MD5: 03e127b6672646ad0f982f162d6e3f8d
SHA1: f7f2320a708c6cd23396e743dace0891178ff2c2
SHA256: 9d8f1a72be2a24f207d86becc3fc97683c12e50dda06e3591b70f44932e210e4
SSDeep: 24576:q2m9O4gSGp2z1ja6H73owdsBtSRt LG61XHypiOZJkxJ:qc HHQs LdhB
Size: 884736 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2014-09-28 07:35:44
Analyzed on: WindowsXPESX SP3 32-bit

Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

mscorsvw.exe:1912

The Trojan injects its code into the following process(es):

%original file name%.exe:736

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:736 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\loading_32_32[1].gif (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lic_4204521680421587228[1].jpg (2476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lic_2626015944720347329[1].jpg (4436 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lic_-2680346721944103378[1].jpg (3464 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\eventUtil[1].js (777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\boomerang[2].js (9 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\www.yy[1].xml (478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery[1].js (1720 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lic_-2443698604613662488[1].jpg (3108 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\autoComplete[2].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lic_8939849939642560792[1].jpg (4880 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cookie[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lic_8157872456451863916[1].jpg (5773 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sea[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\icon_png8[1].png (490 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\udb[1].js (1392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\watchHistory[2].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\watchHistory[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lic_701249758453003410[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\boomerang[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\v[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cookie[2].js (3 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\template[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lic_-962427121967101309[1].jpg (1909 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lic_-1093331428468276457[1].jpg (1608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\v[1].js (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\6220ec2397239c45c10a77ad32ad7e2b2f0fa20e[1].jpg (8337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yy[1] (4404 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\slides[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bxslider[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lic_8469941141627823925[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yyimg_notfound[1].png (5 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (8676 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\img[3].jpg (2520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\e65256cfa234070589396f5e86481601ff519978[1].jpg (25425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[2].css (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yy[1].txt (708 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\online_v3[1].htm (824 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery[2].js (2763 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\autoComplete[1].js (1 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.yy[1].xml (920 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\user[2].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sea[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\scaffold[1].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lic_8551975979386874096[1].jpg (2034 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lic_7038928098121532766[1].jpg (7096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\scaffold[1].js (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\4fc0560cd1d131192384c4ffb6cdfa83e70a08e4[1].jpg (11896 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\duowan[1].js (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\core[1].php (755 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\img[1].jpg (1896 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\z_stat[1].php (1137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\vip[1].png (304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lic_1452218364912954177[1].jpg (11472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lic_-1299152036310736473[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\huajinv5[1].htm (1953 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lic_-3297615641650375074[1].jpg (7239 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yw_speed[1].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yy[1].htm (2674 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\eventUtil[2].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hm[1].js (339 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\template[2].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lic_4024571218891102107[1].jpg (5868 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\index[1].js (741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[2].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\udb[2].js (1236 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\0251296bcd44d452bc88131fcd5a82c510b81c5f[1].jpg (10788 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\user[1].js (700 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\img[2].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lic_2616831772382135215[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lic_3172394440753734522[1].jpg (2520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lazyload[2].js (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\xqlogin.sdk[1].css (738 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\img[2].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\util[2].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lic_-335187966459121615[1].jpg (4513 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\img[1].jpg (2200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\template[1].js (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lic_-504268309035952950[1].jpg (1842 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lic_5513065140658811164[1].jpg (5092 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lic_1772890926629229361[1].jpg (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lic_-7555942589449240475[1].jpg (5552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\request[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lic_167734896859519666[1].jpg (3388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\52a8925607b756ab77869e97b45145c6616320bd[1].jpg (12006 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index[2].js (18 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\img[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hm[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\tz0CN1M3kDeAZZOTAAB249qkdpo746[1].jpg (4576 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logger[1].js (590 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hm[2].js (531 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tabs[2].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lic_4024847165768833334[1].jpg (5633 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\request[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hm[2].js (425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\x_line_bg[1].png (951 bytes)
%System%\BackInC.sys (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\yw_speed[2].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\9679b43469a5c45fb4f9678d5cc16636aff34e13[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yy[2].txt (377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\lic_-4848156311373801567[1].jpg (4544 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\yw_speed[1].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lazyload[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logger[2].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].png (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tabs[1].js (611 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\yw_speed[2].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bxslider[2].js (1573 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lic_5291922992626721370[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\util[1].js (1 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\slides[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\api[1].png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lic_5586077590086644359[1].jpg (6688 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\yw_speed[1].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\loginUserInfo[1] (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\lic_5988792491863884358[1].jpg (4992 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\user[1].js (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)
%System%\BackInC.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041720130418\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\eventUtil[1].js (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.yy[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\scaffold[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\stat[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\lazyload[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\udb[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cookie[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\template[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\tabs[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yy[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\watchHistory[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sea[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\autoComplete[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\boomerang[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\template[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\hm[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041720130418 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\slides[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\v[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hm[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\util[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bxslider[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\logger[1].js (0 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\www.yy[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\request[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yy[1].txt (0 bytes)

Registry activity

The process %original file name%.exe:736 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014112620141127]
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1411878944"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014112620141127]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014112620141127]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014112620141127\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014112620141127]
"CachePrefix" = ":2014112620141127:"
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CA CB 10 54 BF B3 67 0E 1A 45 49 70 4E 3F 51 06"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013041720130418]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process mscorsvw.exe:1912 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\State]
"AccumulatedWaitIdleTime" = "2340000"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: ??
Product Name: ????Yy?:7588444
Product Version: 1.0.0.0
Legal Copyright:
??QQ:2270035360
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ????Yy?:7588444
Comments: ????Yy?:7588444
Language: Portuguese (Brazil)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://ailiubo0628.14.100311.com/
hxxp://all.cnzz.com.danuoyi.tbcache.com/z_stat.php?id=1000432731&online=1&show=line
hxxp://z6.cnzz.com/stat.htm?id=1000432731&r=&lg=en-us&ntime=none&cnzz_eid=595931243-1417012180-&showp=1024x768&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1100383716	42.156.140.19
hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=1000432731&show=line&online=1&t=z
hxxp://online.cnzz.com/online/online_v3.php?id=1000432731&h=z6.cnzz.com&on=1&s=line	42.156.162.15
hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=237557991	42.120.219.171
hxxp://cnzz.mmstat.com/app.gif?&cna=19H8DH4iO3ICAbhrJiZUcRuG	42.120.219.171
hxxp://yy.com/	117.25.157.170
hxxp://www.yy.com/	221.228.79.225
hxxp://www.yy.com/assets/css/style.css	221.228.79.225
hxxp://www.yy.com/assets/css/images/repeat/x_line_bg.png	221.228.79.225
hxxp://www.yy.com/assets/images/loading_32_32.gif	221.228.79.225
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_-2443698604613662488
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_167734896859519666
hxxp://cc00077.h.cnc.ccgslb.com.cn/img?bucket=yysnapshot&file=b7b4f78794e919ae2a83ec4353afb5c4f67ac544&size=180
hxxp://cc00077.h.cnc.ccgslb.com.cn/img?bucket=yysnapshot&file=d3d6bd8e6a1062acd56935183bf0c076f8c6da01
hxxp://www.yy.com/assets/images/vip.png	221.228.79.225
hxxp://www.yy.com/assets/css/images/logo.png	221.228.79.225
hxxp://cc00077.h.cnc.ccgslb.com.cn/common/js/seajs/sea.js
hxxp://cc00077.h.cnc.ccgslb.com.cn/common/images/yyimg_notfound.png
hxxp://cc00077.h.cnc.ccgslb.com.cn/img?bucket=yysnapshot&file=c4bb0c058444fa31ef39f4028843a464fb4aceaa
hxxp://cc00077.h.cnc.ccgslb.com.cn/img?bucket=yysnapshot&file=8d6ba32888498307d655cc36e6f7442d254862fd
hxxp://e.xdwscache.glb0.lxdns.com/api.php?w=134&m=10&text=http://weihui.yy.com
hxxp://cc00077.h.cnc.ccgslb.com.cn/group2/M00/8F/10/tz0CN1M3kDeAZZOTAAB249qkdpo746.jpg?size=180
hxxp://www.yy.com/assets/css/images/icon_png8.png	221.228.79.225
hxxp://cc00077.h.cnc.ccgslb.com.cn/img?bucket=yysnapshot&file=9f1ecdf563b9e7d8db008c250c4fb6a172c6f304
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_-7555942589449240475?imageview/0/w/370/h/282
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_4204521680421587228?imageview/0/w/370/h/282
hxxp://cc00077.h.cnc.ccgslb.com.cn/img?bucket=yysnapshot&file=6f3402bd551d4d55c0d67784937b17e8b0f314b0
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_1452218364912954177?imageview/0/w/370/h/282
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_-2680346721944103378?imageview/0/w/370/h/282
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_3172394440753734522?imageview/0/w/370/h/282
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_-3297615641650375074?imageview/0/w/370/h/282
hxxp://www.yy.com/assets/js/apps/boomerang/index.js?ver=20141125	221.228.79.225
hxxp://www.yy.com/assets/js/index.js?ver=20141125	221.228.79.225
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_5988792491863884358?imageview/0/w/370/h/282
hxxp://cc00077.h.cnc.ccgslb.com.cn/common/js/jquery/1.9.1/jquery.js?ver=20141125
hxxp://www.yy.com/assets/js/apps/boomerang/boomerang.js?ver=20141125	221.228.79.225
hxxp://cc00077.h.cnc.ccgslb.com.cn/common/js/art/template.js?ver=20141125
hxxp://www.yy.com/assets/js/mods/jquery/plugin/bxslider.js?ver=20141125	221.228.79.225
hxxp://hm.e.shifen.com/hm.js?79c375aa39fc2aae3161264213dee7ec
hxxp://hm.e.shifen.com/hm.js?34a908ea88275f6ef0a72588f9c0be86
hxxp://www.yy.com/assets/js/apps/template.js?ver=20141125	221.228.79.225
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_8157872456451863916?imageview/0/w/370/h/282
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_-1093331428468276457?imageview/0/w/180/h/136
hxxp://cc00077.h.cnc.ccgslb.net/duowan.js
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_8469941141627823925?imageview/0/w/180/h/136
hxxp://hm.e.shifen.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=1779682545&si=34a908ea88275f6ef0a72588f9c0be86&st=1&v=1.0.70&lv=1&tt=YY直播-中国最大的视频直播网站,yy语音官网
hxxp://www.yy.com/assets/js/apps/util.js?ver=20141125	221.228.79.225
hxxp://www.yy.com/assets/js/apps/request.js?ver=20141125	221.228.79.225
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_701249758453003410?imageview/0/w/180/h/136
hxxp://hm.e.shifen.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=1991869141&si=79c375aa39fc2aae3161264213dee7ec&st=1&v=1.0.70&lv=1&tt=YY直播-中国最大的视频直播网站,yy语音官网
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_2616831772382135215?imageview/0/w/180/h/136
hxxp://www.yy.com/assets/js/apps/logger.js?ver=20141125	221.228.79.225
hxxp://www.yy.com/assets/js/apps/tabs.js?ver=20141125	221.228.79.225
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_-962427121967101309?imageview/0/w/180/h/136
hxxp://cc00077.h.cnc.ccgslb.com.cn/yysnapshot/9679b43469a5c45fb4f9678d5cc16636aff34e13?imageview/0/w/180/h/136
hxxp://www.yy.com/assets/js/apps/stat.js?ver=20141125	221.228.79.225
hxxp://www.yy.com/assets/js/apps/eventUtil.js?ver=20141125	221.228.79.225
hxxp://ylog.hiido.com/c.gif?act=web&zd=_2b1acc1@yy|_e3d75f1@yy|www@yy|&ui=0.8868442120119542&sp=1&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&vr=15&ut=1416993761514&wd=0&passport=&sns=null	175.100.204.142
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_-504268309035952950?imageview/0/w/180/h/136
hxxp://trust.e.shifen.com/vcard/v.js?siteid=5052355&url=http://www.yy.com/&source=&rnd=76499634
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_1772890926629229361?imageview/0/w/180/h/136
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_-1299152036310736473?imageview/0/w/180/h/136
hxxp://www.yy.com/assets/js/apps/slides.js?ver=20141125	221.228.79.225
hxxp://www.yy.com/assets/js/apps/scaffold.js?ver=20141125	221.228.79.225
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_5291922992626721370
hxxp://www.yy.com/assets/js/mods/jquery/plugin/lazyload.js?ver=20141125	221.228.79.225
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_8551975979386874096
hxxp://www.yy.com/assets/js/mods/jquery/plugin/cookie.js?ver=20141125	221.228.79.225
hxxp://www.yy.com/assets/js/apps/user.js?ver=20141125	221.228.79.225
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_4024847165768833334
hxxp://www.yy.com/assets/js/apps/autoComplete.js?ver=20141125	221.228.79.225
hxxp://www.yy.com/assets/js/apps/watchHistory.js?ver=20141125	221.228.79.225
hxxp://www.yy.com/assets/js/apps/udb.js?ver=20141125	221.228.79.225
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_-335187966459121615
hxxp://www.yy.com/index/func/loginUserInfo?appid=1&sign=x&_=1416993761264	221.228.79.225
hxxp://res.udb.duowan.com/lgn/css/oauth/udbsdk/xqlogin.sdk.css	58.215.175.232
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_5513065140658811164
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_8939849939642560792
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_5586077590086644359
hxxp://cc00077.h.cnc.ccgslb.com.cn/yysnapshot/4fc0560cd1d131192384c4ffb6cdfa83e70a08e4
hxxp://cc00077.h.cnc.ccgslb.com.cn/yysnapshot/52a8925607b756ab77869e97b45145c6616320bd
hxxp://cc00077.h.cnc.ccgslb.com.cn/yysnapshot/0251296bcd44d452bc88131fcd5a82c510b81c5f
hxxp://cc00077.h.cnc.ccgslb.com.cn/yysnapshot/e65256cfa234070589396f5e86481601ff519978
hxxp://cc00077.h.cnc.ccgslb.com.cn/yysnapshot/6220ec2397239c45c10a77ad32ad7e2b2f0fa20e
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_4024571218891102107
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_7038928098121532766
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_-4848156311373801567
hxxp://cc00077.h.cnc.ccgslb.com.cn/fjp/lic_2626015944720347329
hxxp://www.yy.com/assets/js/apps/boomerang/yw_speed.gif?t=14169937753890.9207327753577861	221.228.79.225
hxxp://www.yy.com/assets/js/apps/boomerang/yw_speed.gif?t=14169937756860.29626065445877353	221.228.79.225
hxxp://www.yy.com/assets/js/apps/boomerang/yw_speed.gif?t=14169937759980.05373241652539784	221.228.79.225
hxxp://www.yy.com/assets/js/apps/boomerang/yw_speed.gif?t=14169937762950.611470024657961	221.228.79.225
hxxp://www.yy.com/assets/js/apps/boomerang/yw_speed.gif?t=14169937765920.3824343664146818	221.228.79.225
hxxp://image.yy.com/fjp/lic_-4848156311373801567	119.188.139.203
hxxp://www.duowan.com/duowan.js	111.202.7.25
hxxp://image.yy.com/fjp/lic_-2680346721944103378?imageview/0/w/370/h/282	119.188.139.203
hxxp://s1.yy.com/common/images/yyimg_notfound.png	222.161.226.9
hxxp://image.yy.com/fjp/lic_8939849939642560792	119.188.139.203
hxxp://image.yy.com/fjp/lic_5291922992626721370	119.188.139.203
hxxp://hm.baidu.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=1991869141&si=79c375aa39fc2aae3161264213dee7ec&st=1&v=1.0.70&lv=1&tt=YY直播-中国最大的视频直播网站,yy语音官网	61.135.185.140
hxxp://c.cnzz.com/core.php?web_id=1000432731&show=line&online=1&t=z	66.102.255.49
hxxp://hm.baidu.com/hm.js?34a908ea88275f6ef0a72588f9c0be86	61.135.185.140
hxxp://image.yy.com/fjp/lic_-335187966459121615	119.188.139.203
hxxp://image.yy.com/fjp/lic_-962427121967101309?imageview/0/w/180/h/136	119.188.139.203
hxxp://image.yy.com/fjp/lic_167734896859519666	119.188.139.203
hxxp://image.yy.com/fjp/lic_3172394440753734522?imageview/0/w/370/h/282	119.188.139.203
hxxp://image.yy.com/fjp/lic_7038928098121532766	119.188.139.203
hxxp://image.yy.com/fjp/lic_-2443698604613662488	119.188.139.203
hxxp://snapshot1.yy.com/img?bucket=yysnapshot&file=d3d6bd8e6a1062acd56935183bf0c076f8c6da01	119.188.139.36
hxxp://image.yy.com/fjp/lic_8469941141627823925?imageview/0/w/180/h/136	119.188.139.203
hxxp://image.yy.com/fjp/lic_1772890926629229361?imageview/0/w/180/h/136	119.188.139.203
hxxp://www.huajinv5.com/	211.219.83.20
hxxp://snapshot1.yy.com/img?bucket=yysnapshot&file=9f1ecdf563b9e7d8db008c250c4fb6a172c6f304	119.188.139.36
hxxp://image.yy.com/yysnapshot/9679b43469a5c45fb4f9678d5cc16636aff34e13?imageview/0/w/180/h/136	119.188.139.203
hxxp://qr.liantu.com/api.php?w=134&m=10&text=http://weihui.yy.com	8.37.233.4
hxxp://file.do.yy.com/group2/M00/8F/10/tz0CN1M3kDeAZZOTAAB249qkdpo746.jpg?size=180	218.58.209.2
hxxp://image.yy.com/fjp/lic_701249758453003410?imageview/0/w/180/h/136	119.188.139.203
hxxp://image.yy.com/yysnapshot/0251296bcd44d452bc88131fcd5a82c510b81c5f	119.188.139.203
hxxp://image.yy.com/fjp/lic_5586077590086644359	119.188.139.203
hxxp://image.yy.com/yysnapshot/e65256cfa234070589396f5e86481601ff519978	119.188.139.203
hxxp://hm.baidu.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=1779682545&si=34a908ea88275f6ef0a72588f9c0be86&st=1&v=1.0.70&lv=1&tt=YY直播-中国最大的视频直播网站,yy语音官网	61.135.185.140
hxxp://image.yy.com/fjp/lic_2626015944720347329	119.188.139.203
hxxp://snapshot1.yy.com/img?bucket=yysnapshot&file=c4bb0c058444fa31ef39f4028843a464fb4aceaa	119.188.139.36
hxxp://image.yy.com/fjp/lic_5513065140658811164	119.188.139.203
hxxp://image.yy.com/fjp/lic_-504268309035952950?imageview/0/w/180/h/136	119.188.139.203
hxxp://image.yy.com/yysnapshot/6220ec2397239c45c10a77ad32ad7e2b2f0fa20e	119.188.139.203
hxxp://image.yy.com/fjp/lic_1452218364912954177?imageview/0/w/370/h/282	119.188.139.203
hxxp://s1.yy.com/common/js/seajs/sea.js	222.161.226.9
hxxp://image.yy.com/fjp/lic_2616831772382135215?imageview/0/w/180/h/136	119.188.139.203
hxxp://trust.baidu.com/vcard/v.js?siteid=5052355&url=http://www.yy.com/&source=&rnd=76499634	61.135.185.105
hxxp://pcookie.cnzz.com/app.gif?&cna=19H8DH4iO3ICAbhrJiZUcRuG	42.120.219.171
hxxp://image.yy.com/fjp/lic_5988792491863884358?imageview/0/w/370/h/282	119.188.139.203
hxxp://image.yy.com/fjp/lic_-1299152036310736473?imageview/0/w/180/h/136	119.188.139.203
hxxp://image.yy.com/fjp/lic_8551975979386874096	119.188.139.203
hxxp://snapshot1.yy.com/img?bucket=yysnapshot&file=b7b4f78794e919ae2a83ec4353afb5c4f67ac544&size=180	119.188.139.36
hxxp://hm.baidu.com/hm.js?79c375aa39fc2aae3161264213dee7ec	61.135.185.140
hxxp://image.yy.com/fjp/lic_-3297615641650375074?imageview/0/w/370/h/282	119.188.139.203
hxxp://image.yy.com/fjp/lic_8157872456451863916?imageview/0/w/370/h/282	119.188.139.203
hxxp://image.yy.com/fjp/lic_4204521680421587228?imageview/0/w/370/h/282	119.188.139.203
hxxp://s1.yy.com/common/js/art/template.js?ver=20141125	222.161.226.9
hxxp://image.yy.com/fjp/lic_4024847165768833334	119.188.139.203
hxxp://image.yy.com/fjp/lic_4024571218891102107	119.188.139.203
hxxp://image.yy.com/yysnapshot/4fc0560cd1d131192384c4ffb6cdfa83e70a08e4	119.188.139.203
hxxp://image.yy.com/fjp/lic_-1093331428468276457?imageview/0/w/180/h/136	119.188.139.203
hxxp://image.yy.com/yysnapshot/52a8925607b756ab77869e97b45145c6616320bd	119.188.139.203
hxxp://image.yy.com/fjp/lic_-7555942589449240475?imageview/0/w/370/h/282	119.188.139.203
hxxp://snapshot1.yy.com/img?bucket=yysnapshot&file=8d6ba32888498307d655cc36e6f7442d254862fd	119.188.139.36
hxxp://snapshot1.yy.com/img?bucket=yysnapshot&file=6f3402bd551d4d55c0d67784937b17e8b0f314b0	119.188.139.36
hxxp://v1.cnzz.com/z_stat.php?id=1000432731&online=1&show=line	1.99.192.15
hxxp://s1.yy.com/common/js/jquery/1.9.1/jquery.js?ver=20141125	222.161.226.9

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /lgn/css/oauth/udbsdk/xqlogin.sdk.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: res.udb.duowan.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:11 GMT

Content-Type: text/css

Content-Length: 738

Last-Modified: Fri, 07 Nov 2014 07:31:16 GMT

Connection: keep-alive

ETag: "545c7544-2e2"

Expires: Wed, 26 Nov 2014 14:40:11 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes
/*mark*/@CHARSET "UTF-8";.popup-mask{z-index:30001;position:absolute;t
op:0;left:0;-moz-opacity:0.5;opacity:0.5;filter:alpha(opacity=50);back
ground-color:#000;width:100%;height:100%;zoom:1;}.popup-mask iframe{po
sition:absolute; z-index: -1;}.udbsdk_login{position:absolute; display
:none; left:0px; top:0px;}.udbsdk_close{font:13px/1.5 Tahoma,Arial,Ver
dana;text-align:right;position:relative;top:23px;right:-4px;}.udbsdk_h
ref{TEXT-DECORATION:none;color:#A7CFEC;font-size:14px; font-weight:bol
d;}.udbsdk_href:hover{text-decoration:none !important;}.udbsdk_frm1{wi
dth:524px;*width:526px;_width:526px; height:298px;*height:300px;_heigh
t:312px;} .udbsdk_frm{width:537px ; height:335px;*width:525px; *height
:313px;width:535px\9; height:323px\9;}..

GET /fjp/lic_167734896859519666 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

?G.Y.?.B.D..[.&2lHiv.n&...!.&..7.:.....9....R.........u.#...../.-.....
...Y....V.Q....TwUfK.X.J%Q..TV....R/.<j.UR..;Z.....<............
...."..)un..)V..d.!....d..e. .......7.9l..?.......'w~..,2`...D.7{|.#2.
!ER.U..U3u.......?=S2..dy.......Ap.....QZ.W.....x...L..._!........i..2
.B.2...9.q......e......Tg..?...R.@../{|.S6.....vm.w..I.P...=d...i..j..
..k.......i.h.WEk?......?z.<.A....-.......5.nduo%........Y..,8[E.U^
IW....v...K..v....U.. ...$...F..)T......!KE=].M{.......N..ei..6.:.Jev.
.|~J.....A.3.?q|...=\@.M.w.b.rf..{|.....u,.8x.................b.....`_
..B...GW...W..h....n....\1:I3e.^.}..Nk`.........z?.........R.....o....
.|.Y.{.F.u...-.F.<.........#..M.U.........d..B{2..Vd2..4yT...J.g...
...-...$Hb.n......X....J..Q...5.^.V....i.e..[^...?.........R.?..w.....
|.W.{.GcG.I}..-....J/.V......L.u<q.Hl,........Bq.w...>..j^?.....
.._...*..&.z..u.4jo.......O*Q~(.s*.6../b<..........w.).j/...d.mO.^.
..5..#..4.,. #..m...D..hk.e,....;:.%..9.].KU....Y."..~.S8..%.(c..L....
P..F..2..... .8.BG.3.Q.qL..(g..L........\...\.E\.7\F..i... ........"X.
..I..V-.k..E.n#.i...HLp.Y........[U.......N V..m..*u0.;.....k.....O!%]
nc .?n..C..l..q.....1.e..zi.sY ..E....Z....dK_,c..j.AWlIag1....l).$.2.
{..)..{..... ....jM...g..N V9...........Z...f.H.uP.\e......"..0...!Je=
...#)EDQ..1.....w..#.h.8H.1....T.....k>.D .*.k....E0.f.i......gX.DI
..t...x.2....XNa..!"J....Un..9.d....c...54..sy[8E.\{.Yv..l..V.._5Wh).$
y[..|...l..V.._56.."K.bc.K)W3.V..Y....$.......Y.U..)W..DX.....V..vRGX.
..*f..K*..........9..e......<sT.*....6...(..wUs..RA...h........
<<< skipped >>>

GET /fjp/lic_-7555942589449240475?imageview/0/w/370/h/282 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sat, 22 Nov 2014 18:34:36 GMT

Content-Type: image/JPEG

Content-Length: 35866

Expires: Sat, 29 Nov 2014 18:34:36 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WD.8

Switch: FSCS

Age: 330925

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
......JFIF.....H.H......Photoshop 3.0.8BIM.%......................8BIM
.........H.......H......8BIM.&................?...8BIM............8BIM
............8BIM..................8BIM'.................8BIM.......H./
ff...lff........./ff...............2.....Z...........5.....-..........
8BIM.......p..........................................................
......................................................8BIM............
...@[email protected]... .3.6.5
.5.2.-.8.b.1.4.7.4.e.b.f.b.c.3.5.4.9.d.4.2.b.4.3.e.b.1.1.b.0.6.f.1.a.a
...j.p.e.g...................................r........................
...........................null........boundsObjc..........Rct1.......
.Top long........Leftlong........Btomlong........Rghtlong...r....slice
sVlLs....Objc..........slice........sliceIDlong........groupIDlong....
....originenum....ESliceOrigin....autoGenerated....Typeenum....ESliceT
ype....Img ....boundsObjc..........Rct1........Top long........Leftlon
g........Btomlong........Rghtlong...r....urlTEXT..........nullTEXT....
......MsgeTEXT..........altTagTEXT..........cellTextIsHTMLbool.....cel
lTextTEXT..........horzAlignenum....ESliceHorzAlign....default....vert
Alignenum....ESliceVertAlign....default....bgColorTypeenum....ESliceBG
ColorType....None....topOutsetlong........leftOutsetlong........bottom
Outsetlong........rightOutsetlong.....8BIM.(..........?.......8BIM....
........8BIM...................z......................JFIF.....H.H....
..Adobe_CM......Adobe.d...........................................
<<< skipped >>>

GET /fjp/lic_1452218364912954177?imageview/0/w/370/h/282 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

                                                                      
                                                                      
                                                                      
                                                                      
                                                                      
                                                        <?xpacket e
nd="w"?>...C.......................................................
.............C........................................................
.................r.."..........................................]......
..................#3...."CS..$2Bc.!4Rbrs..1AQ....%DTaq.......5........
.&6d....Et.....................................2......................
."#2..3B.!1C.AQRSqabc.rs..............?...iZ.h..G.......h3].J.>.&.s
Ph.A.8..e.R...7....$i8v]c.c.......n......f.\0.......M...W...i.KMd.j..q
Rs..%PwQ.A7.l-ji.J\of........Be=.H.........c.!7..v.7vK...B.....F..2)..
^...:.[F.......r.s....@..^.=..S.......l.\.l.)...M.&....O3.......^.h...
I.D*ba....../.E...2......=.{...=LLC;vBb....NRK].#..:.)vRR..c..... .b..
OQ]sEg.2.:.(.x...E.F.......K.......dr.!.z..M.......Ee....D.s..B...TQ..
..h...R.h.>.c.]....[.B.Bi......=.gT......0S.......TK..J#.t.R.c..V.P
x{.>b!._..X. ..7u.E...(..._IID7.z...L.~..w)..S..V.b.....p..b.a..(..
..Dv..Q.,.]Z.7..!...x=...(.._t^&"...$......f..l1^,~.....Q.....r}......
...._}.E.N.^..7.c...Rf...`Q.N*k.-.j..0F.. ..)FL8....'...].}-J.. R.(...
!.i.HHTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Mon, 24 Nov 2014 
<<< skipped >>>

GET /fjp/lic_3172394440753734522?imageview/0/w/370/h/282 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sun, 23 Nov 2014 12:48:03 GMT

Content-Type: image/JPEG

Content-Length: 20120

Expires: Sun, 30 Nov 2014 12:48:03 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WD.2

Switch: FSCS

Age: 265320

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
......JFIF.....`.`.....C................................... $.' ",#..(
7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222
222222222222222222222........r..".....................................
...L........................!..1."AQa.q....#2....BR$3br......4CU......
Scs%t..................................-........................!1A."Q
2aq.B..#R.3..............?.{B.N$...f`nH*..Z.....i...G........Z.F..I...
[email protected]*...BASh..<N..Xb.....(.9d....8.b..`.N..d
$..|.E..<..._&'.B.y..xl).X..*|...R.(.....:V..z.:./,q.r..#&.o..'.H[H
;.^a.6..mX.q....s`...$..QRJi...Q.|.....j.0.{[email protected]......*Y...
........i9..X..Z..Z..v.M....*..6A...U.4.H..:3k~....... l.PJ...S.~.....
...Y.\..(...%.......&.I.r.....u.Y....E*.;&...7..trsH1Re P..Vk....v....
...Q.y......<~uz....z.}...$6r......<dc.i.....rev...h....q..T."H.
..t....Ky`.<|.F......u....^....<.c...[.....*.*p......]A.*rG..u..
......q..&(....e.M.H...8....9{....$`U..C&..;79..z.h.M...b.s..F........
bf...I.Y=.K.@.....*..1.0v...L...w.*...J.e......#..._m:.z..-.,Lv.vM..Br
..`Vg....f........K3.bz.N..E.....r..f..f`Q[....T.0.7...........zl.....
.u..O..\.q.....x.d.....<jz.....2.t.5.Zp.V...}.K......d.........1i.2
[.Ny...{..y..Z..i/._...<.J..& .....4'C...n;.N.d.O...i.........F.#q.
:..T.% dW...H.v.......q...8.V:..i....$d9#.`J....Zn..=k4.^...$.fC I..&g
t;.8.....z..,.M......8.......H>2..g.z...e5........\...v.Y..{.k...].
.{.....J.Q.$.>..9FC...*.....Es&...v.P..,.{.?Q....r.\...jTf.'.cB.}..
7.....z...W...............h......9.....W.....=..Q.{3*w.?....0j7.".
<<< skipped >>>

GET /fjp/lic_-3297615641650375074?imageview/0/w/370/h/282 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Mon, 24 Nov 2014 20:00:54 GMT

Content-Type: image/JPEG

Content-Length: 54830

Expires: Mon, 01 Dec 2014 20:00:54 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WC.7

Switch: FSCS

Age: 152949

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
......JFIF..............Exif..II*................*hXXp://ns.adobe.com/
xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> &
lt;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014
 79.151481, 2013/03/13-12:09:15        "> <rdf:RDF xmlns:rdf="ht
tp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf
:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:/
/ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sT
ype/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM
:InstanceID="xmp.iid:82C4ED34699611E49F9E8AD746FB92E7" xmpMM:DocumentI
D="xmp.did:82C4ED35699611E49F9E8AD746FB92E7"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:82C4ED32699611E49F9E8AD746FB92E7" stRef:doc
umentID="xmp.did:82C4ED33699611E49F9E8AD746FB92E7"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;...C................................................................
....C.................................................................
........r..............................................I..............
............!..1A."Qa.2q.#B....R...3b.$Cr....%...4S.5Dc...............
......................I.........................!1..A."Qaq.2....#B....
.3R..br..$4CS...%&5.................?......=E........lA.U.0...........
...]........ ...y >..}*...\[email protected].. ...Ca9.__....p......
.)[email protected]`(.6.....d.. .8o..l.C ][email protected]..'
5.C....'{....uC.[.........].....\.'"2....j...&.......JF5FY......L%
<<< skipped >>>

GET /fjp/lic_8157872456451863916?imageview/0/w/370/h/282 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sat, 22 Nov 2014 23:07:35 GMT

Content-Type: image/JPEG

Content-Length: 34689

Expires: Sat, 29 Nov 2014 23:07:35 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WD.7

Switch: FSCS

Age: 314550

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
HTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Sat, 22 Nov 2014 23:07:35 
GMT..Content-Type: image/JPEG..Content-Length: 34689..Expires: Sat, 29
 Nov 2014 23:07:35 GMT..Cache-Control: max-age=604800..Powered-By-Chin
aCache: HIT from CNC-LQ-c-3WD.7..Switch: FSCS..Age: 314550..Powered-By
-ChinaCache: HIT from CNC-HQ-g-3WK.10........JFIF.....H.H......Exif..M
M.*.......................................................(...........
1...........2...........;.......................i...........%.........
1...............CCanon.Canon EOS 5D Mark II....H.......H....VVV.meitu.
com.2014:08:20 21:55:06.Photographer : KWONSHOONG.....................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /fjp/lic_-962427121967101309?imageview/0/w/180/h/136 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Wed, 26 Nov 2014 10:55:19 GMT

Content-Type: image/JPEG

Content-Length: 12376

Expires: Wed, 03 Dec 2014 10:55:19 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WC.1

Switch: FSCS

Age: 12887

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
..N,0........nH........:..ul....f|%6UI.......t>[x.M.?=...T.-.Ua%..#
..$...iN.....K..#.2...}....KU[,Q.0..,...(.G.x.......X.ws..>.OP.L.,.
.o#.@....=.....y.O....A3......#.=.y..RI3....G......_ .(.3...Su.sSD.Tt.
...............:.I...Tp9...G...9G3:.^}..s.c..]....H...."....%.....S...
..7...cY...q.....uo.....r...c&}@!..J..`c......./.j...SO....F... l...g.
.A.=q... 3.......8.A......]..,.z..y..H.x.....}_:[.t..X...d ......t.}{.
..~..=..;...:4Q....i...@#[email protected]...`k....8Tf....q.u.{......l...L.#.
X.....p&...|...m....<{.e..i..j.K$.A`.6'.........=......e.$:..,.,$U.
...H.....9.."...V<...#..2~X......w..t.Le.I. ,.-.b. q.L.rx.u.i.7iC..
I.........PI<c......?M...;.....'...e&6.........7...2.`.s#o.6!..V..z
... {..k.U.....8.$....}.%..........!.pW.C.8..^w..p.GM,.k<.. ....JO.
O..O..2B.\... .o..k...vI(.2\?.H.Q@...,.`U .................(rF?.T_c..Y
.k.6.G.....?0I.2.pF..`....Y.....*)]j.wH.u..J.[/.....#B.9.....p...=.f~1
...<..(."[email protected]...:.f.....,..s.Afc......f..5..ZX.U....c....'b
 3c...#....W.f...........#.{[email protected] ...`q.6....m...*.15H......
.............>c..{MU..OM.$...3...f....8...C.~G.......*...AU.9...jn)
..9......3..M.pU..I.U..x.Ng.K6..`.......Fy.6G8..s.4........I...&".....
.....z......uN..Rj{...e.@O..../.T.@:&.n......._...r#f<.;.......}.hm
...h$...n_{*.....}...z..|Nh.r|T...K...?:&UIE.T.. *1..b...K.e.Zb%..R3/.
..'..=........d._...\...n....<t..MP.{.7~....#Kw...t..v.>G...MZ..
.C.../....[...U.(.......)n..*...mB1.}y.u.4...G.zx..wr..Te..<..|6...
M.6H'*.$.3...w....f.....}...D..Ai}....N........D.R".....=s......EB
<<< skipped >>>

GET /fjp/lic_-504268309035952950?imageview/0/w/180/h/136 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Mon, 24 Nov 2014 10:01:01 GMT

Content-Type: image/JPEG

Content-Length: 7278

Expires: Mon, 01 Dec 2014 10:01:01 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WD.4

Switch: FSCS

Age: 188946

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
......JFIF.....`.`.....C..............................................
......................C...............................................
............................."........................................
.A..........................!.1A..."Qq#2Ba.....b....$3CR..%Sr.........
............................3.......................!.1.AQa..".q.....2
..BR................?..J.=y..<.>...RqOu.........). ..|b..>%..
&....tg.|....".s...C....>*.....I.-WY....1..~..z......A8e..Q]...j...
j.. V..TU.x...Fk....5...7!)i.mZ..~u..0.X...m3j/.5..l.o.q......I..c...K
...H.k..0.Xl...<.l.g..9..U....Oi..t#..`db...&.u\......jIV..........
....:Op....a......N.O%..*Y..x$..'..u.t&.Z..T.riAJ-...I........k..'#...
D.p..!k.v...V..t!..ce\v;...d.j........b.?.......I..rw.OF....1.........
~$......2z...B3.7......-V.Yg.k.6.pd .......9..jC.<B.M..ey.b......yI
.RU........n....r.x..^-*..V.vE.d/kkV....._.....U^../...5 .S.(.....n...
p........k...w..H^S.U.z......'.pdnX...e.v..2.)rc.$......%[email protected].%
7......`...1..B.=uK.Z.jh..w.Q.......|...<.....Z....;..~t3......]f..
./-.woA....u.wf.)j}.>7.r.S.Q',Sl..,...q.....<......d.......f....
..H.V...o..t.%.yLn[k.o.M&:.B.s.k...6..)Y.......A..;*F.{..Ka*$..A....t.
..7..w...Q../#.o;..P....(g.CG....{!...0.([email protected].|..t.........1.p
.n..PK...&c2e0........V...dM. ..A...9...g9......SI.....TB!O.S..i...Y..
-......c..w.6.V...f...S.N..<..... ^=...\e....*.?lS[].......X..v..~.
[email protected].|.y.P=_..ZS.G.Q.s..;P;.U...n..]..h[?.I.w.*...
....O...5...%.........rLkJ..:..G\.3.i.P..[.8..3.......\u.]]....W..
<<< skipped >>>

GET /fjp/lic_1772890926629229361?imageview/0/w/180/h/136 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Wed, 26 Nov 2014 13:56:50 GMT

Content-Type: image/JPEG

Content-Length: 4320

Expires: Wed, 03 Dec 2014 13:56:50 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WC.3

Switch: FSCS

Age: 1997

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
......JFIF.....`.`.....C................................... $.' ",#..(
7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222
222222222222222222222...........".....................................
...;.........................!1.AQ."aq......#2BR....$.3.¼r..........
.....................!......................!1.A.2Q"a............?..v.
.g..u..I{4P.][email protected]!...p4tA.N..H.l.9.pkZ.I6.,..}
...>.....3.^......h\FZ..G).....3...Y...{.NL.......R.W]QU3..W.#...nJ
.|.):.?0.{.u........n...:..E....3Z....9..n....|=....B.p.1%.T.]...H;...
j......l. e....W....>...:.g.X_f....0Lf...mU ...:.a.V.L2.....ee..zl.
[email protected].[<*J.M...I"..RT.]I.M;...].'.Z.b,..R...M.Q[.)...x.
.d...o.Oou"..i.a..@.#.N.V.5.P.qsBQ.E........!.:..i]..$[B..q..85Ms....u
w/..kB..N.Dt..{N.y........D.J...RH...}UL..;<.....$...r.]....l.2..3.
G...h0.g...g..K...",5.....C.}J....... .zY_.N....{.s.....6&.......,....
...FZ..........M....o..Q..v.Tx.....I[....ob( 3.F..$p..g[.............R
0....}.Z..|B...;9..5i..s..,.5.gX.hf.^.C-$#....l}U....."iq.:.e=..\v...~
.l.8\....j.y.R..VEd.J..%.RJ.$....'.P..g...o..$..L^Y..DP..i!...r...5N!.
......4.*$....Z4.......S...<...A...e.Y.r...l*g..K0a...U.5..u....R..
X...^.%.qh...d1?0..I..zx-.....9....C.|N...F...|.<...4...*5D.vY?..d.
.\,O.....z..a~....).U<S.A.=..].O ..d..*.....f...S?ik......m,-{.g...
.x[.m....a%[email protected].&ii.Eam..;.
..BZb2\(.B.K..P...Z.^3.....;..{.!P......K..F.H...I.8. '.."./"...|..7,.
............[.;.Z.....c.....-.......k.\.n?....Xk.#.c.K....Z...:J).
<<< skipped >>>

GET /fjp/lic_5291922992626721370 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sat, 22 Nov 2014 18:11:03 GMT

Content-Type: image/JPEG

Content-Length: 3577

Expires: Sat, 29 Nov 2014 18:11:03 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WD.4

Switch: FSCS

Age: 332345

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
......JFIF.....H.H.....C...........................%!'&$!$#).;2),8,#$3
F48=?BCB(1HMH@M;AB?...C...........?*$*????????????????????????????????
??????????????????......`...."......................................C.
........................!1.AQa.."q...2....#Brs....$Tt..&35CSbc........
.........................0........................!1AQa...q....B."#$R2
3.............?.q.yUm..0.....8..1..=..w..6U`.}...9..........WH...{.UBD
a.0&........<85&*..y.m-....h.U[d.A.....F.SvAJ.3..).F |.....n.F..x..
.O..8.[....95.Te..`.uJ.WC(.(h..(Y#.c....]...uU.|}=.\.m.....u&I....*..{
>i.h..Y.p#g..../(9.....g...&.[9U.e....S..@..:..I.W7..b@.!*..C..*qS.
`!..T.1.V.....]8Q. .W#....tE...o.p.U.y.....85......UR..].-....T.^..K.I
.5p9<.h...Ja...=i..p...(.9..O....U..7.....F.j.Xh.......c.w.zS.=vz..
La.m/D..U.....R9Q...UZLb.J.J|v........S..W.Zh...F6.3.4.......8t.}.".*.
....O..Vv....h........JG*?.?....$.n.F.U....&Od..3.}].D.......c`.<.P
........j..|.-....b.F....`.{8...x....g..)...skM..|n.0..[..3B.......]^,
6..e.X......zk.....s.m.V.e...../Ae.,7..E./h.w.....).....\A5.}..."N....
..z.sK......!.....>t.K{.[[email protected]@.>..3......O..5...U
.[.V.......G\..nu..&......xg.....l....E..@t$x..Tq.................b..c
9c..|T..5.&ia.(.8kb...Z..$.C.=..2..<.....4-sQ.X..K..'m...Lr|.P...".
W.M=.#k...vy.2. ..g.t...FM....... MV....9.(...N4....4..{|.....F6.g..Gr
.]N{......Kk.. O..J..V....V)..>..].._...XH...u.u.6.t..v..U...=.3...
=..sW..hY..d{.....z..Z.S$g ....am9..'$..:*...X...n01......d....P=..!(.
6zT...9.....K........9\...Kh....Bd!;....8.{...:]...v0].W..9.....Z.
<<< skipped >>>

GET /fjp/lic_4024847165768833334 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Wed, 26 Nov 2014 10:05:35 GMT

Content-Type: image/JPEG

Content-Length: 29527

Expires: Wed, 03 Dec 2014 10:05:35 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WC.8

Switch: FSCS

Age: 15874

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
.UZ.i.......dll.....<c-\1ZG..6*K... BL..C.K.^........5k....... [email protected]
R..B.".r...-7.r*3.M..o.......D...L...4 @.....\../q....i...*.h.6.....!.
..... .....Q5.J.. .T.'-.......8j..........[p...2.4.q.4.K .R..J.C.U...T
Sp....).?RcG..s).e... Z..........]....`i.M6..VD#U(.k..Rz.6:.....o.H..M
i.>..!...J...~.5zB.f..'.g.E..G.\.... ~....m....W.~.........8I......
....'....?\W...).]%X..........3<...I......#..5.SEEB1....,...lC9.{.r
^ ....[S.X.[x..W...s8zO....2....)...7...v.mz..Y.......q/.B.......N....
......g.jX.lL..J.....h...AkT...L...4 G.*K.....0i....o.~...p...Z......N
.....o.~..B.....T...D'.....k.Bn.....M.L.0.`.../.$..#dHg....*....~.^..N
.`..>..P.a.,....T...V....!]...;71gp...b.. i....9.)..nF\............
..Fk....}...R............y.....($......O......a.5Rq..dCO..W.w/...Z9G..
s6..._...<O...a..3..p..vd....a..7dt"..DD;.|........0h...A...BU.$..5
EU......}.......k.`j]...z.......4)@[email protected] .LV...%Q..OS.......N.W
..A....y.lI>.....c=|[email protected]..."._..O....f:i.u^.
gmN.V%....."A.......c..r.%.-QjK....6..>....E..7...Tg...I.% 0.p...U.
..x....C.....zY4.bjJ-6(.H.8.z...{..&.5.....nb`!.`.,.A:..H..M.....Ds..l
F..U.B[g\..5.....I.y1.......=.3\5F.............y....d...W....../-WZ...
..S....nk{.......S...n4.......%]../...A..s......g~..b.)M...R...$9M.&.$
...D..~...E..T.*....t.U.f.O.H#....^..X...n....!I.P..."8......./..K?..Z
......(..C1.8W....;....1..&__...s*.o..r%"%_r..P.1...B.f-....JZ.!J...9^
......y.....E..4 @...B.h..$wN.....B..E......m6.[.#`.9A..5[..N..).~..!_
....^.c.a........JFIF.....d.d.....C...............................
<<< skipped >>>

GET /fjp/lic_-335187966459121615 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sat, 22 Nov 2014 18:11:00 GMT

Content-Type: image/JPEG

Content-Length: 33083

Expires: Sat, 29 Nov 2014 18:11:00 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WD.3

Switch: FSCS

Age: 332350

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
......JFIF..............Exif..II*................rhXXp://ns.adobe.com/
xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> &
lt;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014
 79.151481, 2013/03/13-12:09:15        "> <rdf:RDF xmlns:rdf="ht
tp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf
:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="h
ttp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.ad
obe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3F56D5B59231E3118C
25B73F5F880B25" xmpMM:DocumentID="xmp.did:9F091EB0632411E49786D14E3F6C
6DE5" xmpMM:InstanceID="xmp.iid:9F091EAF632411E49786D14E3F6C6DE5" xmp:
CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5387626a-129b-a146-b6fe-840052f0b385" stRef:d
ocumentID="xmp.did:3F56D5B59231E3118C25B73F5F880B25"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>...C..............................................................
......C...............................................................
........P.~............................................\..............
.............!1."AQ..2aq.#BRb...r.....$3....CV.4FSc.......%&DTs......W
Xtu....................................E.........................."..!
12AQBRa..#q....3Sb....$C......4cr%U..............?......3...A........=
b.....qO,.hg.".....DS0."4gzm. ..0m..........c.h.!%q..n....RP......F.M.
*..>...6..EL.\Q.1..F.*@..<*F.qR.b....0U...:..4^".S..4.z.....
<<< skipped >>>

GET /fjp/lic_5513065140658811164 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sat, 22 Nov 2014 18:10:18 GMT

Content-Type: image/JPEG

Content-Length: 31631

Expires: Sat, 29 Nov 2014 18:10:18 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WD.2

Switch: FSCS

Age: 332393

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
....W*.0...W3n.H.5..:..,4"<.c.S...e.o.=.xl)g...%m.:..`. a9...J....x
K.xy...H...z>.]y ...JKUMd.b...#.F...).%H..\.j.C.!....F..T.I......N.
9...Ij...wQ}Q.`..$.J.I.I....) ."..m =.............. U...(...p..." J.8.
....K8. .c...$..s...eO....R.Gi<.qJ.B|.5.j..b.$,*.e.....squ....{$r..
....%rP.........7d.....N8...9..........r}...v~.....r........>.... |
./!....Y......Q.>\......!'PN!.[.M.,.5Q.DF.C`.8I.8.....vGm.h.A.....m
._.w.o.k....#...hI~k..>....;..rz.....Q...~h.K..]D{....r..}8$=.U.q..
.V..>.k......A ......u...=9sC.u..(....7k....D.wY....k.{It9.....I...
......#...-QK..]L.,._..Cn...f..Q"D[.Y.=.Z)T`.. ..O..=.0..R...0a..r.-..
...7..)....n.j\M.5p...%?Ui......HH...4.CPQ.._/r...m.|e.......8........
V......h.....m`)..>..a;U..Y.............d. ..I6DL.......(p...._1.LB
O.......c.f..&..~.JzP..H...[3.m..yLdAg[N~...J.-.jpi.QvCe[...O.IiA.E...
.m.Q.=qO..............;N)..]...G4 .h.R(]Iq.N?#*.Hm.Mj......EK.Z..j..";
.I$..y. .s.J.....S..O..-IQ..E....A..g...1.../V..^,5-_F.. ..u.........;
m...wb.R%N.I.\...... ..wr....>.h.$...6L.n..E.M.i...W..0"X..Y2.J=...
JNzb..=..".q|..@...... W)6%6..*3.t...X.... .q.t.mv..O......upo!...V\.@
R*lV\..I..5.t./BEG4Fe..j..V....Z.e.......2M......).....I7_..j..Z..Z...
...Q.E(.G......BEj......f.......g(.f..?...H.G.S... .a\.H&I5.X.3I. ....
...k..MA.C5.....D...Vf.5..DRJ.U..%..J ........^n.Cv_n5..........b...!N
.T`.....YQ]a9q*G..q....d.MJ....].I.Rd74.J.rkv.j.INb....K.....v...rU.55
....Vf.$.....sR]. !<...../YyKFJpk.X.. .QMn.a".r..k.....S%....i..z@.
.]..uM.dR.$.{..T.........A%..JiC...rIi?f.j..O..ZK3...*....!J.FA7Vg
<<< skipped >>>

GET /fjp/lic_5586077590086644359 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

.I&..*..%M....B.pr......D.=.j... 9*...C]./F f...~k.y?.W.4....c..e..$..
...i.......7...*..G.......X......#...K.8.V.' ..A..<..[..f.5B..}q...
Q.Lo..U.P3. ....(Wu..5....6.WPT.G..^..T.8cj.-YzKjyGn2...... ..XF.A....
;.$O\j&t....2.....P....z..$....S%....:.j.....F}.c...?.:XD..'..._.kN..e
.g...7 .R....3.=.-QA4#qpJOJP..J"..*..=j...R.l...lK........Wc....P.....
..-....w..........8V.....8..A.OB9...z....B;[.}..F.....u~...G.. ..aG.*.
...R......hj......Z?...'k.1.Yn..n......m.G.G..x..>..8.I.. .h...v...
...p!.o..."4.e.s;.....#..*.....,..@./U..5.Z.LH....=.R....4.%...P.4.9.4
...GVoUb.....v....iK...w(c..7..@..$.......2......k..-.....VI.X.r.7.!.^
..x.....x.*.y.....2.X....,..YBI...k...z.V.b..6..I...v....\(...?c.pZ...
........?!A|J..dK......e5."....g.\.9k...X..t.omE.U.......&..Bn.].T..c.
.p..2y..(.|9U.=P......V.......ih..-.Js.95.d[.......^...7T...p.3D.9....
....K4.;..=.!X....pe4L.:..(.I..!;.\I...\.....-;)=...z4F..G..A..G.J...l
..-.U.u.@>tq1..E..t.*....x....Lw....E:.....E\...T...". ..0......C..
...h..w2Vb.H4..~=.Ai... yr.M.*.Z....[..B...}6A....'*..I...$V`..).....n
.(..'..O....I.;.....*[email protected]:OZJc.0....%.6w..
./R.mS-7.....q........%.._u...([...h..5.A...]...%]s.....w.(..][email protected].
.2.6.@.}..EE.,\.8.O....\.i.....h.uHY.R..0}.......!X.....N.k.jl.....S.[
fJ...h..C..Q)...6......4wF..............y..D...5../.o...x}.a*..<.t.
......RG.\[email protected]][email protected]...~^...".9.S...=..
 ..#SF6.m...2.T)HSV...7........Zc...(\T;[email protected].#?..|\.wW'...i.a.7....
8.HTTP/1.1 200 OK..Server: nginx/1.2.9..Date: Thu, 20 Nov 2014 16:
<<< skipped >>>

GET /yysnapshot/52a8925607b756ab77869e97b45145c6616320bd HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Wed, 26 Nov 2014 14:28:57 GMT

Content-Type: image/JPEG

Content-Length: 92847

Expires: Wed, 03 Dec 2014 14:28:57 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WC.7

Switch: FSCS

Age: 76

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
......JFIF..............Lavc53.8.0...C................................
....#,%.!*!..&4'*./121.%6:60:,010...C...........0 . 000000000000000000
00000000000000000000000000000000..........."..........................
..............^.........................."2!BR..#1Ab.Qaqr..3C.........
$4ST.....56DUcs...%E.....d..&t...V..................................8.
.......................!1."2AQa.q..BR....#3..b.S...4T............?..m.
5ZMC..Ez0a..&e.lO.6.........a%.......>v....0I.4A...NR<......X.UM
;.......V..c..s......`']....- 355.....$CPB.B...a...e.f^..`(.q/......R.
..e....3.....-f.1#Hd[<........hn....@/.,............~p.zX...L*.....
.j........H.........6..........F=..Q..~.>...?8/($Z..k...|G#'.y./$&l
t;.\"-.,.Dt)..."9.62........Z2."..........l<.......7.YK0J.x*?..Z.[.
.\.......9=,:....d....i....bL>S'...(0.%pt.|.T..Zr...N.O..!.....:j.5
.j..........-...j....d.Hk.Y!p..M4.R.^.k..>%..c...P].5.Q....a....%E.
r..\*.A.vX. 5.]..!..E^[email protected]..>.'P....I"..A.(..k.{..
Rc.\.XT...O....c.Bd..(Qj...J.#..K.......O..h.E.y.T....J1. 5..{...8Q..W
.EW(...Un.Y7.T...."P...UEHP..*.....s....2^...J.*...r......Z.U...C.....
.....T..@5I.."S.j.........K[...j...YP.rZ.KB][email protected]..~..m..c..
@k.HsgFHN...P.4y.} 9...W...l...4.a.e..\.QX|....bI.=..2v..-..#...o.!.T.
c.)...Q.'.....{.....}X.D...............4.>...-.A..'.m /......vi..zR
....}.....9....V6..}r......n}....!.....Y..lPX!h......u.....y......{.5.
...aGfL..y8.&.....B.Y.i....B.Pk...[.....<... Y..Y.C.....A........vG
og.yI....e...^#x.....=.i.4..Y..O>YD[.....6".OY...J<.4.C.....
<<< skipped >>>

GET /yysnapshot/0251296bcd44d452bc88131fcd5a82c510b81c5f HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Wed, 26 Nov 2014 14:28:10 GMT

Content-Type: image/JPEG

Content-Length: 95342

Expires: Wed, 03 Dec 2014 14:28:10 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WC.1

Switch: FSCS

Age: 125

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
......JFIF..............Lavc53.8.0...C...........................$ &%#
 #"(-90(*6 "#2D26;=@@@&0FKE>J9?@=...C...........=)#)===============
===================================...........".......................
.................[..........................!"1..2AQ..#RSTaq.....35Bbs
....$46EUrt.........%C..Dcd...&.7F...................................;
.........................!1Q.A.."2Ra..q....3B..#..4.$SCb.............?
..P..1..}..... .........S..}?F....TeQ..3./#.}....†.;9.#......s....(.
.0..0...`....>..U,.. ..W................ 6fq.yu.C.1q\.....OI.t..QU,
T....v..l..........K..?.g..kAAo........r... ...|^MK..K....se..<.:.P
p...M..?".....,..cX..E.u>q).6...Z.w.\f.x..&]...-.7.eQ.R.ya!.....4Q.
...|.]..A.aPS.c...,>^...r.......bZ^NU.[.!....`....}..O.........L9..
S-.l.K....g.&..2.m.W.v..?&..u.....GU...H~................JZP.V>.R.Z
z,D..Ln<.N...&S...8r5.t"4"...@9e. .......'&...`R..z.Z.Q...p........
...\.9<k....a............).#[email protected].{[.\.A..:.......X.x"3....s6..x
.E...|...eQ.t.{. ...8..:Z*.l.!.s(.C.....M..ro.\....K.....~...PvK...>
;\...5...N.##:.2.e.>{..:...n.....,.....T...2......1~w}...W7/....T.X
j.M....M......_....t..=.....f{...A.....I....sr..y]..e............ .mG.
..F<....H.qv}^d...Z.8y......wf.g{.72..jZYkg....J%..j..k....#,......
....ER.MW]G..*N~;...h.c....FB<....T........ e-.._u.k.2...J\D.Q.KN.$
V..b..u.O[M......z1.G...{c_W6..J.N%S..8.....toq.....Y3../...,ZL...&9KF
R>M#jgg{..5....K>....a...)%...Y...gt......s.....R*Kn.Q......M...
1.|h).Y{3.M...V..?...v.Pd.b......|*~T.j. ..UB...!9..6..z2 ..4'eE..
<<< skipped >>>

GET /yysnapshot/6220ec2397239c45c10a77ad32ad7e2b2f0fa20e HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Wed, 26 Nov 2014 14:28:01 GMT

Content-Type: image/JPEG

Content-Length: 84934

Expires: Wed, 03 Dec 2014 14:28:01 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WC.2

Switch: FSCS

Age: 135

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
I...}....]..#.3.?....*...."{...HZM0.@B-=uc.:......9....Z.?,/...z......
.1.)...wU.....7...W.y...|=k.<............7.A.U....W..{Y.8...,F7...O
.......fI.k...~-..r..7.!.Bv.....=I{F<.mH.7L.>.<..f...LK:.....
.Z.1)h..y.<..~.........t....=J.\....=I.G............k...-Y.Qh=...[.
.F...B.z!..........=Jr..7.A.G.|.u^......Q...fZ..H .a...l(]...^..;....R
.R.......%......7gZ.3.L=..p..p!.>H...h.U.f?g.....o...o...tzo...u...
Bg.........c.!.G.|.u^......Q..K.......bc.K.}k...=.o....^..._.y^u.J..h#
..T!r}.|.......h.Nq...z..P.......t...]..m#bI......^.....j.......L.55.R
..C.u.FOIg.....p.k....O.]J.[{..'....Nu3...U.i....}k..NZ...Oa....7.K...
m...R...{..q..K....Z..3.Q...V5.Rb....O...v..........(.2Na...u}W....`iO
-.<.c................)...= &n...J>...,...&Zy..s4..5B...v..;^Fh..
C.`J.M.,...;!u)....r......#tO........h77f.....M.......k..Q..Z.Z.n:3...
I.p....d!..a.V....7......./..l..-.._...z\..gl..:.....{...B9.(..A.wgm.t
...h...9...W.{s......W..~.........Q..B7#|. ...HN....6Fe."'.4c..w4RQ.w.
.w......z.].}(a..y.........]..z..]........i..j.y...F....nY.....Z..c...
...Hi]l......`.h...)L.GJ`..'.R....Z F.%"[email protected]
B..J...*.."....fR..*.QZ... T.Z..L".(...Q..QD.(...QE..QE....&.Z..% Er1m
. .2..S.SI`).(.Q..*...b.*.. )...D.$...8.U=.2....-l6..c1.H. .Nd.Q.....m
B...S....m5.....q..qs.M....i4.Nx........T.,.Qg4.$............*LD....G.
D7.V..n...G...r.......c.....KQ(. x.....Q....}...">..T.'s7s....{>
. ;..d.._.g.k."He...k.......u....8..h.......i}.L...&.W.RA...4..i..kM..
.....e..p]1.....K..g...S.........pjV S. T..R...b]fZ,....2d.I...xD.
<<< skipped >>>

GET /fjp/lic_4024571218891102107 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sat, 22 Nov 2014 18:10:44 GMT

Content-Type: image/JPEG

Content-Length: 38625

Expires: Sat, 29 Nov 2014 18:10:44 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WD.7

Switch: FSCS

Age: 332373

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
......JFIF..............Exif..II*................C....................
................................................C.....................
..................................................P.~.................
...........................O...........................!1..A."Qa.#2Bq.
..R...br..34CS.....%s..&6..$DTcu.....................................S
..........................!..1A"Qaq..2B......#3Rbr..$......4CS..6..
....D.dst..............?.. }[email protected].......([email protected],V..$.B.4......
..S...J...u.9...Y.HU.\.gn....{B....^:..g.S.V...K$n.4.W."....\ sQJH.*.Y
.&...*.g...c.5.q=4t.G.<..Er..H-H....v.....w.J.U..3........\.R...R\.
.H.lv.......O...m.6.f3%'[_..?U..B.M[.o.....T.\...N.=n.Y.\y.T.....m.I .
.. ....{.v.Mb.....Ky.....j2=H...=y..T....&.^...4..B.BP....)..:...JR..f
W.).....]....h...1....e.Hu2.....................Z.V.3[..M....OH...b9&g
t;..s *.;p....[..aJ.eL. c.......*.^..zNRd.........zf...}B.......-.....
...B...../b... LW.. ..T..$..]$.......5.|...DE...._.JU.....W......s'.R.
......j....*........_eC..t...=7..T..........}.(~).*mI..=f...}..P......
..........)....Q...Im...b.AQ,9>s.8.3..z...).z..A@...[...> ......
n.......Ir.;..%.....J.`..X......D1...:...}"....B...*-Fx&[c......C...].
...u. .U.E..Qp...:#.......c..q..q/G..]e...B..#...%..a.6.li;.y..U.....&
gt;..(.)f..]..}[..,..O.I..ZeYY..o.~]c..{q.LL.c..G-%....,.....?*..|?...
VQ.3>&#/.}.f.)]\..._b?;....u.....g..y...O.U.Q.w..D..{...P..ng.7....
..-:..-5.k.,....}.CRS..(....X......$..hn%...w....)..5!..\....'R.CpkX.(
.....([email protected]..<.....z......?.Oh..f..j...{...y...%.H...z..#c%.K..
<<< skipped >>>

GET /fjp/lic_7038928098121532766 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sat, 22 Nov 2014 18:10:38 GMT

Content-Type: image/JPEG

Content-Length: 38173

Expires: Sat, 29 Nov 2014 18:10:38 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WD.7

Switch: FSCS

Age: 332380

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
......JFIF..............Exif..II*................C....................
................................................C.....................
..................................................P...................
...........................P...........................!1..A."Qa.2Bq..
#Rbr...3C....$46S....Tcs.}etu.......................................
S..........................!..1A"2Qaq..B.....#Rr...3Cb.....$E..Ss..c
t....6DT.d..............?..*.........V..\.7...^u[ 8....9,.....$7..8..]
.g. ..).......Q..7.dLa....% u1...9.tq#.?Y..U.#..O.R_..{e.-..  .O[p;...
...svcI......m7Lb|8.m....9..>.......:.).^.Cl.h.p..,..HqDwM..Z......
P..YM*....71.g..Y...]...L....kl.....9.....GJ. .`..GT.{....S...j.......
.R.S.\M.7e....l.o.Gn$(,...m;%.$l..?.2D..H...Q.....Z...T...w...6..3.S..
.*...j[C.......J.ut.:z..].l.=V:.Uf....N.~.ic....]..RSJ......>8....3
..y....nW......B..QRJ..!...[......../b.vkj/.&....|C.Y......$.:.w..gw&g
t;......./^..&.fS..H/Y.".j^dA...wz..EAB..L..])?zkZ..u.....ne}... ..5.P
.P.z..v..s.)....T3.....;...W.kR.....#..q.].....iI.$g..................
;r.....S.mJe$g.....l2..oP~5..T* .........0..zC0W..........m....  .....
.,{T.L..eh..EH#.v.\.2..Y.>QX/.0.......e.`u..J.....}.....=..j.Sc..48
....C.V.....k].....#!.....y'...5...K....^.......8e...\O0.Mcp(.(.]k..u{
.....Y.)[email protected] )....G*cq...[f=......G.......uQp.>...Ne.c...bUA...B.
.?...a.D.XM..RH...%..y..Uo....9J.0..H.1 ....K....o...>_...Z]..v.X..
.y._.G.{.m....'a.t..MA.t..2....^B....5.<..U.HU.}b..].6.T...........
........d....{...iu..#$.0i[.qek>..W~...%9GO9......z...QERjT...j
<<< skipped >>>

GET /fjp/lic_-4848156311373801567 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Thu, 20 Nov 2014 08:47:12 GMT

Content-Type: image/JPEG

Content-Length: 33953

Expires: Thu, 27 Nov 2014 08:47:12 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WC.6

Switch: FSCS

Age: 538987

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.10
......JFIF.....H.H.....C..............................................
......................C...............................................
........................P.~.."........................................
.X..........................!.1.AQa."q..2..#B..Rb....3...$r....67CESds
tu....%Uc..........................................;..................
.....!.1.AQa.."q....2.....B..#R...3br..............?...........f....h.
..{q...X..P........@N<.&3_C.8.Q0!.........;..ob0UC....6.p.Q..8..W..
.k.)T.....X..a.*'.S,..?6*.....X .c.....=........X..o.A."..fh......xG..
1...#....T..z.G<.......aDR.......^..lv4-W.s..".U*..<.9.....8....
....".PKn....t....9WH_...Iunj.....?....;H......6....a......ya $.,.y7&l
t;Z..|*..........Q..>.8A....t........,=.......^.........9..q.......
..A3.WKd._.z5..9.l........z.<.[...... ..7.O.?...F.d.^....K`.W.....9
../..E'.A..z........?..I.....................=i.....'.9l:...E=./......
....e.\p.5.u.W.K.....:.........$..w'..i..[.6...R.r..d.s.[..8G"5.Zc..[.
H..}o..\..?.J....*.......NY.b|....0..G..).s a?>[email protected]...
....u....zn...1.5eJ&.....<.p....,l;.X..)...0......s..#j.L.*...g..I6
..y........../H.)4u&M..f....|.P5L.,.]y`..n<q../ ....)........_..xP.
[email protected].<.{.......n ....I<.$m....;W..>R.gx1]|.4...:_......I"
....&....fG(m....=h.YFWM.g9....KG.e.....l...VZRx.E ..q.^.i..G..Y..>
...<X..P..3.m{5..H.e .[.f...2....%...(...]&`.....Ym..<.. ......o
v.K...;w....]..*....H..[.Q..9.R.Q....%LbH....!...nJ.....g...)OV....X..
V...$..$..O.....){.. .-.i2.b..u.*..`ie..1.I..a...w.I..q..T.)3n...8
<<< skipped >>>

GET /app.gif?&cna=19H8DH4iO3ICAbhrJiZUcRuG HTTP/1.1

Accept: */*

Referer: hXXp://VVV.huajinv5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: pcookie.cnzz.com

HTTP/1.1 200 OK

Server: Tengine

Date: Wed, 26 Nov 2014 14:29:43 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=19H8DH4iO3ICAbhrJiZUcRuG; expires=Sat, 23-Nov-24 14:29:43 GMT; path=/; domain=.cnzz.com

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;..

GET /img?bucket=yysnapshot&file=d3d6bd8e6a1062acd56935183bf0c076f8c6da01 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: snapshot1.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Wed, 26 Nov 2014 14:24:47 GMT

Content-Type: image/jpeg

Content-Length: 11123

Accept-Ranges: bytes

Expires: Thu, 27 Nov 2014 14:24:47 GMT

Cache-Control: max-age=86400

Age: 314

Powered-By-ChinaCache: HIT from CNC-LF-6-3H7.1
......Lavc53.8.0....C.................................................
..........##$  3......................................................
........................}........!1A..Qa."q.2....#B...R..$3br........%
&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..........................
...............................................................w......
.!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcd
efghijstuvwxyz........................................................
......................`...."...................?....Q%.4.<S.Rq.5..z
T.....u...".2..A*.!5x.i...l.(M.z ...... S..0.......7.>...C.}i...)..
...S......._..J.5U[.O..."(mo.~..lP.....CU#.....Is..]}Es.oS........1)&g
t;..jt=..ZN.>#^.".....X.=r.............]w...2..f..WV.jT4%d..T.<.
..........f...P...k.be...kD.O..Ni....<P5./...CT.b......\.i5....M.{.
.....sP..N-......c.J....N......w.9.5E....NO.O.L.7.O.........L.X..KIlD.
.j.l8...C...[.o<....5C=Jj.z......k....,x?Zs..*MW%.(d...3/.W.6!....o
...[v<.(..<........}.P..T....fX~.....I..n.....S...'.T...5f.&...o
C...$......'...R.a..cy..D....]J..vi.....i.p*....eN1u.6..E.."..O?r.U#..
.-.[....X`...$....L.......'........EJ.E....iY..&i6..|..".?...E....$..}
y.Xf.....TG.l($......5=S^.g&.....( ...1:S.....?.}16...5 .Vd.~u,..C..|S
.............SN.....\~.4.v.A.....x..&#.2..S.H~.;m.......V.I....Z...S.~
...J~z..XwG.8......]......z...?.U..&<.Z%..].!......B.sN<..c.C...
..D........../.?n*..[.........L.PV.K..Sx.>*..Tw-{..{..jC..J.....m.c
.TT.....S"?..H.z...qL.jY./....E6T<b....535... >kp....z.~.C:.
<<< skipped >>>

GET /img?bucket=yysnapshot&file=c4bb0c058444fa31ef39f4028843a464fb4aceaa HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: snapshot1.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Wed, 26 Nov 2014 14:29:30 GMT

Content-Type: image/jpeg

Content-Length: 10167

Accept-Ranges: bytes

Expires: Thu, 27 Nov 2014 14:29:30 GMT

Cache-Control: max-age=86400

Age: 31

Powered-By-ChinaCache: HIT from CNC-LF-6-3H7.1
......Lavc53.8.0....C.................................................
......$$""** 33>...................................................
...........................}........!1A..Qa."q.2....#B...R..$3br......
..%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................
..................................................................w...
....!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXY
Zcdefghijstuvwxyz.....................................................
.........................`...."...................?....(. ..(...(...(.
..(...(...(...(...(...(...(...(...(...(...(.....Eu........?.......o..h
......Eu........?.......o..h......Eu........?.......o..h......Eu......
.._.E5..........h....]o.|f.?.........>3~..@....../...........kY...?
.?.....V...G.-....J.P?.........-..(...?.....i..?......h..feQ]...1.....
[email protected].!.4.g....................k.|'.....}..Q].."....M.............
7.;.4.8. ....W\...........]s.|&......8. ....W\...........]s.|&.?....:.
.....?..o..........7.?....u..... .........?...?..o...0>.......4..1O
....v))..1F)h.H.TL.OP1..V`..7T...J.-V.]DB.T.^3{v~gc.A...Qf.u2.K....Y..
........J.yZg$...!.....3.....&.m/>......\..s.S...I.J.=.]A.9Y.......
76.....y....#.j......M.j.n..:V..... .z. ..W..7.I...9...f.....?}z...X.J
...1K.)kTq..1KE&.qF).VC..b...!1F)h.....E2.QM.....S....AKA.......d.....
8..!./..0..^?....&...s.My..s.@..............>.}..];"[oC,.9.....J .l
-%.P0.7g...C-.#!...xwS.&...pk..tV..`k&.o...kD..Xw.5p....].....].Jf2Vv.
(..M..4..Y..f]....N...E.U.E\..Q.VY&h.G.Z.~i...h(.S. i..$...<.vo
<<< skipped >>>

GET /img?bucket=yysnapshot&file=9f1ecdf563b9e7d8db008c250c4fb6a172c6f304 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: snapshot1.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Wed, 26 Nov 2014 14:29:11 GMT

Content-Type: image/jpeg

Content-Length: 19168

Accept-Ranges: bytes

Expires: Thu, 27 Nov 2014 14:29:11 GMT

Cache-Control: max-age=86400

Age: 50

Powered-By-ChinaCache: HIT from CNC-LF-6-3H7.1
......Lavc53.8.0....C.................................................
......$$""** 33>...................................................
...........................}........!1A..Qa."q.2....#B...R..$3br......
..%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................
..................................................................w...
....!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXY
Zcdefghijstuvwxyz.....................................................
.........................h...."...................?....R...QE..QE...}6
....)...(....e:...QE1. %.........DW.O|...S.5.>m.. .3b.5...j.W.EropM
U29....d..=iF.}k.....V......U...<.=G..(H..:N.....];V>o.!..65."..
.5....%[email protected]*[email protected])..T.QE..2.)....O.P.))i(....*:..Q.....S).
.......@e%)[email protected]@..N.Sh$....`K.\.T....M.6.
...L.i(...f.j:@KIL... ...D....]Nk..m..D.....=.O.]...~ ....L......i..D.
p.V\....."r...%...........QWc....s5......:yS.zw..c .........WT..o.D_.S
..|tme...g \......#....>..*.i./X........|.A......\......Z.... {W.}.
}#P.L.....*.K.8..Lj}Fks.:....PhFi..M.HSi..`..}2...ii(...y.....u%.Bj3R.
...i..QS....i(.....e....i..>z..d.=..s.c.w......5t:$...%.%.>.....
.p{9n...E$ ......2..Z.O......%. &.......#<f.\.2.-.h...B.s.....D.).\
......pI...c...30.,R..?8.3.Y.>T.O..9.U....<..,~d...G`>o.....;
.}....2...../.&.M....".#...^>.1@... Q.I.<.1...fZ.~e.yd......j...
....0.~g....>p.....$p..?.........g.}......p.94>L.G.^....L$..I...
..m...7.^y..bh.....k".QQf.L.QM...M....ZJJ(.4.}2...... ..'....4...'
<<< skipped >>>

GET /assets/css/style.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:29:59 GMT

Content-Type: text/css

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:34:59 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
1dbd.............=...Fr......!e^DJ:..,b.v....H`........9$u......s.!.. 
.....H.Y}#......H...[u......C.v......?..w...... ......os........Q.{...
....-.` ....m'.u.[R..c^...6o..)...#.Og......*...J...7.,?m.uKK..}~DA...
.O.....m_.'ov(..>.w...O...EP..M...F...h.....-._....h...n...D[&...j.
"...y..}~..SU...._....].A}.w=i..`.vu...........j...19.R...v..N..4.N.H.
...V..bY(.B.....d..2<. .P>.|%..g...r..Qh..lib.2.X.H8.U<..,..#
..s.. .K.m.H.....G.>.`|....S...).6...3V.N...$.J.8...$........(.....
pw ........w..K]Y..e.X........-c!...,......1...la]......t....<..a..
>...e[../..?\........U.K...m.......<.}......W.......Q.~.....d.9.
>e?1....o.0\o......'<.........x...v_......~.3.X=....!........ {T
\.sO..^...'Y....B.U.m..dv.N..]../q.}f...a...w.~.7..|=....k2\.<O..in
.....Z..MUo....(k.........k...;.p.o..k.N.:.E.N....nj..Od....~y/iY..j..
?.q.....q?x[.5.f!{ZT~....... QU`K..},...!....H...?..!.F.<5.........
.x..|j.... ....h|..~{...A.. ....G.....O&-.3..../......O..M^..i.']v...x
.^6l.......W.Pf-.\k...<..kb...3.....G./..*...#....wQ...#.Gh.......G
./....P.F?....~.V!<c.1..bxA...?...*&..1...........Q..*<V......_.
.v.7.....=........e.e;k.h..Tv.n....XU..XV....-{...'t..G|.....*..C~.k}.
..[.. .E....f.su!RT...y....`<@...."l.........].o.G.....*..?0..J*...
x*...B..TY.............c.|(.B.<...#/.(...._.-U7.E...&p.k.*CFRQ..0..
@..... ...u.U.&..C..z.......v...U..T.......A^^..?...t.....d."..m"X.J..
..5....m.6../>x..X6.r.....6%3-....B......7..."R.......P...#.7..C...
... ...F.|..W.a..Z......%...........N..i.p.l......_e.<.E...;.w.
<<< skipped >>>

GET /assets/images/loading_32_32.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:00 GMT

Content-Type: image/gif

Content-Length: 7595

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

ETag: "5474673e-1dab"

Expires: Wed, 26 Nov 2014 14:35:00 GMT

Cache-Control: max-age=300

Accept-Ranges: bytes
GIF89a . .............DFD...dfd...$"$......TVT...tvt424.........LNL...
lnl......\^\...<:<...,.,|~|............LJL...ljl...$&$......\Z\.
..|z|464.........TRT...trt......dbd...<><....................
..........!..NETSCAPE2.0.....!.......,.... . [email protected],.N..r9...2.T.Qe.
.g.H.N..N.*.<7...k..;Q..9.....X!L=.vjlC.o.6,O,6w4R...D.b.6.O...ix6.
....B!..$4.......B .../6&.(6.Qw..D.**..Q/.I^..E.....R.R-.5..L..6._.J. 
..1....../..(.. ... 3._.!!...|.`..{ ,.../.C..Bp0.#........b..pS22.@aB.
.R.@h!....,..d.r...- @.. [email protected]!8.#
[email protected].\`"g."2Z..a`...m(P..!C.eC...RaC..Q...pW............%..
0|h....$.. .....z~1.!.]*.....y...D*L>;D..oC^P(..9.. ....!.......,..
.. . ...........DBD......dbd$&$...TRT.........trt464.........LJL......
...\Z\.........ljl|z|<><......DFD......dfd424...TVT.........&
lt;:<......LNL.........\^\.........|~|.............................
........pH,j4..r9$<./.T.`a..g.H9x.C.ht.B..!..... .(....4!).&.."c"B.
.3i5.l..B.c# 5.O.52l.eK$.-D.c.5.O_%l,D1.D.....5-.#.1&r.13.. B..D..,...
5...5/Q&....E....0Q._E2...I.4..0.L..L..%..R...S1R...!.dT...] .".&4 bC0
}.Y!..P.C0.[M........a4h.c...:.......-D*.P..M.&..xI`...!$....aB....(xv
..S.9...J......<S.,F..9/L .3....6.. .D...Xa..jE...L.x.........{....
.*.e;$.."[email protected]#<^..3K..Q.......,...
3.......8l6........!.......,.... . ...........DBD......dfd$"$.........
...TRTtvt,.,......LJL........................lnl\^\|~|464...DFD......l
jl$&$............TVT|z|424...LNL..................................
<<< skipped >>>

GET /assets/css/images/logo.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

GET /assets/css/images/logo.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:03 GMT

Content-Type: image/png

Content-Length: 4526

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

ETag: "5474673e-11ae"

Expires: Wed, 26 Nov 2014 14:35:03 GMT

Cache-Control: max-age=300

Accept-Ranges: bytes
.PNG........IHDR.......-.............PLTE........}..lS3#..T.....^,, .N
. .............Y....p...Z...rJ)..<r.j.o6..9L .(j..c.....i*..d...kUK
..5.zq#w.Z[Z.....G..o.|'..4...uxxbce.oQ...,b.2...vL....z3.v(.....2....
....p.....]4....2..S.....H.d*0u.....Z(..h........yy.....0{...L..T...se
UR..HGG..:..W..w........,..-..2....s,.Z&........4.l,..:...0Ur..=..0...
.....3...^2.`...X'....H).H...5..<Ej......}.y9........E..j....r-..2.
....j.....B..........o.{li..:..:..C-q..Z2....so.Y...6....{5.X#..4.....
;opn..`rB..h/:!...:fln.Y...-.O......9....a;..k..5..:..k...0n..~/.. F..
..?.^...V.N9.q-.....6../..AJYm...........J..z..........L)......\KD..8.
..d<#..4.[[email protected]..............
...................... ! ....d/}GW..&.f).l1aso.` ?....i..).. ...@>=
h..QRQES_........F..T..L..U..5867..9v...._..C.........$....tRNS.......
......................................................................
......................................................................
......................................................................
.......................................S..%....tEXtSoftware.Adobe Imag
eReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id
="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/
" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00     
   "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-synta
x-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe
.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns
<<< skipped >>>

GET /assets/js/index.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:04 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:04 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
e6d.............\.s.........5.I.t.,.....!0.8@..).....t.t'.N....Ci...FC
.I..0...$iK....S.%../...[..i.$[JigX`|.}..y...rgJ...(Qn.EW.L)a.w...R.Z.
[.....Uj.().?....I...-....(y...;.6.....|....!.t..k......W]^s.....u...0
....u'#\......Mi.h...zWt......70..*.dG...A&.e'z..F....,E..G....L.cz.|0
.....l...n./...8....t...........GL;...."...".l]/..V3....  ...p_..A(}..
.j'.-....t.....~....#G....\u.z!.*s.VK-Z...W...^.*...Zz.r.....0Kj...)..
.^.}....w..U..p..K.?...cG^=...R...K..2*.%..U..Z.i,;E[_F.>n.o.t.6/.|
..Y..n...d..J....B.........(..P..3.24....#.McD.....3.;.4.U...#%Jz..XO&
#.;..w~|......a...............e)...j ..V.....h.Ef)..4G7 )~.7.Fo5..4t.-
H.e.u.I.Iq.......jnU.[..L..&SR>)...[.Z....d.&'..6.v.mT..:....Hx....
..Vu'........... 7<..b...%[email protected]..&.BSw.e..]...ZK.6.MJ..k
...f.%uQb}U/.......2h..33).....,.q.^[email protected]:....Z.1a.sj.../..an.H.W.S...
06....N..j ....J..*qs#..D/.S...X..^"..>`..j.GaLj...I7l.4.....6))_.(
 zp.6......0..l.<a=^.x....J.....j.;%..~2.....IQ..L.J".2.;.>W. ..
[email protected]@...S-.A....Q.0c...n..2.....(%..w. l.
...^.a8;3<......."f...XN..Q(........".T..7...m.......0.L!..."...dg.
33..T.&.-.2...!...q..&A....M....(`U\.AC..:U..JJ...,.....%..i...!.o8 UI
(E..;W*.O...n...`,[email protected]'...*).T.~.)..pk...G,..8..#.N...P..gm....Y..`.
......-!.O......v[.f.P.............;.$w./.%.3........olu..\:q.U.s..../
...K....x\.>.M.~.....C......-^Bx..|\P.....4)M......"..nk....KE.tm.p
...{&.H.L..{..wz..........\..p..S..... .q...Q...t?...8......i.......$.
.P....UCJ.D-z....^$?.UR..u..b...x...g.......I....Y.......:X.B...*.
<<< skipped >>>

GET /assets/js/mods/jquery/plugin/bxslider.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:04 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:04 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
310e.............}m......;s.....$[.....&.>[email protected].
..9/.....i.m:s9.. ...pp...R^...\m.E......n.R.....e]...Xn39....?.<7I
)~..V.w.\..../../..........#..x$......,....?9~".._.Yv'."Y...z.6E^.7R,.
..y-*.............?^.k....(6wez....O..i&.ky#s.C.......U.T.f._`o......I
...........n.fR,.4..... .].I..LV.:.Y......./...=8...L*..[._. ).}..>
\.... ......B.....z_.@c...^./...|.A...k.m......./....*.fu.o.w..'....z.
......#.....2}...d.Y....%.sQ.%...Os@.../.bs&.r ;.V...t]....y.<.WIVu
[U.)...OO;/`}a..D.h.......9....:)k.....v.X_b.74.d..P......,C..)n|..%.}
#....1m.}Ks.. .=l yqy...M)...X'..&8.I.t....6............3.b.X=...q....
...v.......iP..m....=.f.g......;.Gl.....M....y.]..X...7.y{...s...]?z..
......L.....nh......4[.aH.....mU.k..7.....~...e...\V.....~...._......U
...?........`.d[...@'....`...#^u.1..M..=.E......H.a...Z?........7...3.
......(....|.5.kb.0...C.&D....%wL .(....._>.2.4'..[....:....0......
.H......._=.....-...%P3..f. .|...j...*J....UM.6....WDC<$..M....??..
..Z.:o.). M{.=.....:.d~]....8.....e.....U......z[gu..I..{......T<.~
h.....d.j............G...]....|t.O......5..d!QJ.Kd}K..,...b[.P.RS.{..T
.%[email protected]%K.s. ..o.b.........pl...i.l.<..&.@..!._.,..mz...*-.Z\K
^...`.$......X..~%`......YQ......p{:......{z.._&..l.`.....~..f.3.....c
.7........_..u....W...8Nb...H.i....)...D.AF.<....=|.}C9.&7.s.x...5.
R.!..R.N.l.z..D7...{Pj......h.... ......E*[email protected].^.....o....y=......
E).Gk...............=..3<./[email protected]........~.@
.;.j..eo.M.S. ...?....[O.1.~..........T9#....(.............,....5.
<<< skipped >>>

GET /assets/js/apps/request.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:06 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:06 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
3f2...............O.F....E..8EHMP.o{.VA.@......?.r.hv.;'D.R.....vE..
[email protected]._.........&..|...../..gc....H...P.[...d2;?.....{...{..
;..#..................EY.t.P..55mKd.... ..h..5.P .nNNLN\.b.M].E.y.."..
.Tf.....>...4k..y.0...W..>.YkG...y..A.g.i^ .*.....b...`.}...]ES9
....)..J^.j.Z.^...,.0....25(....b*;..e......E~x...............n.Z=....
.<.|. .",.....1_.E-.E}$.D.|. .F..J./=B..J...P.Dk...n6........r.[...
e..i.......!.3.P.@>..[I........=^7....l..<..I.c....-r...)0.= .j.
...q...q...............&.#*....7_.Q5).hp&....tr$....\.....8...P:.Qdk/{
..Be"(qeND...[...>.^...g.Z=...1...D!.I......7|Y9.... .e?'J.4.t.....
{.6.....g..............R6.J...5..V..q.#.VUPbv.....W...3.UY.-..s..H.W..
...p!.\..:4.......A.sf........F......[=.)i.....n....Ou..}y..G.....eJ.S
......h..^B..`EI.n......M....tq\b..x..;1..F'..........;....W!.fp..O.tv
..[-s}......{Z.R......\Q.EF....O...o.7.u...W....d)j.,U...L.....sNA....
....= <..O...>.i].AA...e*-`..[Z..H......j.F"J9...^..\..7...H8.Dl
4o.;{A....)...h...C-$..?.1.......9q....GCh....w. ..=.........0..>....


GET /assets/js/apps/tabs.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:06 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:06 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
263.............U.n.0....?...........h. .4.him..I..T....KJ..p..'......
.sX....../.f.vui!%.....%[...........HK..$..]...`_..... W.AG^P...S.I.V2
{...E.......`X........[.......w.5.......RA...9."V.h.9Rt?.....-Vd.8p..Z
Q>E.e3Gb.....zTI9....Q..O...SRN..B&.a....0..D,......3..K....e1..:..
.....[q..,?>....n.~....b..]I.r.U%..e...:.N.&.C(T(.._...... t.v&q!.W
%.cTb....-...Qt.......M....m..9<..?.=M....a.[.S..894..I8....?H...8.
<..|.....r.....D'>2....k......:$.....*z.C....... .c....(U..3.7..
v#...FO..3.K......1k......S...M~..X.....i:...W}..}'.t....nQ.....}....?
.*..M^....#..-....D. 1.P..=...&.3.L'A.<[email protected].=D.o... .<.?.
...z.....0......


GET /assets/js/apps/eventUtil.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:06 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:06 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
309.............VOk.A.?o..a...m..sBA.....B.cv6].........T..B......"*("
RCZ...&..Wp..L&.V.....{..~........#.Op.....z...U.Z.F..U...$D... Yk..0j
....Y.y.]vk.Xv.s%...........6.b..Gh..e...9,.hB...TX....h.a. .q|=T....7
.....9M........lFb.AU...US....z.q......$4...Y... N....x...?...bf.>.
..X..x.z.n....[...........g...D.z..T.E)....L?..3...%.=qi.S@..|....XZ..
.....>..gJ...rqe.h..z..a...}....]V..q=...PBVq...mEJR...... ....@...
..j.w..J.n.R.Y.&......2...v....c.G..6...d...V..O"..3...#j..sC...g.X.8.
.......Vmq.}/.l.$.....t.att...k.f{..<;~.}:K....|.^.....^....do...Ny
O..p.~...Ko..=...v..q...e...N_._mK.........gMB...%.....J,.y...nzq.;.8n
...... ..{N.`v.y_E[....Z.n..u.".R.7.l0.^......s.>....][email protected].&.
wK.H0d...M..U.....G'ir...8% .4u...[V...Uar...}...UP...k}!kl5.".|Ap....
....R...3..I.i..~3.Z......0......


GET /assets/js/apps/slides.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: Hm_lvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lpvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lvt_79c375aa39fc2aae3161264213dee7ec=1416993761; Hm_lpvt_79c375aa39fc2aae3161264213dee7ec=1416993761; hiido_ui=0.8868442120119542

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:08 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:08 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
520.............X[O.8.~.WX^4I.%..o.2.........< .L....]...B..{..8...
M%......\B..B.pQ...%C..J.....JiSL.R.e....3..5....I.......-.n*z..<..
.d......K3%j...D.....d...k..{...Aa.G..,.i....L...2.K$............x.n..
/.z....2.?vSw...........)1..W.w..|N.z~.....;.&...CJ>d..u.1..n....i.
6....8.5.... .$#& B_Ouz....HM6........7.].....VFa.<^p.!.Q.t...;7../
...M..M.g..|}..,......k...Y*.$.YQ.i@&..#......~......(....~...m.V.....
.P&..@..\.......:...].E.O...h.Y.~.{..A........%.V..].<...X.....!...
yt..4.S.Ng.Mr.[r...T.:G.:..Rh;.A. ...0X.......).3.p..ko.2...!...5..Z_k
....Y.{...:I...H...A.yt...L.e.^..S.w4MP...k ..'....o.s....Np...9%..`VT
..r....}W.d2}. Y.....K.Z......2......g......... P3..VM.r......&U..R..-
..{lCy ..i...n;...O7H.AL......4w....w.Kh.qa...._..^...'...2..[.cQj....
.1....._k..{J.A..t..a.JC.7.9.|..|...............u....,.jj...>.(....
..|.N.....E...> .JCS...lt.$b2.L)...."...X1y.L@.$.}......3.g.......q
f.yh-.*!CJ.AB....4....M]o.q....,.]...Cc..L......:f.B..F.n.o...(.:..W..
......uXSS...`|...Q..i>...k?...y.%..A.y.v....Kcl...{L0c$.|1..Q.2..$
[.9EOi..g#..\.CDu/... ..m0.`.Y..4.`....f4j.....RY..',...e.&...J..V..5.
..V... >R...a...oF.4....i......8....."..N..K..._...\Y`......RTI..q.
wQ..=C.Z....^.t.[.T..5.....;.G8......pX..=...s......=.}|SnO.$.].1.....
Y....E.r.q...W..b.L..|...i..G.-.i.....}./d.0m__.......x..l..).{....}..
:t....RB..?.....0......
<<< skipped >>>

GET /assets/js/mods/jquery/plugin/lazyload.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: Hm_lvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lpvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lvt_79c375aa39fc2aae3161264213dee7ec=1416993761; Hm_lpvt_79c375aa39fc2aae3161264213dee7ec=1416993761; hiido_ui=0.8868442120119542

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:08 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:08 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
952.............Z[s...~.L....8T,QJ.G...U.'=..v.6.t<....)........]..
x.))I...[..........XHM/[email protected]_.E`\.1y{......In.o
.....P......}rb..!'.v.P...l.B.....m...pA..^.D.,8.xt........o.......|K.
. ......vc..sh.P.d.Kc...<{.......#.O.h2..V .G.%.b.Z<^.$q2Z.t(.."
?jl.2.o..../.X.QD....Y!MGQ."...P....4N...!...X....)S........_....lI.t 
.G..>. .J.{91..3..k.p.,/..x@U..#..T.*.4..o......M.......b...MS..\^c
.#.c..<p...2.4.<..YL/....R.k......... 0t....V.}.........&.k.....
1.g).\9.9.m......Yx..6..y.gTC..f...'$..@C(.%[.F..P4.T.$E.'"`GQ.x8....w
......j.._.|......|......h6}...'..o.a.......i.|..p..g......t......7..8
..s......_.$..x..E....=..^....y..t..h....8|.2...=..'......lfTu..8<.
[email protected]~.g.CF.#~.?.S2..*N..S...=..b.iL...o..
GL.,.[v.k..g.s~M!..<."......[. ..R..)8u..S..}....pa.T...l.P!.^.....
@....!..~.V.V.....vJ.[..w...i.qg..&..yW.j.$fb.y...{A .q.p...`).k.....v
..C.4...........NS...../l.a....L....uW.`^k=.......S29....F.E.,.#.y.M.^
.v).'.;<$r e.n...eA.3i...i.J.. 4&lW!.iIDk..N...R..-....^...G...R..E
..(n.8k,..g.|i.&...A...c...~.....T[..3..z{....E.."...k...I..{.........
}..`"`.OX.2..".4.E.........d..^x.j..ipm'k.J..L.ds...C.Z.OlDY..-.l.^...
3U.=I...^......0W.`P.N.{.z$.$........C2H....b..}.8...,b..7|..I.T.v_..6
.-..:.....i.Z......-........Z!YZAQ.........B...x.G.M.....NkT..|....|6.
...<.h....R..d...h9v..'.T......0..i...AF..~.Hy..h....W*....V|..ch..
....R.f.....\}b..]C..U9<.^....?k..$ ..v..16.C.......y.-WX......Mi!.
.F.k..E=...M...>y.G5...v.e. ...N....b.$v..7$...,..!.....8..D..-
<<< skipped >>>

GET /assets/js/apps/user.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: Hm_lvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lpvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lvt_79c375aa39fc2aae3161264213dee7ec=1416993761; Hm_lpvt_79c375aa39fc2aae3161264213dee7ec=1416993761; hiido_ui=0.8868442120119542

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:09 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:09 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
2bc.............UMo.@.=.R....j[....(....(..T=o.I...Mw.i.*R..@ A..s...8
...@....?.DI%.%.f......8.n...f,R.g...,.. ...P2@.<.R......?c*.`?.q..
&*.........q6..c9.:"... TK.]E....C..u.. 7.....V........].K.v...n...2..
.c.e7H...K'..%6."..nn..=h"...-.........*0-.E.KS.G..A....i.O..:ax.."2..
}.!t@'/F....?.cx...<........x.(S}Bm........=.'g......db.z)........ 
.X-3aT..#...x.........r....&,.IxJ.....0v.....M.).......D......x.....5.
m..V.JM..G.!#>[email protected]..<S5..)..h:..w m..8|.._*
.....J.....6...~}....~.Q..L..,[email protected]..\.c.....A2J..R..dK$.I.
......e,..\\.^_.zs5{.yv......O.n.~.}...n.....q......P.sq_..H.......>
;]Vk.@?....).e.....eoi..H...z...j.c...,...mn.K3s.....i..@..&....W}._..
x-... ..ii....pWE.....0......


GET /assets/js/apps/watchHistory.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: Hm_lvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lpvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lvt_79c375aa39fc2aae3161264213dee7ec=1416993761; Hm_lpvt_79c375aa39fc2aae3161264213dee7ec=1416993761; hiido_ui=0.8868442120119542

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:09 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:09 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
644.............X[..F.~...d.Y9V.uJ. G.d.m..la....,..x..m9.9.-(y.C/..BI
S(...H.C..M.M7.....33....4P.G..s...9GvX..2....#......{.3..;..(4..w.>
;..iMK....4..T:=...`B.F........Q(.JA..ONX.R4[bM.h......D..z..D....qQ*&
lt;{...../~z~...?....{..w/.}J....o..m]....<.\2_..;l.......9...~....
...=....B/Q......E4..i...Zk....~r........wo.Q{.CZ...>?......<...
?......G_.....8{.X.........V.i.{.g.3...i....f...s.p....C}.<...p..Y4
@6..!.\/l...$.w...N....6`.?a.}P.c...Q!9.....2...h2b.,.2....&.b.fjY?d..
...p.T.;D..P. V`....N.QjH\9, .E&..8..."C6&........vaM...h8.XkS.P.m..=&
lt;.&..}g.....)m.L....]...Z..m......<.,..9...5F8.av,.c...t........3
!$.X..;.w.>.........Si......B..OLz.`...f..r89.....X..b...... .....\
..h....N...... ..~...A.#O,..#fG..;..'.J......O.Il..).[c..3=i...$r....D
L...."=......~..Vqzw......DO.c........:....{.....7_h.w......k..5..`{C.
6'.`..R.....]..`.....I.|....u.......%.....F. j......N......[i........l
...i{~..;..Q.E...Y...(.........^[email protected][......^..?.l...g....Tc..esI
V...;.O..z..C.e8.<..h5.....q...(.Yi._.U..8V:...nn.:.*..fk.!1I..D.nb
....G.K.....lF.i)ya..U../.PU......^.....o9....b..J.X..,...0).....e-U .
.. ...&.g0..*.a.........(...G}/....K."..z..V.'..".j...........././ a|.
.....|.h.bME.s./..;..)u.9..*I.[: .!z.....ts...[.D.R............S..JSS.
A.m..K5......Y.N..Uu...|.jC......jT.(..2.|j.P../\..5{OA.*SW.....o.?. .
..K...cd.=..K1....Z.@../yZ...F...V.....?=MuC...........d....L.......D.
..J....f5o.R...}...V)......Y...:......Pim.N.!....Y..*....T..G.....\..d
 ....^g.........?.6.$]T....".I!JK._...E..-/......:....w...h..I....
<<< skipped >>>

GET /index/func/loginUserInfo?appid=1&sign=x&_=1416993761264 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.yy.com/#607455/2253074828

Accept: application/json, text/javascript, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: Hm_lvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lpvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lvt_79c375aa39fc2aae3161264213dee7ec=1416993761; Hm_lpvt_79c375aa39fc2aae3161264213dee7ec=1416993761; hiido_ui=0.8868442120119542

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:10 GMT

Content-Type: application/javascript;charset=UTF-8

Content-Length: 63

Connection: keep-alive

Set-Cookie: JSESSIONID=1CB08B9603D42835DBCFF29B0B6D64F0; Path=/; HttpOnly
{"sign":"x","appId":"","data":{"result":-1,"viewName":"empty"}}
....


GET /assets/js/apps/boomerang/yw_speed.gif?t=14169937756860.29626065445877353 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: Hm_lvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lpvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lvt_79c375aa39fc2aae3161264213dee7ec=1416993761; Hm_lpvt_79c375aa39fc2aae3161264213dee7ec=1416993761; hiido_ui=0.8868442120119542; JSESSIONID=1CB08B9603D42835DBCFF29B0B6D64F0

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:20 GMT

Content-Type: image/gif

Content-Length: 35

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

ETag: "5474673e-23"

Expires: Wed, 26 Nov 2014 14:35:20 GMT

Cache-Control: max-age=300

Accept-Ranges: bytes
GIF87a.............,...........L..;....


GET /assets/js/apps/boomerang/yw_speed.gif?t=14169937762950.611470024657961 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: Hm_lvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lpvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lvt_79c375aa39fc2aae3161264213dee7ec=1416993761; Hm_lpvt_79c375aa39fc2aae3161264213dee7ec=1416993761; hiido_ui=0.8868442120119542; JSESSIONID=1CB08B9603D42835DBCFF29B0B6D64F0

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:21 GMT

Content-Type: image/gif

Content-Length: 35

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

ETag: "5474673e-23"

Expires: Wed, 26 Nov 2014 14:35:21 GMT

Cache-Control: max-age=300

Accept-Ranges: bytes
GIF87a.............,...........L..;..

GET /online/online_v3.php?id=1000432731&h=z6.cnzz.com&on=1&s=line HTTP/1.1

Accept: */*

Referer: hXXp://VVV.huajinv5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: online.cnzz.com

Connection: Keep-Alive

HTTP/1.0 200 OK

Server: Tengine

Date: Wed, 26 Nov 2014 14:21:53 GMT

Content-Type: text/html

Last-Modified: Wed, 26 Nov 2014 14:21:53 GMT

Expires: Wed, 26 Nov 2014 14:36:53 GMT

Age: 470

Content-Length: 824

X-Cache: HIT from online.cnzz.com

Via: 1.0 online.cnzz.com:80 (squid/2.6.STABLE23)

Connection: close
var node=document.getElementById('cnzz_stat_icon_' 1000432731);..if(no
de){..    node.innerHTML="<a href=hXXp://VVV.cnzz.com/stat/website.
php?web_id=1000432731 target=_blank>............</a><a hre
f=hXXp://VVV.cnzz.com/stat/website.php?web_id=1000432731 target=_blank
> |  ......IP[31] | ......PV[79] | ......IP[26] |  ......PV[67] | &
lt;a href=hXXp://VVV.cnzz.com/stat/website.php?web_id=1000432731&metho
d=online target=_blank>............[0]</a>";..}else{..    doc
ument.write("<a href=hXXp://VVV.cnzz.com/stat/website.php?web_id=10
00432731 target=_blank>............</a><a href=hXXp://VVV.
cnzz.com/stat/website.php?web_id=1000432731 target=_blank> |  .....
.IP[31] | ......PV[79] | ......IP[26] |  ......PV[67] | <a href=htt
p://VVV.cnzz.com/stat/website.php?web_id=1000432731&method=online targ
et=_blank>............[0]</a>");..}..

GET /duowan.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.duowan.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript; charset=utf-8

Vary: Accept-Encoding

Content-Encoding: gzip

Server: nginx

Date: Wed, 26 Nov 2014 14:29:13 GMT

Last-Modified: Tue, 04 Nov 2014 03:03:52 GMT

ETag: "54584218-27b2"

Expires: Wed, 26 Nov 2014 14:34:13 GMT

Cache-Control: max-age=300

X-UA-Compatible: IE=EmulateIE7

Age: 52

Content-Length: 4690

Powered-By-ChinaCache: HIT from CNC-CY-2-3gE.3
..........}Z{w.<......@}..]\.....]d..\[email protected]._ $.w.....'......
.hf4..c*.J'.k..E..6T...T...r..'.........S. ...|...O..5...].5t.$.K./...
.8t..2...>1C=...[.._j.o..A.K..mO=........}..F.........kK*..N...-'..
..V..{]4>.........A'.......;......{..7w$..*.3.L.. .T.TAIz].a.B;Tffl
M.3I&..}u ....=7F.X.v@......|5...E.......b..e.........n.<.........E
.6.....N.7.tw...~.<....Jo.r..}&_Jo..c..j.$...l.......P.Bg.d....c...
V.sy....I..._..29M!r.M..YS:........P..q.y,.4=...Q....2...T.~......}..q
`[email protected].*[email protected].%s.=(.|
~i...\@G.....D9....o....S.k....K..`...>Tn..... .....Q...LG,.G.V...@
?.q......D....BF....[...3....M..S......m<.b\......e.[.T..(..3S....j
.... ....J... .>g<....W....Rk...S\....#KD..l'.......f..z........
.9.. r.-#*i.rZ..8[..ZU.......-.....$...3..j.(.8W.."........25.7o.sI...
[email protected]..!...]..6(d\ ..5f\ .#"....H.ld...W.RW...yL.[..Rk..6&k.W..6"..A
.:E..:6...*..Lp...4..G.a.6.}...f...uT..(.j.a.4.......1C ws... tt......
. ...).P....^..... .'.CO..%l..kT?I......C.T...9..D.._...|]...|].d.....
...4..,...Q,H.... .....4.D..~..H_..,O...(.=A..}...u.g.K.6.Q..P........
.r.,.W.6.....|...o./[email protected]).....7...........0
.H{....{...*.Z.._gZ.........]0.....A.YW7Y..u.C..B..|.AU....5.H.-.>c
.......w...vF0.t.....L.I.s....`i..P#..(.{....<.2MG...#....r.0....V.
.. I.!..K...K'..'_.;'......0.O.....B...H;V..............N_...<...).
)/.v-....K.E..=...........U?<.e.8....;.....y.`..P.y.p...6=.)...F...
..T.?.........D...$....w....Y.c:.#t.....0j...^N|'...#f.`.I.*...:..
<<< skipped >>>

GET /common/images/yyimg_notfound.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s1.yy.com

Connection: Keep-Alive

......................................................................
......................................................................
......................................................................
....................................................<I.....IDATx...
ux.I..-f[...-[233.cf.......g..n6..n6.L...t|...;~|.........03...6......
}...3.......r.z.[\.:....A..c.1.....3xxy.3..l....q...........=...lZ...&
lt;.......E...qA..:[email protected]{D....f.w......XS.kRce...:...?.G
.......As..R..g ...Z.g....i[...;8'XKW.P.\.(q...k=.:.Y.v..U..8,[email protected]
l.GFv..X:.w..| p....a... s..].4.q. o...V.....p&..5...8..[....6gs....!.
.5...{k.TM.....K.X......6.T....\ 4...tC.Q...2..Ph,.........Q...'......
.g>...Bs../...LP.&..-#.....(.,......F...x...O.7......4......q..6.z.
d...T.n[...D..uTJe.U.%.D...%1.n.^#,..c..........:[.8...o.K..... ...D.{
.s....a.}$F.............7.MpyA....?...j.N.......1..,h#...E..3s.o.....I
....X.............M.6Ce:B...-.z.&......Ej...|..n.t*......u.....D%.U..I
.....{..;[email protected]..^w.06o...6t2..../.^[email protected].:.@
..=.sv...zL...@[email protected].%/e.f..v....m./....P..#..V......<X..!3~71o....
../o.."........-..B...u........rQ.w.n..t..|[..U............. b.....;@.
..............c..)5.............W7.V..ii......9../.......XX...Ag.Q.a..
."R7\?...AW.G....._j.]...a0...a/]..`(C..=..y.X...._..eU...h....9..%...
..S....t%../..QB....*.H..).S{....v......\...W..`....|...r.,.U.3.b.MI..
u......7.......W.....(\)...Q\@......0p...g..|."..r..A..D...0'.f... .-.
>.HTTP/1.1 200 OK..Server: nginx..Date: Wed, 26 Nov 2014 10:15:
<<< skipped >>>

GET /common/js/jquery/1.9.1/jquery.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s1.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:15:51 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 24 Sep 2014 06:39:05 GMT

Expires: Thu, 27 Nov 2014 14:15:51 GMT

Cache-Control: max-age=86400

Content-Encoding: gzip

Age: 853

Content-Length: 32835

Powered-By-ChinaCache: HIT from CNC-CC-b-3g8.1
............{{...7...."........o...v..q.[cg'-E..HPBL....RD.......`p...
..sNZ.....f...E.L.._n.y..._$.n."QG..&/.R....v.......w.xp....Iqw..l....
.....GO..O..={b^...."F...e6.Q._~..Q^\...y....ytz..Ge.-....f.f.?|.U....
l..7R..i..DU....8.T.....$...Ry....|.N.J.t......n.sjK...*...y4..M..h<
;....y..'jA..my.n..D..5].."..v...jT....:....&..}.}W.......h3..ku.5;]$.
........h.Q.i.7....6:..Of...^.._.v..bH7.......]p:..R....W..k.::}3.,/./
.x.....x6....Q.o.....6.|...lx.L.\.......... xt..Q........||y:../>.&
lt;.<....[nj....e9{LO..N...].S.:N_M....u.....//O..YQ.v...">Y>
=y1..d.P....7}.2.e6{...b.....Lv.v....|.......zu..ON......6~...T}....-.
..Z.gq..4._:..{?.........J.*..b..Vy.......G...z.J....Q....WU\%....... 
y.....u..}.................<....O...R.......>J. .:.I..o.......D.
.7qv.PQT.*. .n..J..........es..E[....Wy.^)@r..5mM.......?H.3.7i.'^...&
Oo`.xz.F.g2....i..i:...#..Iv]....;ss.}<..d..N?...Qr..iA. .....lv|..
~......h&>................w.9*..fQv.R.8.c.W.l:...-.:)......&....._.
._..:1..E...=.F.{Z...oQ..\..A...........QZ~......_.yE].....:p..x...>
;....`./..w2....#.O.....pb.....b..'...\P.Of....c...~C.....t1."...).$qS
.,...n.gQ.w...V.m...~T&..s.%|o.&.L...L.R..X.6.#.&......=.-..E{....T...
s.....&O."...}[email protected]=.nF.x...R..6....iB.N..W{....p
|!..N[.d.`0Mf{......m.R..*r!....].pCx!y'.........U.UB.&...W#.....{.K.7
R.P...).7..D...g.Q|R..m;\.fD...N...k.x....(.C.$.....U.`..I4._{..Y..E.d
......Ft..]D...."...N..,...z......9.t#... ........4..~.-...]..........
p.J"...#..r.k.[.. K.8...........k.;.E>XT.r..Qg....nG......~lf{.
<<< skipped >>>

GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: yy.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Wed, 26 Nov 2014 14:29:51 GMT

Content-Type: text/html

Content-Length: 178

Connection: keep-alive

Location: hXXp://VVV.yy.com
<html>..<head><title>301 Moved Permanently</title
></head>..<body bgcolor="white">..<center><h1&
gt;301 Moved Permanently</h1></center>..<hr><cent
er>nginx</center>..</body>..</html>....

GET /z_stat.php?id=1000432731&online=1&show=line HTTP/1.1

Accept: */*

Referer: hXXp://VVV.huajinv5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v1.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Date: Wed, 26 Nov 2014 14:29:40 GMT

Last-Modified: Wed, 26 Nov 2014 14:29:40 GMT

Cache-Control: max-age=5400,s-maxage=5400

Via: cache37.l2ot7[811,200-0,M], cache21.l2ot7[821,0], cache8.us1[1037,200-0,M], cache2.us1[1038,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:0:406314019

X-Swift-SaveTime: Wed, 26 Nov 2014 14:29:40 GMT

X-Swift-CacheTime: 5400
1002..(function(){function k(){this.c="1000432731";this.R="z";this.N="
line";this.K="";this.M="1";this.r="1417012180";this.P="z6.cnzz.com";th
is.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F=
"_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a=
{};this.la()}function g(a,b){try{var c=.[];c.push("siteid=1000432731")
;c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h
.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.nav
igator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483
648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c
.join("&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,l=d
ecodeURIComponent,n=unescape,p=escape;k.prototype={la:function(){try{t
his.U(),this.J(),this.ia(),this.H(),this.o(),.this.ga(),this.fa(),this
.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.
da(),this.qa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(
a,"i failed")}},oa:function(){try{var a=this;e._czc={push:function(){r
eturn a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function
(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var 
b=0;b<a.length;b  ){var c=a[b];switch(c[0]){case "_setAccount":e._c
z_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1])
;.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPa
geview=c[1])}}}catch(d){g(d,"cS failed")}},qa:function(){try{if("undef
ined"===typeof e._cz_account||e._cz_account===this.c){e._cz_accoun
<<< skipped >>>

GET /api.php?w=134&m=10&text=http://weihui.yy.com HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: qr.liantu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 22 Nov 2014 03:09:54 GMT

Server: nginx

Content-Type: image/png

Transfer-Encoding: chunked

X-Powered-By: PHP/5.4.29

Age: 386407

X-Via: 1.1 zjjhdx36:8104 (Cdn Cache Server V2.0), 1.1 hx2:8 (Cdn Cache Server V2.0)

Connection: keep-alive
13de...PNG........IHDR...............e.....IDATx..].PT.........]V..WR.
.K-.2.......F...)M-5...5.ei..... ..)E3....A.ZM#...R.ABq.p.....~.t.....
....>.8........{.=....>....%.o..t.C7....Ds.M.9.&..t.h..I4..$..n.
..'..w.`../..............4...y...y.r.IAA.s`.......,..M....S.9.&..B....
.......x<....*.Lhh..f#tcc.....uFDD....=.l....s...<...F....1;5.La
aa....A[...V.P.j..m.Vz`[email protected].~.`......  .....t
:e}...#.........L_.f..........N.......$L}#^[email protected]....~.&!.`....?..~o
..h3.W.R_B....t..Yi....N.:I(.8..?............C.?..|cc.P.\..`@......O..
l6.\.....WVV^.v.).t...d2I....$.g............n.*-..[o.\.R..............
o....M<..:u............/.....Z..1#77WZ...466V.f.&Q;c.. .......=..&(
.. .....B.S......cbb....m6.d..;.).............O.Y[[;p.@B;..#G......|..
........%...........k.....'M.....K..e{<.A.....t.........;. tbb.....
.c...k...%J.....f......C./...........B_.|../.$....:t.@......"l{..A....
.f(...T5.....o_.LU..B..........{.9BO.0..._&t^^..\ V............~.y.G.K
...... ...mp... .[s..i .u..<O...[...KpXX.....e...,.G..\XXH.?$..F...
....?'........F.........: @.......i.J.P...A.~.....6..d...{....{YY..|k.
K........g..DsP.K<...u...c.....p.EEE... ..N.............z....;w&tnn
..K........J...7....).B\....k..T.Kn.G.hZI.s:_..Kh(....Z...s....M.9../!
.....3f....<x0.......w..M......p.S~..... ]i!==..u4.....1a.l6l..?...
W^..6..w.....q....@..;..at..U.Va...g.......K...b.;_....1..u.Z...1.....
..M.9. ..S......5...l......G........Q\\<k.,B.w.}.....m.{..G.q....;.
.YYY_|.........m.6|%d....z."tFF.r.7m.....j..zaU|%......K......?.0.
<<< skipped >>>

GET / HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:29:54 GMT

Content-Type: text/html;charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Content-Language: zh-CN

Expires: Wed, 26 Nov 2014 14:30:25 GMT

Cache-Control: max-age=30

Content-Encoding: gzip
ee4..............yw.G./[email protected]".kF.-.#[email protected]
.Hm.dI.Dj....Ej.)....o.ld..K_a"...%.$A..H...Df.r.........f.H..[......_
.R.....H..9.!.=*...=...k........OX..=......'. a.#....mwO..:..B....={..
..........O.92d.v............~ ....ww..w.ls.r.'#.Ak..}..........=.....
.../....&{..{/.r&}.......\.....E.. .f..a.-Q}HV7.G...D$i.....p....X.'`.
.I *.J#.......D..@.;./......(y.P.....u..,.:.S.....w..s.Kk.3}w..Y..~y..
.......~~.M.i....^..n.S.wf.?.N...<....s06....4..7......2......3....
oo...e&..L.{&k....96..b..tj..NI...g....h.i..*.V..;FG..........k.3u:.r.
.R..5....&e.....L^..gO.'.;3K.F...........'.k.....Y..l...n.o....8WO...g
...e...Kw.g....S.'..7v:..R.GKsO-....^.H.\O....&.p<6l....{.2....H.Tl
......T.P..z..j..B...BCz"i.K3."...a......Giwu...PR......=..g.}p.`$.e n
...I...Ic$.....ng....V..^7m n.w.......`.^".....}.OO..g.d...........H$.
..}.SOiC~...i$..LZ.?.>.>.....'.....~S...#C..}....AlhH..;z.../...
.......tc.........d|.z..b&..H.a..vXo..W..z.S...ZQ3......7...#<.5T..
a.]......$O..Bs~?h..............39.xG.......w.2...-.v>........(U...
*.........U.{.I;T... .  .....a.zOf.......<...%i...........7..GB#.Vz
L=....D.o.Y=.O=..z{G........t.o."H...%.{.b...OJ..F...uO W\.5b........I
=.K,}H....R/Y.._.2#..E$c.!=^.......)(......F......p.0.....{B/..|C.. ..
U.3......_. .R....O.........r..Un0...%..{T..J%/..Q ..g..K@S.?3v .....u
.R....gWBfTH...zP6iW.."U..j.fDR~W0.>..._.L. .C})...7..P.:..52X..R9.
!V.\V.L......lE..k..U......._.. #......R~W.....x.....p{..P.Y...'...t.{
....*..|.d..]%{.Q.....Yg..G.p...'ZU.d$._.N...}..BTV.p;W..i...`#)..
<<< skipped >>>

GET /assets/css/images/repeat/x_line_bg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:29:59 GMT

Content-Type: image/png

Content-Length: 951

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

ETag: "5474673e-3b7"

Expires: Wed, 26 Nov 2014 14:34:59 GMT

Cache-Control: max-age=300

Accept-Ranges: bytes
.PNG........IHDR.............../.....PLTE   ....8<.....tRNS....0J..
..tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....&l
t;?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmet
a xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777,
 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3
.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" x
mlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.c
om/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/Resourc
eRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID=
"xmp.iid:12C5775FAB3F11E39163FDB6AC556FB3" xmpMM:DocumentID="xmp.did:1
2C57760AB3F11E39163FDB6AC556FB3"> <xmpMM:DerivedFrom stRef:insta
nceID="xmp.iid:12C5775DAB3F11E39163FDB6AC556FB3" stRef:documentID="xmp
.did:12C5775EAB3F11E39163FDB6AC556FB3"/> </rdf:Description> &
lt;/rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...t....ID
AT.Wc``d.".....$":.....IEND.B`.....


GET /assets/images/vip.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:00 GMT

Content-Type: image/png

Content-Length: 7970

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

ETag: "5474673e-1f22"

Expires: Wed, 26 Nov 2014 14:35:01 GMT

Cache-Control: max-age=300

Accept-Ranges: bytes
.PNG........IHDR.......d......-./....tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:A92BD67FD68211E39D3597FFAA
DD30AB" xmpMM:DocumentID="xmp.did:A92BD680D68211E39D3597FFAADD30AB">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A92BD67DD68211E39D35
97FFAADD30AB" stRef:documentID="xmp.did:A92BD67ED68211E39D3597FFAADD30
AB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>.1......PLTE........%bR...... .`jben....s....
.x........F.......^'..m"KKR..X........m...prz.#.#%2....Y........u.....
Xymmqnpw~s.........877Dr..R4a....i...D......-.?.n....WSvsj...K,,=. y.s
...]..c....!........x../...T.^...q.j.......)*9..1.n.yy...C.......7...t
.w.d\...JVV^.d..f......{.w......ome......f.J. "/.....]........E.=.G>
;[email protected].{.<9U.{..O......\.q=..
..?......s.S..g..g...B.m.99?.u...R......C1x.........UNt...'(6.sc.h....
rfRC,>kd.....kI.n...V.WD...%'5........~53,*,<.d.....h....')8....
~.}#..].^_d..T..N..`......80.yq.....M...IRLl...//A$!?...^W.....y..
<<< skipped >>>

GET /assets/css/images/icon_png8.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:01 GMT

Content-Type: image/png

Content-Length: 10529

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

ETag: "5474673e-2921"

Expires: Wed, 26 Nov 2014 14:35:01 GMT

Cache-Control: max-age=300

Accept-Ranges: bytes
.PNG........IHDR..............'o.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...liTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:7bb480a7-2b39-4771-aefd-a8923aed4f33" xmpMM:DocumentID="xmp.did:
5319E9AA42CF11E48664E3484FD781D6" xmpMM:InstanceID="xmp.iid:5319E9A942
CF11E48664E3484FD781D6" xmp:CreatorTool="Adobe Photoshop CS5 Windows"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B034CC34CF42E411AF
12A46C8819AED9" stRef:documentID="xmp.did:7bb480a7-2b39-4771-aefd-a892
3aed4f33"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>{.n#....PLTElll.}...R........s........7
.................H.KK.............nn..............(..............V....
................L......%&(...........}.nI.........i..........<..6.`
^.......z... .Y0.u)........u..5.H 3....c.........D....................
.....................EEH...................|^..........{-_`b....}.....
w.....q................................~..............j$..............
..................tRNS................................................
..................................................................
<<< skipped >>>

GET /assets/js/apps/boomerang/index.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:04 GMT

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 741

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

ETag: "5474673e-2e5"

Expires: Wed, 26 Nov 2014 14:35:04 GMT

Cache-Control: max-age=300

Accept-Ranges: bytes
define(function(require, exports, module) {..var $ = require("jquery")
,...boom = require("./boomerang"),...root =."/assets/js/apps/";...// $
.ajax({..// .url: root "boomerang/boomerang.txt",..// .dataType: "text
",..// .cache: false,..// .success: function(txt) {..// ..init(getIp(t
xt));..// .},..// .error: function() {..// ..init("0.0.0.0");..// .}..
// });...function getIp(txt) {...var key = ["##{", "dragon.ip", "}##"]
...if (txt == key.join("")) {....return "127.0.0.1";...}...return txt;
..}...function init(ip) {...boom.init({....beacon_url: "hXXps://idcspe
ed.duowan.com/udb/login",....random_num: 1,....site_domain: "VVV.yy.co
m",....remote_ip: ip,....BW: {.....base_url: root "boomerang/yw_speed.
gif"....}...});..}....init("0.0.0.0");.})....


GET /assets/js/apps/boomerang/boomerang.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:04 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:04 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
[email protected](.iLk....V.A....M.h....5$..h..Jr....}.!)..=
M....I....o..........En....(9........UV.C.....}.........j..i.....kn;n.
._E. .G.;G.....K.....LX..2. ..).............f~e9........3....../....@.
U.....s.i...._^q...Dp.......=/. ...Q......C....4j....\..yY..........).
..7...../..?_|iy....Y.@}..c....7.2]Z..D.7..|./}7-B...&EU..l....r.....W
.v.....q>.._......f .r.x..{D_.......Td...-.s.?.D..q..|Sr.=.Wk"w.<
;-|.[..5......HE....?..i...........w.h......&*?H9...C,ryV..n..X..egJ.9
..b..5l.(A....s...P.cL.u..........).~...XZ..`..>G.X..Op.p7._.._e[.8
..NC.S.F..T.-I%.u"*Eg.&~..!.gY.yY?.G..\E>.....^.....c:......<../
.N.....x.mW....ijoW..dG....i4..<.....(....,c..&][email protected].
......(/.[.*rk..h..$.......... ...A....^.........:q...Y...W..aS...V.6@
.4^H...VK#r.z.s...iJ..H...f...N.1.hn. .7.ZW..M-jyJ.......%...Y.~.^....
?.G.. :.QM...:.x^....E..^:[email protected] ...5w..2..4. ._
m%.....!.......y.^.....).}...c.E1..d.f....4u...mkb9....R/...X{P ....hC
T&.kd.8..l.en..M.g.).Y..sxJ3.~.x../J... .-.h....#[email protected]. ...
.B^...Y.-....$.<.....U....L.ja$#;.%R3..i%t.V{..JR......VG..h.E..LE.
.& ....P`J.....?SU...Y..O...kd.../.J..(..@!(BX.C.TQ.M.G"... .-I....p']
.,....K.*#b2..}..K d~}=...:.=...N....{.D6D.f...].Y$. ...`....N.WX...7m
[email protected];d$....\puL.c....!...._}!..x....X......M..`c<4b..
@.Ql0...F.q.Y .AX.x.s..@x....\}.f......z......."o.;`.....Oy...>.R2I
<..........A`A.2.Jk....ta[....C.XvN'.....c..!GbY...%.."0...cd.y....
Q.c_..D|v...K....w.../...e)g.N.H.Q.....4..2.S... \B......D.[..K..|
<<< skipped >>>

GET /assets/js/apps/template.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:04 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:04 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
fb8.............]......=R......8...$....VTHQA.~".......w..k_..I...-M).
V......A....$.....}.O...o......].w>b..........>...[.......V.7lk.
.....\..5.v}oU..z..g....N...o.\..=..>.....~...@}C{yr..J...h-.x^.J.@
u.........iW.......6K...Z...i...JW.......!.<.Xa...t.......l......~.
....j....l.j^.:.V[v.....^.B.C.V?w.\.z.....4\.JiwWGTT.......L.r.2Z...f.
......F'z......n.X..7...y......@..`................Q3...\...>..W.4.
.a..A|B3..~.........ua....._...}{.Xd..w....O.".M4):..o..{}`b.n...v....
B...,K..n....._o.|..F.lF........:....xN.>.........=.P.....KPg..W_..
..._...y..-.z1..5.|.E%......a..JgW'7....[...P]R<\..2.D ....V-^..59.
.ek...h.x.Zg......t...$......Y.u&>c......6).2.^....`.a....._.z.L.,.
dx~..Mc....*.F.................QC7.Eww...#..au.&.:~woO....4#e.......w.
..G_....lt.U...>F.st.......Fo.g...i1T.....|p{..'..G....S3.".d.%.g./
..........x...}(......b.}.j....$.96tb.h%C'..<......y.E.y....D..1Z..
.. ..ka'..Z...$])Q......3f.....0!.....b3....<.`..7z....p8]Bp.4.....
[...)q........vR......2y.........9|......~.....)i80uLrT&.#..^.b-#T....
F.[.2.O....U......}....h<..RQE...CR]RL...z......xG..a,89...B.41...2
....,.O...^9*.....k..k..T.#.#.g....;F#.... .^.hs....c.o:p.....`&....0|
..{w.......;...s{.._...p..t......d[)Xe&suD8...L.M...T)|..>6.).f.q..
f%..........h...:*....By..-.....S3.....6.f..&.^6z..P2y..$.CB..{.?."8~.
H)........B....ICR..>......{...Oc....Z............r.|.~>eh......
.jF.t.Wc-.R?_...P....Z.{....Z.A..M1......k..i^B-)..V..K.W... -..:.0..o
..9.*8..w...l......H.|..T....A...{[..X`.I%BG....fp}.qt.c.~._]<.
<<< skipped >>>

GET /assets/js/apps/util.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:05 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:06 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
437.............W...6... 8.....2......h.*[email protected]
h.]....}.E/..l..a.....s/....NYD.4...D.%.L.......*qQ(&)..Zv:..7D.c4@..[
..)....W.....J..'.........;.J.......{................?k..b"I.../.d.l.B
_...HH.0.Y......V3.?..~[....=yP-fT...y&..U...\.ujW)/().0.W..:{v.ck..O.
.F......5...`..X.5c.{.,!...m|..q.....K:u...`..0.%J>....:`S.....V..h
...1:.5^.\^....B.?.9^.s..5....P...|..tf....*.Q........N!c......!\..4.W
..................`..$x.B...4.:. G.y.'.."L...!.0`0%..>......Q "E.a.
..E...;....PjY..:Du..n............9...<3._....5......._..h.C.......
6J9o.....uj}.. <..8..\yX;.`^9...k.A..........`.6...%M..M./.i...*...
7A:9...g...M...=*Ba......a.........n.n..Ug_.).r.m.2,$3.. .Z{.....H.z..
:..3.J,b..............q.q......A.vv{?......-....e.[.....=.|R...{..A..S
}..lu...x...R.....R..)a|K..0j2..*$<.5...!..&...Z...-X...>.......
P..>&.$......7'..W.s)b*...g_Zk=cO......7.....R.B..... .E.,..x<.d
tka....1s.*.......>......S..r.<?....d.X....2l..UQ.G.."...p..{...
v.......{.}.dP..s".*..O..3..<.."......'/N.9....5}5.O....Z2^.B..<
o..[.=n.7k...-..}..%........(o...Vv...`......U....V^.[Kw.~g...#.~.....
..0......


GET /assets/js/apps/logger.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:06 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:06 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
24e............mT.n.0... .@s.$[Q.5......C."..XO...t)*v...Z$...C..E...2
.....\t./...d..b.w....)..0.nR..b...^.L.O`:.R.>9.q..G.7767..H.L.)H..
F....Ls.|64U.".K..z3....Fw........x.f<...I$.C....?..*...<:.@....
.w&..b.XbO.a#.U.<..Qu:......'K.L."-.N$$....e.R...:..`.E.....A..Nu.!
.-..............I..........Z....9.j...u..`k..K..=B.*vf..jQ.&U\.k.p.!..
.e..V;..8&.G..8d&.N.A.C~d.w.&\.8...Ys.N...].................b........o
.......#X.]-.......?_...n.Z.S. aY...}.......A.J. h..x............Z..[.
.3.i.N....a>...Q.X.Nq..zVd. .p.=.M{uDw.3......,Ys....Q.BJ......Q..1
......../El..V....51lMC.M3.....O.v. s.g....D..y.....0......


GET /assets/js/apps/stat.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:07 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:07 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
4c9.............WO..D..#....m.lp...MX....=...z..j..'..=ff.I.......W..8
........q.u..$............S...s.".U.3...]...!l.s.d..|Z$.#.....U.>..
....2!....~0.>[.....|.8z3..)....Y...;ww$..d....fL............#..D.1
.P..g.'...._}..R1 R.)..w...[..5....U.....4...Y.4_.@~.t.aq~)..K...?...~
......?.:.I../....G.|...I.?c.[&...DR7..Ke4......xL.c....l.w.U.....9...
..<........gq..1..S..4.S.t...hm.._.E.n.......E~0.P...A.o.._...8@(.=
[>`y.M]M.&.6.x.OX6.;~F...F.Q.\*..f;..b.,..,...,.~....u....rT._].F..
....blR..}.....'.E.......yN...wI...L.A."...z?..&f....M.;V*.DF..&mud...
 .NWp(r..../(iN..Ev)x..Z.s.J.K....9wY..){5.x...gPc..#..#.y...rvvF .t..
b...."[email protected].....*....<.\.d.r...,.....I.\..F... ....c&.o..
..l..b [email protected])....`/!86..5A.D.A.._C...n...5.&8=-9.T..%..a]......
.)..;*..RR.`%`z....V...:......v....Glv..].}}G<L....1...p.......1...
 ..My..:tY..O..........(2&C.3.3.O..@...|Z...}(..U[..:.}.G.h[~..]...>
;.X..*..$.....<...Q.iIk.m...K.U5o..*^..%v'..u.:.u..v..~............
..._~.............G4d...\dPM...i...;-..6!....W..p.z$[*4....#..... ..A?
.E.^..Fn./h..l-....R.2.."..Y~)...;{.....m............J...........F.-..
.U..ZAk.=..9v..(..X...n..'.......E..h&U0.h..q.... .*....B6I.?....H..1.
..<r.ou.....X...%K......uQ.....D!....o..\b...% ...y.......Q.T.....0
......
<<< skipped >>>

GET /assets/js/apps/scaffold.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: Hm_lvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lpvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lvt_79c375aa39fc2aae3161264213dee7ec=1416993761; Hm_lpvt_79c375aa39fc2aae3161264213dee7ec=1416993761; hiido_ui=0.8868442120119542

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:07 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:08 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
182f.............<ks.F.......hb..&!.2fR.@...&..q.-_WJ...(..&.....2I
....6......X6<.y...........{N...RkfL.....<.>}t.....-UI.j...iU
<.ni.y.c9DW....x..4.j.A...M.\s..lV.....4...;.YP.....f......3=......
...Wh......p...t....8......&ogM.(.O.z.Y.q*rx.<_.x.....GR.L......*..
Z.g;..A.\'?....N.T...n........'s..qR...N~..y.%2v..MU{[email protected]
.ah .c@.(uU.U........nZ.mW....^.!.....$...@^k.1.J...M.(...MTE|.a...z..
L..5..%.3.r......x.....S8...C..C.....cU..G....f-...]...*..'s\...\.5. .
0jh....<X..%.....g.Vh9.-X.4<s..O....|.T..`.P..F....o...d..k!....
]oL...:..{w.....&.N.z5.U..........`T.f..5.V.j........}.e{5.......:.I0N
H.. ..6.OV. ..N.TT.-Q`|.Bk.Y3b........=?`h..........C..?....7.$.6;.(..
......O u.h..z..............[.....?..8..7.]..,.Kq.Q._.K...9]..l.ny..yN
.VM..o.M...t O..J...P.\....qZ........2....ayZN..u...tMM.#j....q....J..
.."[email protected]...>eM #..E....u._.z..-.ji.p.u.}
.....w.L.[_.?..xjB8{.....hZ.........-....X......iOH.R....[.U.U.y...J.j
T.y.vf.Y...........qJ1r-)D.6k^.r..Y..h...>.i..G....7.9G....&....XW.
.....-....._.GoFv..".L......}..f.e.V.I...^.D=....]..jw...v.....aF.e..I
..z`4..v....E.C...!E.m2..D....f..^V......XU..ae4.A.^...g.........Z..f.
.Ok7.].|.i..e..wS...L......L~......U....C.n........-..5S3...O...M..C0.
..UX..l..F9xn.... r7..Z....n[.rJ....t.....A=.J.qr.;wH.SKc..0....w.....
......./..0O.]...SKhr......3...(..Q..4...-..U....XJ.}.....ATn..B..M! \
1a...g....'......uc.x...8v..j..uX....O......Z....V....~.o...io..Ue....
....V....C..J|.M...[..NK...q..`...x..c......'W.._..Q.........<.
<<< skipped >>>

GET /assets/js/mods/jquery/plugin/cookie.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: Hm_lvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lpvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lvt_79c375aa39fc2aae3161264213dee7ec=1416993761; Hm_lpvt_79c375aa39fc2aae3161264213dee7ec=1416993761; hiido_ui=0.8868442120119542

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:08 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:09 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
56d.............VmS.F..l...a"9...N...aR.Li.&%....p.N..|...0.....w'....
.....}.Y.....E 3 ..5..........$.Py[..|....L..........-....d8~.7..p....
.R.....-......... k.s:...V.<..b.1]1m...u.9U.&.s...( .o.O~.?j.......
.....C s..V../......L..}j..,.J.(..( .....rW..N..u...z..R....`<....R
.Z.c..3.......|.R..z.M...n..\O..'....._.Z.4U.j.jC.A6>p.......mh..p.
S......O{1.3.....5....)Y.2.l.g`.4H}..8W.FI.-j8...r.=.....2V.Y.b...7.[.
?..-.!............io..:...(<?..0m.........!......h....o. ..0......"
.<&]..L....Up.....O?'.?n2..4..../&5...$...Q.yS3|..f..2.r.y8....,.&l
t;\".....t.E.......9....r.aa.3..A).#..(`.!c2..KnH|:..R*.AX.j#.i...=.].
/u......!.......8t4...t6.s}....Q...g..|.f7...ph....G3XO.f.3....&.../.j
.F.A*...G7...}.......O......kSX..=_%^%[email protected]...}.{.fbD....lo .0..
.......My..).rG...i.tn.i.....P...`<..v1.:.>\.9[.......C<.|...
...0b'5..........U/. ..".U.....j.8;.^..#..4J.........D.....c..H..r}...
z......K..........{<b%'....i.Z.......oE.0.p.q....{w..m).j.p.{%.....
. ...8.^.?DN..n.;%d.u...x.S5.c.y"t..Xl4...)N.$(\ h4..N9.(..Z..0".,.A.p
...A^...|...0...[A..y.....I...j...Sx[......]...Ko'CA..n..Q....!%. .l.$
5M-l.E...7..W.,&K.m.'P;.qF....V....j.8<....=.........L..pR.-x....IM
%....B.,.{.Ag..ij...}....n.=i#......K.:Fs..',G.l.{a-.zH8......s>...
.yF...>...QsX......ET[....v...l.>.....[4...C...o....BP.c.$q8.o.0
Q......B=.....7..G.c.8....&.-......E4.A2..M.../U.QV..w<......GN[...
....)...S.QH.j..\Q.Q...<..I..._....a.....0......
<<< skipped >>>

GET /assets/js/apps/autoComplete.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: Hm_lvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lpvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lvt_79c375aa39fc2aae3161264213dee7ec=1416993761; Hm_lpvt_79c375aa39fc2aae3161264213dee7ec=1416993761; hiido_ui=0.8868442120119542

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:08 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:09 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
786.............YMs.6..g&....!9.(9.L[.r...S..Z=%>P$d..H..%...{..A. 
(....(&v.....]0.K.aoYg1%y....&%..~...V.Z.I.b.....W..MT.s4C...<<.
.|[email protected]...{8.k.. /.X..]g..H..7.....KyfV...Bp..k.f
[email protected]......_...k.m...Q.&<?..3..z$y......
...x...no..=...c..$~$...^Fi.M.f...y..1,u...=.?~...__..../...H..`.|..c.
....)@....i..9...bO......{.z....i...$#.D)........ .|..h.-m0..,.w.GO...
..4...c..^'d..4......Z..;7.c..q.0*.p.<...R=.Wa......4[...T....C..#.
b2..Ul..H..S.Y...$.6s`.[or.A..<...7........O.%4^...9..Q...%L>.#p
...e.b".V...zX...Y.8z< .'..UL^........../.:... Tv.=.i.?......m.....
......4="[email protected].;j.!-.Z..&Jk...u].
.5.... ..k..e....3.tq9x0..(K......2.y\W.2...?...k....=.=.....=|...5...
..tN.8..wp!.......':..}p9....C..s......S...n.....78L..X.(`3<..$....
.q}....,,.r..,...Y.e%...0O.......Z.6L....V...,...,,.:...,.{\X.....?...
.....H.D.$9.p?...*.~.].......H.%t..KL.V.....g... ....)...V[.2y.._V.r&Q
...g.....Q..`.=.:.v.\G..(....i6Z.`...H../| .........8J.E.?..R.(.>..
..Y..*...eu........]....4.... =.S.....k..,Gc.M.Fd..,.U..&..IA...5...A.
[email protected]._...........>...(E.h.....F..M[Y.....*.a o....f..x.&
.Q0y.r.pm..JW...B..T..gZ.L}.S..*/?A.|j.ZBO.K5V.v.wU{N=.....CmHC.m.Ty].
X...`K...W.......r. ...u...3d....a.... ?k.J.X..3(p.Gu...`"C....Wt.z...
..o.,t...}.,M.w>...j.oO':vS. z..G/Z.zQ.XT.C.=D..z1..40...=.(S.<T
y....iw....Q....6.............K..^......FD.).l;.....:...y.N..Zd.......
[email protected].(J]......&......?.5.I.)&...'}.....(J...hs..B
<<< skipped >>>

GET /assets/js/apps/udb.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: Hm_lvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lpvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lvt_79c375aa39fc2aae3161264213dee7ec=1416993761; Hm_lpvt_79c375aa39fc2aae3161264213dee7ec=1416993761; hiido_ui=0.8868442120119542

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:09 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

Expires: Wed, 26 Nov 2014 14:35:09 GMT

Cache-Control: max-age=300

Content-Encoding: gzip
23d3.............}k...v....=....]...V{w..4.k-]K ....nFs."Y...6."....i 
.`.@.... .. @......'.f..O..>..d....w...I.4Yu.T.....S..O....U..a....
.[.)'=~.L.<#.E.."...?.......w...O.=.S..u..S,g".$..b.Y...PW`.V...z..
.R.......O.......n...l..&......N..7....3p........$.....w..7).,y...h.~.
...4..&..Y.....z....x1.-?Y,Y.z....ao...G\.o.(R.9.......V.'...S.... 9..
..C.....Io.;.$=.".0E......Z..f....d0.=J.[y.....i..k.Ga...L..Us/.{>.
v/.oe. .Ny..\...=..W.7'.h..`JT'.....p..$uWP...P...'.nC...A"Q.B.Z.Q...x
...t.'m.."!..r*....-..>.s..f._..Kz.*W....,...)KC...].\%].p..h4z....
..I.va.D .........j.H...8Oa...4..|..n.3`>...9-X..\"7`4..z......m...
{.D.q`#<..|.f.f.@..`..^....@i7K~.5.|p_?zp..._....^.q..,....E..2....
S.r.,...}x...R'>.....$9....07JX.ux....q....v6.R.a..m.i....L}w......
....m../...FX...-..6....2_..l....).V..P2..4P.b.3.o...z... |...ZE......
.zO.Ws.Id.rXo..)...{..i...V/..(...e.........btD.&V/...S..?........U...
{...-'..?.........{..4e....M.E..H.e.O-.'.xI....o.A7.(..G.8...$.{..[...
.!..`..l...i.E.pE...O...x``..Z.c.}...... .........y...0[Fl=..........F
....>..-.&..y./..A.3........]...Z..:..5..l..U>.....8y..xv.!..2..
..6..k.ZL..^_V...W U5H.q..>....<.. .6I........V..,......-E<.m
.y.e(...E.....^....a.c...a. [email protected]..;.g...^5..w.SL|....I.......
.../._|c..ut..sP...E...c.C..ME...E...V.6.m..(..q..Sw.F$p6(.T...O.....m
m.T..D..G..<....Z.}k?.....~2wS..ba....|..e...c9..|#g...6..F...-..X.
{. ..{p...8......g../......y;L-.....fr...........k.:..^..~}3X..sW!,Y.E
.e.\-...f..X.q*(l.....(`_...*[email protected]...?...... ......,..F.....d.5.
<<< skipped >>>

GET /assets/js/apps/boomerang/yw_speed.gif?t=14169937753890.9207327753577861 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: Hm_lvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lpvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lvt_79c375aa39fc2aae3161264213dee7ec=1416993761; Hm_lpvt_79c375aa39fc2aae3161264213dee7ec=1416993761; hiido_ui=0.8868442120119542; JSESSIONID=1CB08B9603D42835DBCFF29B0B6D64F0

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:20 GMT

Content-Type: image/gif

Content-Length: 35

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

ETag: "5474673e-23"

Expires: Wed, 26 Nov 2014 14:35:20 GMT

Cache-Control: max-age=300

Accept-Ranges: bytes
GIF87a.............,...........L..;....


GET /assets/js/apps/boomerang/yw_speed.gif?t=14169937759980.05373241652539784 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: Hm_lvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lpvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lvt_79c375aa39fc2aae3161264213dee7ec=1416993761; Hm_lpvt_79c375aa39fc2aae3161264213dee7ec=1416993761; hiido_ui=0.8868442120119542; JSESSIONID=1CB08B9603D42835DBCFF29B0B6D64F0

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:20 GMT

Content-Type: image/gif

Content-Length: 35

Connection: keep-alive

Last-Modified: Tue, 25 Nov 2014 11:25:50 GMT

ETag: "5474673e-23"

Expires: Wed, 26 Nov 2014 14:35:21 GMT

Cache-Control: max-age=300

Accept-Ranges: bytes
GIF87a.............,...........L..;....


GET /assets/js/apps/boomerang/yw_speed.gif?t=14169937765920.3824343664146818 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yy.com

Connection: Keep-Alive

Cookie: Hm_lvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lpvt_34a908ea88275f6ef0a72588f9c0be86=1416993760; Hm_lvt_79c375aa39fc2aae3161264213dee7ec=1416993761; Hm_lpvt_79c375aa39fc2aae3161264213dee7ec=1416993761; hiido_ui=0.8868442120119542; JSESSIONID=1CB08B9603D42835DBCFF29B0B6D64F0

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:21 GMT

Content-T

GET /core.php?web_id=1000432731&show=line&online=1&t=z HTTP/1.1

Accept: */*

Referer: hXXp://VVV.huajinv5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/javascript

Content-Length: 755

Connection: keep-alive

Date: Wed, 26 Nov 2014 14:29:41 GMT

Last-Modified: Wed, 26 Nov 2014 14:29:41 GMT

Expires: Wed, 26 Nov 2014 14:44:41 GMT

Via: cache35.l2hk1[36,200-0,M], cache10.l2hk1[37,0], cache7.us1[199,200-0,M], cache4.us1[200,0]

X-Cache: MISS TCP_REFRESH_MISS dirn:3:528100400

X-Swift-SaveTime: Wed, 26 Nov 2014 14:29:41 GMT

X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="1000432731",c="line",d="
1",e="online_v3.php",f="z6.cnzz.com",g="1",h="pic",i="z",j="站&#
38271;统计",k=window["_CNZZDbridge_" b].bobject,l="http:",
m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h
=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&
&k.callRequest([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k.creat
eScriptIcon(n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php
?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com
/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'>&
lt;img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a
 href='" q "' target=_blank title='" j "'>" j "</a>",k.create
Icon([p])))}();)..

GET /hm.js?34a908ea88275f6ef0a72588f9c0be86 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Set-Cookie: HMVT=34a908ea88275f6ef0a72588f9c0be86|1417012204|; Path=/; Domain=hm.baidu.com

Set-Cookie: HMACCOUNT=04A19992EABB3CA5; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Etag: fb9614156252fe0137fd7f16c0b3e5fc

Cache-Control: max-age=0, must-revalidate

Content-Encoding: gzip

Content-Type: application/javascript

Connection: Keep-Alive

Content-Length: 8253

Date: Wed, 26 Nov 2014 14:30:04 GMT

Server: apache
...........E...(function(){var h={},mt={},c={id:"34a908ea88275f6ef0a72
588f9c0be86",dm:["yy.com","yy.com"],js:"tongji.baidu.com/hm-web/js/",e
trk:[{id:"index_open",eventType:"onclick"},{id:"index_close",eventType
:"onclick"}],icon:'',ctrk:true,align:1,nv:1,vdur:1800000,age:315360000
00,rec:0,rp:[],trust:0,vcard:0,qiao:0,lxb:0,conv:0,apps:''};.;kw.6... 
h4W&"...'..f.v.n..........H..#..IJ. ......C......Z ....g..x.-..>...
e...:[email protected]&.L..*.y.'.2.../.....8...U..P.V5...O..
W.pb.W/`.<.....Y.k....$^.6oZ...4....ec.!..........F.$BD.:p..v..]rG.
{.S....G...8y)...jN..`2....$?*..Td....,.#.3...Y..\S.?v::.K...<.....
...]./Z...(5..Y..3j..%...]].n<.A4"...._u...8e..)N._9..|..~q......kd
.?.~..%A..T.x.qZ*.e".v...#..#.M".e.-.7...[.D.s.Q.E......1...#J.!......
....M..r.......e..\.H...6.._.0.X...2$.mzq....$&`.....{...v:..z"h.._...
.......\X.M.}.Y4..#].............scM7..Z..%"V...k."...i_....RwlOt... l
..%.....Q...?8I..:[email protected].\k<a~%a.u_...&.=.D2
...*.%b..Dc.N^...".2... \.|.P...V.d.w.r%(@.:q..".. .e.......t...$.(..$
....'9S......6.;j..-....*....~4g..S....iD..i........pA....H... ..xQ.}.
....9.....&Y.).LY:/../...n....f.UQ.t.N.F1...;.d.-Ua..C.X,.)..v., w.. .
.B.e.p..([email protected]..\..!? |.s..J#...E..X$.....2l.>.78...q..
......O...8.-Z.T......#~T.'.5u.u.4^&....'.H..zk.......F.........~...n.
Mzy8.R..\.s.rG.....UQn.%...DSY.G. @...`J/.R.....'...../.........S8....
....vT.8!']......-]......l.....m...n...2r..f..H6#lz..a3...0.cxr}MN..Zv
[email protected]..|F.i..p.\..\...(..8~.c.S.......... .2....8..n..:."gm..
<<< skipped >>>

GET /hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=1779682545&si=34a908ea88275f6ef0a72588f9c0be86&st=1&v=1.0.70&lv=1&tt=YY直播-中国最大的视频直播网站,yy语音官网 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

Cookie: HMVT=34a908ea88275f6ef0a72588f9c0be86|1417012204|; HMACCOUNT=ED0CA409355DDE55

HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Pragma: no-cache

Content-Type: image/gif

X-Content-Type-Options: nosniff

Connection: Keep-Alive

Content-Length: 43

Date: Wed, 26 Nov 2014 14:30:06 GMT

Server: apache
GIF89a.............!.......,...........L..;..

GET /stat.htm?id=1000432731&r=&lg=en-us&ntime=none&cnzz_eid=595931243-1417012180-&showp=1024x768&t=undefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefinedundefined...&h=1&rnd=1100383716 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.huajinv5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: z6.cnzz.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.4.1

Date: Wed, 26 Nov 2014 14:29:41 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Tue, 28 May 2013 02:57:17 GMT

Connection: close

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..

GET /hm.js?79c375aa39fc2aae3161264213dee7ec HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Etag: 109067524136ea97851591be6e59ec50

Cache-Control: max-age=0, must-revalidate

Content-Encoding: gzip

Content-Type: application/javascript

Set-Cookie: HMACCOUNT=ED0CA409355DDE55; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Connection: Keep-Alive

Content-Length: 7474

Date: Wed, 26 Nov 2014 14:30:04 GMT

Server: apache
...............(function(){var h={},mt={},c={id:"79c375aa39fc2aae31612
64213dee7ec",dm:["yy.com"],js:"tongji.baidu.com/hm-web/js/",etrk:[],ic
on:'',ctrk:true,align:1,nv:-1,vdur:1800000,age:31536000000,rec:0,rp:[]
,trust:1,vcard:5052355,qiao:0,lxb:0,conv:0,apps:''};.:m{.6... h4...LI.
.f.0.4M..%.^.v...< .R.(R&)....~3..".N.w.>...0..}.X..X8.}v.$.8f.s
:....:.........H.........EV!..L.*.y.f.2...P$.U..4.E.e..X.N=n...~. ~<
;..55..'....1..m.5...5..uKW~..b.....A.Z./...(....{......b...i....A.TD.
.....q..(.....Xw.`....$?...\.N.L."J..3..t..v.v`[email protected]~..`>......[
.n......So9......qH......s.%#b.....8$..../.8..e76T..pq..2.C.o...o>.
/.(.MZ"x.qX..e&..w..q..#.M&.e.-..._..Lb~...tq....=9...}@........Q:....
.F...".."...QM.]...6..{[email protected]..[..F.....
...p...u......S.t.X.n.......rkM7..Y...F.>....E..S.}..n.K..;1.nW.p.E
..m....}b.~.ei..$.A...x.MM.n.H...t...].`S;.A.d.w....".}.....#P.Dd..y.j
X&..J..4..o..H..a)..OX.2j.r.z....T.....N.t..E!..8.......%A... *4&I.9(.
A......).....fc..E.l.....zT1L..0`..4..........99...0.8..x..v.^4.......
.....4JNfK9 M]...k!s..-Vs..}U.;...qQ..Y..Q....0...o-... ..0.........}.
..#;........}d..P...8..g>.......9......e..>....Q.|..[>~.9:...
....<^.'......AK...Bhc.N....PS.$F...e..h......Vo.\..(...(.v{cr}}}..
._...IO...l....X.........T`..Ol...>...(@...`J......e.O.o..YA..).{..
....:..~.?.a;Z.xH..3..M.Y..A... X...6r.r.......\..Y`3.....l...d3#...&g
t;..&..x-...;.f....U.......<..K../.(.......[.I.sWde...?EIT@.@G..>
;.a..........t.....I.U!.O|%.Cd.....(...F...H<<..,.w...3&c2aI
<<< skipped >>>

GET /hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=1991869141&si=79c375aa39fc2aae3161264213dee7ec&st=1&v=1.0.70&lv=1&tt=YY直播-中国最大的视频直播网站,yy语音官网 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

Cookie: HMVT=34a908ea88275f6ef0a72588f9c0be86|1417012204|; HMACCOUNT=ED0CA409355DDE55

HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Pragma: no-cache

Content-Type: image/gif

X-Content-Type-Options: nosniff

Connection: Keep-Alive

Content-Length: 43

Date: Wed, 26 Nov 2014 14:30:06 GMT

Server: apache
GIF89a.............!.......,...........L..;..

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.huajinv5.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 4686

Content-Type: text/html

Content-Location: hXXp://VVV.huajinv5.com/index.htm

Last-Modified: Thu, 30 Oct 2014 14:08:09 GMT

Accept-Ranges: bytes

ETag: "283f3eef4af4cf1:b89d"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Wed, 26 Nov 2014 14:29:29 GMT
..<!-- saved from url=(0021)VVV.huajinv5.com/ -->..<style typ
e="text/css">..<!--...STYLE1 {font-family: "...."}...STYLE2 {col
or: #CC0000}..body {...background-color: #ECE9D8;..}..body,td,th {...c
olor: #CC0000;..}..-->..</style>.. <br>..<meta http-
equiv="Content-Type" content="text/html; charset=gb2312">..<titl
e>....,CF....,........,........,..............</title>..<m
eta name="Keywords" content="........,CF....,........,">..<meta 
name="Description" content="..........................................
,........BUG,..............Www.huajinv5.com">..<style type="text
/css">..BODY {...FONT-SIZE: 12px..}..TD {...FONT-SIZE: 12px..}..TH 
{...FONT-SIZE: 12px..}..A:link {...COLOR: #00FF00}..A:visited {...COLO
R: #00FF00}..A:hover {...COLOR: #FFFFFF}..A:active {...COLOR: #00FF00}
..BODY {...BACKGROUND-COLOR: #000000}...STYLE186 {font-size: 12px; col
or: #00FF00; }...STYLE193 {color: #FF6600; }...STYLE194 {color: #FFFF0
0; }...STYLE196 {COLOR: #CCCCCC; }...STYLE197 {color: #FF0000}...STYLE
18 {...color: #FF00FF;...font-weight: bold;..}...STYLE23 {color: #FF00
00; font-weight: bold; }...STYLE25 {...color: #00FF00;...font-weight: 
bold;..}...STYLE26 {color: #FF00FF; }..</style>..<meta name="
GENERATOR" content="MSHTML 9.00.8112.16441">..<script type="text
/javascript">..<!-- function MM_preloadImages() { //v3.0 var d=d
ocument; if(d.images){ if(!d.MM_p) d.MM_p=new Array(); var i,j=d.MM_p.
length,a=MM_preloadImages.arguments; for(i=0; i<a.length; i  ) 
<<< skipped >>>

GET /common/js/seajs/sea.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s1.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:25:16 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 24 Sep 2014 06:39:05 GMT

Expires: Thu, 27 Nov 2014 14:25:16 GMT

Cache-Control: max-age=86400

Content-Encoding: gzip

Age: 285

Content-Length: 3019

Powered-By-ChinaCache: HIT from CNC-CC-b-3g8.1
.h..X..z_.w....../7b......E.....}..[..Q.6J.H.m.o_t....z|[email protected].$..r
''.BRB.....q...Y.....k..................X.r...}.W...BX0ee..E....g..c;.
IJ..A..,)$e.....4@RT..{_$b.n.z.............x.N.....{.,..zqz..........:
.b.).Z...<y..J...w-.{.}7^.U...n.Wl].:7n....V...lQ.....V.......[j.X\
...xJ.f.([email protected]........=......a)..\w0.
x..I...UC.{.j.......z.6b.0... ..2..I........j.o,`...........a...`u....
..^...07.w....6......r{.....{?dv.q.sa.....,.9.HD..S7....../..R...'..lp
[email protected]&.......M.l4|4h.?..t.{8x.x.<._.B.k...I..?xc|........b../
7......'..p.D.T..,....)0.&-E.q.|..HK..y....Q[.....S.=....~E.Oz.$.k]...
.......d.....#.C.V. z.w...L.Q4../...gn.....d.......l... ..Xm.....Z.._.
.Z.<".^3.EGb..]..dEv..t...L....2.M..ys........'o_..8;}....o..j..k..
.uq.^.....8[G.=.2.J.......O...]...;..k....Bg..n41..M........~.j.."..].
[email protected][email protected].{.,E.0..^j8.\.:..
,G.;..,.Y...j6.39h.rqdG.oeZ..r..T3....\.m(|...\ w,..X..,.8.c2...S.{.,$
.........E<........,.w^..............)....%.Z...I..[.Eci..w..,K.'.F
H..r.O..kg...8....N..U z.....".6...ZQ%w.....K1.3.nWz.r.".">..?.3]..
!....]Cy.:-..p ..(....sC.1I..4.....;.3..}..09....B........F....I.L.$./
..\....s.}...........s..;....{.OG.1...f...|...ZQD..b.@H.*.D|.....5._..
....-'w/",......\y5..M.7 ..{.Me~\...U..W^.)...4. .)[email protected]{.r
[email protected].|...2.Q...Kr.r.0......w. .-~..._..sy.&.
Xd.*..q.^M.....8..._........{.A.;..P.?.....S.>8.v.....!..1~X......8
...p.L........|.z4)h<a.5}....2.y.f......`..a5.....w......l<.
<<< skipped >>>

GET /common/js/art/template.js?ver=20141125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s1.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 07:33:31 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 24 Sep 2014 06:39:05 GMT

Expires: Thu, 27 Nov 2014 07:33:31 GMT

Cache-Control: max-age=86400

Content-Encoding: gzip

Age: 24993

Content-Length: 2555

Powered-By-ChinaCache: HIT from CNC-CC-b-3g8.1
....4{su{..,no...O.l/....A.-.60..0.su.....~....,.0`........B......04).
......w.......?ol!..............y.&5_w`F@.!.\...,.7 ......33...@.#..}.
.,....*g2.*]Vf...mp...\[email protected]^.^[email protected]... ..9N.../RH....
.d..U....q.CN.......<......Z ..E{.f....yb.n.......HL"U).<. 4....
8G^ly...p.b..h|...L....x.E.....=....q.t....2.)[email protected]\.f.`.
.1.&.~......c(6..]-A..`.t.v..2..,...&...lo...P.......s....Iu...L..7..&
gt;.H.D.7..`V;*.o.....t.I!7....:b.....n............N....g........F.qN.
..T..........L....~.$......h...E.\.O......)/...7....},h.k.. ........7J
...qt....W:(a...7...."u.W.p.........FH.j.zO.'?J.E.p...X.|Qa...-X...Z.)
".."r..].......N..p...E.J...a.},.`.4.n..#8\..TW...X..m......DwkfxTq~.0
.X...C..QM.d".?:.6.... Kxt.iT.......u...3Ps...n...=..h.B..\....=*..2..
."z.UeHSk.]C..Ws...........a.0.. *..=....o1]......(.o_c..9.tB..}..k...
<^.=.G...%.0o.b`{pQ.4..K...8....^.M6.4.J.....s.|.@"|....p5L.$.&...Y
.....<#...BXf..D..@?..Q.m.,/O....K.(2..A.u.>.;k.....*..<D4.IS
1.`z.........-G....6..cS....w.0.T....z........v.Kv.1..67.&....\.Ef#...
.!..R....|.}...... }.b..../m......F..u.k......w.:..nx.]......k........
.......Xm......_..('.8G..E.R^.v....&....$.KrE.."....".......A.V..}..yy
f...$..7.,..<....!)4Y..>/...]..R.......\..uc....w.TU......,....m
U.K.6..j{..0...!...v ...V...C..........d...w.T.Y.....1.uV...43...y....
.VY.IX...*.."...@..(tN...Ef.K...XHY..:.X.B..}.j..B3;b...>=...">.
tV.N=..'].8R.W...JP..{.}V..o~.n...6...r?)?...kyugz...B....G...R.2;.)z.
..|..".x..p..Y..$..ej.}...b}(......*....^A.v...#;tj2Z....E...Y)...
<<< skipped >>>

GET /vcard/v.js?siteid=5052355&url=http://VVV.yy.com/&source=&rnd=76499634 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: trust.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 26 Nov 2014 14:30:08 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: Keep-Alive

X-Powered-By: PHP/5.3.24

Content-Encoding: gzip
14........................0..HTTP/1.1 200 OK..Server: nginx..Date: Wed
, 26 Nov 2014 14:30:08 GMT..Content-Type: text/html..Transfer-Encoding
: chunked..Connection: Keep-Alive..X-Powered-By: PHP/5.3.24..Content-E
ncoding: gzip..

GET /c.gif?act=web&zd=_2b1acc1@yy|_e3d75f1@yy|www@yy|&ui=0.8868442120119542&sp=1&fl=11&sl=0&ss=2&bs=6&mb=0&nw=0&fd=0&hiido=0&sn=0&ls=0&vr=15&ut=1416993761514&wd=0&passport=&sns=null HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ylog.hiido.com

Connection: Keep-Alive

HTTP/1.1 200 OK 

GET /img?bucket=yysnapshot&file=b7b4f78794e919ae2a83ec4353afb5c4f67ac544&size=180 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: snapshot1.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Wed, 26 Nov 2014 14:01:38 GMT

Content-Type: image/jpeg

Content-Length: 5581

Accept-Ranges: bytes

Expires: Thu, 27 Nov 2014 14:01:38 GMT

Cache-Control: max-age=86400

Age: 1703

Powered-By-ChinaCache: HIT from CNC-LF-6-3H7.3
......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), qu
ality = 75....C................................... $.' ",#..(7),01444.
'9=82<.342...C...........2!.!22222222222222222222222222222222222222
222222222222..........."..............................................
..............}........!1A..Qa."q.2....#B...R..$3br........%&'()*45678
9:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................
......................................................................
....................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'
()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.............................
.......................................................?......5N.,..K.
.\..#...E..v.L#.Z..5......aZ..........(.....?.8.....C..i6...p..}......
...<y..k........ .tJ.B...9.9.....sZ}...k...VIX....\......H...wm....
..3.y....E.........1.`.?)....k....}#..3.!].a.#...URZ..d..W,...P#`Y...{
......%..>.....s.F1...hx.T..$in.vl....N0N:...u..I......3K..Tl....q.
.....t.:...1..c....Y..Z.M2.n.m.........r{[email protected]
o.....-....\..Zi\v<.|s.."!.Fq...G.L.<t..Z....3.$).l.c...4.w.u?.L
[email protected].]\...I*.c.g.$.P.......`....:.PG..o...1... f..>.x..!.o..S
... ...UJ,.h...\.N..Vi.n_..X.?3.^.............5dx...H=.....}.P..<..
w..$pk{..6...........2De.....r3.VR.f#..........)-..V...Ye.!&.m..8O/o..
.3.L...t....\....0.....O!7h.3.gk..LQPj.5...!.....x.E.V.cG].L....H.....
....j.....]M...O&W$.5.q.....XV.....[.......H....u.?.k...6m.....OR...0.
......Z.ka.3..C.......,...4r'Un.W...k................._......#. ..
<<< skipped >>>

GET /img?bucket=yysnapshot&file=8d6ba32888498307d655cc36e6f7442d254862fd HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: snapshot1.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Wed, 26 Nov 2014 14:24:07 GMT

Content-Type: image/jpeg

Content-Length: 20333

Accept-Ranges: bytes

Expires: Thu, 27 Nov 2014 14:24:07 GMT

Cache-Control: max-age=86400

Age: 354

Powered-By-ChinaCache: HIT from CNC-LF-6-3H7.3
......Lavc53.8.0....C.................................................
......$$""** 33>...................................................
...........................}........!1A..Qa."q.2....#B...R..$3br......
..%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................
..................................................................w...
....!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXY
Zcdefghijstuvwxyz.....................................................
.........................h...."...................?...d..)$...3..^.!..
.i.....,0G...l.Z.P.0?.vE..c............-.R......s..v.^.:.I....h....;..
J.GY2.*K..;3.W9. ..C.....I..-.p.D^....c...J.....8..VQ.,m.Z.....H.I... 
[email protected].....>..zi o.n..5.I8.....]...Pz....i....j...v;..S..\..../z
{VJ.gc....C5.....8.?...xHUF..q.}j.....85....%.H.7`.a.G.jK....*..%{...g
K.F......=.mV;.....c..:z....\;7F......t^...}i..Z'<1.....' .Ba.V..wG
...t#5.a....~_......i.a..8.{..]2....&.Qqc...f..O..%.^~.8..p....a..#.. 
...]N.[....L.M.f ...c. .1|..5.AS.......`[email protected][...QSK. .m...3\
....J..|q....4..V.t.,T.N6.]t.:..g..Vf..Z.]2...:. ...a....}.. -|K......
\...6...2./z..&.5..}..U.R........".-7...an.L.......j.f..i.'....{.>.
.........V.H....D..m...\>..ko*9A.. .6.u'5...Oe..Y=...FkWw/.. .0.k?v
........].m;\.4.0....`.}3.z. t................$.y..T.....Q..n|.3.RRN=.
......@z.!y....D....Z.g..y.d...F.]>...-.....*m....7....h......&..3z
...Y.....:<0=..M....p.=s......R.....,...O.i.\...1.F...0;.\F...t.#,.
.A.U.?.^..s.......f;}9....j.N^.....0....:.:d..;.6P.C.........#g...
<<< skipped >>>

GET /img?bucket=yysnapshot&file=6f3402bd551d4d55c0d67784937b17e8b0f314b0 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: snapshot1.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Wed, 26 Nov 2014 14:29:25 GMT

Content-Type: image/jpeg

Content-Length: 18735

Accept-Ranges: bytes

Expires: Thu, 27 Nov 2014 14:29:25 GMT

Cache-Control: max-age=86400

Age: 37

Powered-By-ChinaCache: HIT from CNC-LF-6-3H7.3
......Lavc53.8.0....C........................................... ! ...
.!!###**((112<<H................................................
..............................}........!1A..Qa."q.2....#B...R..$3br...
.....%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................
.....................................................................w
.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUV
WXYZcdefghijstuvwxyz..................................................
............................h...."...................?....(. ..(...(..
.(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(
...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..
.(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(
...(...(...(...(.nM2.,n......A.a.....pFye.}3.....e.._.......N.n...tb..
.1..................?...<..Uz.\HT. ...q.... ........K..c..I.A......
..Z.4..:"...?.W...N6..8l........49.H.....k..c.......G.......?......?..
..Uz......F>.;.G...j......c..?.....e......B.^ ...n?.*...t..S-....{E
..u)[email protected].....>..1........../..h.....o^W.k......?.F.z. .Y.
.r1..Y4...H....?.4......... ........ J..X...zV.....LK.|..jl..'..8..[..
.d?...4...n.|..w..?....."....z....Z(!q'..w.rs.....F...t..3.q....U:h...
.!..W..#.j.....l........Wd.e)..>r.c.c...*n.......[.. ..z|....T.hz..
.C.....8nA...5..;y>..>1....=...j{"..6/[email protected]..?
\.z.o.jk.0..}..=.....&.q..6a..J..ch.B=.j..w26.Nv...9S.......D|.....TB2
....g..T..jH..@.......^..m....FV3.|...9^..T..K...q....G.H {Q.....z
<<< skipped >>>

GET /9.gif?abc=1&rnd=237557991 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.huajinv5.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cnzz.mmstat.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Tengine

Date: Wed, 26 Nov 2014 14:29:43 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"

Set-Cookie: cna=19H8DH4iO3ICAbhrJiZUcRuG; expires=Sat, 23-Nov-24 14:29:43 GMT; path=/; domain=.mmstat.com

Set-Cookie: sca=37d787b9; path=/; domain=.cnzz.mmstat.com

Set-Cookie: atpsida=0ba3f8cc3cf874abf030c44d_1417012183; expires=Sat, 23-Nov-24 14:29:43 GMT; path=/; domain=.cnzz.mmstat.com

Location: hXXp://pcookie.cnzz.com/app.gif?&cna=19H8DH4iO3ICAbhrJiZUcRuG

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Pragma: no-cache
GIF89a.............!.......,...........L..;..

GET /fjp/lic_-2443698604613662488 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

..1.r.. .....U....bJ...... &....1.#d.c....."."."."."."."."."."."./A#..
..]..eJ...K\7.!...........`.J.8..($.3...."...f(..............<H.E\.
M.>.b..PV........ .rg...v1_WPf..C.......gk9e.......bX.......bg..~..
.....;O.DY..R...........L..(.q.J...........&.u......G7...... B.....K..
89.z..s.x.yR.$m.....v.........d.*......u.v..]3..4.........qh.<..I5.
.K..$..&...u...p..G.......;/Yjd.......-..v,..$.~5....Vf.."[:-oj.......
.f.I...Xi..^..:.;;.g.a....#...V.........x.....u.....).B9.j.....2q.....
.=.......8.tnI.f.{>*' C..v.. p..........U.i"....%...,s.O......V....
.;.Y......!{.:...x..eM.......W...Rm.H\.Fy......d.o.X..A...... ...*.z^k
m...a......-4.B...%)......>S........-.TGV..G._.`..YZ..}..Z....JG,..
=.^..Ut.54....*.....xf~..N....D..E~.y.(=oh.....[.........7q..YTg..[...
.q..s..UV ..I..^.v .0.>p.G.[.9...?.8...../W~ .|.C.B.mmq.?}T]?..."..
..{eg....1.......H..........O....0....Zr..-V8.\.....)K. ......)Y ....B
..Z.(j.G.g. .2z .......mjG...:.{........P..[m......H.9`u.z.q. )$.gn.O.
....J.ea.. .qfVNk).h.2.w.j.Y=Q.o.q.T..y......(...q..\.GUMJ.R.B.Y.....J
i...:c.;wju*.-.............H$....H...k.#,..B...Gk.o...}.-..Ftd.......r
2..y....B.........)....I....k..m7.t.L.4.&L...q..V...D~n.....5..U.y)8._
....Zx).....j....g...%AHi.....;...T.[...P...jo{.......Nx.x.7..R..#.wdc
.]!..PVk%.G.."....kC.I.....*..?i.*.......=..............-1-..H;K[.7...
?..\..AlmM...Yw.....,C.....p../$0...R..GD#...ss:C....=......-....b.:..
......M/b.x.........tJ..D.....:...=...Rg.b...*..nF.V........\...y...*B
0..... .......JFIF.....d.d.....C..................................
<<< skipped >>>

GET /fjp/lic_4204521680421587228?imageview/0/w/370/h/282 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Mon, 24 Nov 2014 12:08:32 GMT

Content-Type: image/JPEG

Content-Length: 30872

Expires: Mon, 01 Dec 2014 12:08:32 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WD.6

Switch: FSCS

Age: 181289

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.3
Adobe.d...............................................................
......................................................................
............z...."................?...................................
.......................................3......!.1.AQa."q.2.....B#$.R.b
34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv.......
.7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.c
s4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw...
..............?.?].k0.....h{.n.;..j...v.........Yf...}..F..........q..
.3.......Y...unk.~n.{...........b.{D.<...{..7_.uQ-q1.T....op...V5..
.0......F.~D6.\..q..c.5_..pcG..y%t.".<z..`.:..@.].N.^.H.p;.?...I...
."\.g.....4H.C...r.@mC..]...m`[email protected][x..T
...ZA..... .gu<.'..?]p........;..}-......w..K.}.a............7...n.
.p.R....]..}....:*.h?F.c.......[..)'...Lq.....Dq.R.....I.......z.!.9..
.lp.N..~...kw.r.@..]I..}G.}V}]oP...b1......5.X.X.:.?.YO...C.E...\X.!.A
.k.61"._.q..k.G.n.R.].r..7.....~......OZ.F....W........>.....IX...5
...'N...z.O...<..E.Yp.M..cg.:.x......U....~.Cs..x......V...{..n....
[email protected].%3>.n>.c.?.<b....wzH.@,.~........=.p...
."V.P.......c".9....v......w..h.N..4...;.}f.......:.h....~.0...c...ZZ|
t.S.>!.......".:mg.%..<......?...{....Zml..C\....g.....]P{..k...
.w.....W.U.l.....)..Dw 8.J^.J.......m.x}..U.=.v.d.M~#....w@../...7]...
..b7hen...X.X.-......k...5..>...........I[Xe..>.....K..?..:..P..
..muT..........-...c......P.Z/.-m.>....6..s....z.....(..#....$.
<<< skipped >>>

GET /fjp/lic_-2680346721944103378?imageview/0/w/370/h/282 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

..Tp......]....JrP..!j.H.e..x..0...D....%.b.M..........{...A. $.kV....
n..Q.......'i).>.P.r&i....8....=...e.m..F..9.].............V>.{.
.Z7..\.....}u......h..x.Ne.DOBJ.....b?.C\.2l.)...........h..S... ..:..
5.c5=.n8..n....g.U.  ]...l?Ocf....H...v.t7..=q.".y...c..v.....Z.Z..G..
Wa2..V..'.7.E4`..bV../&...*!Z"..D0S.T.h.Z.Z.KtE.(..R..,B.N..B.`.I..X4.
.-c.\ u..r1...74.CE...*..(fj..x7.Ib..Uzz.'.0..?U.;..Z.Mo{*.v!.P..0....
x....h..`...m..C.....TLy.s.:...^-....Z..k.U,x..T.n.x...u.......I.T.4.F
.#.}....]O6...,...g.....c]Gfq....9t....#..........|..a2..Q" .....9..G.
.".H.Q... .CBQ.x.3.6... ..s{:a,.&^.dl.B.`m4...8]Bc]..{si.$U...5.......
..Wwr.....JS......a.S=%.V...;LS....5[.W0...V..b.[C..h6..pAZ!;....4.].)
..6z~.q.....N"....L..L.R.n..Wti*....I.bow.....$.VSCq..n..G....0....U5B
=.."......y]..b.Fm.G.......Q...)....1.M..P}n..U.X......Ke.q.T.C0.X.s..
..I.L8..A\.?})[email protected]|..jqY1m....A.3...q!..N ..".:.....-72j
.n\|.]ti..q.k...v &MYD.q'.....!Ed....~D.......2Qz...xQ.Z.....O.N.k1..r
..K{P$.....v&".q...v>....>.....S..MY.G.t....%..'...,.'*a.TDS...,
.Vh.;..f.>~n.[...)....R.VQ.D2j...._;.D.4..U.27..^N.U.......].......
.E. f.D.<a!..K..T&.....6.....HN....h.3N.:[email protected].:
.(t..........B.......m.tH..W..A........#.ML...[.W$.....U..G...\...f..6
...pj{..9H....0Nf...............I....1..,WbZ..1.c7s...ST5...{(...xo(..
b....kF........Z...lx.>.......I NF..tB....2;..U!;v.O...dF.&..-.p..t
.M..{ ...........yh&X..oW.3Q.O...Jy.|[..S.5'.s.2..!........hd-..l...2!
ljq..M*.I$.........LL.......{...Je.nJ.{%...pj.0.I%#.<z...G.....
<<< skipped >>>

GET /fjp/lic_5988792491863884358?imageview/0/w/370/h/282 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yy.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image.yy.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.2.9

Date: Sat, 22 Nov 2014 18:19:50 GMT

Content-Type: image/JPEG

Content-Length: 24952

Expires: Sat, 29 Nov 2014 18:19:50 GMT

Cache-Control: max-age=604800

Powered-By-ChinaCache: HIT from CNC-LQ-c-3WD.2

Switch: FSCS

Age: 331814

Powered-By-ChinaCache: HIT from CNC-HQ-g-3WK.3
n..H...J..\... lR.....P#..R.X.[...NRq.K2.f...._zU.c#5..L............\.
......*.....MU.HA..t.....4..?.~.7.....F.7B.....K..8.}3,....;cj"m..i..9
.....kt..i.nlw..K....9....)D.c.....V.......'.q.^...h%$~..z...P...!>
..Nw.PqL.-.}..w._Z..!.8...( ..]hy.cK..RQ..zUQ....xZq.......k..6;p`.0..
....?....N]O.A.4.x..~\.^}..$4.S......s...*...c9..... .8....$;fK.hmA.J{
.<..$.:........)..H........W1q.O/Oj.%r..3.....`.XdK.yr.d.s......Z..
.I...F9...............F..R....R.Lm..BL.GH].(YD.\Kk.(.:{T........8..k.U
N;...j..s....a.P4iOx.t..B.x.....}....(8......6N._.*..^... ..c.E.....(.
H....D2_.'..#.gmwkD..,.*.gud.s.d........l.h.z?3. ....3g.........m'._7.
T...2`-....%C..M><....<(..dm8.%....V...9x.. .....i)!.Q.$.$r..
.....nV$...;g7.....69./...6.c.DaM.d.O.F.d.(..|%...{.]..N..\.6.=..R....
......Y......}pcP;`..Tp.V._..d......u.}M.........%.$~t..6.. .z.N......
s.(....UMH./.U\X.@..,N...gP..5).F..c.[.....b?..p$y..)B....)...|nL....i
.b0....c.......M.......p..A..............E..!........7......wSFk..F..6
....s...P...=k..u9..p...JV..!.uK.Qj.o.q...$]..[...z....4r^m...DLp.I..M
..{.....;kH....VXI>....&.....8m.cq. _.%A.......VU...`..do.......?..
.t....\..$.oh...D....EU..D#4............F}.h&..-s.qv../.9.W..h!z..g.?.
l...q.J.a4B.. ..z.<0}*.w^......;...r.H..U't'.y..$.9..5.e.g.*.s..(.)
...6s......Q.J...'t).#.*.L..<.|....N|....%.y"R../......)....P*f.tx.
....M.z&.#[email protected][email protected]/[email protected]^H....Y.Z...5...7.H....N.
_c .;x...l2.=..t.."[email protected]$/.x..,z.6..jX..S..3.Fy.>.%e....j......Z.ZS
.8>...k....wYIQ.Q....1.........S....p..\R*..y (g....3...._vq?..
<<< skipped >>>

GET /fjp/lic_-1093331428468276457?imageview/0/w/180/h/136 HTTP/1.1