Trojan.Generic.14779139_33f8635d02 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:172

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:172 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\login[1].js (6473 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\base[1].css (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\desktopcallback[1].htm (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\um[1].js (2251 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\CAIZGTIR.json (174 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\CA9CR6JN.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\visitor[1].htm (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\suda[2].js (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\bilogin[2].js (7649 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\mlog[2].js (3114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\suda[1].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\desktopcallback449a71c2[1] (400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\CAE7WXAZ.js (9663 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\mlog[1].js (2631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\bilogin[3].js (8110 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\prelogin[1].htm (441 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (6752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\form_login[1].gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\aplus_v2[1].js (5051 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\um[2].js (2464 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\login[1].htm (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\form_login[1].gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\seed-min[1].js (7261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\layer_bg[1].png (978 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\localstorage[1].xml (182 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\loginad[1].htm (491 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\login[1].css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\bilogin[1].js (11162 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@weibo[1].txt (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\wbad[1].js (6 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@member[1].txt (441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\frame[1].css (4420 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\qrcode_map[1].jpg (2230 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\icon[1].gif (2130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\frame[1].css (3729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\900x200_img55c5e49193d0e[1].png (5578 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sina.com[1].txt (195 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\main_bg[1].png (991 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\wbad[1].js (15 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@taobao[1].txt (183 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\bg_reg[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\CAKDQRGT.js (14065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\plugin_proxy[1].htm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\550x270_img52d7729699612[1].png (5888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\bilogin[1].js (7852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\login_ad_default[1].jpg (3668 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\um[1].xml (674 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\bg_repeat_reg[1].png (638 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\register[2].css (26 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\localstorage[1].xml (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\footer_top_bg[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@weibo[2].txt (407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\seed-min[1].js (8580 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\js[2].js (1921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\fp[1].swf (2799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\plugin_proxy[1].html (721 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\js[1].js (849 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\bilogin[4].js (9338 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\CAQ7GBO3.js (19741 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ynuf.alipay[1].txt (423 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\CAWNMURE.HTM (2096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\register[1].css (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\login[2].css (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\login_vline[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\logo[1].png (671 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\CAGXE34D.js (7440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\form_login[2].gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\btn[1].png (1685 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\loading_big[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\ico_warn[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\prelogin[1].htm (441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\aplus_v2[2].js (4622 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\bilogin[1].js (6772 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\loading[1].gif (1181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\base[1].css (1713 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\ico-taobao[1].png (1121 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\1.4[1].js (3506 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\login[2].js (6884 bytes)
C:\dc.dll (122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\1.4[2].js (2253 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\bilogin[2].js (9316 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\aplus_v2[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\login[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\base[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\js[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\seed-min[1].js (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\register[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\login[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\bilogin[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@weibo[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\wbad[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\frame[1].css (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\localstorage[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\suda[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\bilogin[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\desktopcallback449a71c2[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040820140409\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\1.4[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\CAE7WXAZ.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\mlog[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\bilogin[3].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\CAKDQRGT.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040820140409 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\um[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\plugin_proxy[1].html (0 bytes)

Registry activity

The process %original file name%.exe:172 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1916x902x32(BGR 0)" = "31,31,31,31"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015081120150812]
"CachePrefix" = ":2015081120150812:"
"CacheLimit" = "8192"
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1432461039"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015081120150812]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012015081120150812\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B CF 82 AB D4 E0 FB 0D 8E 71 60 C7 5F 27 CF 4E"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.2345.com/?kweige"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015081120150812]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014040820140409]
[HKLM\SOFTWARE\Microsoft\Code Store Database\NT5LockDownTest]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
f803ad370a8649a143429f179af5f3ab	c:\dc.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\login[1].js (6473 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\base[1].css (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\desktopcallback[1].htm (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\um[1].js (2251 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\CAIZGTIR.json (174 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\CA9CR6JN.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\visitor[1].htm (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\suda[2].js (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\bilogin[2].js (7649 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[2].txt (372 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\mlog[2].js (3114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\suda[1].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\desktopcallback449a71c2[1] (400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\CAE7WXAZ.js (9663 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\mlog[1].js (2631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\bilogin[3].js (8110 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\prelogin[1].htm (441 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (6752 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\form_login[1].gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\aplus_v2[1].js (5051 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\um[2].js (2464 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\login[1].htm (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\form_login[1].gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\seed-min[1].js (7261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\layer_bg[1].png (978 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\localstorage[1].xml (182 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\loginad[1].htm (491 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\login[1].css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\bilogin[1].js (11162 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@weibo[1].txt (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\wbad[1].js (6 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (170 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@member[1].txt (441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\frame[1].css (4420 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\qrcode_map[1].jpg (2230 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\icon[1].gif (2130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\frame[1].css (3729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\900x200_img55c5e49193d0e[1].png (5578 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sina.com[1].txt (195 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\main_bg[1].png (991 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\wbad[1].js (15 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@taobao[1].txt (183 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\bg_reg[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\CAKDQRGT.js (14065 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\plugin_proxy[1].htm (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\550x270_img52d7729699612[1].png (5888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\bilogin[1].js (7852 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\login_ad_default[1].jpg (3668 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\um[1].xml (674 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\bg_repeat_reg[1].png (638 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\register[2].css (26 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\localstorage[1].xml (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\footer_top_bg[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@weibo[2].txt (407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\seed-min[1].js (8580 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\js[2].js (1921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\fp[1].swf (2799 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\plugin_proxy[1].html (721 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\js[1].js (849 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\bilogin[4].js (9338 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\CAQ7GBO3.js (19741 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ynuf.alipay[1].txt (423 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\CAWNMURE.HTM (2096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\register[1].css (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\login[2].css (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\login_vline[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\logo[1].png (671 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\CAGXE34D.js (7440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\form_login[2].gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\btn[1].png (1685 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\loading_big[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IXUR236N\ico_warn[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\prelogin[1].htm (441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\aplus_v2[2].js (4622 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\bilogin[1].js (6772 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\loading[1].gif (1181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\base[1].css (1713 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPK1O3W1\ico-taobao[1].png (1121 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\1.4[1].js (3506 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\login[2].js (6884 bytes)
C:\dc.dll (122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C5I7WLYR\1.4[2].js (2253 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6563MZQ3\bilogin[2].js (9316 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: Language Neutral

Company Name: Product Name: ?????Product Version: 1.0.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ?????Comments: ??????????(http://www.eyuyan.com)Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1109411	1110016	4.43586	30e8af9e2059282fca5da9cb1b8abea6
.rdata	1114112	733700	737280	3.92322	0cc72175dc2b82abc4a0546ac0a9f943
.data	1851392	331562	81920	3.62414	19dd7ec902e4cd253512b09cbf8c0410
.rsrc	2183168	22788	24576	3.29193	a433b679132fa519c16a52cbda02a8a0

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/css/pages/register/register.css?version=201508111231
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/css/module/base/frame.css?version=201508111231
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/css/patch/register/login.css?version=201508111231
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/images/register/qrcode_map.jpg?version=201508111231
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/images/register/bg_repeat_reg.png?id=1370232467958
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/images/register/bg_reg.png?id=1370232467958
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/images/register/main_bg.png?id=1370232467959
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/images/register/login_vline.png?id=1370232467959
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/images/register/form_login.gif?id=1370232467958
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/images/common/layer_bg.png?id=1370232467958
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/images/register/login_ad_default.jpg?id=1370232467958
hxxp://weibo.grid.sinaedge.com/uve/uveimage/550x270_img52d7729699612.png
hxxp://180.149.134.141/
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/images/register/loading_big.gif?id=1370232467958
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/images/register/logo.png?id=1395992130776
hxxp://security.weibo.com/visitor/visitor?entry=miniblog&a=enter&url=http://weibo.com/&domain=.weibo.com&ua=php-sso_sdk_client-0.6.11&_rand=1439267490.101
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/images/register/footer_top_bg.jpg?id=1370232467958
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/images/register/form_login.gif?id=1370232467959
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/register/js/page/login/bilogin.js?version=201508111231
hxxp://sinajs.xdwscache.glb0.lxdns.com/open/analytics/js/suda.js?version=201508111231
hxxp://sinajs.xdwscache.glb0.lxdns.com/t4/apps/publicity/static/wbad.js?version=201508111231
hxxp://login.sina.com.cn/sso/prelogin.php?entry=weibo&callback=sinaSSOController.preloginCallBack&su=&rsakt=mod&client=ssologin.js(v1.4.18)&_=1439267453914	203.90.242.124
hxxp://login.sina.com.cn/plugin_proxy.html?proxy=hxxp://weibo.com/sso/desktopcallback&type=userinfo&callback=SINA_USER_PLUGIN.callbacks.callback_14f1b067bea	203.90.242.124
hxxp://origin.activex.microsoft.com.akadns.net/objects/ocget.dll
hxxp://wbpctips.mobile.sina.cn/adfront/loginad.php?posid=pos528d79d0cbc47&psid=PDPS000000025446&wbVersion=v5&cip=194.242.96.226&cursor=NaN&eData=6.78,1&callback=wbad_14392865166491&rnd=14392914494782	123.125.22.223
hxxp://origin.activex.microsoft.com.akadns.net/isapi/ocget.dll
hxxp://weibo.grid.sinaedge.com/t5/register/js/page/login/bilogin.js?version=201508111231
hxxp://weibo.grid.sinaedge.com/public/files/image/900x200_img55c5e49193d0e.png
hxxp://beacon.sina.com.cn/a.gif?V=2.2.3&CI=sz:1916x902\|dp:32\|ac:Mozilla\|an:MSIE\|cpu:x86\|pf:Win32\|jv:1.3\|ct:lan\|lg:en-us\|tz:-3\|fv:10\|ja:1&PI=pid:0-9999-0-0-1\|st:0\|et:2\|ref:\|hp:N\|PGLS:\|ZT:\|MT:\|keys:\|dom:225\|ifr:2\|nld:\|drd:\|bp:0\|url:&UI=vid:8873169954192.734.1439267454149\|sid:8873169954192.734.1439267454149\|lv::1:1:1\|un:\|uo:\|ae:\|su:&EX=ex1:WEIBO-V5\|ex2:&gUid_1439267454961	219.142.78.243
hxxp://180.149.134.141/sso/desktopcallback
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/images/common/ico_warn.gif?id=1370232467958
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/images/register/form_login.gif?id=1370232467960
hxxp://sinajs.xdwscache.glb0.lxdns.com/t5/style/images/common/icon.gif?id=20141016154300
hxxp://login.sina.com.cn/sso/prelogin.php?entry=weibo&callback=sinaSSOController.preloginCallBack&su=&rsakt=mod&client=ssologin.js(v1.4.18)&_=1439267461571	203.90.242.124
hxxp://img.t.sinajs.cn/t5/style/images/register/loading_big.gif?id=1370232467958	8.37.230.18
hxxp://img.t.sinajs.cn/t5/style/images/register/form_login.gif?id=1370232467960	8.37.230.18
hxxp://img.t.sinajs.cn/t5/style/images/register/main_bg.png?id=1370232467959	8.37.230.18
hxxp://img.t.sinajs.cn/t5/style/css/patch/register/login.css?version=201508111231	8.37.230.18
hxxp://img.t.sinajs.cn/t5/style/images/register/form_login.gif?id=1370232467959	8.37.230.18
hxxp://u1.img.mobile.sina.cn/public/files/image/900x200_img55c5e49193d0e.png	222.73.28.96
hxxp://img.t.sinajs.cn/t5/style/images/register/logo.png?id=1395992130776	8.37.230.18
hxxp://js2.t.sinajs.cn/t5/register/js/page/login/bilogin.js?version=201508111231	203.130.61.92
hxxp://activex.microsoft.com/objects/ocget.dll	168.62.11.28
hxxp://img.t.sinajs.cn/t5/style/images/register/qrcode_map.jpg?version=201508111231	8.37.230.18
hxxp://weibo.com/
hxxp://js.t.sinajs.cn/t4/apps/publicity/static/wbad.js?version=201508111231	8.37.230.18
hxxp://img.t.sinajs.cn/t5/style/images/register/form_login.gif?id=1370232467958	8.37.230.18
hxxp://img.t.sinajs.cn/t5/style/css/pages/register/register.css?version=201508111231	8.37.230.18
hxxp://img.t.sinajs.cn/t5/style/images/register/login_vline.png?id=1370232467959	8.37.230.18
hxxp://u1.sinaimg.cn/uve/uveimage/550x270_img52d7729699612.png	222.73.28.96
hxxp://tjs.sjs.sinajs.cn/t5/register/js/page/login/bilogin.js?version=201508111231	222.73.28.96
hxxp://img.t.sinajs.cn/t5/style/images/common/layer_bg.png?id=1370232467958	8.37.230.18
hxxp://img.t.sinajs.cn/t5/style/images/common/ico_warn.gif?id=1370232467958	8.37.230.18
hxxp://img.t.sinajs.cn/t5/style/images/common/icon.gif?id=20141016154300	8.37.230.18
hxxp://js1.t.sinajs.cn/t5/register/js/page/login/bilogin.js?version=201508111231	203.130.61.92
hxxp://img.t.sinajs.cn/t5/style/images/register/bg_repeat_reg.png?id=1370232467958	8.37.230.18
hxxp://passport.weibo.com/visitor/visitor?entry=miniblog&a=enter&url=http://weibo.com/&domain=.weibo.com&ua=php-sso_sdk_client-0.6.11&_rand=1439267490.101	203.90.242.119
hxxp://js.t.sinajs.cn/open/analytics/js/suda.js?version=201508111231	8.37.230.18
hxxp://img.t.sinajs.cn/t5/style/images/register/login_ad_default.jpg?id=1370232467958	8.37.230.18
hxxp://codecs.microsoft.com/isapi/ocget.dll	23.97.68.207
hxxp://img.t.sinajs.cn/t5/style/images/register/bg_reg.png?id=1370232467958	8.37.230.18
hxxp://js.t.sinajs.cn/t5/register/js/page/login/bilogin.js?version=201508111231	8.37.230.18
hxxp://img.t.sinajs.cn/t5/style/css/module/base/frame.css?version=201508111231	8.37.230.18
hxxp://img.t.sinajs.cn/t5/style/images/register/footer_top_bg.jpg?id=1370232467958	8.37.230.18
hxxp://weibo.com/sso/desktopcallback
login.taobao.com	140.205.230.1
s.tbcdn.cn	80.231.126.239
log.mmstat.com	140.205.96.3
ynuf.alipay.com	140.205.142.13
assets.alicdn.com	80.231.126.250
g.alicdn.com	195.27.31.250
acjstb.aliyun.com	42.156.184.19

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /objects/ocget.dll HTTP/1.1

Accept: application/x-cabinet-win32-x86, application/x-pe-win32-x86, application/octet-stream, application/x-setupscript, */*

Content-Type: application/x-www-form-urlencoded

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: activex.microsoft.com

Content-Length: 67

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: MC1=V=3&GUID=489b59b88cff45798f407a73595398d1

MIMETYPE=application/x-signassist&CLSID=application_2F_x-signassist

HTTP/1.1 404 Not Found

Cache-Control: private

Content-Length: 13

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/8.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 11 Aug 2015 04:31:33 GMT

404 Not FoundHTTP/1.1 404 Not Found..Cache-Control: private..Content-Length: 13..Content-Type: text/html; charset=utf-8..Server: Microsoft-IIS/8.5..X-AspNet-Version: 2.0.50727..X-Powered-By: ASP.NET..Date: Tue, 11 Aug 2015 04:31:33 GMT..404 Not Found..

GET /t5/register/js/page/login/bilogin.js?version=201508111231 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js1.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 11 Aug 2015 04:31:33 GMT

Server: nginx/1.4.2

Content-Type: application/x-javascript

Last-Modified: Thu, 04 Jun 2015 08:58:46 GMT

Transfer-Encoding: chunked

Expires: Wed, 26 Aug 2015 04:31:33 GMT

Cache-Control: max-age=1296000

Content-Encoding: gzip

X-Via: 1.1 kf50:0 (Cdn Cache Server V2.0)

Connection: keep-alive

400a...............v.G...*d.....$.....%.r.N.%_K..:$.......4.j(...y..>.1....2..%W.9..b"3..;v.9v.......y1./.....l8..........io9.Mk..{.uv...Am........;..$5.*...5..l9*.y..O.g.../Z...qq0._..em......l...(....tYo.h......X^..;..W.l@..l.......?.]_Rc.X,_L.=~..e...[.]..J .Q..w....oWW...|Q....do^..&;.vb{.y./.7..._g...e4H.o..../~.P.;?....P...[k...2...Q.... ...kk.......%*a.k..E.F./no=P....z.a.'...mM.X...9....9....W.....g...3h.;.....n4...qg.......N'..I1..G........\.%....?xP.Wj....]1Y.;TZ-Z_.?h.........G....l^._/....PqZ.3........n..n...l:-z.--..e.w6.~m...F{..7...o.......]/k.....a........s=..o.....w.q}....Y..q.z.....z.;.k....... ......*KR.Ck.;...D?.|\..M....bG.J........h6_....~.N.jc..|..;..y#;.i.,T...|..-..N 4Y.G.NW.[....8z.|...HR...0.....j~:.S}....6.|..k.k(.Q6C."....[.....^..^.E=...e'?......;h..8R...c.t..O...x9........I.s3aS....5.MOl|G.G.A...* ..i..;.._...t..G..<TcC}..U:x\.zt.;x.....s...u.....C........C..........*l....8.Z.h...^....{..../......k.f..=.....7..Q2......Q..G...._......Y .A.r.4.......S.:..B%..... .]....G>...v...b'..N.HO>.....).s.dm5...5{....eQ.Eghs..69.....U..X.....B..3.-....Q.........#s..U......C.A#...._....{......O.<_..~,...y.`k.....v......`6..w...HC!..c.h....%.P.8....z7.i>..Z~......d.U>..r..2......Q...d....1..k.........sg.R.D....s..o.![..tY.....^.:j...V....a..O&.1}s..4#....-8...y.......h=...s...$...A.Q...v......uP....C.0=a..J.|.{k...$..M*.....%.mD.].l......q'.m&.....W....9.......Z..4./.k.^...E:=.^.w.b....o.t.....L8.hTe.pv.........R`..V...wi....A ..|........6........i......l..Q.r.Af>..y.....

<<< skipped >>>

GET /visitor/visitor?entry=miniblog&a=enter&url=http://weibo.com/&domain=.weibo.com&ua=php-sso_sdk_client-0.6.11&_rand=1439267490.101 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: passport.weibo.com

Connection: Keep-Alive

Cookie: login_sid_t=1b661ff1829581b7c560e5e2e168d79a; YF-Ugrow-G0=ad06784f6deda07eea88e095402e4243

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Aug 2015 04:31:31 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

Cache-Control: no-cache, must-revalidate

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Pragma: no-cache

DPOOL_HEADER: nyx69

Content-Encoding: gzip

SINA-LB:aGEuMTY5LmcxLmh5ZHMubGIuc2luYW5vZGUuY29t

SINA-TS:YjRlOTgyY2UgMCAwIDAgMTcgNgo=

6f9.............X.O.V..^...y....../..V..Jk;.6iB(2.!q....@.6..c[;..K`.`b[.qY.U...6.a.v...jk'UH.>_.;.!....s........wO..~.A?):%.'......d.<.%.H.......:&.>Cw...t*&.D.~..a......\.,.9ba....CT.%9.....U..G..:.E.*..J......<..#.R..mJ:Q....mK.F{..\.-.RM..........Rb[.H...0.).J...gmW.K.....qUW.q.l...IDB;)..W.....2.......G......01.r.I.)[....K...j.....u.Q..p9r.]..).6....r;..$..UiZ......r....e.I........'....y.....'....K.Fz.5t..@.@..\........B.#h.IL$>.(."..Y......M..@.....-.%Sc...........'nW.WQ. ......*.7%...2..(J... ....^. .I.^.d..".jR.@.`..........>V.......(.*..u...i2]...Q[.D...H8...a.oU5...e...<..A.}..vk....~m.......*$.\.:cJ.b64..\......g......@UD...>\xq....(..t.........9...'...7./..oo8.m.C./....|..}.i&.....8...%V.....Y.|....33__...|.7;..w.f..].....n... ...]r...brz...Ow.j.f.'0...e.V.QK.(;.;.!Bw...8...H.9.G...... |..W..[#t..N...b.8FFU..2KKt.>.M...7/n.U[..^.............kL...#...O.%K.BO35.VmZ....,....2e....^&an.........ud./6P...p..2...IP....f.w&......_]]...:...B"=..5..f.,.*.6.(.....k..P..4[.......k(-..:.G..{.........K.;[s!.M....1.).....8SG..F......$....z|b.....IP..-6..$.0y....._o|.2V.... FIR.......QB.]..Ln!f...Z.../.6v....U.m8..cxYo:j..../.......Wu.jt..#M.p.....B... ..w........YV..C...E..:..E..><s...'`?...~T$G..C...@:...m.........r.....%...tRr.<.2J\B....5....&..o...v...&k........#...6I....;R..^..c'R....q..6..{UJDg.y. ..\.K.:....;..K....r}...i4aG...l!.3...`D.g......Q?.....F..S..g...Tof.g....~Q...n...L.....=.Z......|..>.9.&...<....i...jk..o?.!.....l>M=....ia......).Xa....mi...|.L..fV...

<<< skipped >>>

GET /sso/prelogin.php?entry=weibo&callback=sinaSSOController.preloginCallBack&su=&rsakt=mod&client=ssologin.js(v1.4.18)&_=1439267461571 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: login.sina.com.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Aug 2015 04:31:39 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

Cache-Control: no-cache, must-revalidate

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Pragma: no-cache

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

DPOOL_HEADER: nyx68

Content-Encoding: gzip

SINA-LB:aGEuMTY5LmcxLmh5ZHMubGIuc2luYW5vZGUuY29t

SINA-TS:YjVlOTgyY2UgMCAwIDAgMTEgNAo=

155............%.M..1.D...@."............^..N..ev.M......q.w.*..i...>..v./........o.-..j.r~.{..}.........o}..^G....I.0]..qz....f..!.Y.Ln.g.......F.G.4....-.c........?.... . ..(1z.n...R,.d%4..........($..!.. ....5..1...r......".zR....K..B...$R....RAU.)g..X(..T....Zk.b.Ka.c.U..&.1)H...Z}..*B..\.U."i.T..0^Sb..^|.D@...~..oC.Gt.....?.._<.y..)..o......0..

GET /t5/register/js/page/login/bilogin.js?version=201508111231 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Wed, 26 Aug 2015 04:31:25 GMT

Date: Tue, 11 Aug 2015 04:31:25 GMT

Server: nginx/1.4.2

Content-Type: application/x-javascript

Last-Modified: Thu, 04 Jun 2015 08:58:46 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=1296000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 ny18:5 (Cdn Cache Server V2.0)

Connection: keep-alive

400a...............v.G...*d.....$.....%.r.N.%_K..:$.......4.j(...y..>.1....2..%W.9..b"3..;v.9v.......y1./.....l8..........io9.Mk..{.uv...Am........;..$5.*...5..l9*.y..O.g.../Z...qq0._..em......l...(....tYo.h......X^..;..W.l@..l.......?.]_Rc.X,_L.=~..e...[.]..J .Q..w....oWW...|Q....do^..&;.vb{.y./.7..._g...e4H.o..../~.P.;?....P...[k...2...Q.... ...kk.......%*a.k..E.F./no=P....z.a.'...mM.X...9....9....W.....g...3h.;.....n4...qg.......N'..I1..G........\.%....?xP.Wj....]1Y.;TZ-Z_.?h.........G....l^._/....PqZ.3........n..n...l:-z.--..e.w6.~m...F{..7...o.......]/k.....a........s=..o.....w.q}....Y..q.z.....z.;.k....... ......*KR.Ck.;...D?.|\..M....bG.J........h6_....~.N.jc..|..;..y#;.i.,T...|..-..N 4Y.G.NW.[....8z.|...HR...0.....j~:.S}....6.|..k.k(.Q6C."....[.....^..^.E=...e'?......;h..8R...c.t..O...x9........I.s3aS....5.MOl|G.G.A...* ..i..;.._...t..G..<TcC}..U:x\.zt.;x.....s...u.....C........C..........*l....8.Z.h...^....{..../......k.f..=.....7..Q2......Q..G...._......Y .A.r.4.......S.:..B%..... .]....G>...v...b'..N.HO>.....).s.dm5...5{....eQ.Eghs..69.....U..X.....B..3.-....Q.........#s..U......C.A#...._....{......O.<_..~,...y.`k.....v......`6..w...HC!..c.h....%.P.8....z7.i>..Z~......d.U>..r..2......Q...d....1..k.........sg.R.D....s..o.![..tY.....^.:j...V....a..O&.1}s..4#....-8...y.......h=...s...$...A.Q...v......uP....C.0=a..J.|.{k...$..M*.....%.mD.].l......q'.m&.....W....9.......Z..4./.k.^...E:=.^.w.b....o.t.....L8.hTe.pv.........R`..V...wi....A ..|........6........i......l..Q.r.Af>..y.....

<<< skipped >>>

GET /open/analytics/js/suda.js?version=201508111231 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Wed, 26 Aug 2015 04:31:29 GMT

Date: Tue, 11 Aug 2015 04:31:29 GMT

Server: nginx/1.4.2

Content-Type: application/x-javascript

Last-Modified: Wed, 26 Nov 2014 00:31:57 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=1296000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 ny14:4 (Cdn Cache Server V2.0)

Connection: keep-alive

1db3.............\.W.... D3.'.B..b.p.&...n.Lf..4v....H2.`...Uu..c........,.z.....m_...$....p ......~'.s{~'l.od?q.~_...".#W\.Mo...yI....zq;.....I4~........u#y1.s.k....fR....).x.[.$..../..Da.....~]..V...........m...}.......6h..}qQ.-Ye.]...../.p...MCG7\....x.._..#..a.2.d.%...NF."....w|.`.c......{.=...@...rE.......>....!D..'<..Y|&.m.=......j..F.<./D/....R_\......c._]][[.UW.]....v.$..}......}.......h....N....g.".T...;.!.K..\1.....y.d2....2i.C.i^..e...i..z.&....3u.BwW.;...F......L.S.D<`5E.^.d{ ..._.v.<.2.2$...D..b.[D..X.m1..<..l..(;.l......^...vG$.r6Z^,n.]...r.;.S...>.. .....&.I3I..|.H[.1..Q:............Ptlt.P.-....I.i.*....;...9.W.H............@..V.,....7....[.......4*.....d.2....f.X....D..... ..m.$2..Rp.......a./...p...[.PT.../...i..<................o`.1A~.-|....L].R...n....<.../...'...2%....".........Ji.[........:..t....F.....H70............Q..M. .G..@.{'...d.5.8..A........(......,Y...F..E%1...H.~.R..h./..Z....].........l.../...W.....Y.$$...6.r4."..........:.'..4C`dK..m)..|I.......X\.Q.............@...-.(.......*...'..B|..4MR)....>....B..:...>...2.A3m.p-.a4C..d.~kj()..2..H.....{. 2..w.....o4...od...Et.j>. "{R..H1.b....]7.I..V^\.........Np\9.3Y\.. ..T.6d..3f&....!...W...<..B).Yo4...J.-...F.eA.PDD.)....pG =...`J>J..C.Dm.#.o......h.....D..r..'.2..Q....L..x.......1...C .1.d.0.. H.........Qr..&.(...07.});.bA.Z...@D....,>b.f.B.....|....a..<9.''..dX.4 N...K%..y2...y.....$1..<..z.a].*.........r....K.ad...... W.d.G....R..[.......L....-.!....(......D,'..q.b'.z...$.....jf...

<<< skipped >>>

GET /adfront/loginad.php?posid=pos528d79d0cbc47&psid=PDPS000000025446&wbVersion=v5&cip=194.242.96.226&cursor=NaN&eData=6.78,1&callback=wbad_14392865166491&rnd=14392914494782 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wbpctips.mobile.sina.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ngx_openresty

Date: Tue, 11 Aug 2015 04:31:33 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.8

Content-Encoding: gzip

179............]..n. .._.Y....`|...W.. ....6]. ..lWy.N\.&.......C..x..J...J..M]4M...c ...EdcJ...].]... ..r...[$........q.O~...0.o.....5;..n.V.z....Z...m.JS..2.@.W.....w.y.d..8...|.E.} j.D. .*.y..k..-N.s..........:...3d.-.-).,.U..(.;.....$.......Ad......!CI..&..j..5C]Kd..H.vM.....%..._...?.....Y......2.tWR_....<.Y...f>.......W.aS..\@[.QD8.a........4.......GK...G8k..x.O.....'Z.......0..HTTP/1.1 200 OK..Server: ngx_openresty..Date: Tue, 11 Aug 2015 04:31:33 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Powered-By: PHP/5.3.8..Content-Encoding: gzip..179............]..n. .._.Y....`|...W.. ....6]. ..lWy.N\.&.......C..x..J...J..M]4M...c ...EdcJ...].]... ..r...[$........q.O~...0.o.....5;..n.V.z....Z...m.JS..2.@.W.....w.y.d..8...|.E.} j.D. .*.y..k..-N.s..........:...3d.-.-).,.U..(.;.....$.......Ad......!CI..&..j..5C]Kd..H.vM.....%..._...?.....Y......2.tWR_....<.Y...f>.......W.aS..\@[.QD8.a........4.......GK...G8k..x.O.....'Z.......0..

GET /uve/uveimage/550x270_img52d7729699612.png HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: u1.sinaimg.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Content-Type: image/png

Last-Modified: Thu, 16 Jan 2014 05:48:04 GMT

Expires: Thu, 25 Jun 2015 02:29:03 GMT

Cache-Control: max-age=2592000

w-debug: 10.13.2.51

Via: 1.0 87-201.u1.sinaimg.cn:80 (squid/2.6.STABLE21)

X-Cacheable: YES

Content-Length: 59144

Date: Mon, 03 Aug 2015 02:47:53 GMT

X-Varnish: 1127431243 1127276265

Age: 1462441

Via: 1.1 varnish, http/1.1 ctc.shanghai.ha2ts4.132 (ApacheTrafficServer/4.2.1.1 [cRs f ])

X-Cache: 66-uimg HIT

X-Via-CDN: f=Edge,s=ctc.shanghai.ha2ts4.132,c=194.242.96.226

.PNG........IHDR...&...........,.....tEXtSoftware.Adobe ImageReadyq.e<....PLTEs...........b.....s........LMO.........{.....c.................{..k..k.....t.....S.....K..C..j..c.....l..L..T..S.....Z........[.....c........{...........s.....R..{..{.....T....................j.....\..E..L..\........l..h...........L.....[..r........q..Y..D.....b.....Q...........d.......................<.....B..z..X..b.....t........t..K.................e.....{..............r.....k.....T..q...........a.....[..;..z...........h..y..{..a..a..wx{......D.....b..I..E.....\...........U..m..l...........M..p..o..U.....n..e...........i..}.....o..F..]...................................]....................X.....Y........]..............X...........Y....................]........^.........................................U..............I........y..y..u........y..Q..A................IDATx....L.i..m.. E...%.-....T,x._.C...XM.K..:H...!.RFN..b.Fl..Oo..1.l.L....!..s..i.....[....b^.]..dc.f..UB.......y.*..=...={...,.....^.}.wm[.78.o2,.m.....5.z.Y...[...[.. ....%./..4..[........M........M...b..*.f.A?.E..!x&.....a._...b...f}}.`....[p.>2....../.OL^.|.......0.q..L.~.x....gS.....?1Y.K ....f..?I.O.<x..[y......c.2..H.2_.-....Z.W.....[.....~..K.y.. .............._,.i..Mb....#..... .....M.Y.....PL^......G.v...^....O.b...c.n....;w&'.....n...i.H.JB.z..z.....;.ca...__...j.O6./.....&... N...:..;....;..=...<#*eh........h.....7..L....z.zL..p.,..5)...|L......;.kr..?..,.8 Yu.. ....R........7..h...GdS>.`N..:6...:K.s....\._7..BL .8~.Ic.....W%...W...a.U...X...

<<< skipped >>>

GET /t5/register/js/page/login/bilogin.js?version=201508111231 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js2.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 11 Aug 2015 04:31:34 GMT

Server: nginx/1.4.2

Content-Type: application/x-javascript

Last-Modified: Thu, 04 Jun 2015 08:58:46 GMT

Transfer-Encoding: chunked

Expires: Wed, 26 Aug 2015 04:31:31 GMT

Cache-Control: max-age=1296000

Content-Encoding: gzip

X-Via: 1.1 kf50:0 (Cdn Cache Server V2.0)

Connection: keep-alive

400a...............v.G...*d.....$.....%.r.N.%_K..:$.......4.j(...y..>.1....2..%W.9..b"3..;v.9v.......y1./.....l8..........io9.Mk..{.uv...Am........;..$5.*...5..l9*.y..O.g.../Z...qq0._..em......l...(....tYo.h......X^..;..W.l@..l.......?.]_Rc.X,_L.=~..e...[.]..J .Q..w....oWW...|Q....do^..&;.vb{.y./.7..._g...e4H.o..../~.P.;?....P...[k...2...Q.... ...kk.......%*a.k..E.F./no=P....z.a.'...mM.X...9....9....W.....g...3h.;.....n4...qg.......N'..I1..G........\.%....?xP.Wj....]1Y.;TZ-Z_.?h.........G....l^._/....PqZ.3........n..n...l:-z.--..e.w6.~m...F{..7...o.......]/k.....a........s=..o.....w.q}....Y..q.z.....z.;.k....... ......*KR.Ck.;...D?.|\..M....bG.J........h6_....~.N.jc..|..;..y#;.i.,T...|..-..N 4Y.G.NW.[....8z.|...HR...0.....j~:.S}....6.|..k.k(.Q6C."....[.....^..^.E=...e'?......;h..8R...c.t..O...x9........I.s3aS....5.MOl|G.G.A...* ..i..;.._...t..G..<TcC}..U:x\.zt.;x.....s...u.....C........C..........*l....8.Z.h...^....{..../......k.f..=.....7..Q2......Q..G...._......Y .A.r.4.......S.:..B%..... .]....G>...v...b'..N.HO>.....).s.dm5...5{....eQ.Eghs..69.....U..X.....B..3.-....Q.........#s..U......C.A#...._....{......O.<_..~,...y.`k.....v......`6..w...HC!..c.h....%.P.8....z7.i>..Z~......d.U>..r..2......Q...d....1..k.........sg.R.D....s..o.![..tY.....^.:j...V....a..O&.1}s..4#....-8...y.......h=...s...$...A.Q...v......uP....C.0=a..J.|.{k...$..M*.....%.mD.].l......q'.m&.....W....9.......Z..4./.k.^...E:=.^.w.b....o.t.....L8.hTe.pv.........R`..V...wi....A ..|........6........i......l..Q.r.Af>..y.....

<<< skipped >>>

GET /t5/style/css/pages/register/register.css?version=201508111231 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Wed, 26 Aug 2015 04:31:21 GMT

Date: Tue, 11 Aug 2015 04:31:21 GMT

Server: nginx/1.4.2

Content-Type: text/css

Last-Modified: Wed, 03 Sep 2014 08:27:47 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=1296000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 qzh148:8106 (Cdn Cache Server V2.0), 1.1 ny18:9 (Cdn Cache Server V2.0)

Connection: keep-alive

1a22.............=k......_.. .w1..5....am.\|.q...... (....H....X......."..8v.H..$.H.]]]...n.........jP..$....i.y...>U.S...bqu7....}...pu..$2`:.._...X.IQ..i.....0.d>....D...(.8 .t:...)]W......u.mO..<...E...,...y.a.....".....b..........m..M...y..a...._......h2.....7w_...,...1....I..j..o`.....cRTi....>.f......d....}.....$..Z.[..t..D...6....W.c.........4......g....OA...up....F.%....=...N.[.#...R...NWKf..............!5....q....*.T1....bfT..d...!...-vHUE#......8/.*.3..%...<?,.@....&...~HJ..b..jrss=..].._-....!.e.2...-....U...qZ..]._.............F.o.}JV....4K\..dS...~[.U........?|....~U....A...W....qx.........%....P...zv....Z$..^.m...N...........5...x..;... .=c...../...q..........N..I.&.S0g.....,.2`...Pi..............l...&z.WZ...kgm=...WAS...#.i-....'.......%X.7h....W..1.z...1..\..d...me...i..?sa1.].9..{#.P...7....tt{;...P.4.p..a#.c...........,.........E^..j.v..E..?.kM...,Z....U..\...A..H.].....] ...?....x.&=l...L...r.go..7%.r..y\K.....U.lAd.....)`...h.Z.B0.L..H.....!*.-.Q.=V9....\.. ........`..d6.O......f..A.......LQ.M.g......f.../.....K.L......*............%.".>E..4q..Dv;..5T........m....tE.....q..ct...........|...,.......,.....>.s..(${...X...w.....?F......=Q:B....~O..L)., ..c..3..u..k..T..d$.....4(w.."y.......B..UD.Xd.....%P..:JV.9.b..G.[...5O#2>.`i..cTX.]....'....3.`p.v4P...7.....,k.kiY`....(.L.(6]s."e.c.kG..N...o6.e..WT-02^.F...w"=.2. 1E....(.7OS...U0.p.n..`p.../...m>..p.......v.....S..V....1.........rbQ........fd0../x..).W#!Ur.......m.0.....o.S..d?9)n..O\G..P..U...2...e....<..? .$5.

<<< skipped >>>

GET /t5/style/css/patch/register/login.css?version=201508111231 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Wed, 26 Aug 2015 04:31:21 GMT

Date: Tue, 11 Aug 2015 04:31:21 GMT

Server: nginx/1.4.2

Content-Type: text/css

Last-Modified: Fri, 13 Feb 2015 10:14:36 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=1296000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 qzh164:8080 (Cdn Cache Server V2.0), 1.1 ny14:7 (Cdn Cache Server V2.0)

Connection: keep-alive

b43.............Z.o....W.....H ....(..ns_z....@...(......urF....I.zX.^.."~h.....$.3....:6.,.W7o..S.4"../O2m.....}....c.,...U...V...p...........%...C.x...B..M...`.....R.2..U.....Q......c%v.nD.1W;YF<.R..c....v..._...`.Z>l...O...X..J..o.(F..S..i*JG......9...\%_.F.E..ik.......^X..:..JE..&....j.....l......G._....N....H.gPc.:..}.N3....e#U..7..*.....Dg~..&V.g0.oB.d.]o........y..f...M.h3}C...u"qX"J....6.1..ay^.....Tb..? ....6.b.:Ol..%.......L..W..E....../d..~.Y&..U...s..`......e...H.q|...7e........`.C........RU......H.;..>...z...V!...!~..6....C.Y.@d..Qo...e..~&.....J...p......q....b$\../6....C.. .c..b..w2.O..=.D..`.J.....zJ.'..*.....F.6..xW.......1. ..N{.....f..J.P..5.........?6J'....L.....R.W1.....-.H^..c~A.8y...l..m..RE..Y..`S....H...5..3.P..r....0..=Y.5....lD.......{. B.....a..,........_G.2.H....F.JA%.t.......U.......^a.esH%.{Rt.h.7..MI.T....9.T&..t......CR...Lxn...P.s.h..0y(.O.I...k4..%\.H......x|nKc%r..o...gp0J.}.O..5..g....v...@QS....Bgw$...2...4.5.NOcM.D....8.......I.%r.8e.)..|Z...h..\...?e.V..L...O(.....8.....M.0.H.`R...JU.-....N}...SL...J...L.....:z.,.C......?..S..*..YD..X......D....i.Q..&I....O.E.Xc..V..,..X...0#........0b....u.ez....i......G.|.B......A^..........C6...D.:..l..G....]k..........^3.u...`.jhm...a>...W..m.......h...D.!.....4.T......oG$.).......Y./h..U..hP..)..<O....S..6.:A<..i.P."..{.g...=X.....f..p.....I/K.7Zd.....7.:$\7.l......*.hl.......ps........j.l....:.yK.tD..-h.q..V. ....5...Q.......n.j.o........~..."../#....l>l..8..i..,vE.YNZ.[......]...([.3..A..i....l......g...I....2.

<<< skipped >>>

GET /t5/style/images/register/bg_repeat_reg.png?id=1370232467958 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 15 Aug 2015 07:05:24 GMT

Date: Fri, 31 Jul 2015 07:05:24 GMT

Server: nginx/1.4.2

Content-Type: image/png

Content-Length: 638

Last-Modified: Thu, 16 Aug 2012 07:46:53 GMT

ETag: "502ca56d-27e"

Cache-Control: max-age=1296000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 qzh158:8109 (Cdn Cache Server V2.0), 1.1 ny18:3 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR...2............?....tEXtSoftware.Adobe ImageReadyq.e<....PLTE........................................................................................................................................................................................................,....NIDATx....q.A.....tb..33...l.yLt.T....:K....X..G.R..,..`.....X".m.....^.0...M.....^...2.Y.......c.......T..KUF1K.r..-GX.2.Y...,U....w..,c..e...-....'...`q.-...a....KU.....Y..{,n.c....-b..e...-.......\aq.....b....KUN.Te...-.X.r..*.XI..,5..fi.L`.... ).X....^.1...-....Yp..Z.,5..f.Q^....Y,I..f.X,...b.X,...b.X,...b.X,...b.X,...b.X,.K../..<.....ps....IEND.B`.HTTP/1.1 200 OK..Expires: Sat, 15 Aug 2015 07:05:24 GMT..Date: Fri, 31 Jul 2015 07:05:24 GMT..Server: nginx/1.4.2..Content-Type: image/png..Content-Length: 638..Last-Modified: Thu, 16 Aug 2012 07:46:53 GMT..ETag: "502ca56d-27e"..Cache-Control: max-age=1296000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 qzh158:8109 (Cdn Cache Server V2.0), 1.1 ny18:3 (Cdn Cache Server V2.0)..Connection: keep-alive...PNG........IHDR...2............?....tEXtSoftware.Adobe ImageReadyq.e<....PLTE........................................................................................................................................................................................................,....NIDATx....q.A.....tb..33...l.yLt.T....:K....X..G.R..,..`.....X".m.....^.0...M.....^...2.Y.......c.......T..KUF1K.r..-GX.2.Y...,U....w..,c..e...-....'...`q.-...a....KU.....Y..{,n.c....-b..e...-.......\aq.....

<<< skipped >>>

GET /t5/style/images/register/bg_reg.png?id=1370232467958 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 15 Aug 2015 07:05:21 GMT

Date: Fri, 31 Jul 2015 07:05:21 GMT

Server: nginx/1.4.2

Content-Type: image/png

Content-Length: 16358

Last-Modified: Thu, 16 Aug 2012 07:46:53 GMT

ETag: "502ca56d-3fe6"

Cache-Control: max-age=1296000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 qzh160:8104 (Cdn Cache Server V2.0), 1.1 ny14:8 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR.......*.....2:Y.....tEXtSoftware.Adobe ImageReadyq.e<....PLTEu............................................................................................y.......................v.....}......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................eK..<|IDATx....|T../............u......x..H..E.....,..xk.,......D...Tl....L./..#h5.nm-.V-D.^.d..5H.}..}.s.s...?......~ZB.).|.=.y.L.I.i........z.....[\....;.......H....TW...............|.U.]r.%....0rd'..I}...9r.x..\r.UW....z.:.......YS].....|.......Xq..^......n..u..V'..{.`u.`..X..,..X...X.`..W...Z..E.u..........*X.,*X..A..V.*.y...P.U....Y3a:.u...%X]...^Uw ....N3a..k..X.I)X.a.3.....#......[.JE...KV....;.L...A.\...k|.. .`....1..S..*X.D...$M .y.0.....:a;T,...a'B..t.......,....uB.b.lo...;.B..T.......e.l.].:....uj..F...$..K...M..x.4.:.......`u$.N!HZ....i(d..x J..x.'B.....,y.R.5.w..].....0.l....Jze]"."..LEUG...XH.......XN.R.V.......P82.`...y.PxU....B...55z....)...I.b..G.*V....2.`.

<<< skipped >>>

GET /t5/style/images/register/login_vline.png?id=1370232467959 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 15 Aug 2015 07:05:24 GMT

Date: Fri, 31 Jul 2015 07:05:24 GMT

Server: nginx/1.4.2

Content-Type: image/png

Content-Length: 1448

Last-Modified: Wed, 14 Aug 2013 09:45:46 GMT

ETag: "520b51ca-5a8"

Cache-Control: max-age=1296000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 qzh158:8109 (Cdn Cache Server V2.0), 1.1 ny18:3 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR.......Y.......Nb....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:EF67795A04BF11E3BE0797C44216B46E" xmpMM:DocumentID="xmp.did:EF67795B04BF11E3BE0797C44216B46E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EF67795804BF11E3BE0797C44216B46E" stRef:documentID="xmp.did:EF67795904BF11E3BE0797C44216B46E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.h!-...rPLTE...................................................................................................................#^w....IDATx....V.0.DQI........b...E.Z.!9Y..............!..O.f...|.?mf....&.%0..B..e`......D.........}....gp.......8......V.._..<{C...!......%..O.w.I..=Y.&d...@3......[a.L.|..Vi... r..&.|bK..7.....{n.5...w,..Y0}.....~.~bE...[dddddddd..f.g.. &..d...S...L......8.1.uxs /./...[.=...|a..t.I......|........`.h...H......ajh.0@4w.%.A..N.F..a......b.ir1.4..L.g.(.6...rL....c.e...<[g_.F[.eW...u}a.Y.~0....;....~.k&.)W..W;_.|........t.....-.....IEND.B`.....

<<< skipped >>>

GET /t5/style/images/common/layer_bg.png?id=1370232467958 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 15 Aug 2015 07:04:46 GMT

Date: Fri, 31 Jul 2015 07:04:46 GMT

Server: nginx/1.4.2

Content-Type: image/png

Content-Length: 978

Last-Modified: Thu, 16 Aug 2012 07:46:54 GMT

ETag: "502ca56e-3d2"

Cache-Control: max-age=1296000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 qzh161:8105 (Cdn Cache Server V2.0), 1.1 ny14:8 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR...2...2......?......tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:54950D94C5B411E1BD97917829D37D92" xmpMM:DocumentID="xmp.did:54950D95C5B411E1BD97917829D37D92"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:54950D92C5B411E1BD97917829D37D92" stRef:documentID="xmp.did:54950D93C5B411E1BD97917829D37D92"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.QG....HIDATx...1.. ....../.....AN5-p[BDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD..'.....~|9r.....IEND.B`.HTTP/1.1 200 OK..Expires: Sat, 15 Aug 2015 07:04:46 GMT..Date: Fri, 31 Jul 2015 07:04:46 GMT..Server: nginx/1.4.2..Content-Type: image/png..Content-Length: 978..Last-Modified: Thu, 16 Aug 2012 07:46:54 GMT..ETag: "502ca56e-3d2"..Cache-Control: max-age=1296000..Accept-Ranges: bytes..Age: 1..X-Via: 1.1 qzh161:8105 (Cdn Cache Server V2.0), 1.1 ny14:8 (Cdn Cache Server V2.0)..Connection: keep-alive...PNG........IHDR...2...2......?......tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp....

<<< skipped >>>

GET /t5/style/images/register/loading_big.gif?id=1370232467958 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 15 Aug 2015 07:05:24 GMT

Date: Fri, 31 Jul 2015 07:05:24 GMT

Server: nginx/1.4.2

Content-Type: image/gif

Content-Length: 2700

Last-Modified: Thu, 25 Apr 2013 11:01:44 GMT

ETag: "51790d18-a8c"

Cache-Control: max-age=1296000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 qzh158:8106 (Cdn Cache Server V2.0), 1.1 ny18:0 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a.....?.................................................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:EEC513F98EC911E2B6F9D4D614328517" xmpMM:DocumentID="xmp.did:EEC513FA8EC911E2B6F9D4D614328517"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EEC513F78EC911E2B6F9D4D614328517" stRef:documentID="xmp.did:EEC513F88EC911E2B6F9D4D614328517"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.....?.,.............pH$....r....>_.I]"..CUyL..X...P....t. D%....1..W.vhh,.C.%../L`XcT.....LmoqT.7.;M}.[?. ,2^......C........g..Q....n>...a...a..a...a.?.Q.g...>.C....?.......U...".L."...J.

<<< skipped >>>

GET /t5/style/images/register/footer_top_bg.jpg?id=1370232467958 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 15 Aug 2015 07:05:21 GMT

Date: Fri, 31 Jul 2015 07:05:21 GMT

Server: nginx/1.4.2

Content-Type: image/jpeg

Content-Length: 9260

Last-Modified: Fri, 04 Jan 2013 09:35:10 GMT

ETag: "50e6a24e-242c"

Cache-Control: max-age=1296000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 qzh195:8106 (Cdn Cache Server V2.0), 1.1 ny14:5 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*...........................b...........j...(...........1.......r...2...........i....................'.......'..Adobe Photoshop CS5 Windows.2013:01:04 10:26:07.................................................................................&...(...............................j.......H.......H.............Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?.....I$.._./.|..J~......i$..O./.|..J~......i$..O./.|..J~......i$..O./.|..J~......I$..T..I$.......Photoshop 3.0.8BIM..........Z...%G........8BIM.%.........}.....pv....N8BIM.:....................printOutput........ClrSenum....ClrS....RGBC....Inteenum....Inte....Clrm....MpBlbool.....printSixteenBitbool.....printerNameTEXT.......8BIM.;....................printOutputOptions........Cptnbool.....Clbrbool.....RgsMbool.....CrnCbool.....CntCbool.....Lblsbool.....Ngtvbool.....EmlDbool.....Intrbool.....BckgObjc..........RGBC........Rd doub@o..........Grn doub@o..........Bl doub@o..........BrdTUntF#Rlt............Bld UntF#Rlt............RsltUntF#Pxl@R..........vectorDatabool.....PgPsenum....PgPs....

<<< skipped >>>

GET /t5/style/images/common/ico_warn.gif?id=1370232467958 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 15 Aug 2015 08:25:45 GMT

Date: Fri, 31 Jul 2015 08:25:45 GMT

Server: nginx/1.4.2

Content-Type: image/gif

Content-Length: 3984

Last-Modified: Wed, 24 Apr 2013 00:41:15 GMT

ETag: "51772a2b-f90"

Cache-Control: max-age=1296000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 qzh195:8106 (Cdn Cache Server V2.0), 1.1 ny15:6 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a...........y.L..~.-..:\...l...o..*...D..R....4p.(..T..T..U.."..U..1..l.....2.....S.....6..S.....:..e..#.....E..V........<..f..C{.,.....:........E..k.w...'....."......Y.......7...z.,q.(..5........8..%..,..U........1.....;..v.n ...J....3......O....(........W..&.....!x....b..G.......................4..i..dh....G..V..U...............a....^..QR....:G....4.....^......{..M.......[.....T..]..W..V..V.....Y..\..Z..a........a....................d..b..bP..M....l..@I.....I..F.............B...[........S....l..Y..q........2.....`........#..1G..|.,d..I.......Yk.....U.._..t.)..f..W..!K................f.....G..n.....V........b.....i........f.....d....._..W.....c......Q....a.........D..a........E.........................b..^K....a..Z........f.....c..SO..h....j..2U..f....A..#.........!.......,...............H. A...*\......#J.H.....2j..q... C..I.!...K.\..%D.0]>4H....#a.../%N..u.....D.<...hT.P.D.J].q.....hl......5b..T.V.]......@...`-..k..K...z....r..-...N.7...[..\........b...3>.8&..`4..Q......6.k7.h.p6R....i..YST.9..~.nd$.Utd...ZL .#q.....|.w..|<.U.QG..Y.P....:..C...^.{*.....y....'.s?..t.9..G_n.a.B)....J.4pC...D x........a...$.L.b.A'D\..D........R.Jq.B.&...u*rD.R1......8.|6.......U...).vE...d.q...N.0$.Q...a..........ju.&\..0&xs....:.i......Rr.Y....x....2's.&..N(.0W..".............^Q:.S.v....*.U..p.\....&.....'.w..%.].J$.k.z.....l...k...&....6....F ...Vk...f.S..v.m.....?..kn...{.........;.............. ........b..V...p...\.....pQ.W....".....e1... ...[..\.S...?-.r.&....JM.S.h...M...3E.B,..6...R6.\3....r... 1.S....

<<< skipped >>>

GET /t5/style/images/common/icon.gif?id=20141016154300 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 15 Aug 2015 08:25:43 GMT

Date: Fri, 31 Jul 2015 08:25:43 GMT

Server: nginx/1.4.2

Content-Type: image/gif

Content-Length: 31175

Last-Modified: Mon, 20 Oct 2014 09:04:27 GMT

ETag: "5444d01b-79c7"

Cache-Control: max-age=1296000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 qzh159:8104 (Cdn Cache Server V2.0), 1.1 ny18:8 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89aX.X......l.'S...Q.4................nO..7S...............S..[...T.....j........M...u.......:..%g.Plmm...Y.....M.............H9....'...V...u..q.:.......;..Y...........;...........\.....y*..i......,..AA{...[V6.....U...ulyz.....;;..'.8...S.q...:.............n.^...P4....S...l....j9.7...&_............;......Zg...L......D..U.pm........N.o..S...*..n.....J....Uq.}D....\.}.x..g.......................E..O.....uFFF..i..4.%....%........s....>..c..G.....c.}E....E"..Z......0..-...>7.~...l...h..f....9..`..|..U...........f..,........:..Oz.%\{.........2....`?....e\..4........".....-...................................M.......Y......}@....U.. ..-. .....`T............!...............SRz......JF.Ec...............aad......d......................V....H.... .t......................s'......!.......,....X.X........8..A...*..P.........".\..Z...#......ha$Dt(M".@!.K.&...I.&....\..........*t Q..3(]...S../]R)P...W.P.JP...`..%x....h.BT....B...,B7....cd.[.oD...s.l.0W........`\%0..H....#?*F.yk...B.,..f...S.>..!...c...."..E!>..;C.K...4.R..}B.U).H.JU2.K.N.....Ph...{.C..........t....%G.....w...a....7...c...#Yf....?.h..U....`....g..f.h.]..M..p.D..&"l.Vt.A.%..? 2."S...Op.......2.,...Bs.U.]uDVw.@.y..w.=..x...H\.....^ ....q....m)X^`...}....~..i&D.............E..4`.I.fT.....R..`Q..E..RE..$.M..P.CK.&.l...DF'....M...R,.........6....B..(T9..Q.#....CC.)..G........C...e ....]XfI..]..e..a....".f.....An.K...|..U.TP.d....Gx...mH.:...nV.I8......`L........C...|...;.....Xl...*..QD.jr./V.C.(....4.:.D TAT0.`5...&...D.{l.J..P.OBYI%UN.^...)...Mmu.VS-

<<< skipped >>>

POST /sso/desktopcallback HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://login.sina.com.cn/plugin_proxy.html?proxy=hXXp://weibo.com/sso/desktopcallback&type=userinfo&callback=SINA_USER_PLUGIN.callbacks.callback_14f1b067bea

Accept-Language: en-us

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weibo.com

Content-Length: 149

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: login_sid_t=1b661ff1829581b7c560e5e2e168d79a; YF-Ugrow-G0=ad06784f6deda07eea88e095402e4243; _s_tentry=-; Apache=8873169954192.734.1439267454149; SINAGLOBAL=8873169954192.734.1439267454149; ULV=1439267454946:1:1:1:8873169954192.734.1439267454149:

data=%7B%22code%22%3A%22-3%22%2C%22msg%22%3A%22getinfo_error%22%7D&callback=SINA_USER_PLUGIN.callbacks.callback_14f1b067bea

HTTP/1.1 200 OK

Server: WeiBo

Date: Tue, 11 Aug 2015 04:31:38 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Tue, 11 Aug 2015 04:31:38 GMT

Cache-Control: no-cache, must-revalidate

Pramga: no-cache

DPOOL_HEADER: dagda31

Content-Encoding: gzip

LB_HEADER: venus242

186............lP.N.P.]c.?\oB...R0"PH....h.DX5........B.[....qo.?.'a./....73gN.......U...@S.9H..ZM.a....BH].....n!I. ...o..]....`...."!A..AN...h=....H....Q..X...'..W3.....H.B!.G.)y.....<c@Q$....^...]`...z.02......D.%dN..3(/`,.bD.#..a...............IW{...5.z.vC&.N....=.......]....L....x ....f............hR.1.y......%#s.7.=..(."N.k.l....[:W....`V..........s.y.."6_.wG..U.|..G~...n. 2.[...M........a.......v......0..

GET /a.gif?V=2.2.3&CI=sz:1916x902|dp:32|ac:Mozilla|an:MSIE|cpu:x86|pf:Win32|jv:1.3|ct:lan|lg:en-us|tz:-3|fv:10|ja:1&PI=pid:0-9999-0-0-1|st:0|et:2|ref:|hp:N|PGLS:|ZT:|MT:|keys:|dom:225|ifr:2|nld:|drd:|bp:0|url:&UI=vid:8873169954192.734.1439267454149|sid:8873169954192.734.1439267454149|lv::1:1:1|un:|uo:|ae:|su:&EX=ex1:WEIBO-V5|ex2:&gUid_1439267454961 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: beacon.sina.com.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 11 Aug 2015 04:31:46 GMT

Content-Type: image/gif

Content-Length: 35

Last-Modified: Mon, 27 Jan 2014 06:58:01 GMT

Connection: keep-alive

Set-Cookie: SINAGLOBAL=194.242.96.226_1439267506.935990; expires=Tue, 19-Jan-2038 03:00:00 GMT; domain=.sina.com.cn; path=/

Set-Cookie: Apache=194.242.96.226_1439267506.935992; domain=.sina.com.cn; path=/

P3P: CP="CAO DSP COR LAW CURa ADMa DEVa PSAa PSDa OUR DELa BUS IND PHY ONL UNI PUR COM NAV INT STA",policyref="/w3c/p3p.xml"

Server: Suda/1.4.2

Accept-Ranges: bytes

GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Tue, 11 Aug 2015 04:31:46 GMT..Content-Type: image/gif..Content-Length: 35..Last-Modified: Mon, 27 Jan 2014 06:58:01 GMT..Connection: keep-alive..Set-Cookie: SINAGLOBAL=194.242.96.226_1439267506.935990; expires=Tue, 19-Jan-2038 03:00:00 GMT; domain=.sina.com.cn; path=/..Set-Cookie: Apache=194.242.96.226_1439267506.935992; domain=.sina.com.cn; path=/..P3P: CP="CAO DSP COR LAW CURa ADMa DEVa PSAa PSDa OUR DELa BUS IND PHY ONL UNI PUR COM NAV INT STA",policyref="/w3c/p3p.xml"..Server: Suda/1.4.2..Accept-Ranges: bytes..GIF89a.............,...........D..;..

GET / HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: weibo.com

Connection: Keep-Alive

Cookie: login_sid_t=1b661ff1829581b7c560e5e2e168d79a; YF-Ugrow-G0=ad06784f6deda07eea88e095402e4243

HTTP/1.1 302 Moved Temporarily

Server: WeiBo

Date: Tue, 11 Aug 2015 04:31:30 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Tue, 11 Aug 2015 04:31:30 GMT

Pramga: no-cache

Cache-Control: no-cache, no-store

Location: hXXp://passport.weibo.com/visitor/visitor?entry=miniblog&a=enter&url=http://weibo.com/&domain=.weibo.com&ua=php-sso_sdk_client-0.6.11&_rand=1439267490.101

DPOOL_HEADER: dagda31

LB_HEADER: venus240

0..

GET /t5/register/js/page/login/bilogin.js?version=201508111231 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tjs.sjs.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Tue, 11 Aug 2015 04:31:21 GMT

Content-Type: application/x-javascript

Last-Modified: Thu, 04 Jun 2015 08:58:46 GMT

Vary: Accept-Encoding

Expires: Wed, 26 Aug 2015 04:31:21 GMT

Cache-Control: max-age=1296000

Content-Encoding: gzip

Age: 16

Content-Length: 84945

Via: http/1.1 ctc.shanghai.ha2ts4.130 (ApacheTrafficServer/4.2.1.1 [cHs f ])

X-Via-CDN: f=Edge,s=ctc.shanghai.ha2ts4.130,c=194.242.96.226

.............v.G...*d.....$.....%.r.N.%_K..:$.......4.j(...y..>.1....2..%W.9..b"3..;v.9v.......y1./.....l8..........io9.Mk..{.uv...Am........;..$5.*...5..l9*.y..O.g.../Z...qq0._..em......l...(....tYo.h......X^..;..W.l@..l.......?.]_Rc.X,_L.=~..e...[.]..J .Q..w....oWW...|Q....do^..&;.vb{.y./.7..._g...e4H.o..../~.P.;?....P...[k...2...Q.... ...kk.......%*a.k..E.F./no=P....z.a.'...mM.X...9....9....W.....g...3h.;.....n4...qg.......N'..I1..G........\.%....?xP.Wj....]1Y.;TZ-Z_.?h.........G....l^._/....PqZ.3........n..n...l:-z.--..e.w6.~m...F{..7...o.......]/k.....a........s=..o.....w.q}....Y..q.z.....z.;.k....... ......*KR.Ck.;...D?.|\..M....bG.J........h6_....~.N.jc..|..;..y#;.i.,T...|..-..N 4Y.G.NW.[....8z.|...HR...0.....j~:.S}....6.|..k.k(.Q6C."....[.....^..^.E=...e'?......;h..8R...c.t..O...x9........I.s3aS....5.MOl|G.G.A...* ..i..;.._...t..G..<TcC}..U:x\.zt.;x.....s...u.....C........C..........*l....8.Z.h...^....{..../......k.f..=.....7..Q2......Q..G...._......Y .A.r.4.......S.:..B%..... .]....G>...v...b'..N.HO>.....).s.dm5...5{....eQ.Eghs..69.....U..X.....B..3.-....Q.........#s..U......C.A#...._....{......O.<_..~,...y.`k.....v......`6..w...HC!..c.h....%.P.8....z7.i>..Z~......d.U>..r..2......Q...d....1..k.........sg.R.D....s..o.![..tY.....^.:j...V....a..O&.1}s..4#....-8...y.......h=...s...$...A.Q...v......uP....C.0=a..J.|.{k...$..M*.....%.mD.].l......q'.m&.....W....9.......Z..4./.k.^...E:=.^.w.b....o.t.....L8.hTe.pv.........R`..V...wi....A ..|........6........i......l..Q.r.Af>..y.....@.....

<<< skipped >>>

GET /t4/apps/publicity/static/wbad.js?version=201508111231 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Wed, 26 Aug 2015 04:31:25 GMT

Date: Tue, 11 Aug 2015 04:31:25 GMT

Server: nginx/1.4.2

Content-Type: application/x-javascript

Last-Modified: Mon, 17 Feb 2014 07:16:15 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=1296000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 ny15:4 (Cdn Cache Server V2.0)

Connection: keep-alive

1921.............[.s.Hv.W(x....D.3.5... HI....xv.Bk]....I.......Tn[.%.\rIU.9..?gS....{.......$U.O.......W...y....$......Z."J..Y</\j......iL...}.it...1.....H3g...w...H_..8..ylZ.7.'.<.O."..s!;...........{.f..g.....fc|e...y.v...l>.....bte...`..[....o..g..Y.M......]..3........n..Xk ...QpeY.......um.r.V.k.q.Cq?....r{@0...*)..,....F...Iqo.J'.Y.M2-.L..t1.M5,....u..Z.... ..2.@>^l.9..p&a.*.O......4....u...\^.f..............<..zB....k..\C(.#.J.[.$=8r.)...M}........../.SW..sw.C8...w..~=.6I.|d........,..`..y...4Oo..#..W.".v.....=$.$.a.BV.....M..w.&.&qr;.A.4.>..........c.d.W......".(.......PS.B......V..~..8L.]"....:.u... ..~:[,.8bv..m.V...8.d..)..F4W..L.g.T.Q {....[)H.,....h1..Y.z.3.&......I..`...U..d.. '...L.h..Yz.t:m......v..J.n.N...N...k..F.......p..........j.$D../...B....n.....=...<{. A.>.:N.E....L0FL.R.._rf.&..Wz.....,..u.u.'d.5.i~....}.......(w.n{.<..7....4..a. @!'.&...Yx.mf^|.y.l.......9../.T..%y............9...bG.M.;.|.E..o.......#.).m...i..8.I....[..0.<.*.(..J.o.wa...p.z/|(%.z.U..1.....^\v6.z.>..~..i..F[..x..~.c.e.....J;:..n]kM47-.].....3gj...c=....E./9Y...8Y^.._g.@..@.k.....d.v..e..e*a.|..q<.....XH...-..d!P....^`w.......$.6..c.e.......Dfl....Z.}x5...........D......}...R................O.g.Bo.|.Ok 3.R..?....'......,.a..W....O_t]e....6........cVM...[.l....au.c..B..6...u...N..C/...4..a./.),.~....S[.&.....v.7..xL........s.l..e.Bj...Fj.B`.....YZ....\2,L.L..'......i.7.1-.. ..[.8.ZaK..V..pI....l0.JQ.......'N...'.nw.6..-6o.....N...gR.....>..x.f^a.....3..?Z..|.u...<>.'......w.i2

<<< skipped >>>

POST /isapi/ocget.dll HTTP/1.1

Accept: application/x-cabinet-win32-x86, application/x-pe-win32-x86, application/octet-stream, application/x-setupscript, */*

Content-Type: application/x-www-form-urlencoded

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: codecs.microsoft.com

Content-Length: 67

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: MC1=V=3&GUID=489b59b88cff45798f407a73595398d1

MIMETYPE=application/x-signassist&CLSID=application_2F_x-signassist

HTTP/1.1 404 Not Found

Cache-Control: private

Content-Length: 13

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/8.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 11 Aug 2015 04:31:33 GMT

404 Not FoundHTTP/1.1 404 Not Found..Cache-Control: private..Content-Length: 13..Content-Type: text/html; charset=utf-8..Server: Microsoft-IIS/8.5..X-AspNet-Version: 2.0.50727..X-Powered-By: ASP.NET..Date: Tue, 11 Aug 2015 04:31:33 GMT..404 Not Found..

GET /plugin_proxy.html?proxy=hXXp://weibo.com/sso/desktopcallback&type=userinfo&callback=SINA_USER_PLUGIN.callbacks.callback_14f1b067bea HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: login.sina.com.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Aug 2015 04:31:32 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

DPOOL_HEADER: nyx68

Content-Encoding: gzip

SINA-LB:aGEuMTY4LmcxLmh5ZHMubGIuc2luYW5vZGUuY29t

SINA-TS:YjVlOTgyY2UgMCAwIDAgMTEgMQo=

a48..............mo......?..XHF/.W`(d.].&.....w@!..-.$..........!M....4m.,Y.l-.ti7.p..?c.....=...GJr.x.....s.....3o.^Zy..q...../......:......e...Q..~.;.5..{.....f.Q.....X?2..<iv. dQ-.Z..)1....\.8....7...............;O~Z>q.......A.L)...oo..s}..Q...y*Hv.^B..8......q.B....7KI.......N....3...i{V.:aD....:5..,.v...Db.)..zV`u.gu.........dq.@.N.7..b1S.....8.(...o......0h..zh.Yt.....tq.....\..^HE..a.....H.lq@.<zT<..d..%..{.`t.....;...../...}qg......~....W..~.{~s...)...Sl....k.H..v..>.>..(|......l.K..X....:.M3 {.|=.{}..=...........\m.^.]../#...PC.].."..5C3....4U..z.....?.^....p.HN.DY)r.(c.l.......K'....o.>.8...*s...........i..g.k.w......}u...{.o..|et.............E..o\......C.."....D......!s[.qT .@.i.}R../v].$...D`n....Z.Hl0`............sz..T.......x%Z.P.<)P.P..G................x(j...5...yq.P..."..d.d*.I....&~..Ap.`.F...._q...:Yx$.-? :B........=.Xt..B.{\.$..~.i....(..^....x...|.ku...k.w<] i....6....R%.....t<.?.n9D. PE...yk...q......B.m...[2r.Us....."...7?H%..P..W.Q..P{.Y...(.\.... .)..:|{.@..q... S.... L...X8^...a.c._.......9.V..}0K...Y%t...I.....4.N.....p.!.U..P.V..*.V...`..EY.'`^....V...X..Q..Y.U..........S.....W.s..Y..D.G&..A$a.J.z..d.......a...2.U"k.M.U.`.n}-.Q!G. .Zrl*.<.V..u....HW........,8eE..P...&1..o.U.a......<.80..*.&.Z$U>>._b`.c..(.UU\.....c.^.<9]..y...Y....b...D..j...3~..bah...........C.'.G.....u............x........fd(..'.0....... l..q...9-..2.7"`I.e9..v...."QjX...g..g .d......~|..:./..EB.:....p...V..uB...&..>...L.....f..k.V.....77.m]KnCrH..W._....Irz...8.~.l...

<<< skipped >>>

GET /public/files/image/900x200_img55c5e49193d0e.png HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: u1.img.mobile.sina.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: ngx_openresty

Date: Tue, 11 Aug 2015 02:03:27 GMT

Content-Type: image/png

Content-Length: 60885

Last-Modified: Sat, 08 Aug 2015 11:14:25 GMT

ETag: "55c5e491-edd5"

Accept-Ranges: bytes

Age: 8892

Via: http/1.1 ctc.shanghai.ts.57 (ApacheTrafficServer/4.2.1.1 [cRs f ])

X-Via-CDN: f=Edge,s=ctc.shanghai.ts.57,c=194.242.96.226

.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...miTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:b923aed6-2026-f843-a067-37b5734f9925" xmpMM:DocumentID="xmp.did:00D11E2334D111E5BFD9CFFCD4ECA28F" xmpMM:InstanceID="xmp.iid:00D11E2234D111E5BFD9CFFCD4ECA28F" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2D0A3AAAC934E5119684F8FA944071F9" stRef:documentID="xmp.did:b923aed6-2026-f843-a067-37b5734f9925"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P6|P....PLTE...vG.(....&$...|.....a....*......T....).swd....}..22..n...P.. ..6#.1....^...T*....2..1*.|h..jFZB.S2.B.....[1.uC....;..C"....K(..w....H/.b6.m<.Y,^lkO..hK".,".vk.........-a2.j8.(..\2.tkq.s.:...wu...Z,.I$....lUm$..< .D#..y.S:...F...iT.f]...3....i. ..I$.3..0....P(..S(.B.....@!.D .K!....k<.wLZ.mvhW......A...`J.......$..L2....,..K*.;!.c9..q.VQP......9..U(....6"pK*.XIt...QP... ..M6B.......,..4:.~.:XD.8....#;..H..D(.7......Uv.Z....._.K0./..._.4..4..e4.p[.9..K$.......N2.O$..m....3..su@A...a_.}.......?(...

<<< skipped >>>

GET /sso/prelogin.php?entry=weibo&callback=sinaSSOController.preloginCallBack&su=&rsakt=mod&client=ssologin.js(v1.4.18)&_=1439267453914 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: login.sina.com.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 11 Aug 2015 04:31:32 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

Cache-Control: no-cache, must-revalidate

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Pragma: no-cache

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

DPOOL_HEADER: nyx67

Content-Encoding: gzip

SINA-LB:aGEuMTY4LmcxLmh5ZHMubGIuc2luYW5vZGUuY29t

SINA-TS:YjJlOTgyY2UgMCAwIDAgMTEgNAo=

158............%.Mk.1.D........%u.......0.>3.:.Nf...I0........x..:>==.m.......eo..rZ..,:../...n....;s..m.k....GK(......|z..._.o0O...[..gr..'3..,.<"..M~8.....cx.....;..N........g.-s.........U.)h.N....2...b....3...,....8.%T..UC......T....19W.T..D.a%..Q.SL.@...U..A....VE.b9..}...*.5`..RLJ.....3.....".9..B...k.A..e.=..aw._..[Wa.......O.?......U.l.......0..

GET /t5/style/css/module/base/frame.css?version=201508111231 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Wed, 26 Aug 2015 04:31:21 GMT

Date: Tue, 11 Aug 2015 04:31:21 GMT

Server: nginx/1.4.2

Content-Type: text/css

Last-Modified: Fri, 12 Dec 2014 06:57:34 GMT

Transfer-Encoding: chunked

Cache-Control: max-age=1296000

Content-Encoding: gzip

Age: 1

X-Via: 1.1 qzh164:8110 (Cdn Cache Server V2.0), 1.1 ny14:6 (Cdn Cache Server V2.0)

Connection: keep-alive

400a..............k.#9.0.;...e..U.P.................z....%."..G.....@.`..=..{..{.=I#.t.....y.* %w.h4...F.q.[<.......d...?...u5?.../.r_.O...8....|.........r}.....:.......z.j.ZN.X..,7.....O..O.....3l.vpr;<..........^.,.'...bqr.>..O......qqrw2[...~......}u...7'.U.^.........AV0WdOn.O.r........\,V.....X....l._T..|.^.w.j._&..pW...z..^.....q]...m5..PXmn....y<......q.<V..9P.....w...x.....]..iw.\..U.............o.w.%.....3t..7..}.f.V.^ywW..r;W.].}uX..O......d^..W.....|.[T'........<....1.Cx.)..........$.G_..l.R.......T...gU.a\.'D.....}................!.&_...0..m*....p.nv..u5...j.}..O......W.\.7e.T.w...w..j..N........p..q..m..t...X..0..tf.....I.X...... ....z.\L5...x;).V..l.^....j.......:@.-1.....2.KD...sS..`@....... .q..?B....~...k....T=.y.Lr.-...|.....1e..j.....A[ ...aX...........\W..O.....Z3.%.z........b.gw_..E......_\..a?x1.....i......Z.'.T..G...K.=.Q..q..P.W7...TK..`.....`.....~..x.........n.Z.....D....bu....(...s..B.>|.5.&..u.[-6...j".r.............b.y.4.../~.W..)V[.V......\.sA..h.......8v.)x.....;..S.*...s.q\..w....X..dL$e..s.....}S....nw,....'....!p._.n....].t.Z.iAe.....}x.8..k.......'..O............m..........!.avC.X,r..P..D...hd........./.gW...%K........u.......G.>.....la.H....}..I..0........3 %a.,.0m..:a...Gm...@g.<..e.....x...Z.o....08....-.P;.`..b\.T......UP\jp....;n'...N..jW..j.d..>U....^....z.{.H.&.=lC`..8"..Y..~......'S%.s...\a...-?@..=..[..=.u$b Q.<}.\D..h.|.?.i~.<Cn.....v,......... m.....tR...=...>...'`.t..Wd.&P..].F)#....{........$b...,.{CUy.x*....R..,...=.s....!...

<<< skipped >>>

GET /t5/style/images/register/qrcode_map.jpg?version=201508111231 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Wed, 26 Aug 2015 04:31:21 GMT

Date: Tue, 11 Aug 2015 04:31:21 GMT

Server: nginx/1.4.2

Content-Type: image/jpeg

Content-Length: 32547

Last-Modified: Thu, 26 Sep 2013 08:53:47 GMT

ETag: "5243f61b-7f23"

Cache-Control: max-age=1296000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 qzh162:8105 (Cdn Cache Server V2.0), 1.1 ny18:10 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......Z.....)hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:CDE244610F0111E3B0D5ECD79BE8843E" xmpMM:DocumentID="xmp.did:CDE244620F0111E3B0D5ECD79BE8843E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CDE2445F0F0111E3B0D5ECD79BE8843E" stRef:documentID="xmp.did:CDE244600F0111E3B0D5ECD79BE8843E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d................1..=...Y....!............................................................................................................................................................#....................................................................................0!24...@"3. P1#$5`'........................!.1A"2.Qaq.3.....#...BR.......5 .r....60....s$4t..b.CS.....cTd&.....................!.1A..0@.aq....2Q"3 P...#.Bb...`p.RrS....................!1AQa..q.0......@ .P`.................hp...a.1h........4..$.^JN.]N.o......c..........|q....................|..b..x.T......6...F:y.U7.9..0..6j..q....].V.>c..

<<< skipped >>>

GET /t5/style/images/register/main_bg.png?id=1370232467959 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 15 Aug 2015 07:05:24 GMT

Date: Fri, 31 Jul 2015 07:05:24 GMT

Server: nginx/1.4.2

Content-Type: image/png

Content-Length: 19759

Last-Modified: Wed, 12 Mar 2014 08:58:09 GMT

ETag: "532021a1-4d2f"

Cache-Control: max-age=1296000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 qzh195:8080 (Cdn Cache Server V2.0), 1.1 ny15:2 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR................m....pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<< skipped >>>

GET /t5/style/images/register/form_login.gif?id=1370232467958 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 15 Aug 2015 08:26:06 GMT

Date: Fri, 31 Jul 2015 08:26:06 GMT

Server: nginx/1.4.2

Content-Type: image/gif

Content-Length: 6467

Last-Modified: Fri, 27 Jun 2014 03:04:35 GMT

ETag: "53acdf43-1943"

Cache-Control: max-age=1296000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 qzh158:8109 (Cdn Cache Server V2.0), 1.1 ny18:2 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a..................R.....N.......#...&...........1Jh.~~~.........]]].......N3.....n...............eee...Tv....SSS...mmm5S.ttt...HHH...w}..........,J.aaa.........%%%........................xxx. ....444......A.#qqq............iiizzzyy}yz... yy~)2..i/.m4.L...V...~~.#.(Z}....&$0a.....[.,............zz~.........8|...\Op.M. .."<[.3P....2;...................[.IRZ.CK.......Ei...8........0...v....F.....J%.7z.r.......q(>.0.........|.hBCWU.Y.i.B`.,..j..8W....P.....f..........3.....u........Ynt.<D....S..t.......Ra.....,L...R.....j]c....s.'...JR...................ek...%...01C.....x..U1T...............{Wp...y.....Ht..........!.QL..e5[....k...9"....x6.....G...x....... .#..8..U..2.4............B..WD?>i.....~G q...l0.....4........F..J..]......]x.........O...wh^6X.........~.........!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C98D5FDC09D6E1119416B167D927D19B" xmpMM:DocumentID="xmp.did:B9F31767F04811E3BA8A9776A84B467E" xmpMM:InstanceID="xmp.iid:B9F31766F04811E3BA8A9776A84B467E" xmp:CreatorTool="Adobe Photoshop CS4 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:70a026cd-6988-

<<< skipped >>>

GET /t5/style/images/register/login_ad_default.jpg?id=1370232467958 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 15 Aug 2015 07:05:24 GMT

Date: Fri, 31 Jul 2015 07:05:24 GMT

Server: nginx/1.4.2

Content-Type: image/jpeg

Content-Length: 43214

Last-Modified: Wed, 19 Dec 2012 09:04:54 GMT

ETag: "50d18336-a8ce"

Cache-Control: max-age=1296000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 qzh162:88 (Cdn Cache Server V2.0), 1.1 ny18:6 (Cdn Cache Server V2.0)

Connection: keep-alive

......Exif..II*.................Ducky.......F.....ohXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0280117407206811B6D0AF6BAC718C8A" xmpMM:DocumentID="xmp.did:C81475FE414111E29874C41135186221" xmpMM:InstanceID="xmp.iid:C81475FD414111E29874C41135186221" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:90883988BA206811822A8C78808BC70F" stRef:documentID="xmp.did:0280117407206811B6D0AF6BAC718C8A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d..............................................................................................................................................................................................................................................!..1AQa..q."..2R....Bbr.#....3S.$...C.T.U....4%V.Dt...c....E..........................!1AQ.aq......"2.....BRb.#r..3$.....C4..Ss..T%5............?..@.H....B....4 >...J........=.......@...d{..(c~.. .#g.........pU,(.?..pQQA.8..}.EY4C.P.......B.......b..;h.7>6..P*...9.}.......?..pV......7..i..Q..m..(.4

<<< skipped >>>

GET /t5/style/images/register/logo.png?id=1395992130776 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 15 Aug 2015 07:05:24 GMT

Date: Fri, 31 Jul 2015 07:05:24 GMT

Server: nginx/1.4.2

Content-Type: image/png

Content-Length: 4069

Last-Modified: Fri, 28 Mar 2014 08:23:43 GMT

ETag: "5335318f-fe5"

Cache-Control: max-age=1296000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 qzh159:8109 (Cdn Cache Server V2.0), 1.1 ny15:4 (Cdn Cache Server V2.0)

Connection: keep-alive

.PNG........IHDR...y...(......(U.....pHYs................ cHRM..z%..............u0...`..:....o._.F...kIDATx...{|T.....$'....(.......:.o......T.*.wm....x_..,jE...FE.Z .....R.W.4..G.....8...!.$y....NNf&...uy>...9........}'.Z.>.nS`...c.>.........n...`.......x....e.*.......K.Gh.U..@.G...c.k.7.J[...>......Y.9.x..G.....}l.'3.2.#.~@.P...N...]|.g.#MYe.n.....@......jY.{2...8..........9..Y............n....=c.p.X0........q.<.`.#.sM...r......W.?..<..}..>..X..oT..,...p%x^ku....e..\.=`..X0.`,....RZY........,.......<r.-......-..r<0....~.-...E.?............-W5O....4O..I.. ..~(....\....3\..\`..W..yj........`..X0.D...(.I...7..`.u.c`...-..n.#'..K..j..4y.L.3.w.4..%8.U.'..?y...........>.b.a.;..$.......{..}R...y....c.p.0..Y......c2.e.6........).."&%i.)...0nP..D`.p....:*d...[...z._..z...n.....1.....p....bJ.Y.L...`[...`....=arn......p@..v.(Ye.[ly.Z..z.d-n..e.#.LY.J-....U..crD...~...#.......XI. .....;.!.'S.3......j`..}...a..UL~..z.B.m0...n..~.H...@g..SV9C..[...x.8.p....LY.z[.yGB..SQ>....Y. bn.p..t.U8S...9i...#....?........z....A.....&-...,A&*....35..c...#..]...G.i...i]=......Gg....my.j..$.IR....4.....LWI...^.U."]I...~..9...=.#)..z.....).V.....o.n.a...,'E.~R.o....&..s5...Sc..R..t..x$..7...Y...."I.=.N.4=H.s.L.k......%.m..v..<f7.. ...@U.xY.2.{......l)0.7.@}GE...@-.}w.2Y...0.}d.4...C.Ui.^...?......H.i.%h.N.hCm]...C....>k...[....M..(]..{.'O.C..*u. ..I.....<.k2..#.UW..k.6w.1.......=........R..TLI........>....7..$...^cr,..J..o.>.......H./...........:.Oy.U....)&...dz.f..1i.Q7!.&.S.'.....$....K...

<<< skipped >>>

GET /t5/style/images/register/form_login.gif?id=1370232467959 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 15 Aug 2015 08:26:18 GMT

Date: Fri, 31 Jul 2015 08:26:18 GMT

Server: nginx/1.4.2

Content-Type: image/gif

Content-Length: 6467

Last-Modified: Fri, 27 Jun 2014 03:04:35 GMT

ETag: "53acdf43-1943"

Cache-Control: max-age=1296000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 qzh158:8109 (Cdn Cache Server V2.0), 1.1 ny18:2 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a..................R.....N.......#...&...........1Jh.~~~.........]]].......N3.....n...............eee...Tv....SSS...mmm5S.ttt...HHH...w}..........,J.aaa.........%%%........................xxx. ....444......A.#qqq............iiizzzyy}yz... yy~)2..i/.m4.L...V...~~.#.(Z}....&$0a.....[.,............zz~.........8|...\Op.M. .."<[.3P....2;...................[.IRZ.CK.......Ei...8........0...v....F.....J%.7z.r.......q(>.0.........|.hBCWU.Y.i.B`.,..j..8W....P.....f..........3.....u........Ynt.<D....S..t.......Ra.....,L...R.....j]c....s.'...JR...................ek...%...01C.....x..U1T...............{Wp...y.....Ht..........!.QL..e5[....k...9"....x6.....G...x....... .#..8..U..2.4............B..WD?>i.....~G q...l0.....4........F..J..]......]x.........O...wh^6X.........~.........!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C98D5FDC09D6E1119416B167D927D19B" xmpMM:DocumentID="xmp.did:B9F31767F04811E3BA8A9776A84B467E" xmpMM:InstanceID="xmp.iid:B9F31766F04811E3BA8A9776A84B467E" xmp:CreatorTool="Adobe Photoshop CS4 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:70a026cd-6988-

<<< skipped >>>

GET /t5/style/images/register/form_login.gif?id=1370232467960 HTTP/1.1

Accept: */*

Referer: hXXp://weibo.com/login.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.t.sinajs.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sat, 15 Aug 2015 08:26:23 GMT

Date: Fri, 31 Jul 2015 08:26:23 GMT

Server: nginx/1.4.2

Content-Type: image/gif

Content-Length: 6467

Last-Modified: Fri, 27 Jun 2014 03:04:35 GMT

ETag: "53acdf43-1943"

Cache-Control: max-age=1296000

Accept-Ranges: bytes

Age: 1

X-Via: 1.1 qzh158:8109 (Cdn Cache Server V2.0), 1.1 ny18:2 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a..................R.....N.......#...&...........1Jh.~~~.........]]].......N3.....n...............eee...Tv....SSS...mmm5S.ttt...HHH...w}..........,J.aaa.........%%%........................xxx. ....444......A.#qqq............iiizzzyy}yz... yy~)2..i/.m4.L...V...~~.#.(Z}....&$0a.....[.,............zz~.........8|...\Op.M. .."<[.3P....2;...................[.IRZ.CK.......Ei...8........0...v....F.....J%.7z.r.......q(>.0.........|.hBCWU.Y.i.B`.,..j..8W....P.....f..........3.....u........Ynt.<D....S..t.......Ra.....,L...R.....j]c....s.'...JR...................ek...%...01C.....x..U1T...............{Wp...y.....Ht..........!.QL..e5[....k...9"....x6.....G...x....... .#..8..U..2.4............B..WD?>i.....~G q...l0.....4........F..J..]......]x.........O...wh^6X.........~.........!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:C98D5FDC09D6E1119416B167D927D19B" xmpMM:DocumentID="xmp.did:B9F31767F04811E3BA8A9776A84B467E" xmpMM:InstanceID="xmp.iid:B9F31766F04811E3BA8A9776A84B467E" xmp:CreatorTool="Adobe Photoshop CS4 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:70a026cd-6988-

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_172:

.text

`.rdata

@.data

.rsrc

t$(SSh

~%UVW

u$SShe

kernel32.dll

setupapi.dll

advapi32.dll

ole32.dll

dc.dll

wininet.dll

rasapi32.dll

ADVAPI32.DLL

shlwapi.dll

HID.DLL

SetupApi.dll

HID.dll

Kernel32.dll

user32.dll

gdi32.dll

OLEACC.DLL

User32.dll

oleaut32.dll

gdiplus.dll

SetupDiOpenClassRegKey

RegCloseKey

ReportError

RegCreateKeyA

RegOpenKeyA

RegEnumKeyA

RegFlushKey

RegDeleteKeyA

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

GetUrlCacheEntryInfoA

MsgWaitForMultipleObjects

GetWindowsDirectoryA

GdiplusShutdown

%System%\ntdll.dll

%System%\kernel32.dll

%System%\USER32.dll

%System%\GDI32.dll

%System%\ADVAPI32.dll

%System%\RPCRT4.dll

%System%\Secur32.dll

%System%\IMM32.DLL

%System%\LPK.DLL

%System%\USP10.dll

%System%\WINMM.dll

%System%\comdlg32.dll

%System%\msvcrt.dll

%System%\SHLWAPI.dll

%System%\SHELL32.dll

%System%\WINSPOOL.DRV

%System%\ole32.dll

%System%\OLEPRO32.DLL

%System%\OLEAUT32.dll

%System%\WS2_32.dll

%System%\WS2HELP.dll

%System%\uxtheme.dll

%System%\MSIMG32.dll

%System%\MSVCP60.dll

%System%\WININET.dll

%System%\CRYPT32.dll

%System%\MSASN1.dll

%System%\PSAPI.DLL

%System%\VERSION.dll

%System%\urlmon.dll

Web.dll

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0001

{4D36E972-E325-11CE-BFC1-08002bE10318}

{36FC9E60-C465-11CF-8056-444553540000}

{4D36E965-E325-11CE-BFC1-08002BE10318}

{4D36E969-E325-11CE-BFC1-08002BE10318}

{4D36E968-E325-11CE-BFC1-08002BE10318}

{4D36E96C-E325-11CE-BFC1-08002BE10318}

{4D36E96B-E325-11CE-BFC1-08002BE10318}

{4D36E96F-E325-11CE-BFC1-08002BE10318}

{4D36E979-E325-11CE-BFC1-08002BE10318}

{4D36E96D-E325-11CE-BFC1-08002BE10318}

{4D36E978-E325-11CE-BFC1-08002BE10318}

.iqW>

"3/%F

href==hXXp://weibo.com/logout.php?backurl=/

Name==password

hXXp://login.sina.com.cn/cgi/pin.php?r=

hXXp://weibo.com/login.php

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies

\*.txt

*.txt|*.txt

\dc.dll

@.reloc

MFC42.DLL

MSVCRT.dll

KERNEL32.dll

WSOCK32.dll

MSVCP60.dll

ReportError_A

VBYB_ReportError

VB_ReportError

uu_loginA

uu_loginW

uu_reportError

debug.ini

ReportError:%s

Error:%s

%s|!|%s

\dms.pdb

%u%u,

dclog.txt

config.ini

port

settimeout:%d

[%d]%s

reg2:%s

checkok:%s %s

check fail:%s %s %s

check:%s %s

getcjfail:%s %s

getcj:%s %s

%s%uout

%s%uin

put img ok:%s

put img fail:%s

put img:%s %s %d

get result ok:%s,%s

get result fail:%s

get result:%s

notifyfail ok:%s

%s\%d-%s.png

notifyfail fail:%s,%s

notifyfail:%s

getimgok:%s,%s

getimg:%s

getinfo fail:%s

getinfo:%s,%s

setresult:%s,%s

HTTP/1.1 200 OK

recv:%d

send:%d

GET /ip.txt HTTP/1.1

Host: %s

User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2

select:%d

ioctlsocket:%d

socket:%d

api.qqchaoren.net

14.17.65.24

14.17.65.23

dama2.qqchaoren.net

dama1.qqchaoren.net

connect total:%s %d

:%s %d

connect discard:%s %d

[d-d-d d:d:d](u)

recv timeout:

recvfail:%d

server close:%d

recv:%d

send:%d

sendfail:%d

connect timeout:

connectok:%s %hu

127.0.0.1

1.1.3

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

%Program Files%\Windowsid\id.id

hXXp://VVV.2345.com/?kweige

ux

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps