Gen.Variant.Jaiko.1240_e871444241 – Adaware

Gen:Variant.Jaiko.1240 (BitDefender), Trojan.Win32.Generic!BT (VIPRE), Gen:Variant.Jaiko.1240 (B) (Emsisoft), Artemis!E87144424128 (McAfee), Heur.AdvML.B (Symantec), Virtob.Win32 (Ikarus), Gen:Variant.Jaiko.1240 (FSecure), Gen:Variant.Jaiko.1240 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: e871444241280296b8631295b5825927

SHA1: 5fd00fa38070b0191d69b730dfff5bc720948793

SHA256: a04d3bcd8a76e6d82d250589807fc4c3f34ecb1dff5e1fc4d2f6ecf158705355

SSDeep: 98304: 7pCo9V4oRqfvCuafAJYvtTHCfZM3ErAJj:KDRJG66UR

Size: 5169152 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: InstallShieldArchive, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171, UPolyXv05_v6

Company:

Created at: 2016-01-26 13:24:10

Analyzed on: Windows7 SP1 32-bit

Summary: Trojan-PSW. Trojan program intended for stealing users passwords.

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:3856

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:3856 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7ACIT357.txt (99 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIR4YGN2\load[1].gif (817 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\json2[1].js (7098 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IBPSKBRA\TCapIframeApi[1].js (73 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X66G0HIG\c_login_2[1].js (71284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X66G0HIG\ptui_ver[1].js (227 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\ptqrshow[1].png (446 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IBPSKBRA\cross_proxy[1].htm (223 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIR4YGN2\ptlogin_report[1].bmp (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X66G0HIG\TCapMsg[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\login[1].htm (4192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIR4YGN2\TCapIframe[1].js (4280 bytes)

Registry activity

The process %original file name%.exe:3856 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1453807450"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASAPI32]
"EnableFileTracing" = "0"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASMANCS]
"EnableFileTracing" = "0"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1916x902x32(BGR 0)" = "31,31,31,31"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 38 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7ACIT357.txt (99 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIR4YGN2\load[1].gif (817 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\json2[1].js (7098 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IBPSKBRA\TCapIframeApi[1].js (73 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X66G0HIG\c_login_2[1].js (71284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X66G0HIG\ptui_ver[1].js (227 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\ptqrshow[1].png (446 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IBPSKBRA\cross_proxy[1].htm (223 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIR4YGN2\ptlogin_report[1].bmp (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X66G0HIG\TCapMsg[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\login[1].htm (4192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIR4YGN2\TCapIframe[1].js (4280 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	817829	819200	4.53268	c7eb64bf80d586c0a987b95ca87b7c58
.rdata	823296	4198686	4202496	5.49182	be9d47591e791b77b41410de1bd8d750
.data	5025792	385524	110592	3.75254	52d4d7020bce69f76ddcce2667e0024e
.rsrc	5414912	31060	32768	3.45026	0049f8603512f68549550592eea10e12

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.hts88.com/Ã¦Å“â‚¬Ã¦â€“Â°Ã§â€°Ë†Ã¦Å“Â¬.txt	103.242.111.137
hxxp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&	103.7.30.66
hxxp://p21.tcdn.qq.com/ptlogin/v4/style/40/images/icon_3_tiny.png
hxxp://p21.tcdn.qq.com/ptlogin/ver/10191/js/c_login_2.js?max_age=604800&ptui_identifier=000D9288C52C261746D6A3CB229D592492596A2493DB595A7ABB516C
hxxp://ui.ptlogin2.qq.com/cross_proxy.html	103.7.30.66
hxxp://p21.tcdn.qq.com/ptlogin/v4/style/0/images/load.gif
hxxp://p21.tcdn.qq.com/ptlogin/v4/style/20/images/shouQ_v2/small_8.png
hxxp://a1574.b.akamai.net/ptqrshow?appid=21000124&e=2&l=M&s=3&d=72&v=4&t=0.5992096586091892&daid=8
hxxp://ui.ptlogin2.qq.com/ptui_ver.js?v=0.29195693338865&ptui_identifier=000D74716AFE765DD422E3A9AF7256D0174B34E79F5E56D5025B4481	103.7.30.66
hxxp://ui.ptlogin2.qq.com/cgi-bin/report?id=358342&t=0.12088238526976086	103.7.30.66
hxxp://captcha.qq.com/template/TCapIframeApi.js?aid=21000124&rand=0.8873663435230374&clientype=2&lang=2052&apptype=2	112.90.83.73
hxxp://log.ptlogin2.tencent-cloud.com/cgi-bin/ptlogin_report?id=294059&msg=Ã¨Â®Â¿Ã©â€”Â®uiÃ¥Â»Â¶Ã¦â€”Â¶Ã¨Â¶â€¦Ã¨Â¿â€¡5s:delay=12680;domContentLoadedEventEnd=1483697690498;navigationStart=1483697677818;clientip=;serverip=\|_\|http://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1%3Dhttp%3A//cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http%3A//cf.qq.com/clan-system/index.shtml&\|_\|Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)&v=0.8188962360270577
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697695696&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697698699&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://p21.tcdn.qq.com/2/json2.js
hxxp://p21.tcdn.qq.com/2/TCapMsg.js
hxxp://p21.tcdn.qq.com/2/TCapIframe.js?v=1.0
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697701710&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697704721&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697707731&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697710742&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697713753&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697716763&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697719774&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697722785&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697725796&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697728806&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697731817&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697734822&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697737831&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697740842&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://imgcache.qq.com/ptlogin/v4/style/40/images/icon_3_tiny.png	203.205.158.38
hxxp://ptlogin2.qq.com/ptqrshow?appid=21000124&e=2&l=M&s=3&d=72&v=4&t=0.5992096586091892&daid=8	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697719774&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697707731&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697716763&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697728806&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://captcha.gtimg.com/2/json2.js	203.205.158.37
hxxp://imgcache.qq.com/ptlogin/v4/style/20/images/shouQ_v2/small_8.png	203.205.158.38
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697698699&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://captcha.gtimg.com/2/TCapIframe.js?v=1.0	203.205.158.37
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697725796&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://imgcache.qq.com/ptlogin/v4/style/0/images/load.gif	203.205.158.38
hxxp://log.wtlogin.qq.com/cgi-bin/ptlogin_report?id=294059&msg=Ã¨Â®Â¿Ã©â€”Â®uiÃ¥Â»Â¶Ã¦â€”Â¶Ã¨Â¶â€¦Ã¨Â¿â€¡5s:delay=12680;domContentLoadedEventEnd=1483697690498;navigationStart=1483697677818;clientip=;serverip=\|_\|http://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1%3Dhttp%3A//cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http%3A//cf.qq.com/clan-system/index.shtml&\|_\|Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)&v=0.8188962360270577	183.61.38.241
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697710742&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697713753&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://captcha.gtimg.com/2/TCapMsg.js	203.205.158.37
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697704721&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697701710&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697737831&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697731817&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697695696&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697740842&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://imgcache.qq.com/ptlogin/ver/10191/js/c_login_2.js?max_age=604800&ptui_identifier=000D9288C52C261746D6A3CB229D592492596A2493DB595A7ABB516C	203.205.158.38
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697722785&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697734822&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /cgi-bin/report?id=358342&t=0.12088238526976086 HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ui.ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_user_id=18433456486385466354; login_param=qlogin_jumpname=jump&qlogin_param=u1%3Dhttp%3A//cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http%3A//cf.qq.com/clan-system/index.shtml&; ptui_identifier=000DF9BBF2BAC0007C39294D555E97DA34547B2DD5A6FBF5A2E8546E; pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Connection: keep-alive

Keep-Alive: timeout=50, max=1024

Server: QZHTTP-2.38.20

Date: Fri, 06 Jan 2017 10:14:48 GMT

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: image/bmp;

Content-Length: 66

BMB.......>...(...................................................HTTP/1.1 200 OK..Connection: keep-alive..Keep-Alive: timeout=50, max=1024..Server: QZHTTP-2.38.20..Date: Fri, 06 Jan 2017 10:14:48 GMT..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Content-Type: image/bmp;..Content-Length: 66..BMB.......>...(.....................................................

GET /ptqrshow?appid=21000124&e=2&l=M&s=3&d=72&v=4&t=0.5992096586091892&daid=8 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439

HTTP/1.1 200 OK

Server: tencent http server

Accept-Ranges: bytes

Pragma: No-cache

P3P: CP="CAO PSA OUR"

Content-Type: image/png

Content-Length: 446

Date: Fri, 06 Jan 2017 10:14:47 GMT

Connection: keep-alive

Set-Cookie: qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg; PATH=/; DOMAIN=ptlogin2.qq.com;

.PNG........IHDR...o...o.............pHYs................pIDAT8...=.. ...1.tz...A....... .q......q...I..../..S..q........H%...&"..e...N..............j.....]...-..E.?...H..\..W....(v.~5..<.Zu..J.Z..d....](......P..........]..c..@Z.T.S%'....C...[..|z..9d.|.U.I.|..s.%..i..s..qo^.J:...\.aT...P.[....4_=.!l..w..4....2[.I..K?.\%.@:n....Z..<=..M.K...@?..VY..0N..e.e..D#.S&.A.w...........LH1Q....F0*....X8.Q.-bO&..M...:q...#.&b.......4|]%..e....IEND.B`.HTTP/1.1 200 OK..Server: tencent http server..Accept-Ranges: bytes..Pragma: No-cache..P3P: CP="CAO PSA OUR"..Content-Type: image/png..Content-Length: 446..Date: Fri, 06 Jan 2017 10:14:47 GMT..Connection: keep-alive..Set-Cookie: qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg; PATH=/; DOMAIN=ptlogin2.qq.com;...PNG........IHDR...o...o.............pHYs................pIDAT8...=.. ...1.tz...A....... .q......q...I..../..S..q........H%...&"..e...N..............j.....]...-..E.?...H..\..W....(v.~5..<.Zu..J.Z..d....](......P..........]..c..@Z.T.S%'....C...[..|z..9d.|.U.I.|..s.%..i..s..qo^.J:...\.aT...P.[....4_=.!l..w..4....2[.I..K?.\%.@:n....Z..<=..M.K...@?..VY..0N..e.e..D#.S&.A.w...........LH1Q....F0*....X8.Q.-bO&..M...:q...#.&b.......4|]%..e....IEND.B`.....

<<< skipped >>>

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697695696&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 65

Date: Fri, 06 Jan 2017 10:14:51 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(321937164)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 65..Date: Fri, 06 Jan 2017 10:14:51 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(321937164)', '');......

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697698699&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:14:54 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(3553628376)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06 Jan 2017 10:14:54 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(3553628376)', '');......

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697701710&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:14:57 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(3804255596)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06 Jan 2017 10:14:57 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(3804255596)', '');......

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697704721&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:00 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(1914719180)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06 Jan 2017 10:15:00 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(1914719180)', '');......

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697707731&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:03 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(3469740448)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06 Jan 2017 10:15:03 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(3469740448)', '');......

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697710742&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:06 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(2657106368)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06 Jan 2017 10:15:06 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(2657106368)', '');......

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697713753&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 65

Date: Fri, 06 Jan 2017 10:15:09 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(254814440)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 65..Date: Fri, 06 Jan 2017 10:15:09 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(254814440)', '');......

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697716763&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:12 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(3331328724)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06 Jan 2017 10:15:12 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(3331328724)', '');......

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697719774&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:15 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(3683655188)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06 Jan 2017 10:15:15 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(3683655188)', '');......

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697722785&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:18 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(2530221588)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06 Jan 2017 10:15:18 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(2530221588)', '');......

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697725796&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:21 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(3438293024)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06 Jan 2017 10:15:21 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(3438293024)', '');......

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697728806&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:24 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(1391478524)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06 Jan 2017 10:15:24 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(1391478524)', '');......

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697731817&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:28 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(3048234764)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06 Jan 2017 10:15:28 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(3048234764)', '');......

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697734822&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:30 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(3833595396)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06 Jan 2017 10:15:30 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(3833595396)', '');......

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697737831&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:33 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(2257604764)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06 Jan 2017 10:15:33 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(2257604764)', '');......

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697740842&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:36 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(3958399348)', '');..HTTP/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cache-Control: no-cache; must-revalidate..Expires: -1..Content-Type: application/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06 Jan 2017 10:15:36 GMT..Connection: keep-alive..ptuiCB('66','0','','0','.....................(3958399348)', '');......

GET /cross_proxy.html HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ui.ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: QZHTTP-2.38.20

Connection: close

Date: Fri, 06 Jan 2017 10:14:48 GMT

Content-Length: 1001

Last-Modified: Mon, 01 Jun 2015 01:52:25 GMT

Content-Type: text/html

Content-Encoding: gzip

Cache-Control: public; max-age=86400

Expires: Sat, 07 Jan 2017 10:14:48 GMT

...........U[o.E.~.H........S.H.'.@.T.5mI]..:.xwlo..qgfc..R....-OE%B..<TH.VB..A......_`f.N.KA..3.|.;.9..c.J....%P...\.~.....Y.>:[@h...>~..|...3..p.......-]....h..j.Zv..MY..WP[q......c../|xnrb>..n..wN.....js.&.W....(t....5..h$H$..N.@.....i.....W.......}...hD Br..h.3..EJ.....BR..n.5..*.5.@.p.k....UBv.........Ys.u....D...8.E...f..b..(.\.)BZ....FA.Bk_.9.m.D...^..y.....KM5.<E.<F9_.......BFP.f.3i.....6-...l......w/.?....L.....{.l.....6~L~.L.....=..s......~6.~.../.......`D.L.a.....1...}.8u....i..21N...e...k..b....a.$.$....:!),..e...;../v_>....A.m......Cr.)h..g..W....?I.?......V.....7...d..:0..S;...MN...p.....'. ^.s.........m4i$S?..F..........j9o.iXR`...0>.....^H99.O%.J.g.....uRc.#L..0*..[.<....|...VR.....4.V..zF.....V.G.0T..6.x...-.....e..@....y;&.#..#l......Ys.Zr...z....7QF.4....L..B~...f,yp..[..Q..H...D.]W"J.u]T.FL..q..q..^.By...5n&.-......l....`W..t.X.|7....]Pn.i..Z..<..ri:[^......R.q,5[...*.v.x......A.....L"..C..H..,0.H.......0l...R..U.-..=..~.7..r.....3.....;.F!..........).6.._.....$.......

GET /ptui_ver.js?v=0.29195693338865&ptui_identifier=000D74716AFE765DD422E3A9AF7256D0174B34E79F5E56D5025B4481 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ui.ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: QZHTTP-2.38.20

Connection: close

Date: Fri, 06 Jan 2017 10:14:47 GMT

Content-Length: 177

Last-Modified: Tue, 03 Jan 2017 02:07:21 GMT

Content-Type: application/x-javascript

Content-Encoding: gzip

Cache-Control: public; max-age=86400

Expires: Sat, 07 Jan 2017 10:14:47 GMT

..........U....0.._Ev......2....neM..m.............>.Q.SR..KI.v.!.o..c..U...`xJ&D.4.s.R..G}.....n..$.r.0.5.h@iW.y..,.J....0z......s}.v.I~.8. ..6....w.3.Z..b...$.:...hL............

GET /2/json2.js HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: captcha.gtimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Date: Fri, 06 Jan 2017 10:14:54 GMT

Cache-Control: max-age=600

Expires: Fri, 06 Jan 2017 10:24:54 GMT

Last-Modified: Tue, 03 Jan 2017 07:41:37 GMT

Content-Type: application/x-javascript

Content-Length: 5426

Content-Encoding: gzip

Keep-Alive: timeout=60

X-Cache-Lookup: Hit From Disktank Gz

...........<ks.8... 0..PJdY.e27..|.....$N........@..Ej...........l';u....D.h4...fv.o....$~9.....h............fQ..w.J.....t,.....~:.&.........;q|">|.....wC...H...o._N...O........J.E.......f.....a.^.^f.E...x..".......I...L.U..A..{..J..:JnV*..u...Jf~.....&.....~..U..^.. ..........3....uvr....o.....`.........zw$......G'.?:9..........tvr....I.FJ........Q2.....dv......@.0...&. ./.y6.Y..oapC.d<.k.fJ../......Q.."..H_......o..Ec.w.....\.D....Y!.......T.4.7..x.u..H.y...7.R.&.A..9.....a..d.aV.5..B.......E=3.6..`A....'(b..!.c._$.....B..T..J.V>.....a<...8...X.6...`....T.......#Y.9<...\].b.FQ'4.1 ..h......LI..,B.....[..X.@.:.......!.s.R..v.... .....\..TTA..-zY./...7.=d..,.e.}.. nZ/....X..'2.P @.-.|.....Pb.&..'%$.#r.i...jZP..u.bG.X.P..".....XUg\'Op..(F....~l.#V..}.>. .;B..)..<.Jm. CqX.7O`.q.B..PF...1.5U .L....*...U..j......k..E...B.Wy.\.....~...L.(.m3..'UE...Pf-3b=.^*0PY.....:....1..Cmd.!.P...*.....Z....h(..EX.cc...8..(x..!.]..7k5..|S...l./n[....zq...vw...0%..]......J.fDJf9..yx.27....!b..bo$..7......x.u.}s......B._.../....i..._.o..w...u.~.]Z...b...S...~......O.[R....S...p.. .<....*...r.?.&....D.....A..B..\.e.3k....&U..V.n.... ..R.F...>T4.._....!.6.#...YB......b.L`..9f.\.;..2kh.....#.t..yu.G.........k..!.fXS.....5#..C.n....T.......f..a.=.. =AV..zV"l.C.f`......B.>........N.R...9,...!.B&.,...D?......H..8c...S...6..0t4....n..i.^..>.....n...]k7..9.Z...T`..F...g...7.....3.U.Z..-..M.m. .._.IKqs...'_r..t.s.r F.......$$.....cq. .........1.F:.:.ZA..r...;j..o4.VA1....MCIK0.wp.>..........[. .V..q.[.

<<< skipped >>>

GET /2/TCapIframe.js?v=1.0 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: captcha.gtimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Date: Fri, 06 Jan 2017 10:14:54 GMT

Cache-Control: max-age=600

Expires: Fri, 06 Jan 2017 10:24:54 GMT

Last-Modified: Tue, 03 Jan 2017 02:10:54 GMT

Content-Type: application/x-javascript

Content-Length: 3148

Content-Encoding: gzip

Keep-Alive: timeout=60

X-Cache-Lookup: Hit From Disktank Gz

...........Ym..... :N....H.}v. 7.MR...7.k..E.P.$!......%.... ...v.o.p'b.....g_x.....".Up(...W......Wc.......]x..}2..w..H..../l..C.{.o.].........=\~..sE.X.\...5.,K....x..Ro..P.<3...Kr6P....q....t..jq...K....u.8..E...X..?~y})n3..T.2....\.A.t...dq<.............bj...z.J.U.J...G.8.$...t....Lp ....'k..."MD...>Ij.9n.Z.. g.a..L'....4azF.p8...#<.....Mx.&.l..F....w.....8O..].?|HX9..X...i.p.q.kb...... ;zvv..#..........~g."1.../)].x......o.H$..L....L^....k.=..x/.z....sG^A...i..c....V...h..l...a.h...rv?.2.N.Wl..A..4.....{w...T 6..gR(..36V.ZI.n.q.$.H....i.....^Q...}.L.....G ..........!.....x=X...............r@... .....ox...x.._l..b......] ctB8...\.6.......q...m..|.v.....P.H.=x..O....K..p2G). .Fd.....a..!..B......x.F.Bq=#IxM....Zh.x.,......#8.m.\..[\..Y..C.w.ow. .g........>6.XC1....tn.x(...S{....6]....|..U .5..G/....}.....n..........7......^.K.....%..9.d..vZ.LR01:.*....^....z..?.y.7...7.@.?e._...@....DXM...4..q...x.6...@.5.....l...s8.u."8..>.............(.Lc.......!..........5....{...8O.<<..T.38...p..$=.... .......~I......1...IA4...Og.%...OK..K`.!.%..W...x. .Q.`I.....r> g....D..u...4TYV.N..Og.'x....y.|.p...[........j&>....R>J5........."..(..Ry.J....y.yd.S...,^....m..&.g..*...4l..K.-R1.5...f.aO..i..T..yE ........m...oI...K1 ....n......U`).J.@.f.#.'=..Y...vT.G.....&...qd$....02d.>.....!^.\.j......v....k).....h.V.W.<w).MJ ...\.;.V....q.3{.....F........57.]At.....F.....;.H.{..k-.....b....8GM.!.....M....>.3.(..........R..".... 'F....{..7.....Cx;..{..C/.&>z.E...N......0!.7L..l.._.$.....

<<< skipped >>>

GET /template/TCapIframeApi.js?aid=21000124&rand=0.8873663435230374&clientype=2&lang=2052&apptype=2 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: captcha.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: tencent http server

Accept-Ranges: bytes

Pragma: No-cache

P3P: CP=CAO PSA OUR

Content-Length: 2727

Connection: close

Content-Type: application/x-javascript

<<< skipped >>>

GET /cgi-bin/ptlogin_report?id=294059&msg=Ã¨Â®Â¿Ã©â€”Â®uiÃ¥Â»Â¶Ã¦â€”Â¶Ã¨Â¶â€¦Ã¨Â¿â€¡5s:delay=12680;domContentLoadedEventEnd=1483697690498;navigationStart=1483697677818;clientip=;serverip=|_|http://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1%3Dhttp%3A//cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http%3A//cf.qq.com/clan-system/index.shtml&|_|Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)&v=0.8188962360270577 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: log.wtlogin.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Connection: close

Server: QZHTTP-2.38.20

Date: Fri, 06 Jan 2017 10:14:51 GMT

Content-Type: image/bmp;

Content-Length: 66

BMB.......>...(.....................................................

GET /ptlogin/v4/style/20/images/shouQ_v2/small_8.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: imgcache.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Date: Fri, 06 Jan 2017 10:14:46 GMT

Cache-Control: max-age=259200

Expires: Mon, 09 Jan 2017 10:14:46 GMT

Last-Modified: Mon, 06 Jun 2016 09:14:56 GMT

Content-Type: image/png

Content-Length: 8566

Keep-Alive: timeout=60

Vary: Accept

X-Cache-Lookup: Hit From Disktank

.PNG........IHDR.............b.{X....gAMA......a.....sRGB.........PLTELiq....................................^^^............................................................zzzccc......................................................................................................................................................fff......7............................................................................................{yx...............ONP.........bba>>>&..$$(stsYXZ......mml...U..[.................ppp...v.....D.....z........k....K`>,......p[Q...Q. ...2........C.....Q..}..A........r....u.~...?......qr.l..=&......~eP>......=..,...ka....a@...[....q.......b.......<{...w.............~^...&m......O......,..O....`..H...ck{....|*.kZ......>...q9.PY.....B......*h~.Bq.J'yJC|...BY.kk...3....Gu.V...&...%.Y.....x...z...l[.&...8.......6....0tRNS..%....0.. I7U>..z.e....U.....\...xI.............?-.....IDATx...mL......1..(I.4.M.Vj.I~sv...g|G.........1..cc.Mx.v0.......b..4.....R..i...:.......)..-...E.v.....c'.a.ot._...>....p...m.J.r)..;.[..).y.HI^nV...G..wI.O..*."...Rp..e".......e...2..]Y;3.{..e...2,...rA..k.%..0. ..lr.r3Y...P.s /..de...d.).....%s...$..gg..........w.I..wd....-....Z...B.......-.....F..p......C....~..`(...B......;.......lW......q.b0......CC...p(..W...&..-...D<..`4..x...C.^......F.....p....c.cC..1...p.......#....b...P..k>|h...b...%...E{4@.P.....'h.D...#j.2R..t.5.{.6.....&. ..@`)...I. .D....]......x..uW,..J.~p.x=.$.^.D...U{=.E/.........]....I.......c5.......c$..=..v........v4

<<< skipped >>>

GET /cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ui.ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Connection: keep-alive

Keep-Alive: timeout=50, max=1024

Server: QZHTTP-2.38.20

Date: Fri, 06 Jan 2017 10:14:33 GMT

P3P: CP="CAO PSA OUR"

Cache-Control: max-age=86400

Set-Cookie: pt_user_id=18433456486385466354; EXPIRES=Mon, 04-Jan-2027 10:14:33 GMT; PATH=/; DOMAIN=ui.ptlogin2.qq.com;

Set-Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; PATH=/; DOMAIN=ptlogin2.qq.com;

Set-Cookie: pt_clientip=7accc2f260e2f09b; PATH=/; DOMAIN=ptlogin2.qq.com;

Set-Cookie: pt_serverip=1e2b0ac5019a3062; PATH=/; DOMAIN=ptlogin2.qq.com;

Set-Cookie: login_param=qlogin_jumpname=jump&qlogin_param=u1%3Dhttp%3A//cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http%3A//cf.qq.com/clan-system/index.shtml&; PATH=/; DOMAIN=ui.ptlogin2.qq.com;

Set-Cookie: uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; PATH=/; DOMAIN=ptlogin2.qq.com;

Set-Cookie: ptui_identifier=000DF9BBF2BAC0007C39294D555E97DA34547B2DD5A6FBF5A2E8546E; PATH=/; DOMAIN=ui.ptlogin2.qq.com;

Last-Modified: Thu, 08 Mar 2012 02:04:00 GMT

Content-Encoding: gzip

Content-Type: text/html

Content-Length: 9990

...........]{s........M.b...G..G.m..S$.......Z3=R...x.G....IH0..l.%.]B..v..!....aV3...W..9....#.XJvc....8......=....N....N[.a.c=.....=e..b.......s .?>r...Z.B.:7pz..z~......i[.z..k....fa.Z..k.s..^...TY^.C.f.........n...3Z)/....T.uZ...n.....w/....}...n/........wu;t/.Ej}.j.;......._....As...e.......LMooz...Y.{.`....M/......g`....f.....P.B...~..<....B.t.....~...;... 6...*.........a....b.MQX..T'.......1...........l..fO....k.-.;.>{...1".....m<k..._W....9.......0p.'.Pez.Q...zx..Z...le~.h7X....c.Q`..7.p..............i..l..O....u...s........A8.o........s..}...w.......OG..jt........e;.B..Vf..?........4....|y..eU..m.N...,.....7..v.....R)...7.....?.\...L..{...D.. .n].2~.?0.t;....'......>...O....h......`}<..K.w~.w.W...7..^}_....oF.....|.?...s~.....m..@......_.s..~..3b$..\...U..1...z....83..@../_.....W~...vv@.B?.z...1.t....X=q.b....lK.......[A.v....^,.$.v.BsqK.a...v.=...2...........f.d.B...v...;.Yv...41Y...,.F.e..n;.........z!..9..0.H. x.h..QfN.B..F[]...t..B.....G.h.0D.1.....;....d..x.-.<.....~.k.].\*....z.r....a.Q.{........5.v..A_x}... .....Td....R....f@|......h^.......G.......?.e..%F.t...R.J.n...p...gJv.j...du!.3.h....T....<^@...V...l......V... .k.eJ...gp3.`...oJ..... .f._.....u ....(........[...zO...@`........t.9..R#.......tQ ....i.J.....j....\.{.RE%...63...4...;....&..*..F...$T.....=.........C.-nX.76........f..TZ.../..8sz~nvee.R9]=.x..|evn.T..9Y.9=.xf.4.gK...33.@..3^.4#....d./J..8S....Ho.Ln[..6.-);.*.~k 7.lwA..ri.......`....r{;Tj...'.v.^g...v6..k:9g.9....k{._....o}...........v?......g.Z......z.u.q

<<< skipped >>>

GET /2/TCapMsg.js HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: captcha.gtimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Date: Fri, 06 Jan 2017 10:14:54 GMT

Cache-Control: max-age=600

Expires: Fri, 06 Jan 2017 10:24:54 GMT

Last-Modified: Tue, 03 Jan 2017 07:41:37 GMT

Content-Type: application/x-javascript

Content-Length: 636

Content-Encoding: gzip

Keep-Alive: timeout=60

X-Cache-Lookup: Hit From Disktank Gz

..........}S]o.0.. ..*X......-.L..i.&MQ49`.7bg......^0.N.....s|.......!."..j#....*..*...nPF...>c...o.._ ..P........I..#.9B.]T$..s.1.u..f.......\s.1.....pH...z..%W.R| .7...k............B....F...z.G...A(..m..{..ZL...wN...:#..-...#.......=p.q....(q@l..V..iSO@.2......M...;...xR.HE.i..o...."..w8.}..3.~ ........N.ev5W."....#..`Q.xh..:..(T..v...h...Hi.*QK.3.Z....hO.....mr..J....F. .Q.....f.4.ZF.....2.d.J..#....2....G2k..w.....5....=.y^..g!...%^..l...[................y.tA?..:....D.. 0kp.,V.B...,.bh.=@.}.....t9.3.&_....v.z......91.;..f.......k.B5.`.y....S..3.......m........s..T.........Hr2.&..g..,m..?..F..q..:..2_.t..M.#.....8..3I.RL....HTTP/1.1 200 OK..Server: X2S_Platform..Connection: keep-alive..Date: Fri, 06 Jan 2017 10:14:54 GMT..Cache-Control: max-age=600..Expires: Fri, 06 Jan 2017 10:24:54 GMT..Last-Modified: Tue, 03 Jan 2017 07:41:37 GMT..Content-Type: application/x-javascript..Content-Length: 636..Content-Encoding: gzip..Keep-Alive: timeout=60 ..X-Cache-Lookup: Hit From Disktank Gz............}S]o.0.. ..*X......-.L..i.&MQ49`.7bg......^0.N.....s|.......!."..j#....*..*...nPF...>c...o.._ ..P........I..#.9B.]T$..s.1.u..f.......\s.1.....pH...z..%W.R| .7...k............B....F...z.G...A(..m..{..ZL...wN...:#..-...#.......=p.q....(q@l..V..iSO@.2......M...;...xR.HE.i..o...."..w8.}..3.~ ........N.ev5W."....#..`Q.xh..:..(T..v...h...Hi.*QK.3.Z....hO.....mr..J....F. .Q.....f.4.ZF.....2.d.J..#....2....G2k..w.....5....=.y^..g!...%^..l...[................y.tA?..:....D.. 0kp.,V.B...,.bh.=@.}.....t9.3.&_....v.z......91.;..f

<<< skipped >>>

GET /Ã¦Å“â‚¬Ã¦â€“Â°Ã§â€°Ë†Ã¦Å“Â¬.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: VVV.hts88.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/plain

Last-Modified: Fri, 09 Dec 2016 00:19:05 GMT

Accept-Ranges: bytes

ETag: "501f24dab151d21:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 06 Jan 2017 08:39:19 GMT

Content-Length: 3

3.2HTTP/1.1 200 OK..Content-Type: text/plain..Last-Modified: Fri, 09 Dec 2016 00:19:05 GMT..Accept-Ranges: bytes..ETag: "501f24dab151d21:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Fri, 06 Jan 2017 08:39:19 GMT..Content-Length: 3..3.2..

GET /ptlogin/v4/style/40/images/icon_3_tiny.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: imgcache.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Date: Fri, 06 Jan 2017 10:14:44 GMT

Cache-Control: max-age=259200

Expires: Mon, 09 Jan 2017 10:14:44 GMT

Last-Modified: Wed, 18 May 2016 07:00:15 GMT

Content-Type: image/png

Content-Length: 10711

Keep-Alive: timeout=60

Vary: Accept

X-Cache-Lookup: Hit From Disktank

.PNG........IHDR.............D.Q.....PLTE.....................r..q..r....................342JOE.......-..*..*..&..$.....%..&.|.........Y........$..$.. .. .....%..%..'.................$......................................................W..........................e............../n.%...../l.$.......................}../..}../...<..u.)u.)......[..B...................................t.(...x.)}. ......!.(.................-.. ../..................r....#n.....k...........A.....Z....#..!u..w..{..~....%...................................}../........%.......*...B%"-........"z....0.....A.#..........**6....&....9:I......12AN....%.................................BDW.....b.....z.....Njlp..............3...= ....TV`..........;5......R3 .=...S.qri.....wP.z|........C,.tr.....9....J*....g..s.....:'.|..TH....i.sEJ..........ltRNS.n2I..,.2.....&.......)....}..C.'#..WA<l`6..iO.L..v.=RV.....^....3........3......SVX.dqT.~..........H.............&.IDATx....j"Q....0.h5..4..$w.:..$..I#.H!.$..n`....*..^Q..6{...h>.k....8.../........C.9...92.G..y.......3,.HB....$.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I...0k.0.}F.J..mA{.C0i....$i.I.<.A.E.fp..h.(.H......j..51W...Dps..X..^.........U..JZ..Kk.a.....d5IfY.$K.:IHB.....$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$b.I.S.....Nn.V..*Y.*.|..Z%....kR...4,.S`..A..'.'...........T.<7.sq.....K......gD...p......l..[......../Q.;..gf....b..}...>$.v..^mU.)2..[d.I..t.nw.8...$....?&I.#.I.GV%q.gc5..z......y..$."[$.....H....&....}dSw.sdSI..c#....$...M....z.A..N2...#...&..,$.j.$.w

<<< skipped >>>

GET /ptlogin/ver/10191/js/c_login_2.js?max_age=604800&ptui_identifier=000D9288C52C261746D6A3CB229D592492596A2493DB595A7ABB516C HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: imgcache.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Date: Fri, 06 Jan 2017 10:14:45 GMT

Cache-Control: max-age=604800

Expires: Fri, 13 Jan 2017 10:14:45 GMT

Last-Modified: Tue, 03 Jan 2017 02:17:58 GMT

Content-Type: application/x-javascript

Content-Length: 33966

Content-Encoding: gzip

Keep-Alive: timeout=60

X-Cache-Lookup: Hit From Disktank Gz

...............Hr ....U...P.Y..7.E..L.v.tw...nu..H&..M.l....".$....$.........N...g.}.Ow.I.c.......#".@....G...M............9].......ly..w..Q.ko....GQ0....n0_.X..8...U.....'O.R.U[..x|....z...k...![.a\.X|.`l.4..X.U.u..h2...3..U.]..s.......9S5M...Ip..1&X..T.......A/.\7..Z.....i...7|3.0..;j.3....K..#j....&u..:.^....(.;...5=..>vg36.vC....).....^6d./dc..%....4.i.Q...}*b.....M.p..oB.R..$%:...,.UO.5. .6u..X....p.......b...S.o...t......].....\.J.....8q........k...w.DN...=..T.........g.y..V.k..8..?.{..2:W..|/.}w.z@WqX_...q...#p..q.......,b....*.@.V.@_b.B.?........3|.HH@P....!et.........km.E....G^...u.H.-......zl...(..'.Q.d..E.]oF.#Go..g|$............1..k.....A..uy<.}...7aDFZ?...~...;..........;.3i..:..$....8X..4.<Y....c.....eo...u.A.|$....eC....E.G.8.R...{....q..1.y.{1.i.....nj.G....q.e...g..\..._.....h..*...V....&......c?ba P..mZ.V.Ns_..k/~w../x*..;;.4hg.".a'?..\U`.x.L).>.x%.C.s)[i..,K@5...i.h9.{.....!s.$c.f@].r}}.F.....n~...kE..F...[.v....&.m..KZD.4...!D.Z...ai..I..rR....S.feJ..F.F....8^.q1>.....v]NA](P..7..EOo....$....1..q.n.......0..j..,...Q...%.Ec..Jn^...\N..a|.z'...r.^.3....|..U)..b...VO....A.....4I.....so..*.@..:J%..f.F3.....T.a..j..g..hu...C.....LfH.i:.....<d...a.M..T..A.Y#...-..E.#gW..r..P0..j7.C7..-.i.p~.N..........._$........O....*./o...E...ywD#..........B.$oE.Ui..`dz9..%.-.....*.f...].;.0.......x..<....... .... |..W......8.[. d.!.CZnm."|q7G.$..9....X.nZJ..MS....Rb...BX.C..".&...d...}.Bo....<MU<....(.)..d..E:v*...T ..94vr|"...Q.. w.M..VG..<f....1;))D..b...o/z...p..p.,.P. !........

<<< skipped >>>

GET /ptlogin/v4/style/0/images/load.gif HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: imgcache.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Date: Fri, 06 Jan 2017 10:14:46 GMT

Cache-Control: max-age=2592000

Expires: Sun, 05 Feb 2017 10:14:46 GMT

Last-Modified: Mon, 16 Mar 2015 08:46:52 GMT

Content-Type: image/gif

Content-Length: 817

Keep-Alive: timeout=60

X-Cache-Lookup: Hit From Disktank

GIF89a.....................................wul..y............!..NETSCAPE2.0.....!.......,..........O.......{....Y..`....I.D8.. S.....(.......D..(.I~.. .H`....Z.f....k.N..q...;'.L..!.......,..........N.......{..@.1....Q]AiN.:..)S.T...,........b....$?...Q(0.).j.f....{....n.-~N....!.......,..........M.........,Eeu......%5..E...f3. ......g(..<...L...D".X`.RJ.J.N..........9...=..!.......,..........N...J..Z.'B. ..q`.....P)8./,S&.$.$.......y....D...."..`.R.ak.b.........m..^S....!.......,..........M......Z.gJ.....}.H..I...b$.(.t..}.......~9..@Y,2..........i00......|......t;..!.......,..........M...R..Z..R.. ..}.H..I.l....t.P0....B....v>.CG1.2...i.P....J.0.R-.....J....t;..!.......,..........M......Z..Z..$..}.H..I.l...at..0..........8..B d..L.I.B)...q80...&..t.......3..;/* |xGv00|a0977a7e1f04529fe4ad7ac9aebd6177 */HTTP/1.1 200 OK..Server: X2S_Platform..Connection: keep-alive..Date: Fri, 06 Jan 2017 10:14:46 GMT..Cache-Control: max-age=2592000..Expires: Sun, 05 Feb 2017 10:14:46 GMT..Last-Modified: Mon, 16 Mar 2015 08:46:52 GMT..Content-Type: image/gif..Content-Length: 817..Keep-Alive: timeout=60 ..X-Cache-Lookup: Hit From Disktank..GIF89a.....................................wul..y............!..NETSCAPE2.0.....!.......,..........O.......{....Y..`....I.D8.. S.....(.......D..(.I~.. .H`....Z.f....k.N..q...;'.L..!.......,..........N.......{..@.1....Q]AiN.:..)S.T...,........b....$?...Q(0.).j.f....{....n.-~N....!.......,..........M.........,Eeu......%5..E...f3. ......g(..<...L...D".X`.RJ.J.N..........9...=..!.......,

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_3856:

.text

`.rdata

@.data

.rsrc

t$(SSh

~%UVW

u$SShe

Hw2.Hw

kernel32.dll

ole32.dll

wininet.dll

MsgWaitForMultipleObjects

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

1%SqlnD

U[5%u

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

hXXp://VVV.hts88.com/Ã¦Å“â‚¬Ã¦â€“Â°Ã§â€°Ë†Ã¦Å“Â¬.txt

hXXp://VVV.hts88.com

hXXp://VVV.cf23.pw/?action=loginok

&submit1= &is_cs=0&is_get=1&show_msg=&jz=0&no_new=0

&logpassword=

hXXp://VVV.htsqq.com/cpa

@qq.com

&cardpwd[]=

&cardnum[]=

&cardquantity=1&cardvalue[]=

hXXp://VVV.520faka.com/product/req.php

WinHttp.WinHttpRequest.5.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Content-Type: application/x-www-form-urlencoded

.html

C:\cf

D:\cf

E:\cf

F:\cf

VVV.hts88.com

hXXp://wpa.qq.com/msgrd?v=3&uin=895585828&site=qq&menu=yes

hXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?>

}.IH_

&%SWl

, #&')*)

-0-(0%()(

j%.Usl6

(7),01444

'9=82<.342>

JO.NO

K'%sS

.omo.\

1.eob

FTp0z

g.zc8

}YF*.RzB;

wZ7%f

.GR)9r

Sn-5}

Zi]%ue{

H.lo4

;.kE9

o5}.ssH

eA.me

^h7{%u

)].iT

" id="W5M0MpCehiHzreSzNTczkc9d"?>

ohXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?>

.vtW4

.gJ_}

K[M.yLV

c?z-v}

3I!9.rrs

,.RI5 -i

I:\;'C

.tWe)#a-k9

O$.UZs

H=`%s

.tA?8

@0@@ 0```@

{.mz9n

t].bE

1`%Ss&,

Q.wuy%

),($ !$%$

. &.#&'&

.gSkZOKX

3.RY<:s>

s.Wl

d.rswo^

m.HrCl

:%ss)

e-.KY

M%s xN

.ZQ6\

&4'*./121

%6:60:,010

.RS$0

M.Re.

.Or?0

@%uQ'

s.LM:

"]=.Jc

%fP[u

o%%S-,

%UxUt

u%X]

.mkNn]3R

%UEQX

$lrs

'P.EK

%2%(,-/0/

#484.7*./.

!9W%8sE

!%0)!#-$

*9*-13666 (;?:4>0563

#'2*#%/%

#0$&* -.-

"251,5(,-,

z=%uh

,%FYq3

wh.WP

Im%DT

Q6.ZE

lK.eJ

>F.VX

H@|T%c

E%StM

iÃ—i

-9}{ 2G

{[%x7rA

dV.IF8

; Ã€}

.bA\U;Z

@.Ay$

4.AbA

P(7p7p7p7p4[G.kpv

#S.fA$

"b%XX{

" id="W5M0MpCehiHzreSzNTczkc9d"?>

o>.KIh

" id="W5M0MpCehiHzreSzNTczkc9d"?>

Sp.Qi

" id="W5M0MpCehiHzreSzNTczkc9d"?>

Dt%U&

jW%Uo

" id="W5M0MpCehiHzreSzNTczkc9d"?>

.zh/I

.Ib_U

z:\mm

" id="W5M0MpCehiHzreSzNTczkc9d"?>

bCjK%C

X,x%u4

" id="W5M0MpCehiHzreSzNTczkc9d"?>

R:\UnO

" id="W5M0MpCehiHzreSzNTczkc9d"?>

V.Is"

" id="W5M0MpCehiHzreSzNTczkc9d"?>

k.Iu4

Gi,%D

6?.qe

.bt.P

" id="W5M0MpCehiHzreSzNTczkc9d"?>

.mQ^%

" id="W5M0MpCehiHzreSzNTczkc9d"?>

}35.RBRT

8EI%D

$(4,$&1'

hXXp://ptlogin2.qq.com/getface?appid=1006102&imgtype=3&encrytype=0&devtype=0&keytpye=0&uin=

hXXp://q4.qlogo.cn/g?b=qq&k=

VVV.hts88.com

ip.qq.com

hXXp://VVV.cf23.pw/reg.asp?action=regok

&regpassword2=

&regpassword=

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

https

HTTP/1.1

hXXps://

hXXp://

hXXp://VVV.waqiang.com/index.php/url/shorten

(*^__^*)

\SkinH_EL.dll

hXXp://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?url=http://VVV.hts88.com/&showcount=1&desc=&summary=&title=&site=&pics=&style=101&width=199&height=30&otype=share

.UL?6>RF:

s_=%f

2'%c`rx

O8$.GJ

.yFJS

K.pxR;

Me-5}

W.tgSuR

ro .Nu

.kE'v

R:i.IGGQm&

-.oY"

%X]js

0.fmYu

.owWf

[t.UF

6.xzr

b[q\.YC

Gsj.cmBq

{-.ZjFu

o.onu

?x.FH#?%>!

-e.xi

m,l>.XZ

z.JU'N

#Rz.iAJZ:

).iiy

.oK=n

KXm%s

5m.kY

x.oii'

%yEs.ID

h8q.wJ

.Kmm;

Nm{%S

.ogxm

.XJZ{

3W%ur

.no{o

n.NNJ6

5.iJ{|M

6..lb

.DS0Ãž

-.ui'{

].Dr|{

g5u%x

\],%uR

.ZQn2i7

%~W.mV

NM]%u

E.Wy^

l-n.RM.

~weBXw^

C&vI1O%c,

J.RPs

0{c(%D

c.Sh'

NSNT/%f

.eYet

.XM"e

.mak_

AbÅ¸

s5x.eh

%.nU{

9MB.pm

i.iEAs7)

.gyI'd

WI.kZ);s?

.kME8o

)J.qrp

%XI7d

%HZ.SN

#w).Ut

.Lmok

mdV%F

t!'%5x

%ui[O6

N*umSG

H.cSm

lV.JT

.Ex9r

NI.mZK\

k.XBRs{

-c}:c

]&.XK

axabÃ¾

g8Bu9g.HJr

m.Get

%c!P$"\md

%.jzFN

=Ik.Zqu

"ZY'%f

j-.ey6

7.YKF

M%.ev

k"OxZ%xM

g.YII

rah.QP

#.gm

.DFO8l:Bp

6u%x.X^

g.zoGih

m%.ov

E.WqEe

.Wy^

.RK}Z

.RvzE-]

QKEY

UB#R..QwQW

zxL.gB

i.dqN

MbU%FV

.Eniu

y.eyf

_m7.Uev

ay.oq

-ory}

KI.gkh

hF77.YL@6

K^SQL38:

.fcn/

;Xp>tp%x'

H@%ut

C8tCp

"TJQ!R.Hp

M:\

hf%ClR

%F |*

S0%S)

[@?A5&nT2

SQlZ

fm%C,

%sXZg

^>cm%DQ

%fmb4

%sB&u

r =url":*j

4p.tU

{%xP2

yX8

d.eRm

Y"?z%fxr?

?5.oL

%c;pb

.bS~C

&s-9s6}

Q!5R%uR)

"8uK#g.sR

c.riI

g, .CO7

XFq%.X

KM.Nx

7XA%D

rxI.Ef[

I.lYI

-4I.lB

Ã‘DWZ

T 0%X

5G%qB%C#S

`EZTA%XAX

2 U%X\

e.xD6Xu/

wEBR3`

@C.Qs

vow.ww

tL%uTI

%ur'q

8.CMo

Â61

cr%cMo

-mM7i}

Im%Cl

.fn[j

.RC}E

%<.sva1>

7T5%f

.TC^S

iurl

KEY?r_

d-%x8

$.cE8

!.LWqJw

&BX.BPm

<.nld>

D.rXH

920707683

$8!%.fF_a

.EZCif`

je%N.Rz#j4'

Tn'i%s

N.svH

|Ng%S

`3<.of>

j.uMB

I%d~5)Jrr

o.YAN

hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

895585828

hXXp://VVV.hts88.com/jiaocheng/shuad

hXXp://VVV.hts88.com/jiaocheng/jihuo

%d&&'

123456789

00003333

1.2.18

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

MSWHEEL_ROLLMSG

__MSVCRT_HEAP_SELECT

Broken pipe

Inappropriate I/O control operation

Operation not permitted

user32.dll

F%D,3

iphlpapi.dll

SHLWAPI.dll

MPR.dll

WINMM.dll

WS2_32.dll

VERSION.dll

RASAPI32.dll

AVIFIL32.dll

GetProcessHeap

WinExec

GetCPInfo

KERNEL32.dll

GetKeyState

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

GetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

WINSPOOL.DRV

comdlg32.dll

RegCloseKey

RegOpenKeyExA

RegCreateKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

OLEAUT32.dll

oledlg.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

WSOCK32.dll

.PAVCException@@

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

1.1.3

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) CometHTTP

1.1.4

(*.htm;*.html)|*.htm;*.html

VVV.dywt.com.cn

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

(*.avi)|*.avi

WPFT532.CNV

WPFT632.CNV

EXCEL32.CNV

write32.wpc

Windows Write

mswrd632.wpc

Word for Windows 6.0

wword5.cnv

Word for Windows 5.0

mswrd832.cnv

mswrd632.cnv

Word 6.0/95 for Windows & Macintosh

html32.cnv

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

zcÃ

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

1, 0, 6, 6

- Skin.dll

(*.*)

1.0.0.0

%original file name%.exe_3856_rwx_10028000_00015000:

Gw2.Hw

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ã

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0