136724&_=34825432	171.91.157.237
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/210075&hsid=0.4215254752462996&io=1&ut=1465062580864&rnd=0.90377522127779441465062580864	14.17.112.237
hxxp://weblbs.yystatic.com//get-data/86415000?subSid=86415000&type=yycomscene&referer=hxxp://www.yy.com/210075&_=45925731	171.91.157.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=6015,6015&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1034336498&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2
hxxp://www.yy.com/cm/user?time=1465062586&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	221.228.79.225
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=72578111&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062581&username=	14.17.112.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=160802413&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/136724&hsid=0.4559120123177925&io=1&ut=1465062581068&rnd=0.90377522127779441465062581068	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=86415000&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062581&username=	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&act_type=201&source=0_0&time=1465062581&username=	14.17.112.237
hxxp://stat2.web.yy.com/c.gif?act=webyysceneload&rel=yycomscene&ver=1.19&ref=http://www.yy.com/210075&tlt=0&took=4282&ip=194.242.96.218&time=1465062578927&wyy=cc515ea9f79d46d0a143e95390998e1b&sid=86415000&sidsub=86415000	183.61.143.81
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=7734,7734&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=122391367&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2
hxxp://weblbs.yystatic.com//get-data/86415000?subSid=86415000&type=yycomscene&referer=hxxp://www.yy.com/210075&_=39794521	171.91.157.237
hxxp://cm.hiido.cn/cm/user?time=1465062588&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	113.107.236.195
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=6875&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/136724&hsid=0.4559120123177925&io=0&ut=1465062587958&rnd=0.90377522127779441465062587958	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=5625&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/210075&hsid=0.4215254752462996&io=0&ut=1465062586536&rnd=0.90377522127779441465062586536	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062586614&wd=0&passport=&sns=null&pcmb=1&pl=http://www.yy.com/210075&v=T20160526.01&rnd=0.207941949396607371465062586614	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062588114&wd=0&passport=&sns=null&pcmb=1&pl=http://www.yy.com/136724&v=T20160526.01&rnd=0.207941949396607371465062588114	14.17.112.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=394224880&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=传奇人生-正在直播-中国领先的直播网站
hxxp://weblbs.yystatic.com//get-data/72578111?subSid=72578111&type=yycomscene&referer=hxxp://www.yy.com/136724&_=44812174	171.91.157.237
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/136724&hsid=0.4559120123177925&io=1&ut=1465062588630&rnd=0.90377522127779441465062588630	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=86415000&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062587&username=	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/210075&hsid=0.4215254752462996&io=1&ut=1465062587536&rnd=0.90377522127779441465062587536	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&act_type=201&source=0_0&time=1465062587&username=	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=72578111&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062589&username=	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&act_type=201&source=0_0&time=1465062589&username=	14.17.112.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=7062,31&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1023115031&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=7000&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/210075&hsid=0.4215254752462996&io=0&ut=1465062594614&rnd=0.90377522127779441465062594614	14.17.112.237
hxxp://www.yy.com/cm/user?time=1465062595&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	221.228.79.225
hxxp://ylog.hiido.com/j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062595099&wd=0&passport=&sns=null&pcmb=1&pl=http://www.yy.com/210075&v=T20160526.01&rnd=0.207941949396607371465062595099	14.17.112.237
hxxp://cm.hiido.cn/d.gif?sed=88cb609a6797cf75&te=2&rl=yycomscene&td=0&ip=null&sd=72578111&sbd=72578111&ud=null&ot=1465062595&dr=0&wy=cc515ea9f79d46d0a143e95390998e1b&rf=http://www.yy.com/136724&sr=0&cd=0&ui=0.20794194939660737&in=null	113.107.236.195
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=336900312&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/210075&hsid=0.4215254752462996&io=1&ut=1465062595646&rnd=0.90377522127779441465062595646	14.17.112.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=7594,7594&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=686386291&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2
hxxp://cm.hiido.cn/d.gif?sed=88cb609a6797cf75&te=3&rl=yycomscene&td=0&ip=null&sd=72578111&sbd=72578111&ud=null&ot=1465062596&dr=1&wy=cc515ea9f79d46d0a143e95390998e1b&rf=http://www.yy.com/136724&sr=0&cd=0&ui=0.20794194939660737&in=null	113.107.236.195
hxxp://cm.hiido.cn/cm/user?time=1465062596&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	113.107.236.195
hxxp://weblbs.yystatic.com//get-data/86415000?subSid=86415000&type=yycomscene&referer=hxxp://www.yy.com/210075&_=9060850	171.91.157.237
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=7406&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/136724&hsid=0.4559120123177925&io=0&ut=1465062596114&rnd=0.90377522127779441465062596114	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062596318&wd=0&passport=&sns=null&pcmb=1&pl=http://www.yy.com/136724&v=T20160526.01&rnd=0.207941949396607371465062596318	14.17.112.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=657929662&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=传奇人生-正在直播-中国领先的直播网站
hxxp://weblbs.yystatic.com//get-data/72578111?subSid=72578111&type=yycomscene&referer=hxxp://www.yy.com/136724&_=9648186	171.91.157.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=86415000&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062596&username=	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&act_type=201&source=0_0&time=1465062596&username=	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/136724&hsid=0.4559120123177925&io=1&ut=1465062596911&rnd=0.90377522127779441465062596911	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=72578111&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062597&username=	14.17.112.237
hxxp://ylog.hiido.com/j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&act_type=201&source=0_0&time=1465062597&username=	14.17.112.237
hxxp://hm.e.shifen.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=7000,7000&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1870802401&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2
hxxp://www.yy.com/cm/user?time=1465062602&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	221.228.79.225
hxxp://ylog.hiido.com/j.gif?act=webstat&ht=www.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=&lt=6907&xy=&ext=&v=v0.8.0&pl=http://www.yy.com/210075&hsid=0.4215254752462996&io=0&ut=1465062602583&rnd=0.90377522127779441465062602583	14.17.112.237
hxxp://res.m.yystatic.com/group16/M00/AB/90/tz0M9VZdRP8AAAAAAABOGkURMpY256.jpg	87.245.198.83
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=160802413&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站	220.181.7.190
hxxp://res.m.yystatic.com/group16/M00/CB/2B/tz0M9VbtNkMAAAAAAAA9VFYDCvU355.jpg	87.245.198.83
hxxp://emyfs.bs2cdn.yy.com/MGU2NTExZWItYTI1Mi00N2VmLTg5NDgtOWUwY2UxNGUzMjQ2.jpg	87.245.198.83
hxxp://dataaq.yy.com/d.gif?sed=2721b1f0627548b7&te=2&rl=yycomscene&td=0&ip=null&sd=72578111&sbd=72578111&ud=null&ot=1465062575&dr=0&wy=cc515ea9f79d46d0a143e95390998e1b&rf=http://www.yy.com/136724&sr=0&cd=0&ui=0.20794194939660737&in=null	14.17.109.66
hxxp://cm.hiido.cn/cm/user?time=1465062562&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	113.107.236.195
hxxp://yyweb.yystatic.com/pc/images/components/w-liveplayer/images/w-liveplayer-errbg.jpg?201605261526	87.245.198.83
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062552&nv=0&rnd=389553210&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站	220.181.7.190
hxxp://yyweb.yystatic.com/pc/images/components/w-thirdpartyLogin/images/login-close.png	87.245.198.83
hxxp://res.m.yystatic.com/group16/M00/BC/E7/tz0M9Vahn78AAAAAAABHwm5wG-M269.jpg	87.245.198.83
hxxp://yyweb.yystatic.com/pc/js/studio.js?20160603212726	87.245.198.83
hxxp://res.m.yystatic.com/group16/M00/E1/52/tz0M9VdPA9EAAAAAAAA61AG8C_o574.jpg	87.245.198.83
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=394224880&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=传奇人生-正在直播-中国领先的直播网站	220.181.7.190
hxxp://mobilelivephoto.bs2dl.yy.com/1264046092_1465050091.600552.jpg?ips_thumbnail/4/0/w/363/h/330/format=jpeg	87.245.198.83
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=594117554&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=传奇人生-正在直播-中国领先的直播网站	220.181.7.190
hxxp://log.mmstat.com/cm.gif?url=http://cms.tanx.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=buCLmnR1GIMVgMVaX93GCw==&hi_cmuiv=0.6	140.205.96.3
hxxp://res.m.yystatic.com/group16/M00/D5/3D/tz0M9VcXMfcAAAAAAABR2ACo4I4351.jpg	87.245.198.83
hxxp://yyweb.yystatic.com/pc/images/components/w-leftMenu/images/icons-menuclose.png	87.245.198.83
hxxp://yyweb.yystatic.com/pc/images/default_portrait.jpg	87.245.198.83
hxxp://dataaq.yy.com/d.gif?sed=88cb609a6797cf75&te=2&rl=yycomscene&td=0&ip=null&sd=72578111&sbd=72578111&ud=null&ot=1465062595&dr=0&wy=cc515ea9f79d46d0a143e95390998e1b&rf=http://www.yy.com/136724&sr=0&cd=0&ui=0.20794194939660737&in=null	14.17.109.66
hxxp://hdjs.hiido.com/hiido_internal.js?siteid=www@yy	87.245.198.83
hxxp://emyfs.bs2cdn.yy.com/MTQxYmJhMjMtODRkMi00MDU2LWI4ODktYzk3MDFkNGJhNWIx.jpg	87.245.198.83
hxxp://m.yy.com/zone/1391682584/	183.61.6.181
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=8984,47&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1518234277&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2	220.181.7.190
hxxp://yyweb.yystatic.com/pc/images/loading-white-mini.gif?201605261526	87.245.198.83
hxxp://yyweb.yystatic.com/pc/js/lib/requirejs/require.js?20160603212726	87.245.198.83
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=646224961&si=c493393610cdccbddc1f124d567e36ab&st=1&v=1.1.26&lv=1&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站	220.181.7.190
hxxp://yyweb.yystatic.com/pc/js/liveplayerInline.js?20160603212726	87.245.198.83
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=7000,7000&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1870802401&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2	220.181.7.190
hxxp://m.yy.com/zone/1371549646/	183.61.6.181
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=7687,453&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1791280354&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2	220.181.7.190
hxxp://m.yy.com/zone/1391682584	183.61.6.181
hxxp://c2.web.yystatic.com/r/sc/yycomscene/defaultScene/1/76/defaultScene.swf	87.245.198.84
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=7734,7734&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=122391367&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2	220.181.7.190
hxxp://yyweb.yystatic.com/pc/images/default_load.png	87.245.198.83
hxxp://emyfs.bs2cdn.yy.com/YjRkNjY5ODUtMWEyYy00MTQxLThlYjAtZjRhMzYzMjAwNTEw.jpg	87.245.198.83
hxxp://yyweb.yystatic.com/pc/images/components/w-liveplayerToolBar/images/w-liveplayerToolBar-sprite.png?201605261526	87.245.198.83
hxxp://yyweb.yystatic.com/pc/images/2wm.png	87.245.198.83
hxxp://cms.tanx.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=buCLmnR1GIMVgMVaX93GCw==&hi_cmuiv=0.6&cna=kALaD6m0UlUCAcLyYNpLlIs0	140.205.243.64
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=1&rnd=461872113&si=c493393610cdccbddc1f124d567e36ab&st=1&v=1.1.26&lv=2&tt=传奇人生-正在直播-中国领先的直播网站	220.181.7.190
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=657929662&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=传奇人生-正在直播-中国领先的直播网站	220.181.7.190
hxxp://c2.web.yystatic.com/r/sc/yycomscene/defaultScene/1/76/liveBaseSceneConfig.xml	87.245.198.84
hxxp://cm.hiido.cn/cm/user?time=1465062555&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	113.107.236.195
hxxp://cm.hiido.cn/cm/user?time=1465062580&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	113.107.236.195
hxxp://statistics.yy.com/statistics/StatisticsAction.json?uri=studio_ie6_windows xp&value=1	221.228.79.225
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1100045455&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站	220.181.7.190
hxxp://cm.hiido.cn/cm/user?time=1465062595&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	113.107.236.195
hxxp://emyfs.bs2cdn.yy.com/NTk0MmFiOTYtMDEzOS00M2RmLTk2NzQtYWQ5NjhhZGU3MzQw.jpg	87.245.198.83
hxxp://c2.web.yystatic.com/r/rc/yycomscene/core/1/19/playui.swf	87.245.198.84
hxxp://c2.web.yystatic.com/r/sc/yycomscene/defaultScene/1/76/danmaku.swf	87.245.198.84
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1978565649&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=传奇人生-正在直播-中国领先的直播网站	220.181.7.190
hxxp://dataaq.yy.com/d.gif?sed=ac2d7764b9edb680&te=2&rl=yycomscene&td=0&ip=null&sd=72578111&sbd=72578111&ud=null&ot=1465062568&dr=0&wy=cc515ea9f79d46d0a143e95390998e1b&rf=http://www.yy.com/136724&sr=0&cd=0&ui=0.20794194939660737&in=null	14.17.109.66
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=1188,1188&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1791133847&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2	220.181.7.190
hxxp://emyfs.bs2cdn.yy.com/N2FjOGQ3MGItODQxYS00ODA5LThkOGQtMWZmNWE2MWI1NzM5.jpg	87.245.198.83
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=6015,6015&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1034336498&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2	220.181.7.190
hxxp://emyfs.bs2cdn.yy.com/NDQ1NzI4OTctZjBkMi00NzRkLTk4OGItYWRkN2NjZWU4ZjY4.jpg	87.245.198.83
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=7594,7594&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=686386291&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2	220.181.7.190
hxxp://emyfs.bs2cdn.yy.com/NjM0YWQxNGQtOWIzNy00Yjg1LWI4MjMtZGNmOWJlZTM4ZDU1.jpg	87.245.198.83
hxxp://c2.web.yystatic.com/r/sc/yycomscene/defaultScene/1/76/ShowBackground.swf	87.245.198.84
hxxp://emyfs.bs2dl.yy.com/MGFhN2YyZTEtZWM1YS00MWJiLWFkZjAtNWYyYTExZDQzNTg0.jpg	87.245.198.83
hxxp://m.yy.com/zone/1371549646	183.61.6.181
hxxp://cm.hiido.cn/cm/adx/tanx?tanx_ver=1&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=yzwRC8sZVk qFEJH3ShePQ==&hi_cmuiv=0.6&tanx_tid=WVXU1KqJTQU=	113.107.236.195
hxxp://yyweb.yystatic.com/pc/images/components/w-head/images/w-head-sprite.png?$cssjsdate	87.245.198.83
hxxp://yyweb.yystatic.com/pc/images/components/w-liveplayer/images/w-liveplayer-sprite.png?201605261526	87.245.198.83
hxxp://cm.hiido.cn/cm/user?time=1465062570&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	113.107.236.195
hxxp://res.m.yystatic.com/group16/M00/BC/E9/tz0M9VahqFgAAAAAAAAk6C0I27c747.jpg	87.245.198.83
hxxp://res.m.yystatic.com/group16/M00/DA/69/tz0M9VcuazEAAAAAAAAvAhGaUQY835.jpg	87.245.198.83
hxxp://cms.tanx.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=buCLmnR1GIMVgMVaX93GCw==&hi_cmuiv=0.6&cna=kALaD7rWWhICAcLyYNokUOf8	140.205.243.64
hxxp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=86415000&subSid=86415000&newtuna=1&referer=http://www.yy.com/210075	87.245.198.84
hxxp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtuna=1&referer=http://www.yy.com/136724	87.245.198.84
hxxp://yyweb.yystatic.com/pc/css/headfoot.mix.css?20160603212726	87.245.198.83
hxxp://yyweb.yystatic.com/pc/images/components/w-chatroom/images/alpha-bg.png	87.245.198.83
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=6063,6063&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1064664793&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2	220.181.7.190
hxxp://emyfs.bs2dl.yy.com/OWJjZjY1NjYtY2U4OS00NzkwLTg4M2MtM2QxNjY2ODkyMWQx.jpg	87.245.198.83
hxxp://cms.tanx.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=yzwRC8sZVk qFEJH3ShePQ==&hi_cmuiv=0.6&	140.205.243.64
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=7015,7015&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=175963089&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2	220.181.7.190
hxxp://www.duowan.com/duowan.js	87.245.198.83
hxxp://yyweb.yystatic.com/pc/images/components/w-thirdpartyLogin/images/login_btn.png	87.245.198.83
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=385932941&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站	220.181.7.190
hxxp://c2.web.yystatic.com/r/rc/yycomscene/core/1/19/core.bmp	87.245.198.84
hxxp://emyfs.bs2cdn.yy.com/YzczODkwMjMtNmJmZi00ZjBiLTk0NDYtNTcyNGVlOWYxODQ4.jpg	87.245.198.83
hxxp://res.m.yystatic.com/group16/M00/D5/AE/tz0M9VcY1jwAAAAAAABER38yZBk347.jpg	87.245.198.83
hxxp://res.m.yystatic.com/group16/M00/A8/67/d7wtWVZMVGYAAAAAAAAsUBB5Ylo338.jpg	87.245.198.83
hxxp://mobilelivephoto.bs2dl.yy.com/1501809610_1465004462.jpg?ips_thumbnail/4/0/w/363/h/330/format=jpeg	87.245.198.83
hxxp://cms.tanx.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=yzwRC8sZVk qFEJH3ShePQ==&hi_cmuiv=0.6&cna=jwLaD3iTjxECAcLyYNpUr7X5	140.205.243.64
hxxp://dataaq.yy.com/g.gif?sed=302d848f8da56965&te=2&rl=yycomscene&td=0&ip=null&sd=72578111&sbd=72578111&ud=null&ot=1465062579&dr=0&wy=cc515ea9f79d46d0a143e95390998e1b&rf=http://www.yy.com/136724&sr=0&cd=0&ui=0.20794194939660737&in=null&lk=0&res=0_0&ra=null&hz=48&fs=0&mid=null&hid=null	14.17.109.66
hxxp://res.m.yystatic.com/group16/M00/9E/CC/d7wtWVI1Ol0AAAAAAAA5sxARP9E766.jpg	87.245.198.83
hxxp://res.m.yystatic.com/group16/M00/C5/F0/d7wtWVcpnn4AAAAAAAAsxTKw0FU569.jpg	87.245.198.83
hxxp://emyfs.bs2cdn.yy.com/NmRhYmZjOTAtYWFiOC00ZDAyLWFhOTUtMmIwNDI3OTk0YTgz.jpg	87.245.198.83
hxxp://log.mmstat.com/cm.gif?url=http://cms.tanx.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=yzwRC8sZVk+qFEJH3ShePQ==&hi_cmuiv=0.6	140.205.96.3
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1720588834&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站	220.181.7.190
hxxp://emyfs.bs2cdn.yy.com/NjBhMWM0YjktYTY0ZC00MDI4LThkZGUtM2RjNzI1NGU1MGQ3.jpg	87.245.198.83
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=2114723665&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=传奇人生-正在直播-中国领先的直播网站	220.181.7.190
hxxp://hm.baidu.com/hm.js?c493393610cdccbddc1f124d567e36ab	220.181.7.190
hxxp://res.m.yystatic.com/group16/M00/D0/82/tz0M9VcDglUAAAAAAAA0AFVcLuE178.jpg	87.245.198.83
hxxp://yyweb.yystatic.com/pc/images/components/w-liveplayer/images/w-liveplayer-sprite-p24.png?201605261526	87.245.198.83
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=336900312&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站	220.181.7.190
hxxp://emyfs.bs2dl.yy.com/ZTE4NDIzY2MtZDA5OS00YjQzLWI2NGUtMzBmODc3M2ZmMzQz.jpg	87.245.198.83
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=6953,6953&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062552&nv=0&rnd=1721426335&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2	220.181.7.190
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=2719,2719&et=3&fl=11.6&ja=1&ln=en-us&lo=0&nv=0&rnd=510011058&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=1	220.181.7.190
hxxp://res.m.yystatic.com/group16/M00/A7/1F/d7wtWVZErbEAAAAAAAAuj2mMZr0392.jpg	87.245.198.83
hxxp://yyweb.yystatic.com/pc/js/lib/jQuery/jquery-1.11.1.min.js	87.245.198.83
hxxp://emyfs.bs2cdn.yy.com/YzY1ODZlNDQtN2M1Ni00MmFlLWI0NGMtNmQ2ZjhhNjIwYjM5.jpg	87.245.198.83
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=134596779&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=传奇人生-正在直播-中国领先的直播网站	220.181.7.190
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=6797,6797&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1429594728&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2	220.181.7.190
hxxp://dataaq.yy.com/d.gif?sed=e17f0f1299ae37ae&te=2&rl=yycomscene&td=0&ip=null&sd=86415000&sbd=86415000&ud=null&ot=1465062575&dr=0&wy=cc515ea9f79d46d0a143e95390998e1b&rf=http://www.yy.com/210075&sr=0&cd=0&ui=0.20794194939660737&in=null	14.17.109.66
hxxp://yyweb.yystatic.com/pc/css/studio.css?20160603212726	87.245.198.83
hxxp://yyweb.yystatic.com/pc/images/icons-index.png?20160505002	87.245.198.83
hxxp://emyfs.bs2cdn.yy.com/ZGI4OGIzN2ItYjAzZS00NGFkLWEyNTQtZjQ1YjFhMDg4YzY4.jpg	87.245.198.83
hxxp://yyweb.yystatic.com/pc/js/headfoot.mix.js?20160603212726	87.245.198.83
hxxp://c2.web.yystatic.com/r/sc/yycomscene/defaultScene/1/76/gradeIco.swf	87.245.198.84
hxxp://res.m.yystatic.com/group16/M00/C4/E8/d7wtWVcggoIAAAAAAABEjk6S4z4003.jpg	87.245.198.83
hxxp://c2.web.yystatic.com/r/sc/yycomscene/defaultScene/1/76/controlBar.swf	87.245.198.84
hxxp://yyweb.yystatic.com/pc/images/components/w-leftMenu/images/icons-leftMenu2.png	87.245.198.83
hxxp://cms.tanx.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=buCLmnR1GIMVgMVaX93GCw==&hi_cmuiv=0.6&	140.205.243.64
hxxp://emyfs.bs2dl.yy.com/MTMyYjhhMzYtODhjNS00MmJhLTk1M2ItNzBkY2YzYzVhMGMy.jpg	87.245.198.83
hxxp://c2.web.yystatic.com/r/sc/yycomscene/defaultScene/1/76/liveCard.swf	87.245.198.84
hxxp://yy.com/crossdomain.xml	113.107.236.195
hxxp://hm.baidu.com/hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=7062,31&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1023115031&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2	220.181.7.190
hxxp://cm.hiido.cn/cm/user?time=1465062586&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737	113.107.236.195
aq.yy.com	140.206.200.32
lgn.yy.com	111.206.234.57

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Outdated Windows Flash Version IE

Traffic

GET /r/sc/yycomscene/defaultScene/1/76/ShowBackground.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://c2.web.yystatic.com/r/sc/yycomscene/defaultScene/1/76/liveCard.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.web.yystatic.com

Connection: Keep-Alive

Cookie: wyy=cc515ea9f79d46d0a143e95390998e1b; hiido_ui=0.57246662237330648

HTTP/1.1 200 OK

Content-Length: 30064

Content-Type: application/x-shockwave-flash;charset=UTF-8

Last-Modified: Sat,05-Dec-15 05:49:27 GMT

Via: 1.1 db79:5011 (Cdn Cache Server V2.0)

Connection: close
CWS.m...x....\[email protected].&..`.w'.j......U.#j@
.Q..m...n.UB........R...xk...mw.........?.;....93.;...r.......].B.`R..
.6....0...hr.).Y.... &.o)..U..&.....k...G.(/.............[DU.].j......
..2.z0.V,)_Z.j...........J..~..`.?z-{...g}.,.)|......*b&DO..wU.dr...W.
........K..;.Y.UQ.b.......*zyqE....6d..........W..qO. ...../.^....5...
..>...h...U....ZlZ..pj\...Q..QqqY..&.&O.....496vJ..h... .....o.....
..5{...X....s..U..E.u....e.1... ^-_R..?.SXf..<cy.......0M.;...-..j.
.'$....b...'..fRrj|rb|.yRbR.......so..K^.'.O...o..?..sos.../].........
......ZX.tuaAZ..W..B....B..Rt?....g...._...y.....{ ...@....{[.........
...8......}.2`:.......D&..[[email protected]..".f.0...s{z..L..Y....
.....k...*...ik../YV.../........:fiA...........,M_W^8o...%..-I..M.....
^.E.s....u>...../-..U.Rt...c.ma..(/d......N..L..=!!q...F..B..Vc'FA@
H.89n....3.._........\.? ....y..06!.pRA.....Q....Q.......'...J....W.s?
..|n.).4=uRlR|......g...I.S..........'D.....<w..y......W.(.Z......R
.b..Hbe....QOd.../Y...s.._...G...E.9-5.<}..d..."1i..GSR......DS....
.......I...1..B...s../.(....v.a.<....=4([email protected]..?q.....8N.I.L..
[email protected]...*.S!O;.*. ....?m.@...
.H.....3..c....".."8..0..3..X..^{"..zr.......v...C.*..|.%Pb........e..
...a..x..W....r..{v!....n.4.....SR.g...O..&J.f....:...L..C|...qhF.....
F..<2..mO#=2...w..tq......-l....P.'y.p...0;.^.h..`as...}.6... ..a&2
.g.(N....S8G.F.#.#..AY.{.'{..m...G....$,;l....>,v....&#.1.......QG.
..e..l..$....L5..... ].....L....B.....J.eO.o.VG.....f.....Kx....R.
<<< skipped >>>

GET /hiido_internal.js?siteid=www@yy HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hdjs.hiido.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 04 Jun 2016 17:49:00 GMT

X-Powered-By: Express

Accept-Ranges: bytes

Cache-Control: public, max-age=0

Last-Modified: Fri, 03 Jun 2016 09:39:08 GMT

ETag: W/"5bb3-15515a16a60"

Content-Type: application/javascript

Content-Length: 23475

X-Via: 1.1 db77:1 (Cdn Cache Server V2.0)

Connection: keep-alive
/*! hiido.js: v0.8.0 2016-06-03 17:39:06 */.!function(e){function n(t)
{if(i[t])return i[t].exports;var r=i[t]={exports:{},id:t,loaded:!1};re
turn e[t].call(r.exports,r,r.exports,n),r.loaded=!0,r.exports}var i={}
;return n.m=e,n.c=i,n.p="",n(0)}([function(e,n,i){"use strict";!functi
on(){var e=i(1),n=navigator.userAgent;try{new e(n,!0)}catch(t){console
.dir(t);var r=new Image(1,1),o="";for(var a in t)o =a ":" t[a] ";";var
 s=encodeURIComponent,u=t.stack?s(t.stack):"";r.src=window.location.pr
otocol "//wbugs.hiido.com/c.gif?e=" s(o) "|" u "|" s(window.location.h
ref) "|" s(n),r.onload=function(){}}}()},function(e,n,i){"use strict";
function t(e,n,i,t){e.addEventListener?e.addEventListener(n,i,!!t):e.a
ttachEvent&&(e["e" n i]=i,e[n i]=function(){e["e" n i](window.event)},
e.attachEvent("on" n,e[n i]))}function r(e){var n="; " document.cookie
,i=n.split("; " e "=");return 1===i.length?"":decodeURIComponent(i[1].
split(";")[0])}function o(e,n,i){i=i||{};var t=e "=" encodeURIComponen
t(n);if(i.expires&&"number"==typeof i.expires){var r=new Date;i.expire
s=1e3*i.expires*60*60*24,r=new Date(r.getTime() i.expires),t=t "; expi
res=" r.toUTCString()}i.path?t=t "; path=" i.path:"; path=/",i.domain?
t=t "; domain=" i.domain:"",document.cookie=t}function a(){return wind
ow.location.hostname}function s(){var e,n=window._hiido_wid,i=Object.p
rototype.toString;if(n)if("[object Array]"===i.call(n))e=n.join("|");e
lse if("function"==typeof n)try{e=n.call(window),"[object Array]"===i.
call(e)&&(e=e.join("|"))}catch(t){window.console.log("_hiido_wid .
<<< skipped >>>

GET /hiido_internal.js?siteid=www@yy HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

If-Modified-Since: Fri, 03 Jun 2016 09:39:08 GMT

If-None-Match: W/"5bb3-15515a16a60"

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hdjs.hiido.com

Connection: Keep-Alive

HTTP/1.1 304 Not Modified

Date: Sat, 04 Jun 2016 17:49:08 GMT

X-Powered-By: Express

Accept-Ranges: bytes

Cache-Control: public, max-age=0

Last-Modified: Fri, 03 Jun 2016 09:39:08 GMT

ETag: W/"5bb3-15515a16a60"

X-Via: 1.1 FM-31430C:8104 (Cdn Cache Server V2.0), 1.1 fuzhou189:8107 (Cdn Cache Server V2.0), 1.1 db77:1 (Cdn Cache Server V2.0)

Connection: keep-alive
HTTP/1.1 304 Not Modified..Date: Sat, 04 Jun 2016 17:49:08 GMT..X-Powe
red-By: Express..Accept-Ranges: bytes..Cache-Control: public, max-age=
0..Last-Modified: Fri, 03 Jun 2016 09:39:08 GMT..ETag: W/"5bb3-15515a1
6a60"..X-Via: 1.1 FM-31430C:8104 (Cdn Cache Server V2.0), 1.1 fuzhou18
9:8107 (Cdn Cache Server V2.0), 1.1 db77:1 (Cdn Cache Server V2.0)..Co
nnection: keep-alive......

GET /j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=72578111&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062572&username= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

Cookie: hiido_mid=14650625393270664410100017

HTTP/1.1 200 OK 

Content-type: image/gif

Content-Length: 35

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA div COM NAV OTC NOI DSP COR

Set-Cookie: hiido_mid=14650625393270664410100017; Path=/; expires=Mon, 25-Aug-25 10:20:28 GMT 
GIF89a.............,...........D..;..

GET /j.gif?act=webstat&ht=VVV.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=<=&xy=&ext=&v=v0.8.0&pl=http://VVV.yy.com/210075&hsid=0.4215254752462996&io=1&ut=1465062555755&rnd=0.90377522127779441465062555755 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

Cookie: hiido_mid=14650625393270664410100017

HTTP/1.1 200 OK 

Content-type: image/gif

Content-Length: 35

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA div COM NAV OTC NOI DSP COR

Set-Cookie: hiido_mid=14650625393270664410100017; Path=/; expires=Mon, 25-Aug-25 10:20:28 GMT 
GIF89a.............,...........D..;..

GET /hm.js?c493393610cdccbddc1f124d567e36ab HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

Cookie: HMACCOUNT=45C9319AF5C9C37A

HTTP/1.1 200 OK

Cache-Control: max-age=0, must-revalidate

Content-Encoding: gzip

Content-Length: 8796

Content-Type: application/javascript

Date: Sat, 04 Jun 2016 17:49:06 GMT

Etag: a6182c7abd554fdec141e481c8a3b5e5

Server: apache
...............(function(){var h={},mt={},c={id:"c493393610cdccbddc1f1
24d567e36ab",dm:["yy.com"],js:"tongji.baidu.com/hm-web/js/",etrk:[],ic
on:'',ctrk:false,align:-1,nv:-1,vdur:1800000,age:31536000000,rec:0,rp:
[],trust:0,vcard:0,qiao:0,lxb:0,conv:0,med:0,cvcc:'',cvcf:[],apps:''};
.;.{......p..`5........l.]....X..I..l...c..IZ...wF.CN...{.....3....d.&
lt;5R.LB.....wi..E...;.9.....[.....,..a.....~H'.s..V.....Ij/2.>..8'
j........[..e..../6..k1~z;.......%.4.Oc.F.g5.F..../..D..*..x<^...f.
].M.....(...Pv..bvhd.Xa......U......T..^.~>.l..m..........GK&DI.D..
.kN..`2.UlAQ.Uov&r.,b/.......Y/A.|'..m.,`.X.Ox......3a...h.6L#..dV .m.
.m.m. ..........eg.4.N..|...)....}....0....v......<...EJ...8-..".&v
n..#....:.."..S.e....A.6.l..;..b9.{.$......7B.|x6...GZ......X.j1P.4...
....3.eox..d.$..2.6..|..k.... ..[RX.....j.....~{7......9...g.1....S4..
#Kb..F.......`.s.g....9H.....T0..D<.'.{%...&...Yd..@.."O..{...8....
$.,3.A.R.x.M,....J.....)...Q[. ` .....Z...?]B....[,....UMK.,Y..L.|...u
....p_.&.tE.D....9.&r%...t.Kf.H..d.i....&.....b...Xf..I.N.&`...&...-.Y
C...P.......%0.e..%_.....!..!ShaU..D0.........&...K.pJt.....H..V......
)(}.d...Z.d...*.Z~......T;... [email protected]}3...50.T
G....#..`K.|....~......,..c......E.4.|gp..a!^..w<Z.......Fh....(l*.
.ge.....i..,Y....I..`."5.3i.....F.........n......:*t.`..QL.<...v...
.ge..!.9...yt..@....`I......E.k._.'..(A...].0.........n... .......n!k.
..>...(x..Fnm....n...7.l...e3.f ..6S.LM.8..on...y#;....f.....F..#..
......".E..p......GM..3W....f..8.!. .b.>.c....J.......7I"..j...
<<< skipped >>>

GET /hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=6953,6953&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062552&nv=0&rnd=1721426335&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

Cookie: HMACCOUNT=45C9319AF5C9C37A

HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Content-Length: 43

Content-Type: image/gif

Date: Sat, 04 Jun 2016 17:49:13 GMT

Pragma: no-cache

Server: apache

X-Content-Type-Options: nosniff
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: private, max-age=0, no-cache..Content-Length: 43..Content-Type: i
mage/gif..Date: Sat, 04 Jun 2016 17:49:13 GMT..Pragma: no-cache..Serve
r: apache..X-Content-Type-Options: nosniff..GIF89a.............!......
.,...........L..;....


GET /hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1720588834&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

Cookie: HMACCOUNT=45C9319AF5C9C37A

HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Content-Length: 43

Content-Type: image/gif

Date: Sat, 04 Jun 2016 17:49:14 GMT

Pragma: no-cache

Server: apache

X-Content-Type-Options: nosniff
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: private, max-age=0, no-cache..Content-Length: 43..Content-Type: i
mage/gif..Date: Sat, 04 Jun 2016 17:49:14 GMT..Pragma: no-cache..Serve
r: apache..X-Content-Type-Options: nosniff..GIF89a.............!......
.,...........L..;....


GET /hm.js?c493393610cdccbddc1f124d567e36ab HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

Cookie: HMACCOUNT=45C9319AF5C9C37A

HTTP/1.1 200 OK

Cache-Control: max-age=0, must-revalidate

Content-Encoding: gzip

Content-Length: 8796

Content-Type: application/javascript

Date: Sat, 04 Jun 2016 17:49:21 GMT

Etag: a6182c7abd554fdec141e481c8a3b5e5

Server: apache
...............(function(){var h={},mt={},c={id:"c493393610cdccbddc1f1
24d567e36ab",dm:["yy.com"],js:"tongji.baidu.com/hm-web/js/",etrk:[],ic
on:'',ctrk:false,align:-1,nv:-1,vdur:1800000,age:31536000000,rec:0,rp:
[],trust:0,vcard:0,qiao:0,lxb:0,conv:0,med:0,cvcc:'',cvcf:[],apps:''};
.;.{......p..`5........l.]....X..I..l...c..IZ...wF.CN...{.....3....d.&
lt;5R.LB.....wi..E...;.9.....[.....,..a.....~H'.s..V.....Ij/2.>..8'
j........[..e..../6..k1~z;.......%.4.Oc.F.g5.F..../..D..*..x<^...f.
].M.....(...Pv..bvhd.Xa......U......T..^.~>.l..m..........GK&DI.D..
.kN..`2.UlAQ.Uov&r.,b/.......Y/A.|'..m.,`.X.Ox......3a...h.6L#..dV .m.
.m.m. ..........eg.4.N..|...)....}....0....v......<...EJ...8-..".&v
n..#....:.."..S.e....A.6.l..;..b9.{.$......7B.|x6...GZ......X.j1P.4...
....3.eox..d.$..2.6..|..k.... ..[RX.....j.....~{7......9...g.1....S4..
#Kb..F.......`.s.g....9H.....T0..D<.'.{%...&...Yd..@.."O..{...8....
$.,3.A.R.x.M,....J.....)...Q[. ` .....Z...?]B....[,....UMK.,Y..L.|...u
....p_.&.tE.D....9.&r%...t.Kf.H..d.i....&.....b...Xf..I.N.&`...&...-.Y
C...P.......%0.e..%_.....!..!ShaU..D0.........&...K.pJt.....H..V......
)(}.d...Z.d...*.Z~......T;... [email protected]}3...50.T
G....#..`K.|....~......,..c......E.4.|gp..a!^..w<Z.......Fh....(l*.
.ge.....i..,Y....I..`."5.3i.....F.........n......:*t.`..QL.<...v...
.ge..!.9...yt..@....`I......E.k._.'..(A...].0.........n... .......n!k.
..>...(x..Fnm....n...7.l...e3.f ..6S.LM.8..on...y#;....f.....F..#..
......".E..p......GM..3W....f..8.!. .b.>.c....J.......7I"..j...
<<< skipped >>>

GET /hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=8984,47&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1518234277&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

Cookie: HMACCOUNT=45C9319AF5C9C37A

HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Content-Length: 43

Content-Type: image/gif

Date: Sat, 04 Jun 2016 17:49:30 GMT

Pragma: no-cache

Server: apache

X-Content-Type-Options: nosniff
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: private, max-age=0, no-cache..Content-Length: 43..Content-Type: i
mage/gif..Date: Sat, 04 Jun 2016 17:49:30 GMT..Pragma: no-cache..Serve
r: apache..X-Content-Type-Options: nosniff..GIF89a.............!......
.,...........L..;....


GET /hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=6015,6015&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1034336498&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

Cookie: HMACCOUNT=45C9319AF5C9C37A

HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Content-Length: 43

Content-Type: image/gif

Date: Sat, 04 Jun 2016 17:49:37 GMT

Pragma: no-cache

Server: apache

X-Content-Type-Options: nosniff
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: private, max-age=0, no-cache..Content-Length: 43..Content-Type: i
mage/gif..Date: Sat, 04 Jun 2016 17:49:37 GMT..Pragma: no-cache..Serve
r: apache..X-Content-Type-Options: nosniff..GIF89a.............!......
.,...........L..;....


GET /hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&et=0&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=160802413&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2&tt=[K歌]花樣年華〆娱乐休闲会所 我的电脑会唱歌，叫醒你的耳朵~-正在直播-中国领先的直播网站 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

Cookie: HMACCOUNT=45C9319AF5C9C37A

HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Content-Length: 43

Content-Type: image/gif

Date: Sat, 04 Jun 2016 17:49:38 GMT

Pragma: no-cache

Server: apache

X-Content-Type-Options: nosniff
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: private, max-age=0, no-cache..Content-Length: 43..Content-Type: i
mage/gif..Date: Sat, 04 Jun 2016 17:49:38 GMT..Pragma: no-cache..Serve
r: apache..X-Content-Type-Options: nosniff..GIF89a.............!......
.,...........L..;....


GET /hm.js?c493393610cdccbddc1f124d567e36ab HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

Cookie: HMACCOUNT=45C9319AF5C9C37A

HTTP/1.1 200 OK

Cache-Control: max-age=0, must-revalidate

Content-Encoding: gzip

Content-Length: 8796

Content-Type: application/javascript

Date: Sat, 04 Jun 2016 17:49:45 GMT

Etag: a6182c7abd554fdec141e481c8a3b5e5

Server: apache
...............(function(){var h={},mt={},c={id:"c493393610cdccbddc1f1
24d567e36ab",dm:["yy.com"],js:"tongji.baidu.com/hm-web/js/",etrk:[],ic
on:'',ctrk:false,align:-1,nv:-1,vdur:1800000,age:31536000000,rec:0,rp:
[],trust:0,vcard:0,qiao:0,lxb:0,conv:0,med:0,cvcc:'',cvcf:[],apps:''};
.;.{......p..`5........l.]....X..I..l...c..IZ...wF.CN...{.....3....d.&
lt;5R.LB.....wi..E...;.9.....[.....,..a.....~H'.s..V.....Ij/2.>..8'
j........[..e..../6..k1~z;.......%.4.Oc.F.g5.F..../..D..*..x<^...f.
].M.....(...Pv..bvhd.Xa......U......T..^.~>.l..m..........GK&DI.D..
.kN..`2.UlAQ.Uov&r.,b/.......Y/A.|'..m.,`.X.Ox......3a...h.6L#..dV .m.
.m.m. ..........eg.4.N..|...)....}....0....v......<...EJ...8-..".&v
n..#....:.."..S.e....A.6.l..;..b9.{.$......7B.|x6...GZ......X.j1P.4...
....3.eox..d.$..2.6..|..k.... ..[RX.....j.....~{7......9...g.1....S4..
#Kb..F.......`.s.g....9H.....T0..D<.'.{%...&...Yd..@.."O..{...8....
$.,3.A.R.x.M,....J.....)...Q[. ` .....Z...?]B....[,....UMK.,Y..L.|...u
....p_.&.tE.D....9.&r%...t.Kf.H..d.i....&.....b...Xf..I.N.&`...&...-.Y
C...P.......%0.e..%_.....!..!ShaU..D0.........&...K.pJt.....H..V......
)(}.d...Z.d...*.Z~......T;... [email protected]}3...50.T
G....#..`K.|....~......,..c......E.4.|gp..a!^..w<Z.......Fh....(l*.
.ge.....i..,Y....I..`."5.3i.....F.........n......:*t.`..QL.<...v...
.ge..!.9...yt..@....`I......E.k._.'..(A...].0.........n... .......n!k.
..>...(x..Fnm....n...7.l...e3.f ..6S.LM.8..on...y#;....f.....F..#..
......".E..p......GM..3W....f..8.!. .b.>.c....J.......7I"..j...
<<< skipped >>>

GET /hm.gif?cc=0&ck=1&cl=32-bit&ds=1276x846&ep=7000,7000&et=3&fl=11.6&ja=1&ln=en-us&lo=0&lt=1465062557&nv=0&rnd=1870802401&si=c493393610cdccbddc1f124d567e36ab&st=4&v=1.1.26&lv=2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

Cookie: HMACCOUNT=45C9319AF5C9C37A

HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Content-Length: 43

Content-Type: image/gif

Date: Sat, 04 Jun 2016 17:49:53 GMT

Pragma: no-cache

Server: apache

X-Content-Type-Options: nosniff
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache..

GET /j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062588114&wd=0&passport=&sns=null&pcmb=1&pl=http://VVV.yy.com/136724&v=T20160526.01&rnd=0.207941949396607371465062588114 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

Cookie: hiido_mid=14650625393270664410100017

HTTP/1.1 200 OK 

Content-type: image/gif

Content-Length: 35

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA div COM NAV OTC NOI DSP COR

Set-Cookie: hiido_mid=14650625393270664410100017; Path=/; expires=Mon, 25-Aug-25 10:20:28 GMT 
GIF89a.............,...........D..;..

GET /136724 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:48:56 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Content-Language: en-US

X-Cache: EXPIRED

Content-Encoding: gzip
4a4.............}.s.G...l.....|.|.Y..i.N...a.g.r.T..Ici........W..`.2$
..pB [email protected]...~.....I..nYE......O.>}........3R.H.y..v..O
...4.....D..<%...'P.......Q.zO@..,-.B....Ds .(..f$..e.aB..=.,'...=H
K.|....=..$.w.B.2(.Q...%1..._.y/L...bGZ$.,...0S.r..b.-v....l....zaD..'
H.*1#{..1I.}..:.I.....................|....f.....Cgs...G.AwD. p..)&[..
.D.Gh..d2.......Xnhp.x_..RZ..LQ.O#.@.^!.......~.M.v..=J..$z...8]b.....
..?.ir....`(..Q...x1...C,.....h...:...#......p.Cb.K.Xb$..ZY.A~tqeq.z.^
...Gyv.z.e...............S.;_........w.pa#....(/dE.m..w`.;j./.>.._.
frgi....F0........7y....R.<sC^8.........).c.....V..}....]..%&K.$...
.z..d.A.>..s.). ....*q.."..$..T$.1|r.V....2#4H6...2g.9...</.4..&
lt;[email protected]#.....,........H....`S......X.T
4...........S.......Y.2...Xp..Yp...T..zK..H..D.3.%;.....X*..L&>'.Xg
.3..<.M...x..D8....d.C.Ei[._..Hl].......6..h:..48H.;.I(...:...Y~.E.
(.YZ....x...$#.!Q*e...<~H.#.0h..!.d"..W...3..!u.K..2.....!.A.......
...Q.....H...o.....Z...bI.o..b....<h.`.. .X.............t.....&....
]..*m..6.5...t.S%).....0.4......u............u....8N........5....V..;.
,..&.6N|... ......N.......4..Y.7..OF.D..K0.)3H..q. ......D...v.P...<
;...Y~t'.g.Y..E.i&..J..W...I.........a)..2b6b..Q..`.`...-...J...._.3..
.......U..:x......<}.h..W3..S.....Te..... ...X.B.3.j.......I.......
xm......bm~^.z...X.......".O..%......GQ. 9...tG..1.......=!.....?*.B..
N.._...H.9.v'.,.......<.B.G.w.(c.P..k.......8*.R.....O....~...4..:.
...1e.D.Q...0.....#.>.....G.....n..f.3.p....,M..&J.....pj!.,..'
<<< skipped >>>

GET /j.gif?act=webstat&ht=VVV.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=<=&xy=&ext=&v=v0.8.0&pl=http://VVV.yy.com/210075&hsid=0.4215254752462996&io=1&ut=1465062570489&rnd=0.90377522127779441465062570489 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

Cookie: hiido_mid=14650625393270664410100017

HTTP/1.1 200 OK 

Content-type: image/gif

Content-Length: 35

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA div COM NAV OTC NOI DSP COR

Set-Cookie: hiido_mid=14650625393270664410100017; Path=/; expires=Mon, 25-Aug-25 10:20:28 GMT 
GIF89a.............,...........D..;..

GET / HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: hiido_ui=0.20794194939660737; hdjs_ui=0.9037752212777944; hdjs_session_id=0.4559120123177925; hdjs_session_time=1465062549724

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:49:04 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 17:49:03 GMT

Content-Encoding: gzip
4c8..............{w.G.7.w.Z.;.x..$..V./.0.A...Z....4k..,.],Y...m..Y...
.$..0..&....c0..~...$......._.V..!D..ruw......w...>..d1..M.........
...o*..........)>.Hd..r...k....t.;...x!.IW)[email protected]..&.}3...,/...
NN.J..']..r.T).?.'2]..(}.........9.D..\....DO.X...8U.._../c.<h.....
x:..c.T.g:9......'...n..t..9.=.I...K.#..u...f. .......6..m.o.#.....).?
.y}K.}........R....oB...x69.]......Rv.6.Z)N...=......p....D);....x).G%
.I.3.%.o%[email protected].\J4...D0W.......t.4....
..............v....|>.#.._~Z..A.;P]{ \..-..n.._:Z..RX:!.<.>_.
...?...}....3..W.......7....0.R{t..$.T{.".;S?.R;....<.T._.'...K...7
...6.=.........k..8q....(l.?./..........J..'...V..|.0..L6../<....[.
.f'k........m.. .}......Djn.XJ.u."..A......._.....O.k/./.....E........
.......h.....]J.i.R....r&....m0..r9...1..J....B(..P......&YF.eQ..24..x
19.....^..._,...\S!s.. .8.#........#J.me..t9..g`D>..._.m.......y.h}
..G[........b...........K.|..........i>......0h`../=......Ta<.Tp
.W.^g*.t.#...#g.._..M...J.$.."......J)m:[email protected]~.......g.OS....^D
.f.s...Gw.....y>0....!..Qb..v?.@..|V....|q..@&.L.&?.dR.l..."......E
...p2{ .....O......$..Rw!^..]..:.4^.. ..).*?......a.K..Y0U.~\l.=!|.R?y
..|...xuc..|@X|.8.!<..p^X=............Xo...g............).}:z..T.P.
..cY..t...1000.....z.....|......J.Dp.T.).JA01N... ..x)..nl<.....x..
..L`.x......P...,...h@%\|[email protected]...`P.........3".v..IP..X....
....:..>x.. ."8.NaR.....%.M.........P.[.....6.V.?...O......x.......
.T..O...sa....../.oL.&...r....39.n........u.....K...G..UF..!<|.
<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: hiido_ui=0.20794194939660737; hdjs_ui=0.9037752212777944; hdjs_session_id=0.4559120123177925; hdjs_session_time=1465062549724

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:49:07 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 17:49:05 GMT

Content-Encoding: gzip
1f20...............w.G.?.s.Z..A.g.$Y'.........9nyLd<..Y..$,.zx.6...
....mLB....6I0.H0.....r....r..[....j.3..8P.....k.O.].k....,&...T ..s..
..}....'....G...|.....x...?....t3].N.....>.*...T)U..$..>U....&.2
.xc.S...R.....r.t)u .'.].4(}.........y.D..|....DO.....8..?P..(c..h...3
..d...J.r.Lr.'9S.....E..{.S......k.....`..A|j..B...2W.m h....G{......?
.9}K.}......@;."..T...A..Lr....S..S...L..R,...;<.=07.......Rf.....R
..J.....H..J...Bj6....w.}[email protected][email protected]....`...e&....Ti&
gt;..'....A.OO>S....v...3|.. .._yZ..A.;P]. \...,..../...x),..V.W./K
.....g.}........dJj.......<-,.....6.........._.....i.E...........;.
..G[....p.vi.v.:(4._k<?..[...K.....{g.?.,l..>_.....p.|L:3../=.V6
.[V.2...Z..C..G....B......3...-..e..Hw.......s./....;O.././.........s.
. .................i.R..s.r:...Wm...r9...1..J....B(..P......&YG.eQ..24
..D19.....^..<P,.@.\S!K., .8.#........#j.me..L9....G...._.m.......9
.j}............b.v.........K.|....&......>.....).i.../=......T~".Tp
.7.^g*.0.........o..&J\~...p..J.O..h..6.([email protected]~.......g.OR....^D
.f.s...{w..3..9>0....!..Qb..v..@..|Z....\q..@:.L.....)..`|C.....3..
..x8.9.H....G].T..t.|y.;./OA....7M..$..pZ......vxU..R8q..U...6....^..8
^[....Xus..|@8..qdSxp....v..?[...../^{..X[....o.S..........t..K.8.4...
.. ...d...(.L.s.J.{O8(....Rq..*...8........I(v...x.||.......=......w@.
K3.,.G...p.Y.........q.9...n..A...3 .e......v.2IP.X,.....`w.....^.....
..C.."...xIlS....::SP.jrKw...o.oU..._~"W.,...'.ni.A..I..xa....[7~.....
.1...i....3]fr`..p.os.....!.?..T.........Kx..q.[...*[email protected]....(..
<<< skipped >>>

GET /j.gif?act=webstat&ht=VVV.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=<=&xy=&ext=&v=v0.8.0&pl=http://VVV.yy.com/136724&hsid=0.4559120123177925&io=1&ut=1465062581068&rnd=0.90377522127779441465062581068 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

Cookie: hiido_mid=14650625393270664410100017

HTTP/1.1 200 OK 

Content-type: image/gif

Content-Length: 35

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA div COM NAV OTC NOI DSP COR

Set-Cookie: hiido_mid=14650625393270664410100017; Path=/; expires=Mon, 25-Aug-25 10:20:28 GMT 
GIF89a.............,...........D..;..

GET /j.gif?act=webstat&ht=VVV.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=<=&xy=&ext=&v=v0.8.0&pl=http://VVV.yy.com/210075&hsid=0.4215254752462996&io=1&ut=1465062570708&rnd=0.90377522127779441465062570708 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

Cookie: hiido_mid=14650625393270664410100017

HTTP/1.1 200 OK 

Content-type: image/gif

Content-Length: 35

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA div COM NAV OTC NOI DSP COR

Set-Cookie: hiido_mid=14650625393270664410100017; Path=/; expires=Mon, 25-Aug-25 10:20:28 GMT 
GIF89a.............,...........D..;..

GET /j.gif?act=webstat&ht=VVV.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=<=&xy=&ext=&v=v0.8.0&pl=http://VVV.yy.com/210075&hsid=0.4215254752462996&io=1&ut=1465062580864&rnd=0.90377522127779441465062580864 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

Cookie: hiido_mid=14650625393270664410100017

HTTP/1.1 200 OK 

Content-type: image/gif

Content-Length: 35

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA div COM NAV OTC NOI DSP COR

Set-Cookie: hiido_mid=14650625393270664410100017; Path=/; expires=Mon, 25-Aug-25 10:20:28 GMT 
GIF89a.............,...........D..;..

GET /j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062564114&wd=0&passport=&sns=null&pcmb=1&pl=http://VVV.yy.com/136724&v=T20160526.01&rnd=0.207941949396607371465062564114 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

Cookie: hiido_mid=14650625393270664410100017

HTTP/1.1 200 OK 

Content-type: image/gif

Content-Length: 35

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA div COM NAV OTC NOI DSP COR

Set-Cookie: hiido_mid=14650625393270664410100017; Path=/; expires=Mon, 25-Aug-25 10:20:28 GMT 
GIF89a.............,...........D..;..

GET /j.gif?act=webstat&ht=VVV.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=<=6953&xy=&ext=&v=v0.8.0&pl=http://VVV.yy.com/210075&hsid=0.4215254752462996&io=0&ut=1465062562724&rnd=0.90377522127779441465062562724 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

Cookie: hiido_mid=14650625393270664410100017

HTTP/1.1 200 OK 

Content-type: image/gif

Content-Length: 35

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA div COM NAV OTC NOI DSP COR

Set-Cookie: hiido_mid=14650625393270664410100017; Path=/; expires=Mon, 25-Aug-25 10:20:28 GMT 
GIF89a.............,...........D..;..

GET /cm/user?time=1465062548&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.hiido.cn

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: nginx

Date: Sat, 04 Jun 2016 17:49:00 GMT

Content-Type: text/plain; charset=UTF-8

Content-Length: 0

Connection: keep-alive

Location: hXXp://cm.hiido.cn/cm/user?hi_tc=1&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Set-Cookie: cm_ui="buCLmnR1GIMVgMVaX93GCw==|0.6"; Expires=Thu, 01 Dec 2016 17:49:00 GMT; Path=/
....


GET /cm/user?hi_tc=1&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|& HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.hiido.cn

Connection: Keep-Alive

Cookie: cm_ui="buCLmnR1GIMVgMVaX93GCw==|0.6"

HTTP/1.1 302 Found

Server: nginx

Date: Sat, 04 Jun 2016 17:49:00 GMT

Content-Type: text/plain; charset=UTF-8

Content-Length: 0

Connection: keep-alive

Location: hXXp://cms.tanx.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=buCLmnR1GIMVgMVaX93GCw==&hi_cmuiv=0.6&
HTTP/1.1 302 Found..Server: nginx..Date: Sat, 04 Jun 2016 17:49:00 GMT
..Content-Type: text/plain; charset=UTF-8..Content-Length: 0..Connecti
on: keep-alive..Location: hXXp://cms.tanx.com/t.gif?tanx_nid=109887427
&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zd
s=www@yy|&hi_cmui=buCLmnR1GIMVgMVaX93GCw==&hi_cmuiv=0.6&......


GET /cm/adx/tanx?tanx_ver=1&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=buCLmnR1GIMVgMVaX93GCw==&hi_cmuiv=0.6&tanx_tid=mh7AnrnlrII= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.hiido.cn

Connection: Keep-Alive

Cookie: cm_ui="yzwRC8sZVk qFEJH3ShePQ==|0.6"

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:49:05 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Set-Cookie: cm_mapping=tanx|0|1465066145; Expires=Thu, 01 Dec 2016 17:49:05 GMT; Path=/
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: ng
inx..Date: Sat, 04 Jun 2016 17:49:05 GMT..Content-Type: image/gif..Con
tent-Length: 43..Connection: keep-alive..P3P: CP="CURa ADMa DEVa PSAo 
PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Set-Coo
kie: cm_mapping=tanx|0|1465066145; Expires=Thu, 01 Dec 2016 17:49:05 G
MT; Path=/..GIF89a.............!.......,...........L..;....


GET /cm/user?time=1465062564&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.hiido.cn

Connection: Keep-Alive

Cookie: cm_ui="yzwRC8sZVk qFEJH3ShePQ==|0.6"; cm_mapping=tanx|0|1465066145

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:49:14 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: ng
inx..Date: Sat, 04 Jun 2016 17:49:14 GMT..Content-Type: image/gif..Con
tent-Length: 43..Connection: keep-alive..GIF89a.............!.......,.
..........L..;....


GET /cm/user?time=1465062579&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.hiido.cn

Connection: Keep-Alive

Cookie: cm_ui="yzwRC8sZVk qFEJH3ShePQ==|0.6"; cm_mapping=tanx|0|1465066145

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:49:30 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: ng
inx..Date: Sat, 04 Jun 2016 17:49:30 GMT..Content-Type: image/gif..Con
tent-Length: 43..Connection: keep-alive..GIF89a.............!.......,.
..........L..;....


GET /cm/user?time=1465062596&domain=yy.com&zds=www@yy|&hiido_ui=0.20794194939660737 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.hiido.cn

Connection: Keep-Alive

Cookie: cm_ui="yzwRC8sZVk qFEJH3ShePQ==|0.6"; cm_mapping=tanx|0|1465066145

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:49:47 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: ng
inx..Date: Sat, 04 Jun 2016 17:49:47 GMT..Content-Type: image/gif..Con
tent-Length: 43..Connection: keep-alive..GIF89a.............!.......,.
..........L..;..

GET /j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=86415000&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062581&username= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

Cookie: hiido_mid=14650625393270664410100017

HTTP/1.1 200 OK 

Content-type: image/gif

Content-Length: 35

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA div COM NAV OTC NOI DSP COR

Set-Cookie: hiido_mid=14650625393270664410100017; Path=/; expires=Mon, 25-Aug-25 10:20:28 GMT 
GIF89a.............,...........D..;..

GET /j.gif?act=webstat&ht=VVV.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=<=8078&xy=&ext=&v=v0.8.0&pl=http://VVV.yy.com/136724&isnew=1&hsid=0.4559120123177925&io=0&ut=1465062557818&rnd=0.90377522127779441465062557818 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

Cookie: hiido_mid=14650625393270664410100017

HTTP/1.1 200 OK 

Content-type: image/gif

Content-Length: 35

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA div COM NAV OTC NOI DSP COR

Set-Cookie: hiido_mid=14650625393270664410100017; Path=/; expires=Mon, 25-Aug-25 10:20:28 GMT 
GIF89a.............,...........D..;..

GET /j.gif?act=webstat&ht=VVV.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=<=7235&xy=&ext=&v=v0.8.0&pl=http://VVV.yy.com/136724&hsid=0.4559120123177925&io=0&ut=1465062579583&rnd=0.90377522127779441465062579583 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

Cookie: hiido_mid=14650625393270664410100017

HTTP/1.1 200 OK 

Content-type: image/gif

Content-Length: 35

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA div COM NAV OTC NOI DSP COR

Set-Cookie: hiido_mid=14650625393270664410100017; Path=/; expires=Mon, 25-Aug-25 10:20:28 GMT 
GIF89a.............,...........D..;..

GET /r/sc/yycomscene/defaultScene/1/76/gradeIco.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://c2.web.yystatic.com/r/sc/yycomscene/defaultScene/1/76/danmaku.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.web.yystatic.com

Connection: Keep-Alive

Cookie: wyy=cc515ea9f79d46d0a143e95390998e1b; hiido_ui=0.57246662237330648

HTTP/1.1 200 OK

Content-Length: 8475

Content-Type: application/x-shockwave-flash;charset=UTF-8

Last-Modified: Sat,05-Dec-15 05:49:28 GMT

Via: 1.1 db79:5011 (Cdn Cache Server V2.0)

Connection: close
CWS..(..x..zw\S..n...{.ED:!....).b... ..B...4.T...t....D.."HS. U....D.
.....>........"k.........c........,1 ...2`[email protected] .....gm`$...E...
W.".T..NN.00P6PA.Lq..WSS..`..X. B./.D.......h.......L!.P.d...5...O....
W. o.....d..d'..3.[...#'/........).<.L.%...tw.....~.BV.. ...H.....Q
...r.'z..)..k.....\.....b..e0.2..........,.Q.a0.....'..@......#cUm.Up.
5......../:.....?".........3m].........|.8..........W..y].q.d.7......"
:.w........=......].5.~.....02s..z............:..6.. gM.#[email protected].
....'[email protected]...).auU...}.C%yy]..VOOYE.P_Y...O.................d..u/
.%..F.....j....UQ.....nV=#5UU].].}%.....e..)..W...@p1.......<......
..T.2../...dR..........f@..{.../2.oS..51.u..KZ._MPK......i....$.4..0..
PH...FnCv..f.3(h(...q.....SA....Y..].....`1T...sU....t..y...1."f..|fm.
...i............/.....Y./..Y..c.....]...Wl.py.....&~...Q.........5.L.*
[R..ts.v/G.../.S%.,.......q....K.....N.GS.5l..U..o0[6J._..(.=?u..g.,..
'......#..fC..ss..[).*...........20i.[.1p.....D_.k.......z.....I.L....
.$.....!Ni../N.j..4o.g..e)...HN8.l'.....k..R.fWt.. ........]S.F. ..T .
...q...6...i...F.U...)...H..z...n.3...h"'HK-..u.............C....G..'.
".)t....h.&E. .\w.H.Z;t..:...90..EQ....'........$..[....7A....I.......
.>.O..#&.....r#yEB..:......"|.{....c].j...H..O.G..........4(6E$u.D.
..9.......#..HV.....(.x..taV..u.5....V|...C...]...-.........M.7.......
...;^jm1}......;N.....&.I..84..?.'.>..r.....*.u..(8...pK.3*......IX
...c%)....".4.A..T..d..3.n...^H.y..2..g..^..0x..#n...9Yz.Z$........I..
..............3..j#.. ..w...'.E.7.....Q.w..d...U..:J... 5..^.}T\=#
<<< skipped >>>

GET /j.gif?act=webstat&ht=VVV.yy.com&siteid=www@yy&speid=&ui=0.9037752212777944&sc=1276.846&cl=32-bit&pcmb=1&os=win|xp&bs=ie6&mb=&se=&wd=&rfh=&rf=&sns=&fl=-1&ln=&ja=1&ck=1&ot=<=&xy=&ext=&v=v0.8.0&pl=http://VVV.yy.com/136724&hsid=0.4559120123177925&io=1&ut=1465062571677&rnd=0.90377522127779441465062571677 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

Cookie: hiido_mid=14650625393270664410100017

HTTP/1.1 200 OK 

Content-type: image/gif

Content-Length: 35

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA div COM NAV OTC NOI DSP COR

Set-Cookie: hiido_mid=14650625393270664410100017; Path=/; expires=Mon, 25-Aug-25 10:20:28 GMT 
GIF89a.............,...........D..;..

GET /j.gif?act=web&zd=www@yy|&ui=0.20794194939660737&sp=0&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&ut=1465062548411&wd=0&passport=&sns=null&pcmb=1&pl=http://VVV.yy.com/136724&v=T20160526.01&rnd=0.207941949396607371465062548411 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

HTTP/1.1 200 OK 

Content-type: image/gif

Content-Length: 35

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA div COM NAV OTC NOI DSP COR

Set-Cookie: hiido_mid=14650625393270664410500173; Path=/; expires=Mon, 25-Aug-25 10:20:28 GMT 
GIF89a.............,...........D..;..

5....2.... ...}...Y..%G&.."eR...`y..q....,...........



0....3.... .....9s.&.|.........u..&4..Y.<.'.......



..\..k..Lu..e74ec...~5t...... .:....l.......M8*0..G.~.mG...YBha....s..
..0m...^...(....<.....l..M..)....6]...q.....%



).\..j..Lu...z4eR[...5t......oC...5.T.......NH^0..[.5.-.....{.4....&..
..9;...;........n...x......y.o.....y....V].0-U..0.j..3KcM.e.....:.....
.Ks[L.PF.v.a.0..[.fK$Nu.v.. SE...5f...........o...............}Z;.^zx.
.).\..j..Lu...z4eR[...5t......oC...5.T.......NH^0..[.5.-.....{.4....&.
...9;...;........n...x......y.o.....y....V].0-U..0.j..3KcM.e.....:....
..Ks[L.PF.v.a.0..[.fK$Nu.v.. SE...5f...........o...............}Z;.^zx
....



.-..M.Z.....tfx..b..7..].._h...... l.e.S.9o...L`.h.h ,;#|.Z..ho.-k..Q.
.j.T.......=RTO...1..3..{a........~o....0Ok..C.....S.".j....p.H..UH...
&:c.jV..{l5.{(.%.7........{/.T1.].\.9...u...."..#l.....[......nl .l...
{.. .. 8*.."^.rg.f.......e...I8.qj....".3...c



....1....^&* ..{.....6..X.)..



........[...]....:u..G#J?...s.....k..q.j..-.&V..v.?.T..t.....7k..q.3..
..k{.A.....3..EO.............A.....3e...m.."..A......'..A.3..%....[.m.
[email protected]....^.#.^D.........\.
T.7q..x_Ew.._....:.O:K..........7<..........b.. 0-.|.}..fEP|g....0.
).{j......._h.I......<\....r....A.b..C>.|nZ.....7....P..........
[email protected]`n=\.O....K"h.....*.....B....QZ.....U.....
/....w......t...e............. ........w..>.f....P..*.g...g.,.h.<
;.(qH.....X....#..N...k.$.!....N.U..'.g.....R.a...W.lO"U.



G.^*.B.p.K..Q.#..&4c.j\..{.&....3w"j......|...._....G:X....0......'|0.
.....u.....w...X..(.7.wG.^*.B.p.K..Q.#..&4c.j\..{.&....3w"j......|....
_....G:X....0......'|0......u.....w...X..(.7.w.t.X...?....n.92&..M4..?
..~.Ix:|..O.}.R. .*?.......ot...9M..??. .w..F....:..%.n..p..fw..K].-s.
..e.NW5w..#.b....]I.A..y../;..N...6........w......3s.....`=..L......].
@.....w....[.m..........,q.(...N..M......T............wJ....O.._....Y.
..^D.........m...yv..KQ...s_....:.4&........t..(2.........v"....,.|.z.
.fEP.g....0xB...V......-h.I......<\....r....A.b..C>.|nZ.....7...
.P..........p4g..>.pvB`r.../rps."......r`n...2....O#h.fx.?(.t.X...?
....n.92&..M4..?..~.Ix:|..O.}.R. .*?.......ot...9M..??. .w..F....:..%.
n..p..fw..K].-s...e.NW5w..#.b....]I.A..y../;..N...6........w......3s..
...`=..L......][email protected]....[.m..........,q.(...N..M......T............
wJ....O.._....Y...^D.........m...yv..KQ...s_....:.4&........t..(2.....
....v"....,.|.z..fEP.g....0xB...V......-h.I......<\....r....A.b..C&
gt;.|nZ.....7....P..........p4g..>.pvB`r.../rps."......r`n...2....O
#h.fx.?(........<.QZ....,U[....[...G.......b...q..........r..#.....
...w..m......P.vF.........i.;..qH/....X...\ ..N.....d......x.`....co..
...;X.."l.Tv_,...B2.W...*......H....6.-F..uk#kE...38Y....3pi..........
..<.QZ....,U[....[...G.......b...q..........r..#........w..m......P
.vF.........i.;..qH/....X...\ ..N.....d......x.`....co.....;X.."l.Tv_,
...B2.W...*......H....6.-F..uk#kE...38Y....3pi......



...7....j,......H.%..6.Y..r..^.....Gk]....3y...8......G..t..f..L...5..
Q..l.L...7(CnX.."..O(.q(.W{..F .....[.....Sg(...}Y&..o.C..k.X..$?..`.-
'T......ay:J.WE4...E$<FE..?....48Z.v..!t..>.b.GJb#*.&.Y.~....e."
..6.&......SSF...*.....e'..D0/"h.."V){........DRR.....?....T..-kx.....
.V......T}|..}5..}..<.8.L;...X.o#.\<..7...-,..M:.$j.*.  .;.._.Z.
..`..d...C.5..:b...t.U...M.lZ..o.....S..h..q.d.....c.fF.-J'.z.v...Cq..
9.I.dJZ0.A4Dl....<.8CQ....b..X....



i.........Ng..s.=.f..Q .4.~.C.6*@og.....O(.p?....m......7...y...<z.
..*0...X.B..[.Y...2..d.n&U....!.iM#z#Vi....t.x.w8..".....c.N.{Y...FK8i
.........Ng..s.=.f..Q .4.~.C.6*@og.....O(.p?....m......7...y...<z..
.*0...X.B..[.Y...2..d.n&U....!.iM#z#Vi....t.x.w8..".....c.N.{Y...FK8mN
J.(w.].Y.~..8...=..5.&9.....'.n...*....KBp3Icg "k..!W)k....6bX..).....
.8.t..,.2.imNJ.(w.].Y.~..8...=..5.&9.....'.n...*....KBp3Icg "k..!W)k..
..6bX..)......8.t..,.2.i..



..M...<..........F....c..a[q.].U"z.:.Zt.I\...n.]..>...`.>d.*.
.}.....[>..6O%f./....E.ez.....N.=.y...-......hq..T4G....mN..!;.[..E
j],tjH......j...d0.7.".e./....5.U{....d....Z.4....O..h......."..r..wAT
...S.0)j]....D.Q..z.:&.^.a.E.@...(......').).T.m.VE..:.o.$..0.$T&.M'9K
*.).....4..`..\..p6.C..h%....,...}O.z...........Y9Dj..E6..r..o.xT..nPX
..i.L........!`....A.M...][email protected]"'..t. .I.F!..G.......~.f
..=.h..O.(.,\.....8=.<...y..b........g..NH [email protected]&..<y.4..CM
.(.........$e



.......".....I....R}5./.H..N..i;...:.ofo.5...b..-*.....Yk.*.' MSf.1.6.
..X..d...C.5..:b....WR....R.a....(...b5.'."B.......".....I....R}5./.H.
.N..i;...:.ofo.5...b..-*.....Yk.*.' MSf.1.6...X..d...C.5..:b....WR....
R.a....(...b5.'."B."...h.Qq^t.Yu.G..][email protected]....
.)',..:.....n........be.nC....X..e.p4X.(q_.D.\..I]...t........b.>..
...}.....S8..N7.d."...h.Qq^t.Yu.G..][email protected].....
)',..:.....n........be.nC....X..e.p4X.(q_.D.\..I]...t........b.>...
..}.....S8..N7.d

GET /s/72578111/72578111/yycomscene.swf HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weblbs.yystatic.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Access-Control-Allow-Credentials: true

Access-Control-Allow-Methods: GET

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 600

Connection: keep-alive

Content-Length: 0

Content-type: text/html

Location: hXXp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtuna=1&referer=http://VVV.yy.com/136724
HTTP/1.1 302 Found..Access-Control-Allow-Credentials: true..Access-Con
trol-Allow-Methods: GET..Access-Control-Allow-Origin: *..Access-Contro
l-Max-Age: 600..Connection: keep-alive..Content-Length: 0..Content-typ
e: text/html..Location: hXXp://c2.web.yystatic.com/r/rc/yycomscene/mai
n/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtun
a=1&referer=http://VVV.yy.com/136724......


GET /s/72578111/72578111/yycomscene.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.yy.com/136724

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weblbs.yystatic.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Access-Control-Allow-Credentials: true

Access-Control-Allow-Methods: GET

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 600

Connection: keep-alive

Content-Length: 0

Content-type: text/html

Location: hXXp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtuna=1&referer=http://VVV.yy.com/136724
....


GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weblbs.yystatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Connection: keep-alive

Content-Length: 260

Content-type: text/html

Last-Modified: Sat,05-Dec-15 05:49:08 GMT
...<?xml version="1.0"?>.<cross-domain-policy>..<site-c
ontrol permitted-cross-domain-policies="all"/>..<allow-http-requ
est-headers-from domain="*" headers="*" secure="false"/>..<allow
-access-from domain="*" secure="false" to-ports="*" />.</cross-d
omain-policy>....


GET //get-data/72578111?subSid=72578111&type=yycomscene&referer=hXXp://VVV.yy.com/136724&_=32552383 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtuna=1&referer=http:/%2

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weblbs.yystatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Credentials: true

Access-Control-Allow-Methods: GET

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 600

Connection: keep-alive

Content-Encoding: gzip

Content-Length: 810

Content-type: text/html

Set-Cookie: wyy=192e7f4eb03c434c9cb751dc5e3cbc4f;Path=/;Domain=yystatic.com;Expires=Sun,04-Jun-17 17:49:08 GMT

Set-Cookie: hiido_ui=0.02169874264937767;Path=/;Domain=yystatic.com;Expires=Sun,04-Jun-17 17:49:08 GMT
...........U...F.}.g.f.L......BH..@``^.....#......e.=....l.d6.[TW.:].&
gt;U.R..!.U.......K..U]!"3.i`..T}7Le.....?>o.0..,g..qk....pV0.Df..O
@4.-.......@.].. . ).u..3.....ZSB....(..$H._..,H...q.4.h...7U..D..i...
6 ;...N...6.....v.....1.C...-l.-.k.=Q.............u$..}.a.1..........~
7&r.m.>.-...G....Z:a.6..R*'..:......'rk.M.I......4*.'|....2Z..h....
.z.)[email protected]>...2VE..4Y.....YYh\.....0.G..Fa...."F.....E.F.T
0Z.K.!'.M...1.....)T...u>...?vs. ..|.......c\%......f...dG....."S..
8.OJ..).......8.......ib....0.......K..&...E..a......X.H-....I..n.']..
....>V/..n l....R<9...tQ....h.A.!....K..]...T.C}_......{...[.o).
:.*....... ..._.?#.ku.;..)S%.. ...S...An...o..A.".....b}H.i>.;.=gpW
....n...\..C...|S..../.,.....*...z}..KFU...io...C)..CC.f..4...g?OOo.d.
S...:.>......c........z?....x:-....25\.)dp.1.h.$.. s........U...HTT
P/1.1 200 OK..Access-Control-Allow-Credentials: true..Access-Control-A
llow-Methods: GET..Access-Control-Allow-Origin: *..Access-Control-Max-
Age: 600..Connection: keep-alive..Content-Encoding: gzip..Content-Leng
th: 810..Content-type: text/html..Set-Cookie: wyy=192e7f4eb03c434c9cb7
51dc5e3cbc4f;Path=/;Domain=yystatic.com;Expires=Sun,04-Jun-17 17:49:08
 GMT..Set-Cookie: hiido_ui=0.02169874264937767;Path=/;Domain=yystatic.
com;Expires=Sun,04-Jun-17 17:49:08 GMT.............U...F.}.g.f.L......
BH..@``^.....#......e.=....l.d6.[TW.:].>U.R..!.U.......K..U]!"3.i`.
.T}7Le.....?>o.0..,[email protected].......@.].. . ).u..3.....
ZSB....(..$H._..,H...q.4.h...7U..D..i...6 ;...N...6.....v.....1.C.
<<< skipped >>>

GET /s/72578111/72578111/yycomscene.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.yy.com/136724

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weblbs.yystatic.com

Connection: Keep-Alive

Cookie: wyy=cc515ea9f79d46d0a143e95390998e1b; hiido_ui=0.57246662237330648

HTTP/1.1 302 Found

Access-Control-Allow-Credentials: true

Access-Control-Allow-Methods: GET

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 600

Connection: keep-alive

Content-Length: 0

Content-type: text/html

Location: hXXp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtuna=1&referer=http://VVV.yy.com/136724
HTTP/1.1 302 Found..Access-Control-Allow-Credentials: true..Access-Con
trol-Allow-Methods: GET..Access-Control-Allow-Origin: *..Access-Contro
l-Max-Age: 600..Connection: keep-alive..Content-Length: 0..Content-typ
e: text/html..Location: hXXp://c2.web.yystatic.com/r/rc/yycomscene/mai
n/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtun
a=1&referer=http://VVV.yy.com/136724......


GET /s/72578111/72578111/yycomscene.swf HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weblbs.yystatic.com

Connection: Keep-Alive

Cookie: wyy=cc515ea9f79d46d0a143e95390998e1b; hiido_ui=0.57246662237330648

HTTP/1.1 302 Found

Access-Control-Allow-Credentials: true

Access-Control-Allow-Methods: GET

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 600

Connection: keep-alive

Content-Length: 0

Content-type: text/html

Location: hXXp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtuna=1&referer=http://VVV.yy.com/136724
HTTP/1.1 302 Found..Access-Control-Allow-Credentials: true..Access-Con
trol-Allow-Methods: GET..Access-Control-Allow-Origin: *..Access-Contro
l-Max-Age: 600..Connection: keep-alive..Content-Length: 0..Content-typ
e: text/html..Location: hXXp://c2.web.yystatic.com/r/rc/yycomscene/mai
n/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtun
a=1&referer=http://VVV.yy.com/136724......


GET //get-data/72578111?subSid=72578111&type=yycomscene&referer=hXXp://VVV.yy.com/136724&_=20658772 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtuna=1&referer=http:/%2

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weblbs.yystatic.com

Connection: Keep-Alive

Cookie: wyy=cc515ea9f79d46d0a143e95390998e1b; hiido_ui=0.57246662237330648

HTTP/1.1 200 OK

Access-Control-Allow-Credentials: true

Access-Control-Allow-Methods: GET

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 600

Connection: keep-alive

Content-Encoding: gzip

Content-Length: 798

Content-type: text/html
...........U...G.}.g..>.VW.}`1....@`a_.1}..`I3...0..TK..H..N^F...N.
....^..).U. [email protected]*...,.........e`....:N@._.`.......d
.........#,.H...t.....-.f.K.,@yS.4K.(@q...-..U..!..y..z....9..a...F...
zX.q}8.r.y..%c.kp......Sn...........e&..}.a..!.g?>.)wU....)....<
.T.3ePj.....ki)...'.JdN3.........&f."80Vz-#X..Qq.6.h....a.....D...h|c!
j.<d.=(...:Q.l9W.4@~l..<.$....i...E.J.. ....(r.......Nx..0.A*.D.
.....E....@.\...|jw_~.......e}.......*...p\..,.S....R1].O....?)..<n
WX...d.9-....?.&Vi..L.kRS.tI.%I_.........m...c.j....X...#pzY..|..<.
/..x.....I.*..3.b...PN.$B4.1..c..q.....b.z_?.%2.M.....y...............
......oH.Z]...Cn...........W.....mz0.....q...].O..?..Y.C..'....wx.6..Q
/........l."..n.R..r...IQU.H"..5_DHb.u.../.......<=.U..L..iu.>.B
.......C.r.O..c..B..........{(I...).S.q.l.P...o...ZW...HTTP/1.1 200 OK
..Access-Control-Allow-Credentials: true..Access-Control-Allow-Methods
: GET..Access-Control-Allow-Origin: *..Access-Control-Max-Age: 600..Co
nnection: keep-alive..Content-Encoding: gzip..Content-Length: 798..Con
tent-type: text/html.............U...G.}.g..>.VW.}`1....@`a_.1}..`I
3...0..TK..H..N^F...N.....^..).U. [email protected]*...,........
.e`....:N@._.`.......d.........#,.H...t.....-.f.K.,@yS.4K.(@q...-..U..
!..y..z....9..a...F...zX.q}8.r.y..%c.kp......Sn...........e&..}.a..!.g
?>.)wU....)....<.T.3ePj.....ki)...'.JdN3.........&f."80Vz-#X..Qq
.6.h....a.....D...h|c!j.<d.=(...:Q.l9W.4@~l..<.$....i...E.J.. ..
..(r.......Nx..0.A*.D......E....@.\...|jw_~.......e}.......*...p\.
<<< skipped >>>

GET /s/72578111/72578111/yycomscene.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.yy.com/136724

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weblbs.yystatic.com

Connection: Keep-Alive

Cookie: wyy=cc515ea9f79d46d0a143e95390998e1b; hiido_ui=0.57246662237330648

HTTP/1.1 302 Found

Access-Control-Allow-Credentials: true

Access-Control-Allow-Methods: GET

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 600

Connection: keep-alive

Content-Length: 0

Content-type: text/html

Location: hXXp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtuna=1&referer=http://VVV.yy.com/136724
HTTP/1.1 302 Found..Access-Control-Allow-Credentials: true..Access-Con
trol-Allow-Methods: GET..Access-Control-Allow-Origin: *..Access-Contro
l-Max-Age: 600..Connection: keep-alive..Content-Length: 0..Content-typ
e: text/html..Location: hXXp://c2.web.yystatic.com/r/rc/yycomscene/mai
n/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtun
a=1&referer=http://VVV.yy.com/136724......


GET /s/72578111/72578111/yycomscene.swf HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weblbs.yystatic.com

Connection: Keep-Alive

Cookie: wyy=cc515ea9f79d46d0a143e95390998e1b; hiido_ui=0.57246662237330648

HTTP/1.1 302 Found

Access-Control-Allow-Credentials: true

Access-Control-Allow-Methods: GET

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 600

Connection: keep-alive

Content-Length: 0

Content-type: text/html

Location: hXXp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtuna=1&referer=http://VVV.yy.com/136724
HTTP/1.1 302 Found..Access-Control-Allow-Credentials: true..Access-Con
trol-Allow-Methods: GET..Access-Control-Allow-Origin: *..Access-Contro
l-Max-Age: 600..Connection: keep-alive..Content-Length: 0..Content-typ
e: text/html..Location: hXXp://c2.web.yystatic.com/r/rc/yycomscene/mai
n/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtun
a=1&referer=http://VVV.yy.com/136724......


GET //get-data/72578111?subSid=72578111&type=yycomscene&referer=hXXp://VVV.yy.com/136724&_=34825432 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtuna=1&referer=http:/%2

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weblbs.yystatic.com

Connection: Keep-Alive

Cookie: wyy=cc515ea9f79d46d0a143e95390998e1b; hiido_ui=0.57246662237330648

HTTP/1.1 200 OK

Access-Control-Allow-Credentials: true

Access-Control-Allow-Methods: GET

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 600

Connection: keep-alive

Content-Encoding: gzip

Content-Length: 799

Content-type: text/html
...........U...A.}.3.v.B....E.Q|...}...T..If..1..n.$.N........NUW...Q.
....f ......j......KN.3D.jUum?.}.W.Z.....i.a..m/....#.sN. ..K.-0....pM
.2.9.D...Of.K.(8.Hl....<.\.]I.....vKJ[(..H..B~ZU.........u.d.......
&..n........!...%b..........d?m......pF..DZ..<d.g....].....7...iR.y
j0.%.p...\.!...#..pr..............A...3V.`@...,P...&......Ny.... P.E.Q
.."0..5HbLpR..R.!....O.....,,3..Iu.c...9.........h2uBQ.*..X9.eL.....P.
...f....M.S...w7w.........ov..U"...l=.,.Sq"m.&Q&n......4 ..^....A.Ni..
/..k.IQ.\....X]..%..({.j/......m.N..T..G..C..2.8.F:j......T..}.#..&.Ux
e.....((.u.!..7.PBQdQ..6.].j..o........4m.3}s..1.yn.<d.>^....B..
#.V...}..;...T^...n.!.c..6..pUd...)..w.....a...nJ. ......saCl.......|}
.e..B...!....I......$..\...K,..>:L. ..E:.i..n%3.k.G..}*.......W=`:.
..wC7.!.....Q1..e...J..H.N.G...B.../3.g.W...HTTP/1.1 200 OK..Access-Co
ntrol-Allow-Credentials: true..Access-Control-Allow-Methods: GET..Acce
ss-Control-Allow-Origin: *..Access-Control-Max-Age: 600..Connection: k
eep-alive..Content-Encoding: gzip..Content-Length: 799..Content-type: 
text/html.............U...A.}.3.v.B....E.Q|...}...T..If..1..n.$.N.....
...NUW...Q.....f ......j......KN.3D.jUum?.}.W.Z.....i.a..m/....#.sN. .
.K.-0....pM.2.9.D...Of.K.(8.Hl....<.\.]I.....vKJ[(..H..B~ZU........
.u.d.......&..n........!...%b..........d?m......pF..DZ..<d.g....]..
...7...iR.yj0.%.p...\.!...#..pr..............A...3V.`@...,P...&......N
y.... P.E.Q.."0..5HbLpR..R.!....O.....,,3..Iu.c...9.........h2uBQ.*..X
9.eL.....P....f....M.S...w7w.........ov..U"...l=.,.Sq"m.&Q&n......
<<< skipped >>>

GET /s/72578111/72578111/yycomscene.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.yy.com/136724

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weblbs.yystatic.com

Connection: Keep-Alive

Cookie: wyy=cc515ea9f79d46d0a143e95390998e1b; hiido_ui=0.57246662237330648

HTTP/1.1 302 Found

Access-Control-Allow-Credentials: true

Access-Control-Allow-Methods: GET

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 600

Connection: keep-alive

Content-Length: 0

Content-type: text/html

Location: hXXp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtuna=1&referer=http://VVV.yy.com/136724
HTTP/1.1 302 Found..Access-Control-Allow-Credentials: true..Access-Con
trol-Allow-Methods: GET..Access-Control-Allow-Origin: *..Access-Contro
l-Max-Age: 600..Connection: keep-alive..Content-Length: 0..Content-typ
e: text/html..Location: hXXp://c2.web.yystatic.com/r/rc/yycomscene/mai
n/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtun
a=1&referer=http://VVV.yy.com/136724......


GET /s/72578111/72578111/yycomscene.swf HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weblbs.yystatic.com

Connection: Keep-Alive

Cookie: wyy=cc515ea9f79d46d0a143e95390998e1b; hiido_ui=0.57246662237330648

HTTP/1.1 302 Found

Access-Control-Allow-Credentials: true

Access-Control-Allow-Methods: GET

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 600

Connection: keep-alive

Content-Length: 0

Content-type: text/html

Location: hXXp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtuna=1&referer=http://VVV.yy.com/136724
HTTP/1.1 302 Found..Access-Control-Allow-Credentials: true..Access-Con
trol-Allow-Methods: GET..Access-Control-Allow-Origin: *..Access-Contro
l-Max-Age: 600..Connection: keep-alive..Content-Length: 0..Content-typ
e: text/html..Location: hXXp://c2.web.yystatic.com/r/rc/yycomscene/mai
n/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtun
a=1&referer=http://VVV.yy.com/136724......


GET //get-data/72578111?subSid=72578111&type=yycomscene&referer=hXXp://VVV.yy.com/136724&_=9648186 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=72578111&subSid=72578111&newtuna=1&referer=http:/%2

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weblbs.yystatic.com

Connection: Keep-Alive

Cookie: wyy=cc515ea9f79d46d0a143e95390998e1b; hiido_ui=0.57246662237330648

HTTP/1.1 200 OK

Access-Control-Allow-Credentials: true

Access-Control-Allow-Methods: GET

Access-Control-Allow-Origin: *

Access-Control-Max-Age: 600

Connection: keep-alive

Content-Encoding: gzip

Content-Length: 790

Content-type: text/html
...........U]..:.}..0.>.E...dX..KK....})e.%.k....MC.....v.Phz.....9
3..Q...{H}Q....(?~/..(.!.3.!0.....~.Q.W.[...... ...-.|...(_....]...@..
b....d....K$d$,*.&,.#.....t..*~e....~Z....A... .. .>U.p.F?6..v...}X
..d.!..:g.a.n.X...:..O..>#.D7..-3................e.7C"G...qj..g....
BH#%Ge).8...P.9d..w.....7uH2...c.D.!:T(."g.A#...<.....F...Q!H.....Z
:x.......Cw.j....Q..........k..p....'...B.kS.0..@....!$...t&..TE=T..&l
t;:.RV.*7........)......|.....W..*..z.Y..&}.R.f.(6...I.J..(eW".,}H.S\.
.e....U....\....9.s.^..e<...o......E)hE.0.5.k..2Nse..>..sq.....E
eb.Z....].*[email protected]=."}[..,.r_...3U.&.o...f..a/sh...y..m. .*...WA
../|'.>.4...J..........v.M.3B.....T..wi?N;......r....F...scCh#.....
.|.7..5...-R.._.O.>vT..-.....<.b~u.....b0 ....tm'3.z.G.T}..^.I.!
...D....wC7.=.............#..drZ:..MP.?^...C.hT...HTTP/1.1 200 OK..Acc
ess-Control-Allow-Credentials: true..Access-Control-Allow-Methods: GET
..Access-Control-Allow-Origin: *..Access-Control-Max-Age: 600..Connect
ion: keep-alive..Content-Encoding: gzip..Content-Length: 790..Content-
type: text/html.............U]..:.}..0.>.E...dX..KK....})e.%.k....M
C.....v.Phz.....93..Q...{H}Q....(?~/..(.!.3.!0.....~.Q.W.[...... ...-.
|...(_....][email protected]$d$,*.&,.#.....t..*~e....~Z....A... .. .&g
t;U.p.F?6..v...}X..d.!..:g.a.n.X...:..O..>#.D7..-3................e
.7C"G...qj..g....BH#%Ge).8...P.9d..w.....7uH2...c.D.!:T(."g.A#...<.
....F...Q!H.....Z:x.......Cw.j....Q..........k..p....'...B.kS.0..@....
!$...t&..TE=T..<:.RV.*7........)......|.....W..*..z.Y..&}.R.f.(
<<< skipped >>>

GET /j.gif?act=webevent&eventid=10008953&value=1&sys=3&uid=0&ui=0.20794194939660737&sid=86415000&act_type=1&source=0_0&bak1=0_0&parm1=0&time=1465062587&username= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

Cookie: hiido_mid=14650625393270664410100017

HTTP/1.1 200 OK 

Content-type: image/gif

Content-Length: 35

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA div COM NAV OTC NOI DSP COR

Set-Cookie: hiido_mid=14650625393270664410100017; Path=/; expires=Mon, 25-Aug-25 10:20:28 GMT 
GIF89a.............,...........D..;..

GET /r/sc/yycomscene/defaultScene/1/76/defaultScene.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=86415000&subSid=86415000&newtuna=1&referer=http:/%2

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.web.yystatic.com

Connection: Keep-Alive

Cookie: wyy=cc515ea9f79d46d0a143e95390998e1b; hiido_ui=0.57246662237330648

HTTP/1.1 200 OK

Content-Length: 28691

Content-Type: application/x-shockwave-flash;charset=UTF-8

Last-Modified: Sat,05-Dec-15 05:49:13 GMT

Via: 1.1 db80:82 (Cdn Cache Server V2.0)

Connection: close
CWS.X...x...y|.E.?.....=.;.b..*........!....s ...$.$.I&.L..~...*.%....
r.... .x_.P.....o..~.{&.............x.........1....$.T.t..O>MQ...~.
...`eUvq...c.j.C..]..&.n...{....F_. ......./....w..=!.3.T....Y.:..U2..
.PE......3..-.4........".iCc.VfYY..W.....C......* ....:o.*oCC...K....3
T...i.w..gU.7TsE..AJ...k}W.4x j|..j}c2sZ.Ka[.d [.y.S.*.....e.d.X9J..X^
.............A.0.X_....AJV..y..?M...$....Fo..*_...DFG.d..a.U}..\......
e.. z...'.={..?.#~....?~.:.G....Xs.EP.E9......:..U..}.J_...6\B.ew.o_U.
...z.|}.$...IAV...`.......T5.0-.;.~...f.m|...>G.o-E...WfT..z55... .
U...z....`.....9C...p.__./..W.?.P.m2J....O...j}.zs@c}.U.#m|.[...F_E...
..%x..#.........&_.e.\...Y..E.....!...P.U..V....U.8[.7.4S...Y'/z.:o=.&
.?bD.o.;..Y#F..x..}......Ua...9..|.0TSkDr...C...4..}&.M..#F.%..(...#..
.u.,...TJ1b......A........*.5..5.............J6. ?.v..(..o}...y..5..fh
.......AE...n.Q......._...6....q4....z..Z..^....}A......L...I2.0.C..?o
W;....c.......zh.?.Z.6.v..........."ul....8.?d.RbD.....)y..a.J_@j.....
.CT]..S.....(......i.:_....\.......Q..jG..%...n.'.."...(_.1L..Kv.,.e'.
...B_.....31W..A0tm..C..g.-.].^...^A_5./)...X.eow9AU....^....!h.4..t..
...m. ....$.....I.....>..D.v'V..]CB.%.uuP)..u..@r>5...6.gk..j...
.aqC....F......J.4.....4X...>.......*..z....a.8{....r..ol..|"......
W...G^..n.y.;..#].v.......cF......i`....*.......7...*...... .m.,faLE.%
...!.P....... ._F........zh.\e...>..........vrJ..A..Al.55E..9...1..
.\RTX...W...}f>....g.|.fGd../..B.e1Z....X.1......tCN...&.Rhz.E.W.).
...df...Jy...fGd........N...]......$........N'..W....rI...b_]`....
<<< skipped >>>

GET /zone/1371549646 HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Sat, 04 Jun 2016 17:48:53 GMT

Content-Type: text/html

Content-Length: 154

Connection: keep-alive

Location: hXXp://m.yy.com/zone/1371549646/
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>......


GET /zone/1371549646/ HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:48:53 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 17:48:53 GMT
f11..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta ht
tp-equiv="Content-Type" content="text/html; charset=utf-8" />..<
title>YY............ [email protected]...</title>..<
;meta name="keywords" content=".......................................
...............YY............"/>..<meta name="description" conte
nt="YY...............YY...........................K...................
.............................YY...YY..................................
......................................................................
................K......m.yy.com" />..<link type="text/css" rel="
stylesheet" href="hXXp://m.yy.com/css/public.css" />..<link type
="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/star.css" />
..<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/
album.css" />..<link type="text/css" rel="stylesheet" href="http
://m.yy.com/css/uiwidget-popup.css" />..<link type="text/css" re
l="stylesheet" href="hXXp://m.yy.com/css/uiwidget-pagebar.css" />..
<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/ui
widget-messagebox.css"/>..<link type="text/css" rel="stylesheet"
 href="hXXp://m.yy.com/css/zone-index-pagebar.css"/>..<link type
="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/jplayer.blue.mo
nday.css"/>..<link type="text/css" rel="stylesheet" href="ht
<<< skipped >>>

GET /zone/1371549646 HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Sat, 04 Jun 2016 17:48:54 GMT

Content-Type: text/html

Content-Length: 154

Connection: keep-alive

Location: hXXp://m.yy.com/zone/1371549646/
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>......


GET /zone/1371549646/ HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:48:55 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 17:48:55 GMT
4ca..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta ht
tp-equiv="Content-Type" content="text/html; charset=utf-8" />..<
title>YY............ [email protected]...</title>..<
;meta name="keywords" content=".......................................
...............YY............"/>..<meta name="description" conte
nt="YY...............YY...........................K...................
.............................YY...YY..................................
......................................................................
................K......m.yy.com" />..<link type="text/css" rel="
stylesheet" href="hXXp://m.yy.com/css/public.css" />..<link type
="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/star.css" />
..<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/
album.css" />..<link type="text/css" rel="stylesheet" href="http
://m.yy.com/css/uiwidget-popup.css" />..<link type="text/css" re
l="stylesheet" href="hXXp://m.yy.com/css/uiwidget-pagebar.css" />..
<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/ui
widget-messagebox.css"/>..<link type="text/css" rel=..1000.."sty
lesheet" href="hXXp://m.yy.com/css/zone-index-pagebar.css"/>..<l
ink type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/jplayer
.blue.monday.css"/>..<link type="text/css" rel="stylesheet" 
<<< skipped >>>

GET /zone/1371549646 HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Cookie: hiido_ui=0.20794194939660737; Hm_lvt_c493393610cdccbddc1f124d567e36ab=1465062552; Hm_lpvt_c493393610cdccbddc1f124d567e36ab=1465062552

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Sat, 04 Jun 2016 17:49:03 GMT

Content-Type: text/html

Content-Length: 154

Connection: keep-alive

Location: hXXp://m.yy.com/zone/1371549646/
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>......


GET /zone/1371549646/ HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Cookie: hiido_ui=0.20794194939660737; Hm_lvt_c493393610cdccbddc1f124d567e36ab=1465062552; Hm_lpvt_c493393610cdccbddc1f124d567e36ab=1465062552

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:49:03 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 17:49:03 GMT
f11..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta ht
tp-equiv="Content-Type" content="text/html; charset=utf-8" />..<
title>YY............ [email protected]...</title>..<
;meta name="keywords" content=".......................................
...............YY............"/>..<meta name="description" conte
nt="YY...............YY...........................K...................
.............................YY...YY..................................
......................................................................
................K......m.yy.com" />..<link type="text/css" rel="
stylesheet" href="hXXp://m.yy.com/css/public.css" />..<link type
="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/star.css" />
..<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/
album.css" />..<link type="text/css" rel="stylesheet" href="http
://m.yy.com/css/uiwidget-popup.css" />..<link type="text/css" re
l="stylesheet" href="hXXp://m.yy.com/css/uiwidget-pagebar.css" />..
<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/ui
widget-messagebox.css"/>..<link type="text/css" rel="stylesheet"
 href="hXXp://m.yy.com/css/zone-index-pagebar.css"/>..<link type
="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/jplayer.blue.mo
nday.css"/>..<link type="text/css" rel="stylesheet" href="ht
<<< skipped >>>

GET /zone/1371549646 HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Cookie: Hm_lpvt_c493393610cdccbddc1f124d567e36ab=1465062556; hiido_ui=0.20794194939660737; Hm_lvt_c493393610cdccbddc1f124d567e36ab=1465062552,1465062557

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Sat, 04 Jun 2016 17:49:10 GMT

Content-Type: text/html

Content-Length: 154

Connection: keep-alive

Location: hXXp://m.yy.com/zone/1371549646/
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>......


GET /zone/1371549646/ HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Cookie: Hm_lpvt_c493393610cdccbddc1f124d567e36ab=1465062556; hiido_ui=0.20794194939660737; Hm_lvt_c493393610cdccbddc1f124d567e36ab=1465062552,1465062557

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:49:11 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 17:49:11 GMT
f11..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta ht
tp-equiv="Content-Type" content="text/html; charset=utf-8" />..<
title>YY............ [email protected]...</title>..<
;meta name="keywords" content=".......................................
...............YY............"/>..<meta name="description" conte
nt="YY...............YY...........................K...................
.............................YY...YY..................................
......................................................................
................K......m.yy.com" />..<link type="text/css" rel="
stylesheet" href="hXXp://m.yy.com/css/public.css" />..<link type
="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/star.css" />
..<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/
album.css" />..<link type="text/css" rel="stylesheet" href="http
://m.yy.com/css/uiwidget-popup.css" />..<link type="text/css" re
l="stylesheet" href="hXXp://m.yy.com/css/uiwidget-pagebar.css" />..
<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/ui
widget-messagebox.css"/>..<link type="text/css" rel="stylesheet"
 href="hXXp://m.yy.com/css/zone-index-pagebar.css"/>..<link type
="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/jplayer.blue.mo
nday.css"/>..<link type="text/css" rel="stylesheet" href="ht
<<< skipped >>>

GET /zone/1371549646 HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Cookie: Hm_lpvt_c493393610cdccbddc1f124d567e36ab=1465062564; hiido_ui=0.20794194939660737; Hm_lvt_c493393610cdccbddc1f124d567e36ab=1465062552,1465062557

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Sat, 04 Jun 2016 17:49:18 GMT

Content-Type: text/html

Content-Length: 154

Connection: keep-alive

Location: hXXp://m.yy.com/zone/1371549646/
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>......


GET /zone/1371549646/ HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Cookie: Hm_lpvt_c493393610cdccbddc1f124d567e36ab=1465062564; hiido_ui=0.20794194939660737; Hm_lvt_c493393610cdccbddc1f124d567e36ab=1465062552,1465062557

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:49:19 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 17:49:19 GMT
a79..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta ht
tp-equiv="Content-Type" content="text/html; charset=utf-8" />..<
title>YY............ [email protected]...</title>..<
;meta name="keywords" content=".......................................
...............YY............"/>..<meta name="description" conte
nt="YY...............YY...........................K...................
.............................YY...YY..................................
......................................................................
................K......m.yy.com" />..<link type="text/css" rel="
stylesheet" href="hXXp://m.yy.com/css/public.css" />..<link type
="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/star.css" />
..<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/
album.css" />..<link type="text/css" rel="stylesheet" href="http
://m.yy.com/css/uiwidget-popup.css" />..<link type="text/css" re
l="stylesheet" href="hXXp://m.yy.com/css/uiwidget-pagebar.css" />..
<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/ui
widget-messagebox.css"/>..<link type="text/css" rel="stylesheet"
 href="hXXp://m.yy.com/css/zone-index-pagebar.css"/>..<link type
="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/jplayer.blue.mo
nday.css"/>..<link type="text/css" rel="stylesheet" href="ht
<<< skipped >>>

GET /zone/1371549646 HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Cookie: Hm_lpvt_c493393610cdccbddc1f124d567e36ab=1465062571; hiido_ui=0.20794194939660737; Hm_lvt_c493393610cdccbddc1f124d567e36ab=1465062552,1465062557

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Sat, 04 Jun 2016 17:49:26 GMT

Content-Type: text/html

Content-Length: 154

Connection: keep-alive

Location: hXXp://m.yy.com/zone/1371549646/
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>......


GET /zone/1371549646/ HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Cookie: Hm_lpvt_c493393610cdccbddc1f124d567e36ab=1465062571; hiido_ui=0.20794194939660737; Hm_lvt_c493393610cdccbddc1f124d567e36ab=1465062552,1465062557

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:49:27 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 17:49:27 GMT
f11..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta ht
tp-equiv="Content-Type" content="text/html; charset=utf-8" />..<
title>YY............ [email protected]...</title>..<
;meta name="keywords" content=".......................................
...............YY............"/>..<meta name="description" conte
nt="YY...............YY...........................K...................
.............................YY...YY..................................
......................................................................
................K......m.yy.com" />..<link type="text/css" rel="
stylesheet" href="hXXp://m.yy.com/css/public.css" />..<link type
="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/star.css" />
..<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/
album.css" />..<link type="text/css" rel="stylesheet" href="http
://m.yy.com/css/uiwidget-popup.css" />..<link type="text/css" re
l="stylesheet" href="hXXp://m.yy.com/css/uiwidget-pagebar.css" />..
<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/ui
widget-messagebox.css"/>..<link type="text/css" rel="stylesheet"
 href="hXXp://m.yy.com/css/zone-index-pagebar.css"/>..<link type
="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/jplayer.blue.mo
nday.css"/>..<link type="text/css" rel="stylesheet" href="ht
<<< skipped >>>

GET /zone/1371549646 HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Cookie: Hm_lpvt_c493393610cdccbddc1f124d567e36ab=1465062581; hiido_ui=0.20794194939660737; Hm_lvt_c493393610cdccbddc1f124d567e36ab=1465062552,1465062557

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Sat, 04 Jun 2016 17:49:34 GMT

Content-Type: text/html

Content-Length: 154

Connection: keep-alive

Location: hXXp://m.yy.com/zone/1371549646/
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>......


GET /zone/1371549646/ HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Cookie: Hm_lpvt_c493393610cdccbddc1f124d567e36ab=1465062581; hiido_ui=0.20794194939660737; Hm_lvt_c493393610cdccbddc1f124d567e36ab=1465062552,1465062557

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:49:35 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 17:49:35 GMT
4c5..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta ht
tp-equiv="Content-Type" content="text/html; charset=utf-8" />..<
title>YY............ [email protected]...</title>..<
;meta name="keywords" content=".......................................
...............YY............"/>..<meta name="description" conte
nt="YY...............YY...........................K...................
.............................YY...YY..................................
......................................................................
................K......m.yy.com" />..<link type="text/css" rel="
stylesheet" href="hXXp://m.yy.com/css/public.css" />..<link type
="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/star.css" />
..<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/
album.css" />..<link type="text/css" rel="stylesheet" href="http
://m.yy.com/css/uiwidget-popup.css" />..<link type="text/css" re
l="stylesheet" href="hXXp://m.yy.com/css/uiwidget-pagebar.css" />..
<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/ui
widget-messagebox.css"/>..<link type="text/css"..1000.. rel="sty
lesheet" href="hXXp://m.yy.com/css/zone-index-pagebar.css"/>..<l
ink type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/jplayer
.blue.monday.css"/>..<link type="text/css" rel="stylesheet" 
<<< skipped >>>

GET /zone/1371549646 HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Cookie: Hm_lpvt_c493393610cdccbddc1f124d567e36ab=1465062588; hiido_ui=0.20794194939660737; Hm_lvt_c493393610cdccbddc1f124d567e36ab=1465062552,1465062557

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Sat, 04 Jun 2016 17:49:42 GMT

Content-Type: text/html

Content-Length: 154

Connection: keep-alive

Location: hXXp://m.yy.com/zone/1371549646/
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>......


GET /zone/1371549646/ HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Cookie: Hm_lpvt_c493393610cdccbddc1f124d567e36ab=1465062588; hiido_ui=0.20794194939660737; Hm_lvt_c493393610cdccbddc1f124d567e36ab=1465062552,1465062557

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:49:43 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 17:49:43 GMT
4c5..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta ht
tp-equiv="Content-Type" content="text/html; charset=utf-8" />..<
title>YY............ [email protected]...</title>..<
;meta name="keywords" content=".......................................
...............YY............"/>..<meta name="description" conte
nt="YY...............YY...........................K...................
.............................YY...YY..................................
......................................................................
................K......m.yy.com" />..<link type="text/css" rel="
stylesheet" href="hXXp://m.yy.com/css/public.css" />..<link type
="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/star.css" />
..<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/
album.css" />..<link type="text/css" rel="stylesheet" href="http
://m.yy.com/css/uiwidget-popup.css" />..<link type="text/css" re
l="stylesheet" href="hXXp://m.yy.com/css/uiwidget-pagebar.css" />..
<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/ui
widget-messagebox.css"/>..<link type="text/css"..1000.. rel="sty
lesheet" href="hXXp://m.yy.com/css/zone-index-pagebar.css"/>..<l
ink type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/jplayer
.blue.monday.css"/>..<link type="text/css" rel="stylesheet" 
<<< skipped >>>

GET /zone/1371549646 HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Cookie: Hm_lpvt_c493393610cdccbddc1f124d567e36ab=1465062596; hiido_ui=0.20794194939660737; Hm_lvt_c493393610cdccbddc1f124d567e36ab=1465062552,1465062557

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Sat, 04 Jun 2016 17:49:50 GMT

Content-Type: text/html

Content-Length: 154

Connection: keep-alive

Location: hXXp://m.yy.com/zone/1371549646/
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>......


GET /zone/1371549646/ HTTP/1.1

Referer: hXXp://m.yy.com/zone/1371549646

Accept: */*

Accept-Language: zh-cn

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: m.yy.com

Cache-Control: no-cache

Cookie: Hm_lpvt_c493393610cdccbddc1f124d567e36ab=1465062596; hiido_ui=0.20794194939660737; Hm_lvt_c493393610cdccbddc1f124d567e36ab=1465062552,1465062557

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 17:49:51 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Sat, 04 Jun 2016 17:49:51 GMT
4c5..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
 "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<ht
ml xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta ht
tp-equiv="Content-Type" content="text/html; charset=utf-8" />..<
title>YY............ [email protected]...</title>..<
;meta name="keywords" content=".......................................
...............YY............"/>..<meta name="description" conte
nt="YY...............YY...........................K...................
.............................YY...YY..................................
......................................................................
................K......m.yy.com" />..<link type="text/css" rel="
stylesheet" href="hXXp://m.yy.com/css/public.css" />..<link type
="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/star.css" />
..<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/
album.css" />..<link type="text/css" rel="stylesheet" href="http
://m.yy.com/css/uiwidget-popup.css" />..<link type="text/css" re
l="stylesheet" href="hXXp://m.yy.com/css/uiwidget-pagebar.css" />..
<link type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/ui
widget-messagebox.css"/>..<link type="text/css"..1000.. rel="sty
lesheet" href="hXXp://m.yy.com/css/zone-index-pagebar.css"/>..<l
ink type="text/css" rel="stylesheet" href="hXXp://m.yy.com/css/jplayer
.blue.monday.css"/>..<link type="text/css" rel="stylesheet" 
<<< skipped >>>

GET /c.gif?act=webyysceneload&rel=yycomscene&ver=1.19&ref=http://VVV.yy.com/210075&tlt=0&took=4282&ip=194.242.96.218&time=1465062578927&wyy=cc515ea9f79d46d0a143e95390998e1b&sid=86415000&sidsub=86415000 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://c2.web.yystatic.com/r/rc/yycomscene/main/1/11/main.swf?type=yycomscene&topSid=86415000&subSid=86415000&newtuna=1&referer=http:/%2

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stat2.web.yy.com

Connection: Keep-Alive

Cookie: Hm_lpvt_c493393610cdccbddc1f124d567e36ab=1465062571; hiido_ui=0.20794194939660737; Hm_lvt_c493393610cdccbddc1f124d567e36ab=1465062552,1465062557

HTTP/1.1 200 OK

Server: nginx/1.0.10

Date: Sat, 04 Jun 2016 17:49:38 GMT

Content-Type: image/gif

Content-Length: 35

Last-Modified: Mon, 16 Nov 2015 11:04:22 GMT

Connection: keep-alive

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Methods: GET,POST,OPTIONS

Accept-Ranges: bytes
GIF89a.............,...........D..;HTTP/1.1 200 OK..Server: nginx/1.0.
10..Date: Sat, 04 Jun 2016 17:49:38 GMT..Content-Type: image/gif..Cont
ent-Length: 35..Last-Modified: Mon, 16 Nov 2015 11:04:22 GMT..Connecti
on: keep-alive..Access-Control-Allow-Origin: *..Access-Control-Allow-H
eaders: X-Requested-With..Access-Control-Allow-Methods: GET,POST,OPTIO
NS..Accept-Ranges: bytes..GIF89a.............,...........D..;..

GET /duowan.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.duowan.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 04 Jun 2016 17:52:08 GMT

Date: Sat, 04 Jun 2016 17:47:08 GMT

Server: nginx

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 11794

Last-Modified: Fri, 27 May 2016 09:51:47 GMT

ETag: "574818b3-2e12"

Cache-Control: max-age=300

X-UA-Compatible: IE=EmulateIE7

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 fuzhou186:8104 (Cdn Cache Server V2.0), 1.1 db78:2 (Cdn Cache Server V2.0)

Connection: keep-alive
/* Hiido v20160527.01*/.eval(function(E,I,A,D,J,K,L,H){function C(A){r
eturn A<62?String.fromCharCode(A =A<26?65:A<52?71:-4):A<63
?'_':A<64?'$':C(A>>6) C(A&63)}while(A>0)K[C(D--)]=I[--A];f
unction N(A){return K[A]==L[A]?A:K[A]}if(''.replace(/^/,String)){var M
=E.match(J),B=M[0],F=E.split(J),G=0;if(E.indexOf(F[0]))F=[''].concat(F
);do{H[A  ]=F[G  ];H[A  ]=N(B)}while(B=M[G]);H[A  ]=F[G]||'';return H.
join('')}return E.replace(J,N)}('j BY="CA",Dg="ylog.u.k";7 Di(){j BH=8
.Dq,BM=CT(BH),d=BM?BM.B1:O,BO=BM?Ck(BM.CI):O;Y(BO=="Cc")BO=O;j BZ=DE(0
.Bd.CR),CV=CT(BZ),BS=CV?CV.B1:".";Y(0.Bd.protocol=="Dz:")BY="Dz";Y(BS=
="."||DQ(BS))y v;j _=C0(BS);Y(!_.BD)y v;j BK=P;Y(!BH)BK=O;p Y(BS==d){B
K=Q;BO=O}j ap=$.appName,av=$.DT,Z=$.Dd.B3();7 Ci(X){Y(X==By.Bg)X=P;p Y
(X==Cu.T)X=Q;p Y(X==BU.By)X=R;p Y(X==1440.V)X=B4;p Y(X==Co.864)X=S;p Y
(X==BU.U)X=T;p Y(X==BU.Bg)X=BI;p Y(X==B_.Bq)X=U;p Y(X==1680.Cm)X=BE;p 
Y(X==B_.By)X=Bp;p Y(X==Cn.Bq)X=Bq;p Y(X==BU.EP)X=Dw;p Y(X==BU.D8)X=14;
p Y(X==1360.Bg)X=15;p Y(X==DJ.T)X=Dv;p Y(X==1400.Cm)X=Dt;p Y(X==B_.V)X
=Du;p Y(X==DW.h)X=19;p Y(X==Co.D8)X=Dy;p Y(X==1088.612)X=Br;p Y(X==Cn.
Cl)X=Bl;p Y(X==Cn.DM)X=Bm;p Y(X==BN.Co)X=f;p Y(X==BN.1536)X=CS;p Y(X==
Cb.Dv)X=Dl;p Y(X==Cb.BN)X=Dn;p Y(X==Cu.h)X=Do;p Y(X==DW.e)X=Dp;p Y(X==
320.f)X=Dr;p Y(X==1366.Bg)X=Bn;p Y(X==480.BP)X=BP;p Y(X==1080.By)X=Bi;
p Y(X==DJ.D_)X=Bj;p Y(X==1136.D_)X=e;p Y(X==Cb.DM)X=Bh;p Y(X==BN.Cl)X=
CL;p Y(X==B$.Q)X=CM;p Y(X==B$.BN)X=CK;p Y(X==B$.f)X=CQ;p Y(X==2880.Du)
X=CP;p Y(X==Dx.C3)X=CO;p Y(X==Dx.f)X=CN;p Y(X==Bs.C3)X=Ce;p Y(X==B
<<< skipped >>>

GET /YjRkNjY5ODUtMWEyYy00MTQxLThlYjAtZjRhMzYzMjAwNTEw.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/136724

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: emyfs.bs2cdn.yy.com

Connection: Keep-Alive

Cookie: hiido_ui=0.20794194939660737

HTTP/1.1 200 OK

Expires: Sun, 05 Jun 2016 17:49:07 GMT

Date: Sat, 04 Jun 2016 17:49:07 GMT

Server: openresty

Content-Type: image/jpeg

Content-Length: 71114

Accept-Ranges: bytes

Last-Modified: Tue, 10 May 2016 05:48:32 GMT

ETag: "43fb4a32bf8e5dbb7d27b8c12b54086e66a066e9"

Cache-Control: public,max-age=86400

X-Via: 1.1 db77:10 (Cdn Cache Server V2.0)

Connection: keep-alive
......JFIF.....H.H.....fExif..MM.*.......1.........&.i.........4....ww
w.meitu.com..............................................C............
............................................ "..".......C.............
............................................................&.........
......................................................}........!1A..Qa
."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuv
wxyz..................................................................
............................................................w.......!1
..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefg
hijstuvwxyz...........................................................
.........................?.....(.......\...Qp3.5D...G;s.3.s.....rKs...
..13....(...rm...N..<1,.[3........ .'Z^.P....J.^g...c.0..QvV.g....Q
...c..9'....pr...f..6..G.....W.Q......5.I..r.T..a....<k..F.6.[.F...
..:.1.v9'VSz.R.{.r3l.,.....g)6g&.....T=L.dW.........f..p.&......b...w.
.[.nne.T..1'q.-^...#..IK.g'w..ga....F..k.15.........I...FX..J.1LkS.Q..
.b>.r.... .v..b.....6.|.c[...|.b......>..{...#..um.W.".)..9...=.
...E3..H.b..$Y....9.y....Z..z.../.A#j..&r..8Rz}A.}iYv4...............N
@.W.(Iv4.w...=..<p.v...H..q.H.'d.bu....n.x.Ds.(.v...%S....$......i.
.G.v.3.Ty..W.=.o..s......^.E.......kNt..3.....A...vv.....Q.m.Kw...U...
5^.;....B....RE.>$.....`u..R.s5...._..?.]..XG.n..j9R..x..y.M#.o.)..
,a#..4..GW#U.T......<j.H..7zm.b..WSO.,...Dd..o....eT.A.T.e...K..S..
....'.@.<...L.?*?.)-.6.jn.../.|[/.Y.o...Q,..b....*.......,.<
<<< skipped >>>

GET /cm.gif?url=http://cms.tanx.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=yzwRC8sZVk+qFEJH3ShePQ==&hi_cmuiv=0.6 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: log.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Sat, 04 Jun 2016 17:49:03 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=jwLaD3iTjxECAcLyYNpUr7X5; expires=Tue, 02-Jun-26 17:49:03 GMT; path=/; domain=.mmstat.com

Location: hXXp://cms.tanx.com/t.gif?tanx_nid=109887427&tanx_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www@yy|&hi_cmui=yzwRC8sZVk qFEJH3ShePQ==&hi_cmuiv=0.6&cna=jwLaD3iTjxECAcLyYNpUr7X5

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server:
 Tengine..Date: Sat, 04 Jun 2016 17:49:03 GMT..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CUR
a ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=jwLaD3iTjx
ECAcLyYNpUr7X5; expires=Tue, 02-Jun-26 17:49:03 GMT; path=/; domain=.m
mstat.com..Location: hXXp://cms.tanx.com/t.gif?tanx_nid=109887427&tanx
_cm&domain=yy.com&hiido_ui=0.20794194939660737&time=1465062548&zds=www
@yy|&hi_cmui=yzwRC8sZVk qFEJH3ShePQ==&hi_cmuiv=0.6&cna=jwLaD3iTjxECAcL
yYNpUr7X5..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-c
ache..Pragma: no-cache..GIF89a.............!.......,...........L..;..

GET /group16/M00/DA/69/tz0M9VcuazEAAAAAAAAvAhGaUQY835.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/210075

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: res.m.yystatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sun, 10 May 2026 11:41:04 GMT

Date: Thu, 12 May 2016 11:41:04 GMT

Server: nginx

Content-Type: image/jpeg

Content-Length: 12034

Last-Modified: Sat, 07 May 2016 22:25:43 GMT

ETag: "572e6b67-2f02"

Cache-Control: max-age=315360000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 db77:9 (Cdn Cache Server V2.0)

Connection: keep-alive
......JFIF...................................................%...#... 
, #&')*)..-0-(0%()(...........(...((((((((((((((((((((((((((((((((((((
((((((((((((((........@...............................................
............}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:
CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................
......................................................................
..........w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
.............................................?...&.`?....Jv.R.....J...
.$.$.....)m...v....m...x...Iyw$.I,I.......#g..Nrrj.#.OJb4,.....>.-.
.sA4...)s..0m=.r3MH\..F..5jH.@.;'8.Us".Yb .G.N..i...1X..n)..n.........
.0......#[email protected][email protected][email protected][email protected]..%.%!.j.CI...U.Mn.}P.;c...#..
q.|..<[email protected]...|.I..9..Ee9.F..Vu.Z.j......v%.
....)..-..0..W......5I.....O.T.K......Z..$.".;j.e...2x....%.J......%..
[email protected][email protected][email protected]..%.%$0..4..H.-TA.=.1....
...n..^......*..-N...vv.9$...YE....5B6|5.}..J..h.{.......S.m!...aX..U{
..!.g....({...........&V...q.4....(...kE".H"%....._..j.......h..a4..._
.I.....5 OL....(......(......(.......h.....%H....*.,k.PI8....o..Y..kX.
yq...X.vo...t..B}...@^L([email protected]....,..q.0..t.
....(...Gjb*\B.H".`cO..L0.j.CC.p.g..d4Y........lS$..P.....R..9.....@..
[email protected].@.........!.bP..&.R.....b9..j..c..... ....... .i..S.....w1g
#,...y...Q5fh..Q&...Mv.n......v..-u;.-B.T..~...M.y.E.."..J..).....
<<< skipped >>>

GET /group16/M00/D0/82/tz0M9VcDglUAAAAAAAA0AFVcLuE178.jpg HTTP/1.1