Trojan.Win32.FlyStudio_20d7e31233

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):

regsvr32.exe:1104
regsvr32.exe:1796

The Trojan injects its code into the following process(es):

%original file name%.exe:772

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:772 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\a4[1].png (1838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico-1[1].gif (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\green_skin[1].png (1463 bytes)
C:\yysy.edb (404 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\dedecms[1].css (542 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\a1[1].png (2970 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico-2[1].gif (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].png (3537 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\layout[1].css (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1-1403111Z0350-L[1].jpg (22113 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[1].js (3818 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1-1403111910220-L[1].jpg (11445 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\gjsb[1].htm (18 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yysyuan[1].txt (161 bytes)
%System%\dm.dll (3924 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
C:\yysy.dll (252 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\dedeajax2[1].js (1774 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic_scroll[1].js (786 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\a3[1].png (1435 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\a2[1].png (435 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\search-bt[1].gif (565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ico-3[1].gif (54 bytes)
C:\UUWiseHelper.dll (291 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bcastr3[1].swf (2810 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\new-article[1].gif (269 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\page[1].css (3374 bytes)

Registry activity

The process regsvr32.exe:1104 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 2A 73 B8 1E 81 C5 DA ED C5 80 F0 5E 76 01 E1"

The process regsvr32.exe:1796 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB F6 E2 8C E4 9D B1 86 82 EC C2 AA F2 2A E7 5D"

[HKCR\dm.dmsoft\CLSID]
"(Default)" = "{26037A0E-7CBD-4FFF-9C63-56F2D0770214}"

[HKCR\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib]
"(Default)" = "{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}"

[HKCR\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\HELPDIR]
"(Default)" = "C:\Windows\System32\"

[HKCR\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}]
"(Default)" = "dm.dmsoft"

[HKCR\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\dm.dmsoft]
"(Default)" = "dm.dmsoft"

[HKCR\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}]
"(Default)" = "Idmsoft"

[HKCR\dm.dmsoft\CurVer]
"(Default)" = "dm.dmsoft"

[HKCR\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID]
"(Default)" = "dm.dmsoft"

[HKCR\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0\win32]
"(Default)" = "C:\Windows\System32\dm.dll"

[HKCR\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0]
"(Default)" = "Dm"

[HKCR\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32]
"(Default)" = "C:\Windows\System32\dm.dll"

[HKCR\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib]
"Version" = "1.0"

The process %original file name%.exe:772 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 40 53 5B 4C 61 FC 98 CC B2 71 6C 13 BF 7C D8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
dc6b73cbd1f6f5cec640a8c634ae50c8	c:\UUWiseHelper.dll
036b1cd5a746f04738aeac8e20bcb55a	c:\WINDOWS\system32\dm.dll
28f3944080c5a4bc8562a879498d1225	c:\yysy.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   regsvr32.exe:1104
   regsvr32.exe:1796
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\a4[1].png (1838 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico-1[1].gif (50 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\green_skin[1].png (1463 bytes)
   C:\yysy.edb (404 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\dedecms[1].css (542 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\a1[1].png (2970 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ico-2[1].gif (50 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].png (3537 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\layout[1].css (12 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1-1403111Z0350-L[1].jpg (22113 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\j[1].js (3818 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1-1403111910220-L[1].jpg (11445 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\gjsb[1].htm (18 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@yysyuan[1].txt (161 bytes)
   %System%\dm.dll (3924 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   C:\yysy.dll (252 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\dedeajax2[1].js (1774 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pic_scroll[1].js (786 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\a3[1].png (1435 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\a2[1].png (435 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\search-bt[1].gif (565 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ico-3[1].gif (54 bytes)
   C:\UUWiseHelper.dll (291 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bcastr3[1].swf (2810 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\new-article[1].gif (269 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\page[1].css (3374 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: ??
Product Name: yy?????7.0 - ???
Product Version: 7.0.0.0
Legal Copyright: ????:www.yysyuan.com
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 7.0.0.0
File Description: ??YY??????????
Comments: ??????????(http://www.eyuyan.com)
Language: Language Neutral

Company Name: ??Product Name: yy?????7.0 - ???Product Version: 7.0.0.0Legal Copyright: ????:www.yysyuan.comLegal Trademarks: Original Filename: Internal Name: File Version: 7.0.0.0File Description: ??YY??????????Comments: ??????????(http://www.eyuyan.com)Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	1810432	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	1814528	1687552	1684480	5.45712	34c35b78b0818c139e995152c4d6d69b
.rsrc	3502080	12288	11264	3.37653	bd1ef8f287f0f2eac1da5e9c467e96bf
.rmnet	3514368	61440	57856	0.399351	0674bff11b6d18c96be4f15a9382a1a9

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.yysyuan.com/yanz/yydkq7.0.txt	118.193.162.207
hxxp://www.yysyuan.com/gjsb.html	118.193.162.207
hxxp://s1.uuwise.com/Api/config.aspx	116.255.181.152
hxxp://www.yysyuan.com/templets/default/style/dedecms.css	118.193.162.207
hxxp://www.yysyuan.com/include/dedeajax2.js	118.193.162.207
hxxp://www.yysyuan.com/templets/default/style/layout.css	118.193.162.207
hxxp://www.yysyuan.com/templets/default/style/page.css	118.193.162.207
hxxp://www.yysyuan.com/images/js/j.js	118.193.162.207
hxxp://www.yysyuan.com/templets/default/js/pic_scroll.js	118.193.162.207
hxxp://www.yysyuan.com/templets/soft/images/logo.png	118.193.162.207
hxxp://www.yysyuan.com/templets/default/images/green_skin.png	118.193.162.207
hxxp://www.yysyuan.com/templets/default/images/bcastr3.swf	118.193.162.207
hxxp://www.yysyuan.com/templets/default/images/search-bt.gif	118.193.162.207
hxxp://www.yysyuan.com/templets/default/images/ico-1.gif	118.193.162.207
hxxp://www.yysyuan.com/images/a1.png	118.193.162.207
hxxp://www.yysyuan.com/images/a2.png	118.193.162.207
hxxp://www.yysyuan.com/uploads/allimg/140311/1-1403111910220-L.jpg	118.193.162.207
hxxp://www.yysyuan.com/templets/default/images/ico-2.gif	118.193.162.207
hxxp://www.yysyuan.com/images/a3.png	118.193.162.207
hxxp://www.yysyuan.com/templets/default/images/ico-3.gif	118.193.162.207
hxxp://www.yysyuan.com/images/a4.png	118.193.162.207
hxxp://www.yysyuan.com/templets/default/images/new-article.gif	118.193.162.207
hxxp://www.yysyuan.com/uploads/allimg/140311/1-1403111Z0350-L.jpg	118.193.162.207
lc.uudama.com	116.255.181.147
hi.baidu.com	180.76.2.41
www.xinray.com	115.29.243.104

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /yanz/yydkq7.0.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: VVV.yysyuan.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:20 GMT

Content-Length: 195

Content-Type: text/plain

Content-Location: hXXp://VVV.yysyuan.com/yanz/yydkq7.0.txt

Last-Modified: Wed, 11 Feb 2015 20:50:54 GMT

Accept-Ranges: bytes

ETag: "d4a1636d3c46d01:33ae"

Server: IIS

X-Powered-By: WAF/2.0

////....</p>............=..</p>............=..</p>..........=....YY....,YY.... ....QQ:16858878</p>..........=hXXp://wpa.qq.com/msgrd?V=1&uin=16858878&Site=-&Menu=yes</p>..////....</p>..HTTP/1.1 200 OK..Date: Mon, 17 Aug 2015 14:18:20 GMT..Content-Length: 195..Content-Type: text/plain..Content-Location: hXXp://www.yysyuan.com/yanz/yydkq7.0.txt..Last-Modified: Wed, 11 Feb 2015 20:50:54 GMT..Accept-Ranges: bytes..ETag: "d4a1636d3c46d01:33ae"..Server: IIS..X-Powered-By: WAF/2.0..////....</p>............=..</p>............=..</p>..........=....YY....,YY.... ....QQ:16858878</p>..........=hXXp://wpa.qq.com/msgrd?V=1&uin=16858878&Site=-&Menu=yes</p>..////....</p>......

GET /templets/default/style/dedecms.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:25 GMT

Content-Length: 3401

Content-Type: text/css

Content-Encoding: gzip

Content-Location: hXXp://VVV.yysyuan.com/templets/default/style/dedecms.css

Last-Modified: Fri, 01 Jul 2011 08:14:56 GMT

Accept-Ranges: bytes

ETag: "0802bf6c637cc1:33ae"

Vary: Accept-Encoding

Server: IIS

X-Powered-By: WAF/2.0

...........;..#G..Yi.......k...~.{...T@..D.N...l.....n.wb.?....P.\..(..X...r..7.\"nTu=.......@...q=.W}..=.t:..A.......w.a.....1......*....jYH.M..;M....r....\......~...]......)......#. Zfi^...k...Wy..0F...t.Eqx|n.eh....h.'..:........a...n...:X.|.%....g.r..e.4....*.....[69I.G:9K.2....|..!J..E....].H.......N..8..4.l..3D..i....?..\z....*.".4Ge.&...,... .&.....].^......x...t.zj..(.V.I.c<-O&..L..X; ........y.,.0.9LM.E.N...p.8).'.......w..a.....\...;..N..Q.`.c...>....,.....(......9..j..$%.-..g..Kos....W.i.....(..z48.{...W_...-p}.\o(7Mc.*..C...:X....O......8E....G.N....W..aW..kS..D...b..x.T.t".J.|U2.I........s...'....~;..<m.i\..Q..rb..!.]^^....s..Bf.....db..w5..)..wHd.N...j]...?...U:.Y.^.z8.=..........I....1$.........?...%..CS..::]... K#j..V...28......fe..Y... ..d.3Vb< ...N..i...-..d.tR..-.(a..`..a..fl.......y.{qW..\..3XwD..]..`..%.E}l..J.....J.....~...G.c....q.....s....>J.,....;;....i.C....8O(s..=.1._g..2Z....)*.....;.;.*......yQl..6.iF.s_l.$.J5d.d.K..m..F ..ZW.V.%<0...d...-...YO...).B5...F.d#...z.g{."i......e......JT.{.:....a.1......Y..4...H..Lb....;p'(IT[.tu/'.Y'Y=f.....x.g..q.,4.(^..c..7 HTTP/1.1 200 OK..Date: Mon, 17 Aug 2015 14:18:25 GMT..Content-Length: 3401..Content-Type: text/css..Content-Encoding: gzip..Content-Location: hXXp://VVV.yysyuan.com/templets/default/style/dedecms.css..Last-Modified: Fri, 01 Jul 2011 08:14:56 GMT..Accept-Ranges: bytes..ETag: "0802bf6c637cc1:33ae"..Vary: Accept-Encoding..Server: IIS..X-Powered-By: WAF/2.0.............;..#G..Yi.......k...~.{...T@..D.N...l.....n.wb.?.

<<< skipped >>>

GET /templets/default/style/layout.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:30 GMT

Content-Length: 2812

Content-Type: text/css

Content-Encoding: gzip

Content-Location: hXXp://VVV.yysyuan.com/templets/default/style/layout.css

Last-Modified: Fri, 01 Jul 2011 08:14:56 GMT

Accept-Ranges: bytes

ETag: "0802bf6c637cc1:33ae"

Vary: Accept-Encoding

Server: IIS

X-Powered-By: WAF/2.0

...........Z[o...~N...)...`..H$%?).S.....}.(q$..H../Y.?f..n...i...M.8..u.]w....../......E......9.P...b!.65<s..;gf.R.\..*.6.......n.t.Fx{..R?.'...0...".,..&..?B...........i.bUU..*HUZ.....^.|..j.:..y.....=....^...V..?........=98.w.t....{..(b....{W._..A..Z.R.5.E..y.................:..F.~.............=.......-.im...Zm...}<Ye..9..z..._&;U.f.P....au....YBNH..`.?.[.Y.2T.....A..?....T.!..rz|A....X..m.q.~..A.).M.W.3....hh.....H8t=\...o........./.....H..>.x...w2...[....E.....E.c...~...........D....R.UFe?'...$o....T ..F....t....U.O~`....<..Y*c......%.3.....e..xH.l..&.2.pme.....\.q..z=.........AFmhw.Pt..^F-....P.VB....fNv.t..i..U..$........&1.....R75.c..e..vgA...tC......IwH*....Wo..!.Wdk.2U...8.).>.w 1:TH.....H...........O.LC..JIg.T.`....S......2.[.G...={..'........YZ..M...!".....Qq....e........U.vB.AZ.%...P.... DK....]..]..W:..@=.YA6j...w~u.......X.Y.!KO.........K.......$...]qV.J....%........u.=.....G.l.3...<.D....}.:.B..S....i7..........Z....Y.T..{~5...!.E,.I.FW.................3..;...H.P...5Q.Mw5...Z.~M(H<...s...&3N..'.........J..an.....N.....g..88>{k.3...^.{...2.Fo_o7.ZN...rm.4.....K>z9.0. ..I.1MS.]3xE.1..;)]&`..u"..o..x......bi........uaM...0..E@Ez..3........%\\.\..........l......d.O].*d#.9w_.=..x.?@...L(B...y.....w....Q.4{$.GF..^X..o.X.......6....@X.....YR../.......98>=|.3.L..JSA.\= 1.P.3.?.......R..we3..&.5....2y...a..%)..9(..1._76.Ud,F....S......\_.k..e#(....6OmS..<.D;...... .... .8.RF.TL.?........f:......-c....9....4..[.F....wR&...]@.2A.....i?....S.....9...........>V-......s....

<<< skipped >>>

GET /templets/default/style/page.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:30 GMT

Content-Length: 4879

Content-Type: text/css

Content-Encoding: gzip

Content-Location: hXXp://VVV.yysyuan.com/templets/default/style/page.css

Last-Modified: Tue, 19 Nov 2013 07:36:13 GMT

Accept-Ranges: bytes

ETag: "80d4c35fae4ce1:33ae"

Vary: Accept-Encoding

Server: IIS

X-Powered-By: WAF/2.0

...........<M..:r..`....b.5..}.j.s.O .......@.d[.Y.Jr.<....r..!....9..S.AN!%Rb.EJ....n...%..X.*V...|yy..#..p....o.@..s...y....}..5.WI...6.i..X...H...9..)....x......u.....k~....O..e..........9l.].|.B..."l6.%.U<%.}..9.q....../...Q..8$...l.E.3K.d.<....}U..x.Ta^.a...9U.o....1.'..v._.oi>/..w.J.$lf/..."..Cf.j...U.T..(7nI[.Y........Wz.-..8.M.....9.f..C....6..ou.....R7U....w....-.f..."/.c...J...F.........Q............6.F..{..._?d*<E.6i.S......4c....O^7i...6 .o..E..Q...,...#eN. q.XA.p....P......F..3..Ow..q..........u.C...uC..:A@.0..0....V.F8.2b....u......3....H#...k..3]........DZ....A.q!~|.. .z}.......?....n.....nC..%..e..b....[8..k.......%......Z-.6....e..TFf....!..$Ku..$~...c...{...Om;.1.......f...nv.10.....\,../.q.V....d.v,.....=o.i.etu...%....../....A.gB.V.c.....".uB[.i. ....t.J.....A&...............0;.B.....w..[j/..z.....|\...-](.o...w.#.!N....S9.$.....".Wf9U!.TF..qX...:..cGE...Z....I.)....!....u3&...z'..S.R.>w.. .....#N...K....[L. 6.5...u......=.,;.I.{.&2............wd..&..G......}.^b..];..=..x..$$....).G....l..8.^...DF... .........4......]{F...P...MR7v..09|..G.B...K....Y..KuxR......2. ..pkHTTP/1.1 200 OK..Date: Mon, 17 Aug 2015 14:18:30 GMT..Content-Length: 4879..Content-Type: text/css..Content-Encoding: gzip..Content-Location: hXXp://VVV.yysyuan.com/templets/default/style/page.css..Last-Modified: Tue, 19 Nov 2013 07:36:13 GMT..Accept-Ranges: bytes..ETag: "80d4c35fae4ce1:33ae"..Vary: Accept-Encoding..Server: IIS..X-Powered-By: WAF/2.0.............<M..:r..`....b.5..}.j.s.O .......@.d[.Y.Jr.

<<< skipped >>>

GET /templets/default/js/pic_scroll.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:41 GMT

Content-Length: 1119

Content-Type: application/x-javascript

Content-Encoding: gzip

Content-Location: hXXp://VVV.yysyuan.com/templets/default/js/pic_scroll.js

Last-Modified: Fri, 01 Jul 2011 08:14:54 GMT

Accept-Ranges: bytes

ETag: "053faf4c637cc1:33ae"

Vary: Accept-Encoding

Server: IIS

X-Powered-By: WAF/2.0

...........W.o.6..?@....&*q.x[.,.<.Y..k..I..i.....GQ....}GJ...I...*Sw.........S.k.K .|;<.|.h(....B. ..4..x..j....K.4I......Gq.*....R).H@....._c!M.;.elv....B.EB9.....y..X....T.WL..Z... ...q...........8...0..8..E.p...*..S.. ...).,0.i..t-.='......]$&9...F..............8..P.v.fJs$..b....'.S......J$bj .dzN}."....r...r.6(?U.K.7...aK..?%.R.t#.g.zP.)..}..c.............)..P.<...X./...x..H.D...7....|.P....eo<8kH3/..;5EMsQ...r.".~....YV=..Q.E..N.........o...O.|.$.m._....@-.n......@..\...X.....Q.).c...!]...br.B..b. ...d.Nc.u|.6.,4? .g.....y-m..g..J...Wq......}...$.}|..#.e~12..U)......Y.c.G.....5>...}&..*;.w8..y..6.,.7.&..wj...4 #..S7....79z....:...59gR,P..k....o.dvk..uN<..2C......3......Dh&....F...S..d..e.........3'...]..........h.w...G..Y..W..oY'......V./....y.... d....:e...K4.5S.:.|........s.C...W..L.xm.z..#=...qgX^.#gY.... .):\7..F.8....U....<.-.NT..a.j....... ..>.\N.....>.....)..S6....}.4.....4.....;..7._....kx...............Ln.On&..pu.......}.%.O;O..s;[......7...O....<<8"A.....R....mk.].5."Ku.Y.9g=.*-.[....V,fY.d....6>.oD.^`x..1L....ea^..-..[.VW...I.K`JSl,..X....b.>Hs<T`[%....HTTP/1.1 200 OK..Date: Mon, 17 Aug 2015 14:18:41 GMT..Content-Length: 1119..Content-Type: application/x-javascript..Content-Encoding: gzip..Content-Location: hXXp://VVV.yysyuan.com/templets/default/js/pic_scroll.js..Last-Modified: Fri, 01 Jul 2011 08:14:54 GMT..Accept-Ranges: bytes..ETag: "053faf4c637cc1:33ae"..Vary: Accept-Encoding..Server: IIS..X-Powered-By: WAF/2.0.............W.o.6..?@....&*q.x[.,.&lt

<<< skipped >>>

GET /templets/default/images/green_skin.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:50 GMT

Content-Length: 4162

Content-Type: image/png

Content-Location: hXXp://VVV.yysyuan.com/templets/default/images/green_skin.png

Last-Modified: Fri, 01 Jul 2011 08:14:56 GMT

Accept-Ranges: bytes

ETag: "0802bf6c637cc1:33ae"

Server: IIS

X-Powered-By: WAF/2.0

.PNG........IHDR.......>.....LG.)....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...kp\.Y..w/Z..lY..8.l.8..Ih..Ig....m.M;..C;0.....O..m........a...@....0.4.B/..$.....i.\|...l.......=.Ti-i......~..{......}.9.)....ih../..f.>.U....I-..uU.a..r....r....ok.....n...Yr.E..&....P....Jt...iw.zy`C.....z.B.$i....z..6...cT....*4..)t.........f.c.e..X..Z2=..^..C.T(..e ....M.....P..oq.5m....M..Q....<*..< ..>iH...S.J.......Yo.....m0.:...W...V...d.9...P...EE.B...B.kq..C...h.BI....i.~@.W(i..P.). >...P,. .....9.P...s.Z^....gUR...S. .K...=....@\&s(@~.J...IH.:.M...R.P..W.B.x.K..p..J...X.{.*.n.{...X.!..K...h........h..%-...,.`..ha...7.6U..0..IY..@.....n..:......'.*?~~.'g..".f...Q.......`*ky..L6.n.15.B.T(...@...P....B.P....0..P....0..T(...0..T(.@.(.!..B....!..B.T(..E...P....B.P....(..?}..3]......~..5&K.\...._.H. .@I.D.T(@.U(...o...B../P,. .!.D..y.v...<.T(..... ...@~..@...P..._.b!.*...*.......<.!.@...2.T(@.U(.../P,....h...2.....P...._.X.@^..c..W....9V(..U(J. ..T..9)Z..@... P... P..........@....@.....(......B... P..3...P... P.......$.F..P.......P....B....!............,..'....z...=6...j.......E.\...Sca..9K.........)PR;..y.y.C.r....@~..e...h...U(.P... P......<...h...Z.@....@..4S6...V...n...(=kJ.....g..R(.....Z.;..C ..................Rm....)...qy......*.......*.@....@....@.....(.@..(@...=.B...`...B................B.....V..........X2.]...7, .....BW............k..%.....`)t..l7$i-.}......e..z..,D.)......#..Vu....o.. ./...o.oz......w..@......../.5=C....?.TVM.....Z...=..y).5. l....rY(.0.]kS...B.(..U.H~ttgx...g....qP.

<<< skipped >>>

GET /templets/default/images/bcastr3.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.yysyuan.com/gjsb.html

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:51 GMT

Content-Length: 14371

Content-Type: application/x-shockwave-flash

Content-Location: hXXp://VVV.yysyuan.com/templets/default/images/bcastr3.swf

Last-Modified: Fri, 01 Jul 2011 08:14:54 GMT

Accept-Ranges: bytes

ETag: "053faf4c637cc1:33ae"

Server: IIS

X-Powered-By: WAF/2.0

CWS.....x..}.t..qh....... x..."%.")..(."...AP...I...-..p...jw.C.-.:HY...2,F.-...9.e..e;.$;.q...J..;.....K...8.?.O.ut..... %[yO&.fg...........O..?.h..............{N...!.....~!H4..k...3.....=mb...@L..7.1.G...X....|..NxZ..\......@d..T..A.`q..E_v...J..!..C...!...a..c.L9=........ i..@DX..s....h.._...C...aI.~...0..$..,.........">,.o..(FT|..?..fC....ro....)6.}.,......tc.q.q..X.cH.....Z..n...E......NO.).\m...l..U,......OG.:.A/C.m..|....D.......9|....w.y..a%...Ad.g.O......~.5 ..Yf.&A....1~t:z.hyX.....c.Z.V0..9....D.......t.tq.{.......U[...S.8T...:qe..7..^.._.....b..T.J.....C_...........b..b...r........5b.X'.....q....bm......W....U...../..M......'.../d~m.zs....;j...-.y..."/?.&*..Mi...%..4Vs.^k..`.[i.\........O..dr..}Il3S.$. ...(^.....7.[L.zs.,[L......... .Dk...B...~?7.r..M...=.I....elm..X)..o.../e..|N....S.m{.'.7.u$..<R.R..".-.I.....w0Y.....l/..|.=WN.w..Ci@1....E*]"x...{..M..P@_c/.......[...?Y*.e.N.#.W..).........w..dD.\N....?.I ...... ....[...L...KC..=.)e..s&.r...7..b.....s.......&.R....ez..g.E*.~AY.S..t............?..J8z.'{O...@..m.B..~Q>.N.*..;0.._.T.*J.L*.........(......)&s..|qH......Tw.J.[H..@.`...r..G.........d.......\.T........B5A.\m..."2...8..p...'.E.b._.........Tz...@.s]..ClL......!.)..5Rr5~;...........p9.L8..@W>.......(. 7i.~...v.O....J.>.*I..L..F...;..&S)'.X...~.j)..\........U.S..~.2v.SiQ..A-......|&'.m\.q.....].n..m...r..=...#.. ...ij/.....,...\.,......d9).@...T.T@I..).A}cD..<!....Gxvg.....P..............(.E.A27.b.,...d\>.].9...5.=.fm.. ......>.k.\..J..'.."Iyw1?H.s...r*...[S(.%.>...

<<< skipped >>>

GET /images/a2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:59 GMT

Content-Length: 8183

Content-Type: image/png

Content-Location: hXXp://VVV.yysyuan.com/images/a2.png

Last-Modified: Tue, 19 Nov 2013 07:03:07 GMT

Accept-Ranges: bytes

ETag: "2896d66f5e4ce1:33ae"

Server: IIS

X-Powered-By: WAF/2.0

.PNG........IHDR.......:......_.\....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....]Wy.....v<.....)q..P..*HmCE.*.......V.t.UM...R.*....L.!.38.`;..gpB.04..H......y.z.Yg...9..:......>k.a...g...{..m{.....=2[]sx..zp........T.I..3)MU..'.q...f....j.......xP:PU....g...3.3].=5U.=9.....fOyYW..4.t..........r....D..-..N.R.^*.c.\Z.0^..8?......[........ma{.fO.........>.%[4..N...b...MW..gf....V.*]T:<Sm=4Sm90Um./iP..2H-..j..^...|...g2@......D...a...#5...Q.>k......m-...c ...B....~..Uu.....^.....>3]m=,/*P7...{.A.U.t.h...f}.t.M....lG[...l68.s8......6.....']\.V..5....HB..A...b..m..../...I.....hk.<..*C..y.....p.-.t..u...',. #.`.#..U.....:......ibG5....6i!Lj.... oK...h.z.Z. .|.-...T..J.....c......H..-...f....lG[..n..P...Pl..f...K..K.....D...]K.'4a....w.P..>.........(. ..*....R;.J.z..N.R..........J}u.Yi]sy...Z.bW.....7.C.......*.eP.<..9....XO@Cx;.7..6.Oh.S..OJ~..&.!7..-i..r%.u.........RY.R..*...T..J....|L..]T....Q.O..r......u..d?.M.=..I........j....F.e.w...>. U......'.?......P_8_.n....-.'.MR.%......*.._...U..K.vL.K...[.....6..F@u.M.G7y..."..'....xQ.tH...}......5.f.u.u.....I....Lxr./.9...NS.t...xX&rT.Jx2....D.I.a.....u.mI...h...K.]..R...R..\.z.Tj'U...8.Q..&......mJ..I^.....bOv.O..O..h....\...C....x$............i.^..g.tD.....8.".kR..q&,..~....u.-...D...R_.Juz..N.R.^*...T.U..W...6.>j.|.J....v.....k....".. "............W..@...T..\.z.Tj'U...4/.Ry.mf}...6..5...hk....@G".c.P.&eL......M.h..6.i.\y{...r;.Ju\.yq....}.tn..h..(ve..;..p.."NB..E@.....r.c.8.....@51L....Zp@...b.^*...T.U..W.|..Z...:...P9

<<< skipped >>>

GET /uploads/allimg/140311/1-1403111910220-L.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.yysyuan.com/templets/default/images/bcastr3.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:19:00 GMT

Content-Length: 46219

Content-Type: image/jpeg

Content-Location: hXXp://VVV.yysyuan.com/uploads/allimg/140311/1-1403111910220-L.jpg

Last-Modified: Tue, 11 Mar 2014 11:10:22 GMT

Accept-Ranges: bytes

ETag: "439587f1a3dcf1:33ae"

Server: IIS

X-Powered-By: WAF/2.0

......JFIF.....`.`.....C....................................................................C.......................................................................f...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..P01.....a......S.`v<..S.`...*Ej|..S.=......2{....U..{..$_..<.....vbh.>.H.x........s...]...mB....\......3...:...y....R ...@...cm.OU.8.k....)FGv.VZ.m..b..HS ..GCV......9.==......{..GY........,...W....._......z..2.lyo........@.muT.J..K..?<~.... )..................e.."..^....f....,...h.]s.^.....g.UbhF.>~.9&\...W................w. l.2...r.>.FW6"%...S.1...J.p6..u.zT9...M`..Bd.....jU.2... `18<~..7f.........I...\..N1.F;[>..{.H%'#.;{.^R.%..\3..f.y2.O.......y<......M .......[.0.c.[...>^......p@<..[...b..#_`..c..i..F..4..U.= 2..*.`.Q.*....;.OSUd}.w.Gnk.....*.DG ........V...n..2...c>.Ze......RV8j6.......= ....*.... .O.PH..u~..c.8.....E....<Y..............&.?.g./E...D..a.F1.............Vo.Q7}._:..(..v.NJ.l....%.W.N5.ZTf.............Q....'..V.......?.d..H...w.V...6.G.J...|O....q..W:n.mos5..u<....c......C..Q...........T........Q.. ....Oq....n.<.m...S....9V#.l..r...S.,4

<<< skipped >>>

GET /gjsb.html HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:20 GMT

Content-Length: 5166

Content-Type: text/html

Content-Encoding: gzip

Content-Location: hXXp://VVV.yysyuan.com/gjsb.html

Last-Modified: Wed, 19 Nov 2014 11:30:45 GMT

Accept-Ranges: bytes

ETag: "80601b42ec3d01:33ae"

Vary: Accept-Encoding

Server: IIS

X-Powered-By: WAF/2.0

Set-Cookie: safedog-flow-item=BC1D4A6754EC; expires=Mon, 17-Aug-2015 15:59:20 GMT; domain=yysyuan.com; path=/

...........<.s.G.?C..C.p..1.hF.d.tE ..*......R..H3..F.efd[....8$..mlc.._`.F..-d6...y...r..pu....d......F=.........OM.:.o..E_y.$...^y..._:..7I..w.$..;...7.~.2.<^pNbR2..b..H.....H(J..Ivttx:|.Qj#....D.(..=.....UX"r.p.J.3)..p.<Tcc#...9.E.INa....^...a...R...>.Ms...oaB.:..A....#...n..>.&...(."p.ht..bn.........Q...?..udru.x.6,.9~..Y..|..C.M$..3.b.\.`99..i$..# ....?Y..?].7...=...vm.....#................wQ.......7....n.L.....R.f......b...MJ.S..l.(...#L....cN...E>...FB.S.AB.Z...p...)2.r.LFPHY.....r.........aBm..... ..<.......R..5...U"x<....2L.|..igp....,Kq.........\`:i....4....q'a......V.Oh.F..H....K.........>r.....fRqd.u....a...oi..f....32'.s.....$x...f$hJr].'....~..K\.B...Y.#.@.=...X..H.,WW..F.a..(bBF2{.G.....Hu.........C....0D.g.-I.....:..".o.*t....>>.t.._|Yl............... .X1.IB.=..E.C./d_b.\-..$ P....d..,.Iq.....S.k...X #.......l..W...kN....KJ......0.t"Mh..?...^A.2...w......bo...c"...:...b.N..X.]oD.9.E..D..#.......1..q(?'..@..fR.g...I..qg.K$.5=........1wi...G.M....u...2.1Dtt.....J4...g....E.....1R<......G9L.....HDF?..^.....d"]&4.(..W6...=.bU.....T......jQVIE.............,.x5.`........[.. ....HB...._.....zZO.K0.<4eWF...j..hBLrihM....3...6....\.%9....&...Ih_D... ....W..f`.6]...h.b..:.NB..).=..................F.....wT.4[h"..h.....d.Xn....9....U3..u.P.|._&(S..e...'......\.d.U...8.EO:.F.l.a".'@..*.0ASA.0.#...x.d..#.3(.!.e0.#.cR)4:....]..o...K.$.......0.....X.æ#p....H....Cb.iNB..a]8..kH.\.b...q.i.3..,.)..7}s.X.....c.MPdX .....a..Bu)....?.....|.V....5dG.,....KeL.........Cq..mN.....

<<< skipped >>>

GET /include/dedeajax2.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:25 GMT

Content-Length: 2240

Content-Type: application/x-javascript

Content-Encoding: gzip

Content-Location: hXXp://VVV.yysyuan.com/include/dedeajax2.js

Last-Modified: Fri, 01 Jul 2011 08:14:28 GMT

Accept-Ranges: bytes

ETag: "0a7be5c637cc1:33ae"

Vary: Accept-Encoding

Server: IIS

X-Powered-By: WAF/2.0

...........Y.o.........."...x_PLU..v.c....f`3.Z<.L$R#..Z.?...).`...N*..j.v.:.b....X.m....$X..s...#y.(.....5.D........{......{{...B~.4.......V.w...\.tn..d....E....|>.4......j.))*.[..g..a].. ........!]0.@.....C.Q.Ke...l.A...G.....J!$#v.h..#.H$P.W_{.=.pk....j}../.`k..fL..=54,(..].....N...r..)..j&r....|}.<".$.Vl.\.5Fckiq.o8...o.......U...>.....4...'_~..t.......].n........#P.6Z{y.../............W~....!.9r.9.......K...Vw.X..$.%.............{..4'Dd.."Gb...o$b..}.t.x..yK._q..]O..7.........$.....X.y3..(.\5h....>}i.....=~Q..O.c!#.:,.....Y.w..cx.....XD.G'.E.0kO..k._..V....}P]......H\!e.0...T.D:..sU..H.>.5..T.b...a.U.Kj.:"........<.....lg...n.0Ct.\$(o.9......z.#zb9.#.?._....k.YE....Y`.U296}.dLw.[..e...|#..O^.G..g 19z.ex1U.2......`\..S.......x.Y....Z..6.}..b.R.....y...<e...x6....w.v........s..-.8 .. ._.yL..`.{c....%..>'.........Y.....6.G1R..."F8T.B.-Z.GI.?..Tk..k....".#i.b....D.N.............N..!..h2........T..\...##...j.Wu(z...\jF.......b.S..(.d..$..^z{......&...e......l...Qui.cL..../w...[..8b.3.'.>NLv5.].....B...j.Pl.3.....D6..Lh..~ ..d....I......!x.4.k..:|..[{z.....bccu....J.y..[.......}....&HTTP/1.1 200 OK..Date: Mon, 17 Aug 2015 14:18:25 GMT..Content-Length: 2240..Content-Type: application/x-javascript..Content-Encoding: gzip..Content-Location: hXXp://VVV.yysyuan.com/include/dedeajax2.js..Last-Modified: Fri, 01 Jul 2011 08:14:28 GMT..Accept-Ranges: bytes..ETag: "0a7be5c637cc1:33ae"..Vary: Accept-Encoding..Server: IIS..X-Powered-By: WAF/2.0.............Y.o.........."...x_PLU..v.c....f`3.Z&

<<< skipped >>>

GET /images/js/j.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:40 GMT

Content-Length: 15657

Content-Type: application/x-javascript

Content-Encoding: gzip

Content-Location: hXXp://VVV.yysyuan.com/images/js/j.js

Last-Modified: Fri, 01 Jul 2011 08:14:22 GMT

Accept-Ranges: bytes

ETag: "083e7e1c637cc1:33ae"

Vary: Accept-Encoding

Server: IIS

X-Powered-By: WAF/2.0

...........}y[......<...n_.b!.d[^.x.$..%.....G.....6[...}...$......mIg.SU...............x.T.-...6.'.C.[p..>....=.O.,&Ew...i......Qp.........%......'[....!....Aa.o..Y...FQ<-.{q......g..`....;k.8W5.QT..tT..."7kff........@.e;[.].v..v.T-...|....r.ZV.[......@......x.O..l..flN........4..M..:hnl.c}.Lg..h.....0........7n.y6..G].3..w{.tw..z....z...U..V.c..w....k.O.A;..~l.*.0..z..*nn........j_'....~ ./.. .......z..qu.P.X4...h,[F.l.........%..{....n..aQ^....aJ.F..d.o.......o.V..t.........J.O......|Pp...,...7..@.;..G....W.k.J..fF................c..8(g.~..uu......e.N...{V..?.o.....E~.$g.}=...........Y...8(x.}..)D..9.F.........*..u...........#b.=...kt.8A..?.*6......t`9.k.$...t.r~.]...".[...I..a...}..`.R..h.....9.V.J.v.....%.:.....C]......:i.".....m....L.|.v.R.3.^ .^...rC.>..K#..#.C....\....v.....=....3..ca~..T..>1..5..e...6.=.....*?4CP.......(..Z(..m.....~.b..>..>H....V.$.}.D0.l.....hD.I?Xp....}.......Bd...z....u....}...fh.... ]Bl......6...F..........F@..m#.LB.6..5'...T.Z.*\..RM.......*........._....5..{.3....5.H..3IJ.....c..ve...A.W.6..U..*.Toy....(X..A...P.L.E.O...r,g.N........G...iJ .R.W/3.R.....*..b..9...~.m.<...Y....5...lJ.5J..@.EZ...o...S..n....y..:...P$J.K.....<.[I... .....$..[.....X..).|z......Z.5y..}...... .[.m."X..{.fY..f..D-M!x.m....c....SZ............M.hU...a.{.L....5.Q.)d.d..CB......(Jk-....!.. ..k.........5.H.......s....[...6.q.P.9.^4...}..,.h..k(..J...,;..V....I..:{ZG.....w..)NEx...{....o........HFf.....t.M.p)r*....7.*....'...[...Z...-<6m....9.\E..w.b..)....{.]...P.N..#..H.r_8.'.

<<< skipped >>>

GET /templets/soft/images/logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:50 GMT

Content-Length: 13124

Content-Type: image/png

Content-Location: hXXp://VVV.yysyuan.com/templets/soft/images/logo.png

Last-Modified: Wed, 30 May 2012 07:24:00 GMT

Accept-Ranges: bytes

ETag: "0689f2e353ecd1:33ae"

Server: IIS

X-Powered-By: WAF/2.0

.PNG........IHDR.......F.............sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..2.IDATx^.....E.... .X...*v.-*.....-.. .......b`"......ts.K....t....30,{.K..........;;;...*_..pS.P.H.|....@f.v..l..D6n6.H..G...,1......5...]...}5.D..1....4..o0..Y.......7f..\7.D...F.Z.....rf.2 `>...D...\f dV`..@..v.2gn.Y.....\f'dV`7.@..v.bgn.Y...e......\....`...p....3...^....1..l2..n6...Lel...Y.z.Y...k...,X..,.=6.^.kl..,[...\.yw.......L.7.....i.,.k..;.7..\^W0..g..?..l...9)o..3...?.i...cf/.~sA..._i...|..|.DD..F.....>sL.~.,C...~..O..~...3.t.m.A........M.\...?p.y..Ef....W.K...aKM.....oO7s....{.o.w/}e.......yg..s..Y......4......L.G.....2]..1.6.............L.....g&.!...>.=..=Jpl..&...]b..c..y.*.W.*...5{.yO.h...X.z.U..,.`z.....O./3.V%.....RK>..o.....y..y.1C$]zkSq....sP.....@..>.eN|z..|..Pu.....y......?.L.5#...x....1.Q]cy...~.?..o...-..K^..2O7_..{.w..K..Z.%Z...I.6....n.6.f..<..M.....o.....h...3...Rn...i.....p.)x.0sn..f.6y"3${..s[..f..F......;..X..n..;N4Eo.a*i........*I...^h*..k..zg>7.|7a.T......t......2...Gi..]..1.{q...Xh..j...\..8<.c.TH.c.........'....6..R.( T....z&....KU...xS..x{.0.l...M...L..a&....m.;......QN.....&k.....>a.z3b..s....G.^g...Wi5.......o...x..g|>v.:.....i.)..B...YG...........q........./.?;7.9.....>[...{T.......u.d"...2-F....o.......UZ.5.......o~...J.$Z..g...CM..0s.^..(.`....d.a. ......z..B]..O..B..K:.yb..#5.Z.,.i:\.>....F.q.6.(sy..f.$.F.-..UD.u4.#..3...a.SI.......G-...s...D....y...SR.....1.d.........s.9J..<X.J.O.....=gi.o.......Y.......<.9..........Q.

<<< skipped >>>

GET /templets/default/images/search-bt.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:54 GMT

Content-Length: 565

Content-Type: image/gif

Content-Location: hXXp://VVV.yysyuan.com/templets/default/images/search-bt.gif

Last-Modified: Fri, 01 Jul 2011 08:14:56 GMT

Accept-Ranges: bytes

ETag: "0802bf6c637cc1:33ae"

Server: IIS

X-Powered-By: WAF/2.0

GIF89aD...............333........................mkk...1,/725......ywwsqqgcdkiiNILwruwuu...TRRZXXigg...HCF;99947A<?gadPKN......- ?:=JEH`[^...RMPNLL...^\\D@AqooVQT...LGJ....................................!.......,....D......@..P(....r.l..*.L@.Z...v.......@.....z.F#....M...p.}....j....w.f.v.t.j.V.......j...k.h.T.U)m.d..k.l.g0..V..l...g...q.f."U......i....zh....#.h.....u..........(................1 ,3./!.....]....< '>.x..a...!>t.0.@y............J......6RL.....0cZ2@....2O% ..!HR4Tp..J....8..A.Nc.....E@....T..U...78...xG....X..=.....p...B..]...4..........Lx.. .;....

GET /templets/default/images/ico-1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:54 GMT

Content-Length: 50

Content-Type: image/gif

Content-Location: hXXp://VVV.yysyuan.com/templets/default/images/ico-1.gif

Last-Modified: Fri, 01 Jul 2011 08:14:56 GMT

Accept-Ranges: bytes

ETag: "0802bf6c637cc1:33ae"

Server: IIS

X-Powered-By: WAF/2.0

GIF89a.............XXX...!.......,...............;....

GET /images/a1.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:54 GMT

Content-Length: 8657

Content-Type: image/png

Content-Location: hXXp://VVV.yysyuan.com/images/a1.png

Last-Modified: Tue, 19 Nov 2013 07:02:54 GMT

Accept-Ranges: bytes

ETag: "423b555ef5e4ce1:33ae"

Server: IIS

X-Powered-By: WAF/2.0

.PNG........IHDR.......:......_.\....sRGB.........gAMA......a.....pHYs..........o.d..!fIDATx^....eUy.....nz....w.....$...R1.X.......XV@.I.$|..*m*j>@.4..@36.t7.D73"....=.w..=.Z.>....9..n[..C...>{.a...g..Z{.f`......p.du...j...j......c.jit.Ii..y.d5.t...j...Z.7jOe.W..vV......jd....W...U...l.#Q...<. .K.A.V...k.GO.....vj.un..R=.J...T..ki............\...emt..m....7{.../.......(....v...)v....*...du.....Jg..LT.vOTkw.Uk...P......=.....P...*....-@..vj.....~(....P..:.YK.t..m.k.......zeZ.o..._V.....].. }R^...j..yQ..Z.........}@...4k...MR;].y[...P...d..(2.X....*^...tv.B....V..3.q..e&......>.Y[.]o...*..R.LyP.T.~.SJ...#.Dk.....<..O.DAF......R.:gU..H.tX.:...R.......0...........C....R[.z..TO.R.n*.....?...~(.....R[-c.v.......i...b_.....nv....;>#.....F@M.Z.=...........v .mIe.s.OQ*Wn U....R=.J...TO.R..r......-..j.......-u5.......aon..y&....U..C!..z.! .C.w.4....Cxk..U.....X.......h...a...T.-(.`&/.J.Je.J.;.TO.R.n*.c....T,.Au.\.......g*.k..Q&.K.c.$..-.d_.......F@Y...P.q.=....Re..Q..p...a..m.......$........N..d.-...R.mLU.zr..uS........-.sT.F.Tw[@u.I.F'y..."..'....xQ.tH....$l5....vO.........I..e.D..},.9...NS.t...xX:rH.Jx.R..R..$..I..U....%u....../.w..JU*.M.zr..uS..T.2.b?G....3k...7)..v..-u.0.{..?.t$.t....ws...v.W....8.=Z.K.S..8G..{.........E@G..iD.BG..a.P...L@..mY-u$*.w..JU*.M.zr..uS..T.2.R..J.M...QK..T..\.......... R......b.C..v(R.;.........R=.J...TO.R.W._\..&......M*.k...RW.P.T.].......)..,...^.....h;..<W^....\O.R.W._\...B.&].Y-u5.....`g....[.I.....9...kwb..'. ....:..08.A3.(.CZ,.M.zR...J..*./._......).*g.-.....

<<< skipped >>>

GET /templets/default/images/ico-2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:19:00 GMT

Content-Length: 50

Content-Type: image/gif

Content-Location: hXXp://VVV.yysyuan.com/templets/default/images/ico-2.gif

Last-Modified: Fri, 01 Jul 2011 08:14:56 GMT

Accept-Ranges: bytes

ETag: "0802bf6c637cc1:33ae"

Server: IIS

X-Powered-By: WAF/2.0

GIF89a...................!.......,...............;....

GET /images/a3.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:19:00 GMT

Content-Length: 8304

Content-Type: image/png

Content-Location: hXXp://VVV.yysyuan.com/images/a3.png

Last-Modified: Tue, 19 Nov 2013 07:03:27 GMT

Accept-Ranges: bytes

ETag: "999b4c72f5e4ce1:33ae"

Server: IIS

X-Powered-By: WAF/2.0

.PNG........IHDR.......:......_.\....sRGB.........gAMA......a.....pHYs..........o.d.. .IDATx^....].Y...B.;....w..;q".2.B..H.6-.-.".VB.......@A. :|....8M.8qf...9i:S...I<.w...w.w...Y..sOn.\.X.i.a..}.....\..z.....;.P]{l..yd..qh....l.]...F........n}r..v.....:V...#....zH:.PM..W..j...j......R.}.q]y^.4....(]...... ..U&.]nY.|r...S)................\...ee........3{.../.......(....v...!v....*...Bu....u.....W;..W;..V.....m.h..B...|;..t.[e.3...Hc.^e.........Z.U..W..TN_y.....P.1...R.]O/T................>5W.<&/*P...m..A.U.t.hS#@..\..... .........'c.G3..]..KS..^.../]....G5.=.Lq...Id.9.....YY..oH......k.<..*C..9.....p.......i.O.0...P....nS.:g[..t.tJ.:...T.O....@..g_y\W......6...TV.a.-......J.....mU...b.H..-..5f*..<nW^.....P...Pl..f...K..K................F@.......Q..%....<E)]..T...8...UJ.O.|R........?..T*.k.J....v.....2..L.{s;..K.......4...T#'.T....h..N...[..G5.....$.z.....M..4.R..........\IY.,^)}....UJ.O.|L....b.....R..X..W<Si\s..4y^..[&..l.$....T..l5..zt.......e...JC.l...'..<......>p>...q]y^R_@...K....) UZ..*......J.....-....Qi..).V@u.!/..<nW^.P.....H.(P:..................g...r..b92.vn..pNG@.......(....T.2=.P.O....@.40}.q]y^R?@..p).R|W..T.4.T.'W)]?..IUJ.*.sT)..<.2j.~C.x...v......=..@..@....|7.....\...<...G;..s.{..Vi.^..g.tB.....4."M.S..i:,..z...h.i[VW..J.]..R...S).\.t.T.'U).../.R|.yfe....J....v.....5p...".. "..........N.....#@...O.R.~*.....U..W)..<.2j.~C.q..q....j......T...N.Rg.8...:prP@..6x.<?i.i9.T.4.R..J.M.2L.7......].....7.......S.Ps&%@w.../N@..(.Pu..ap....P4.....J..*.q...U._...

<<< skipped >>>

GET /templets/default/images/ico-3.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:19:03 GMT

Content-Length: 54

Content-Type: image/gif

Content-Location: hXXp://VVV.yysyuan.com/templets/default/images/ico-3.gif

Last-Modified: Fri, 01 Jul 2011 08:14:56 GMT

Accept-Ranges: bytes

ETag: "0802bf6c637cc1:33ae"

Server: IIS

X-Powered-By: WAF/2.0

GIF89a...................!.......,...............}Q..;....

GET /images/a4.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:19:03 GMT

Content-Length: 8139

Content-Type: image/png

Content-Location: hXXp://VVV.yysyuan.com/images/a4.png

Last-Modified: Tue, 19 Nov 2013 07:03:36 GMT

Accept-Ranges: bytes

ETag: "95a4b677f5e4ce1:33ae"

Server: IIS

X-Powered-By: WAF/2.0

.PNG........IHDR.......:......_.\....sRGB.........gAMA......a.....pHYs..........o.d...`IDATx^....].Y.._..dm.2..f...!...$.^....$T.....P8f-...$T.P$....[".....6k..8.q...f[.4.......}....d.<.U....>.....}....~.....?.P]w|..ut....\...l.].>0#.VS.g.).....m..j......o;*......C....y....>5[m}r....Tf_yZW^.4..........C.r....D..-.TN.R.~*.c.Y..._..8>......W....>..]ea{sfO.........>.%[4..N...b....U..g...^^..W..t|..ul..yd.....Nm;H'5...M...P...*....-@.....]...q(......F....z...v.......tl...~v...W......nxQ.>//..\.....@..P.....Ty...M....r.yC...<mWY...l68.s8....V...*....ty.zmo.;.-..d..=( .M....F.fu...!..W.................G..v......)V.0...P....nS..g[..T.t..t..vR.<..nH.aR.}.i]yYR?@'....R]...h..\.|.T*'U.6....8..G..h...9S=}.i......G@..6@.E..."s,../.@.F@.#.&V-.Ok..#.S?f@m.}.........(. ..*....TN.R.~*....'.<....a..R]]sV..\........9.vj...!p^...r@...S.<.:9............a{k...&;......w/.....eI[]JWR...`..<. . .. ...R9.J...T.)...T..Cu.\*.....Jg*.k...'/K.c.$....d_.....5[..r.......y@9....08....d...5@....'.'..<. /K..h.T~.`..%u.J..T.rr...S..........9*..!.....7.u....* .*{2@q....J..[.zX.V...^wl.~......e9.~b9:.....pNE@.......(.......=...Oh...D.41}.i]yYR?@..p..RzW..T.<.T*'W)_?..IU..*.sT)..2.:j.yC.|...v......-...S...-."..k.^wl..........G.9.=.sZ...U.3.:!..d.t.A..4(................UF.RzW..T.<.T*'W)_?..IU..*.....D.Y..........]eu....8.vj.Ps..PlqR...E..N.O.#@G..U..\.|.T*'U)..4..Rz.efu....J....v.5..4.......P..e.....m/4........s..I#H...*.q...UJo*.a..E.......9...{.1`.8...5.j.....#.......E...a0.N.....F....S..T.<......

<<< skipped >>>

GET /templets/default/images/new-article.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.yysyuan.com/gjsb.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:19:04 GMT

Content-Length: 269

Content-Type: image/gif

Content-Location: hXXp://VVV.yysyuan.com/templets/default/images/new-article.gif

Last-Modified: Fri, 01 Jul 2011 08:14:56 GMT

Accept-Ranges: bytes

ETag: "0802bf6c637cc1:33ae"

Server: IIS

X-Powered-By: WAF/2.0

GIF89a................UUU............!.......,...............0.I..8....`(.di.h..l..04........~.._lH,...$n...x...'MZ...VKmN....F.o...z..V.='..{.....(...9]pb{......a@sf.U.v....Z.....TrM..O}..........................c..f.vP5....i..N.2..........o......"~............... ..;HTTP/1.1 200 OK..Date: Mon, 17 Aug 2015 14:19:04 GMT..Content-Length: 269..Content-Type: image/gif..Content-Location: hXXp://VVV.yysyuan.com/templets/default/images/new-article.gif..Last-Modified: Fri, 01 Jul 2011 08:14:56 GMT..Accept-Ranges: bytes..ETag: "0802bf6c637cc1:33ae"..Server: IIS..X-Powered-By: WAF/2.0..GIF89a................UUU............!.......,...............0.I..8....`(.di.h..l..04........~.._lH,...$n...x...'MZ...VKmN....F.o...z..V.='..{.....(...9]pb{......a@sf.U.v....Z.....TrM..O}..........................c..f.vP5....i..N.2..........o......"~............... ..;....

GET /uploads/allimg/140311/1-1403111Z0350-L.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.yysyuan.com/templets/default/images/bcastr3.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.yysyuan.com

Connection: Keep-Alive

Cookie: safedog-flow-item=BC1D4A6754EC

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:19:07 GMT

Content-Length: 111646

Content-Type: image/jpeg

Content-Location: hXXp://VVV.yysyuan.com/uploads/allimg/140311/1-1403111Z0350-L.jpg

Last-Modified: Tue, 11 Mar 2014 11:00:35 GMT

Accept-Ranges: bytes

ETag: "8bdda21193dcf1:33ae"

Server: IIS

X-Powered-By: WAF/2.0

......JFIF.....`.`.....C....................................................................C.........................................................................y.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...w......?.......u...}...f.4...I.[F.m.e!.gB.2......e...|...6.k.....:....5.....rI,K.b......!..9..?lx..%.C....>".<.....;\.....i$c..Y@....Uo..a..:.6P.x..!........:....Z.7......$...Q.....n.....~..J..'...O.j..e..#c...!.&.<J...V... .5.......4...Cgg........D......7E4PI...2]m |.k|.(...x.Fo... ....xj.X.WJ...L..j...@....{=*....'Y.W.......fK.;.6)'..Q.xr..`8.. U.kt.....[..............m.X...xXj."......k.est........2......$.,P(rH\.[...&...k/./....K...A.<).Omo.G0.,.fk...:.....D....t.p?..............5.*...............w...~x.B._....xsM.<...t..F.....I....#,..2A.....K...r...b`..^".....|3.<.5.......7.[......eZ'.X.%.Q..i.........e.......2......\......[r..7..VNJV....s......%..jZ...'.5.....4{...(U........;.trns...Y....m...... ...g..S.Vs/.t.|9l..C..X...{..YK.L...[..(.N.nG.....4....xK..|....H....Br......?.G.......c....e.$.>..i...ob}.)wqv..'c.!.9....`.|......e.....O.K...j..K7.k......t.3.......pc&...b..K8.

<<< skipped >>>

POST /Api/config.aspx HTTP/1.1

User-Agent: WiseClientAPI-2.0.0.5

Version: 2.0.0.5

HASH: dc6b73cbd1f6f5cec640a8c634ae50c8

Cache-Control: no-cache

Accept: */*

TTL: 1439821100643

Content-Type: multipart/form-data; boundary=-------------aabbccddeeff007dc3d73a70130

Content-Length: 378

Host: s1.uuwise.com

Connection: Keep-Alive

---------------aabbccddeeff007dc3d73a70130

Content-Disposition: form-data; name="HASH"

FC8CB478269789B12082AD6B1B3F8A51

---------------aabbccddeeff007dc3d73a70130

Content-Disposition: form-data; name="SID"

100581

---------------aabbccddeeff007dc3d73a70130

Content-Disposition: form-data; name="InitTTL"

1439821100628

---------------aabbccddeeff007dc3d73a70130--

HTTP/1.1 200 OK

Date: Mon, 17 Aug 2015 14:18:21 GMT

Server: Microsoft-IIS/6.0

ServerV: 10036

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Set-Cookie: ASP.NET_SessionId=kv5cox452dieyw45agq5bv31; path=/; HttpOnly

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 180

313030302C6C632E757564616D612E636F6D3A393230303A3130312C7570612E757564616D612E636F6D3A38303A3130322C7570612E757564616D612E636F6D3A38303A3130332C7C307C3139342E3234322E39362E32313820HTTP/1.1 200 OK..Date: Mon, 17 Aug 2015 14:18:21 GMT..Server: Microsoft-IIS/6.0..ServerV: 10036..X-Powered-By: ASP.NET..X-AspNet-Version: 2.0.50727..Set-Cookie: ASP.NET_SessionId=kv5cox452dieyw45agq5bv31; path=/; HttpOnly..Cache-Control: private..Content-Type: text/html; charset=utf-8..Content-Length: 180..313030302C6C632E757564616D612E636F6D3A393230303A3130312C7570612E757564616D612E636F6D3A38303A3130322C7570612E757564616D612E636F6D3A38303A3130332C7C307C3139342E3234322E39362E32313820..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_772:

`.rsrc

`.rsrc

.rmnet

.rmnet

t%SVh

t%SVh

FtPrk

FtPrk

t$(SSh

t$(SSh

|$D.tm

|$D.tm

~%UVW

~%UVW

u$SShe

u$SShe

u-h}*Q

u-h}*Q

user32.dll

user32.dll

UUWiseHelper.dll

UUWiseHelper.dll

User32.dll

User32.dll

kernel32.dll

kernel32.dll

gdiplus.dll

gdiplus.dll

Kernel32.dll

Kernel32.dll

GdiPlus.dll

GdiPlus.dll

Ole32.dll

Ole32.dll

ntdll.dll

ntdll.dll

NTDLL.DLL

NTDLL.DLL

shell32.dll

shell32.dll

gdi32.dll

gdi32.dll

FastVerCode.dll

FastVerCode.dll

Gdi32.dll

Gdi32.dll

dwmapi.dll

dwmapi.dll

Gdiplus.dll

Gdiplus.dll

ole32.dll

ole32.dll

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

uu_loginA

uu_loginA

EnumWindows

EnumWindows

keybd_event

keybd_event

uu_reportError

uu_reportError

ReportError

ReportError

UnregisterHotKey

UnregisterHotKey

RegisterHotKey

RegisterHotKey

GdipGetStringFormatHotkeyPrefix

GdipGetStringFormatHotkeyPrefix

GdipSetStringFormatHotkeyPrefix

GdipSetStringFormatHotkeyPrefix

RegCreateKeyA

RegCreateKeyA

RegOpenKeyA

RegOpenKeyA

RegEnumKeyA

RegEnumKeyA

RegCloseKey

RegCloseKey

{B6F7542F-B8FE-46a8-9605-98856A687097}

{B6F7542F-B8FE-46a8-9605-98856A687097}

{86AB1D8A-7995-4D86-AE5F-18710759228B}

{86AB1D8A-7995-4D86-AE5F-18710759228B}

YY.exe

YY.exe

hXXp://VVV.jsdati.com/index.php/do/register

hXXp://VVV.jsdati.com/index.php/do/register

|*.txt

|*.txt

hXXp://VVV.uudama.com/

hXXp://VVV.uudama.com/

scripting.FileSystemObject

scripting.FileSystemObject

TEAKEY

TEAKEY

\yysy.edb

\yysy.edb

/YY.exe

/YY.exe

hXXp://VVV.yysyuan.com/a/20131119/6.html

hXXp://VVV.yysyuan.com/a/20131119/6.html

Ex_DirectUI_MsgBox

Ex_DirectUI_MsgBox

07/08/13

07/08/13

09/27/12

09/27/12

/z.bmp

/z.bmp

8000000

8000000

-1,-1,-1

-1,-1,-1

/q.bmp

/q.bmp

f/k.bmp

f/k.bmp

/b.bmp

/b.bmp

KeyedEvent

KeyedEvent

WindowStation

WindowStation

Port

Port

WaitablePort

WaitablePort

FilterConnectionPort

FilterConnectionPort

FilterCommunicationPort

FilterCommunicationPort

195B95EF-4DDC-4F68-82ED-184D1C3CB72B

195B95EF-4DDC-4F68-82ED-184D1C3CB72B

32F1C86B-E64C-4EAF-8BC1-C142570008BC

32F1C86B-E64C-4EAF-8BC1-C142570008BC

SESSIONkEY

SESSIONkEY

-12027,TEAKEY

-12027,TEAKEY

*.exe

*.exe

/yybrowser.exe

/yybrowser.exe

/yybrowsere.exe

/yybrowsere.exe

/yyexternal.exe

/yyexternal.exe

/yyexternale.exe

/yyexternale.exe

/yyLDVideo.exe

/yyLDVideo.exe

/yyLDVideoe.exe

/yyLDVideoe.exe

10/05/12

10/05/12

\.YVV

\.YVV

Ï[H

Ï[H

L

ohXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?> 

)-X}4*

\sya.ini

\syb.ini

/yysy.dll

.rsrc

o.pg=

%6U/U0

x\%SHK

u.HsL

T.WvR

.WUAjOH

3.SiY

.Be$>;%
j%u4 e
K.sUQ
!d.Cd
p(.vp
XO.Br.
A.tCD
-!-.WPi.
@.Ydl
C.kwF
nU.lj\4
B .PR6A%
?Jkernel32.dll
script*g.FileSyste
Speed.ba
upportedExce
.hWR`
S5.INI
ELECTED4.MSVCRT5
.PAVV
> (*.&)|
anx.htm7)
07-034/)7
LvJ.vp
%s:%dOQ
ld%cVJPEGMEM
zcÁ
iGl.chs\S
LJve %f
b=.textv6
KERNEL32.DLL
ADVAPI32.dll
COMCTL32.dll
comdlg32.dll
GDI32.dll
OLEAUT32.dll
SHELL32.dll
USER32.dll
WINMM.dll
WINSPOOL.DRV
WS2_32.dll
ShellExecuteA
yysy.dll
hXXp://VVV.yysyuan.com/yanz/yydkq7.0.txt
:VVV.yysyuan.com
\data\setsoft.ini
\TEMP.TMP
\YY.exe
\\YY.exe
/Launcher.xml
C:\Windows\System32\dm.dll
@uK95%u
!!"#$%&'()) ]}
Bl$B&J.d%.d
]%S@v
eX.DJkF
.bQiP
m%u)8H
':{24.*@
.mQ0!3
QsL,[%c
/d$%u
ftPG
%U09 SC9
3%Sr0,Lr
{URL>
I.NBU
W-w%S
!D%CT
.LaW#
Crt_`
L%Sl-_
,,h(Ooq_q
7%S)z%
hHN%D
4Qc.aY|
:5^,0#$`
J&0X%XJ
A.tCDH
h.MvtH
@.MHN
?456789:;
%F&V&
j`.kl
late 1.2.3 Cop
!"9999#$%&
B.iNP@p.
e procesrs when executedn
MSG.N
\plugin\.tlb
API.D1%fO
#TCPDLE
$.nj~
keypadhT
\\.\Physz
=%d
x=%f,Ty
@r%4u
B^%fN~
Cn6%Cs
'.uO(
%ubM|ZU
&e.Swr
.plBGO`
oßg
%.jIr
R6.aN(
i'.gO
q~3.Wd
N7.Vw
Pz .QB
%c|(.
K@>%si
umö
CMsg
"F*~TCp
7G#V%F
.text
`.rdata
@.data
@.reloc
t.SSSj
%*.*f
CNotSupportedException
CCmdTarget
commctrl_DragListMsg
COMCTL32.DLL
__MSVCRT_HEAP_SELECT
GetProcessHeap
GetCPInfo
KERNEL32.dll
UnhookWindowsHookEx
SetWindowsHookExA
ActivateKeyboardLayout
GetKeyState
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
imesample.dll
ImeProcessKey
Global\share_file_input_flag_%d
Global\share%s
Global\%s
c%d%d
System\CurrentControlSet\Control\Keyboard Layouts\
Keyboard Layout\Preload
.PAVCObject@@
.PAVCException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
> >%>5>;>
5 5$5(585\5|5
.reloc
MapVirtualKeyA
GetAsyncKeyState
MapVirtualKeyExA
GetKeyboardLayout
MSVCP60.dll
MSVCRT.dll
User32Kernel32.dll
%x-%x
PSAPI.DLL
dx.mouse.cursor
dx.mouse.raw.input
dx.keypad.raw.input
dx.public.graphic.protect
dx.mouse.focus.input.api
dx.mouse.state.message
dx.mouse.position.lock.message
dx.mouse.focus.input.message
dx.public.active.message
dx.mouse.state.api
dx.keypad.state.api
dx.public.fake.window.min
dx.public.disable.window.minmax
dx.public.disable.window.size
dx.public.disable.window.position
dx.public.memory
dx.public.anti.api
dx.public.inject.type.6
dx.public.inject.type.5
dx.public.hide.dll
dx.public.inject.type.0
dx.public.disable.window.show
dx.public.defense.sh
dx.public.defense.memory|dx.public.defense.ny
dx.public.defense.memory
dx.public.defense.ny
dx.mouse.input.lock.api|dx.keypad.input.lock.api
dx.mouse.input.lock.api2
dx.mouse.input.lock.api
dx.mouse.clip.lock.api
dx.mouse.position.lock.api
dx.keypad.input.lock.api
d3d8.dll
d3d9.dll
ddraw.dll
dinput8.dll
dx.graphic.3d
dx.graphic.2d|dx.graphic.2d.2
dx.graphic.2d
yy3d9.dll
dx.graphic.2d.2
dx.graphic.3d.8
dx.mouse.api|dx.keypad.api
GetKeyboardState
dx.keypad.state.api|dx.mouse.state.api
dx.public.active.api
dx.public.active.api2
dx.public.input.ime
dx.mouse.raw.input|dx.keypad.raw.input
dx.mouse.api
dx.keypad.api
imm32.dll
Iphlpapi.dll
%d_%%d_%%d
%d_%%d
;:;@;[;};
0 0$0(0,000
{43C6DBBB-BEAD-4DFB-B6D2-52C5CDB5B70A} = s 'Dm'
'Dm.EXE'
val AppID = s {43C6DBBB-BEAD-4DFB-B6D2-52C5CDB5B70A}
dm.dmsoft = s 'dm.dmsoft'
CLSID = s '{26037A0E-7CBD-4FFF-9C63-56F2D0770214}'
CurVer = s 'dm.dmsoft'
ForceRemove {26037A0E-7CBD-4FFF-9C63-56F2D0770214} = s 'dm.dmsoft'
ProgID = s 'dm.dmsoft'
stdole2.tlbWWW
~cmdWd
KeyPress
.aKeyDownWd
MKeyUpWWWd
ShowScrMsgWW
msgWd
SetShowErrorMsgW
>SGetWindowStateWW
U@SetWindowSizeWWWd
SetWindowStateWWd
iRSetKeypadDelayWWd
BkeypadWW
SetExportDictWWWd
keyWd
FindWindowSuperW
qHKeyDownCharW
pOkey_strWd
KeyUpCharWWWd
KeyPressChard
KeyPressStrWd
EnableKeypadPatchWWWd
=PEnableKeypadSyncd
EnableRealKeypadd
method KeyPressWWW
method KeyDown
method KeyUpWW
method ShowScrMsgW
method SetShowErrorMsg
method GetWindowStateW
method SetWindowSizeWW
method SetWindowStateW
method SetKeypadDelayW
method SetExportDictWW
method FindWindowSuper
method KeyDownChar
method KeyUpCharWW
method KeyPressCharWWW
method KeyPressStr
method EnableKeypadPatchWW
method EnableKeypadSyncWWW
method EnableRealKeypadWWW
IMM32.dll
MFC42.DLL
VERSION.dll
dm.dll
\UUWiseHelper.dll
SSSSh
ByScreen.JPG
operator
GetProcessWindowStation
E:\work\UUWiseHelper
\UUWiseHelper.pdb
RegOpenKeyExW
SHLWAPI.dll
urlmon.dll
dbghelp.dll
IPHLPAPI.DLL
UUWiseHelper.DLL
uu_easyRecognizeUrlA
uu_easyRecognizeUrlW
uu_loginW
uu_recognizeByCodeTypeAndUrlA
uu_recognizeByCodeTypeAndUrlW
"0,01070
88J8R8x8
0#0'0-01070;0
=*>0>4>8>
5%6S6
3$3,383\3|3
:-1014,URL
:-19011,
/FastVerCode.dll
NETAPI32.dll
WININET.dll
.PAVCFileException@@
.PAVCInternetException@@
Content-Disposition: form-data; name="key"
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; MALN)
POST /api.php?mod=yzm&act=state HTTP/1.1
/api.php?mod=yzm&act=state
LZConfig.ini
User-Agent: Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0)
HTTP/1.1
/api.php?mod=yzm&act=add
POST /api.php?mod=yzm&act=result HTTP/1.1
/api.php?mod=yzm&act=result
POST /api.php?mod=yzm&act=point HTTP/1.1
/api.php?mod=yzm&act=point
POST /api.php?mod=yzm&act=register HTTP/1.1
/api.php?mod=yzm&act=register
eee.5etm.com
POST /api.php?mod=dmuser&act=yzm_error HTTP/1.1
/api.php?mod=dmuser&act=yzm_error
.5etm.com