MD5: e871444241280296b8631295b5825927
SHA1: 5fd00fa38070b0191d69b730dfff5bc720948793
SHA256: a04d3bcd8a76e6d82d250589807fc4c3f34ecb1dff5e1fc4d2f6ecf158705355
SSDeep: 98304: 7pCo9V4oRqfvCuafAJYvtTHCfZM3ErAJj:KDRJG66UR
Size: 5169152 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: InstallShieldArchive, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171, UPolyXv05_v6
Company:
Created at: 2016-01-26 13:24:10
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:3856

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:3856 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7ACIT357.txt (99 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIR4YGN2\load[1].gif (817 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\json2[1].js (7098 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IBPSKBRA\TCapIframeApi[1].js (73 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X66G0HIG\c_login_2[1].js (71284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X66G0HIG\ptui_ver[1].js (227 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\ptqrshow[1].png (446 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IBPSKBRA\cross_proxy[1].htm (223 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIR4YGN2\ptlogin_report[1].bmp (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X66G0HIG\TCapMsg[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\login[1].htm (4192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIR4YGN2\TCapIframe[1].js (4280 bytes)

Registry activity

The process %original file name%.exe:3856 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1453807450"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASAPI32]
"EnableFileTracing" = "0"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASMANCS]
"EnableFileTracing" = "0"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1916x902x32(BGR 0)" = "31,31,31,31"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 38 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\e871444241280296b8631295b5825927_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://www.hts88.com/最新版本.txt	103.242.111.137
hxxp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&	103.7.30.66
hxxp://p21.tcdn.qq.com/ptlogin/v4/style/40/images/icon_3_tiny.png
hxxp://p21.tcdn.qq.com/ptlogin/ver/10191/js/c_login_2.js?max_age=604800&ptui_identifier=000D9288C52C261746D6A3CB229D592492596A2493DB595A7ABB516C
hxxp://ui.ptlogin2.qq.com/cross_proxy.html	103.7.30.66
hxxp://p21.tcdn.qq.com/ptlogin/v4/style/0/images/load.gif
hxxp://p21.tcdn.qq.com/ptlogin/v4/style/20/images/shouQ_v2/small_8.png
hxxp://a1574.b.akamai.net/ptqrshow?appid=21000124&e=2&l=M&s=3&d=72&v=4&t=0.5992096586091892&daid=8
hxxp://ui.ptlogin2.qq.com/ptui_ver.js?v=0.29195693338865&ptui_identifier=000D74716AFE765DD422E3A9AF7256D0174B34E79F5E56D5025B4481	103.7.30.66
hxxp://ui.ptlogin2.qq.com/cgi-bin/report?id=358342&t=0.12088238526976086	103.7.30.66
hxxp://captcha.qq.com/template/TCapIframeApi.js?aid=21000124&rand=0.8873663435230374&clientype=2&lang=2052&apptype=2	112.90.83.73
hxxp://log.ptlogin2.tencent-cloud.com/cgi-bin/ptlogin_report?id=294059&msg=访问ui延时超过5s:delay=12680;domContentLoadedEventEnd=1483697690498;navigationStart=1483697677818;clientip=;serverip=|_|http://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1%3Dhttp%3A//cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http%3A//cf.qq.com/clan-system/index.shtml&|_|Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)&v=0.8188962360270577
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697695696&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697698699&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://p21.tcdn.qq.com/2/json2.js
hxxp://p21.tcdn.qq.com/2/TCapMsg.js
hxxp://p21.tcdn.qq.com/2/TCapIframe.js?v=1.0
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697701710&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697704721&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697707731&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697710742&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697713753&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697716763&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697719774&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697722785&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697725796&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697728806&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697731817&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697734822&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697737831&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://a1574.b.akamai.net/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697740842&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&
hxxp://imgcache.qq.com/ptlogin/v4/style/40/images/icon_3_tiny.png	203.205.158.38
hxxp://ptlogin2.qq.com/ptqrshow?appid=21000124&e=2&l=M&s=3&d=72&v=4&t=0.5992096586091892&daid=8	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697719774&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697707731&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697716763&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697728806&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://captcha.gtimg.com/2/json2.js	203.205.158.37
hxxp://imgcache.qq.com/ptlogin/v4/style/20/images/shouQ_v2/small_8.png	203.205.158.38
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697698699&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://captcha.gtimg.com/2/TCapIframe.js?v=1.0	203.205.158.37
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697725796&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://imgcache.qq.com/ptlogin/v4/style/0/images/load.gif	203.205.158.38
hxxp://log.wtlogin.qq.com/cgi-bin/ptlogin_report?id=294059&msg=访问ui延时超过5s:delay=12680;domContentLoadedEventEnd=1483697690498;navigationStart=1483697677818;clientip=;serverip=|_|http://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1%3Dhttp%3A//cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http%3A//cf.qq.com/clan-system/index.shtml&|_|Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)&v=0.8188962360270577	183.61.38.241
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697710742&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697713753&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://captcha.gtimg.com/2/TCapMsg.js	203.205.158.37
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697704721&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697701710&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697737831&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697731817&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697695696&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697740842&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://imgcache.qq.com/ptlogin/ver/10191/js/c_login_2.js?max_age=604800&ptui_identifier=000D9288C52C261746D6A3CB229D592492596A2493DB595A7ABB516C	203.205.158.38
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697722785&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115
hxxp://ptlogin2.qq.com/ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697734822&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8&	87.245.221.115

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0

Traffic

GET /cgi-bin/report?id=358342&t=0.12088238526976086 HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ui.ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_user_id=18433456486385466354; login_param=qlogin_jumpname=jump&qlogin_param=u1%3Dhttp%3A//cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http%3A//cf.qq.com/clan-system/index.shtml&; ptui_identifier=000DF9BBF2BAC0007C39294D555E97DA34547B2DD5A6FBF5A2E8546E; pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Connection: keep-alive

Keep-Alive: timeout=50, max=1024

Server: QZHTTP-2.38.20

Date: Fri, 06 Jan 2017 10:14:48 GMT

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: image/bmp;

Content-Length: 66
BMB.......>...(...................................................H
TTP/1.1 200 OK..Connection: keep-alive..Keep-Alive: timeout=50, max=10
24..Server: QZHTTP-2.38.20..Date: Fri, 06 Jan 2017 10:14:48 GMT..Pragm
a: no-cache..Cache-Control: no-cache; must-revalidate..Content-Type: i
mage/bmp;..Content-Length: 66..BMB.......>...(.....................
................................

GET /ptqrshow?appid=21000124&e=2&l=M&s=3&d=72&v=4&t=0.5992096586091892&daid=8 HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439

HTTP/1.1 200 OK

Server: tencent http server

Accept-Ranges: bytes

Pragma: No-cache

P3P: CP="CAO PSA OUR"

Content-Type: image/png

Content-Length: 446

Date: Fri, 06 Jan 2017 10:14:47 GMT

Connection: keep-alive

Set-Cookie: qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg; PATH=/; DOMAIN=ptlogin2.qq.com;
.PNG........IHDR...o...o.............pHYs................pIDAT8...=.. 
...1.tz...A....... .q......q...I..../..S..q........H%...&"..e...N.....
.........j.....]...-..E.?...H..\..W....(v.~5..<.Zu..J.Z..d....](...
...P..........]..c..@Z.T.S%'....C...[..|z..9d.|.U.I.|..s.%..i..s..qo^.
J:...\.aT...P.[....4_=.!l..w..4....2[.I..K?.\%.@:n....Z..<=..M.K...
@?..VY..0N..e.e..D#.S&.A.w...........LH1Q....F0*....X8.Q.-bO&..M...:q.
..#.&b.......4|]%..e....IEND.B`.HTTP/1.1 200 OK..Server: tencent http 
server..Accept-Ranges: bytes..Pragma: No-cache..P3P: CP="CAO PSA OUR".
.Content-Type: image/png..Content-Length: 446..Date: Fri, 06 Jan 2017 
10:14:47 GMT..Connection: keep-alive..Set-Cookie: qrsig=i4Ss2U4nK6KHDl
D9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg; PATH=/; DOMAIN=ptl
ogin2.qq.com;...PNG........IHDR...o...o.............pHYs..............
..pIDAT8...=.. ...1.tz...A....... .q......q...I..../..S..q........H%..
.&"..e...N..............j.....]...-..E.?...H..\..W....(v.~5..<.Zu..
J.Z..d....](......P..........]..c..@Z.T.S%'....C...[..|z..9d.|.U.I.|..
s.%..i..s..qo^.J:...\.aT...P.[....4_=.!l..w..4....2[.I..K?.\%.@:n....Z
..<=..M.K...@?..VY..0N..e.e..D#.S&.A.w...........LH1Q....F0*....X8.
Q.-bO&..M...:q...#.&b.......4|]%..e....IEND.B`.....
<<< skipped >>>

GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697695696&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 65

Date: Fri, 06 Jan 2017 10:14:51 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(321937164)', '');..HTTP/
1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cach
e-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appli
cation/x-javascript; charset=utf-8..Content-Length: 65..Date: Fri, 06 
Jan 2017 10:14:51 GMT..Connection: keep-alive..ptuiCB('66','0','','0',
'.....................(321937164)', '');......


GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697698699&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:14:54 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(3553628376)', '');..HTTP
/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cac
he-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appl
ication/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06
 Jan 2017 10:14:54 GMT..Connection: keep-alive..ptuiCB('66','0','','0'
,'.....................(3553628376)', '');......


GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697701710&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:14:57 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(3804255596)', '');..HTTP
/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cac
he-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appl
ication/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06
 Jan 2017 10:14:57 GMT..Connection: keep-alive..ptuiCB('66','0','','0'
,'.....................(3804255596)', '');......


GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697704721&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:00 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(1914719180)', '');..HTTP
/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cac
he-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appl
ication/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06
 Jan 2017 10:15:00 GMT..Connection: keep-alive..ptuiCB('66','0','','0'
,'.....................(1914719180)', '');......


GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697707731&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:03 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(3469740448)', '');..HTTP
/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cac
he-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appl
ication/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06
 Jan 2017 10:15:03 GMT..Connection: keep-alive..ptuiCB('66','0','','0'
,'.....................(3469740448)', '');......


GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697710742&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:06 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(2657106368)', '');..HTTP
/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cac
he-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appl
ication/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06
 Jan 2017 10:15:06 GMT..Connection: keep-alive..ptuiCB('66','0','','0'
,'.....................(2657106368)', '');......


GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697713753&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 65

Date: Fri, 06 Jan 2017 10:15:09 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(254814440)', '');..HTTP/
1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cach
e-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appli
cation/x-javascript; charset=utf-8..Content-Length: 65..Date: Fri, 06 
Jan 2017 10:15:09 GMT..Connection: keep-alive..ptuiCB('66','0','','0',
'.....................(254814440)', '');......


GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697716763&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:12 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(3331328724)', '');..HTTP
/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cac
he-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appl
ication/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06
 Jan 2017 10:15:12 GMT..Connection: keep-alive..ptuiCB('66','0','','0'
,'.....................(3331328724)', '');......


GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697719774&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:15 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(3683655188)', '');..HTTP
/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cac
he-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appl
ication/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06
 Jan 2017 10:15:15 GMT..Connection: keep-alive..ptuiCB('66','0','','0'
,'.....................(3683655188)', '');......


GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697722785&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:18 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(2530221588)', '');..HTTP
/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cac
he-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appl
ication/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06
 Jan 2017 10:15:18 GMT..Connection: keep-alive..ptuiCB('66','0','','0'
,'.....................(2530221588)', '');......


GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697725796&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:21 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(3438293024)', '');..HTTP
/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cac
he-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appl
ication/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06
 Jan 2017 10:15:21 GMT..Connection: keep-alive..ptuiCB('66','0','','0'
,'.....................(3438293024)', '');......


GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697728806&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:24 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(1391478524)', '');..HTTP
/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cac
he-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appl
ication/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06
 Jan 2017 10:15:24 GMT..Connection: keep-alive..ptuiCB('66','0','','0'
,'.....................(1391478524)', '');......


GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697731817&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:28 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(3048234764)', '');..HTTP
/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cac
he-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appl
ication/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06
 Jan 2017 10:15:28 GMT..Connection: keep-alive..ptuiCB('66','0','','0'
,'.....................(3048234764)', '');......


GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697734822&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:30 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(3833595396)', '');..HTTP
/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cac
he-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appl
ication/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06
 Jan 2017 10:15:30 GMT..Connection: keep-alive..ptuiCB('66','0','','0'
,'.....................(3833595396)', '');......


GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697737831&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:33 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(2257604764)', '');..HTTP
/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cac
he-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appl
ication/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06
 Jan 2017 10:15:33 GMT..Connection: keep-alive..ptuiCB('66','0','','0'
,'.....................(2257604764)', '');......


GET /ptqrlogin?u1=http://cf.qq.com/clan-system/index.shtml&ptredirect=1&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=0-0-1483697740842&js_ver=10191&js_type=1&login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk&pt_uistyle=40&aid=21000124&daid=8& HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439; qrsig=i4Ss2U4nK6KHDlD9ykFZaE3jLJDvV1wL4doJ*M0tTVVuf0Q6X-ZQ7*-bhrBjaJvg

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Expires: -1

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 66

Date: Fri, 06 Jan 2017 10:15:36 GMT

Connection: keep-alive
ptuiCB('66','0','','0','.....................(3958399348)', '');..HTTP
/1.1 200 OK..Server: Tencent Login Server/2.0.0..Pragma: no-cache..Cac
he-Control: no-cache; must-revalidate..Expires: -1..Content-Type: appl
ication/x-javascript; charset=utf-8..Content-Length: 66..Date: Fri, 06
 Jan 2017 10:15:36 GMT..Connection: keep-alive..ptuiCB('66','0','','0'
,'.....................(3958399348)', '');......

GET /cross_proxy.html HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ui.ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_user_id=18433456486385466354; login_param=qlogin_jumpname=jump&qlogin_param=u1%3Dhttp%3A//cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http%3A//cf.qq.com/clan-system/index.shtml&; ptui_identifier=000DF9BBF2BAC0007C39294D555E97DA34547B2DD5A6FBF5A2E8546E; pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439

HTTP/1.1 200 OK

Server: QZHTTP-2.38.20

Connection: close

Date: Fri, 06 Jan 2017 10:14:48 GMT

Content-Length: 1001

Last-Modified: Mon, 01 Jun 2015 01:52:25 GMT

Content-Type: text/html

Content-Encoding: gzip

Cache-Control: public; max-age=86400

Expires: Sat, 07 Jan 2017 10:14:48 GMT
...........U[o.E.~.H........S.H.'.@.T.5mI]..:.xwlo..qgfc..R....-OE%B..
<TH.VB..A......_`f.N.KA..3.|.;.9..c.J....%P...\.~.....Y.>:[@h...
>~..|...3..p.......-]....h..j.Zv..MY..WP[q......c../|xnrb>..n..w
N.....js.&.W....(t....5..h$H$..N.@.....i.....W.......}...hD Br..h.3..E
J.....BR..n.5..*.5.@.p.k....UBv.........Ys.u....D...8.E...f..b..(.\.)B
Z....FA.Bk_.9.m.D...^..y.....KM5.<E.<F9_.......BFP.f.3i.....6-..
.l......w/.?....L.....{.l.....6~L~.L.....=..s......~6.~.../.......`D.L
.a.....1...}.8u....i..21N...e...k..b....a.$.$....:!),..e...;../v_>.
...A.m......Cr.)h..g..W....?I.?......V.....7...d..:0..S;...MN...p.....
'. ^.s.........m4i$S?..F..........j9o.iXR`...0>.....^H99.O%.J.g....
.uRc.#L..0*..[.<....|...VR.....4.V..zF.....V.G.0T..6.x...-.....e..@
....y;&.#..#l......Ys.Zr...z....7QF.4....L..B~...f,yp..[..Q..H...D.]W"
J.u]T.FL..q..q..^.By...5n&.-......l....`W..t.X.|7....]Pn.i..Z..<..r
i:[^......R.q,5[...*.v.x......A.....L"..C..H..,0.H.......0l...R..U.-..
=..~.7..r.....3.....;.F!..........).6.._.....$.......

GET /ptui_ver.js?v=0.29195693338865&ptui_identifier=000D74716AFE765DD422E3A9AF7256D0174B34E79F5E56D5025B4481 HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ui.ptlogin2.qq.com

Connection: Keep-Alive

Cookie: pt_user_id=18433456486385466354; login_param=qlogin_jumpname=jump&qlogin_param=u1%3Dhttp%3A//cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http%3A//cf.qq.com/clan-system/index.shtml&; ptui_identifier=000DF9BBF2BAC0007C39294D555E97DA34547B2DD5A6FBF5A2E8546E; pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; pt_clientip=7accc2f260e2f09b; pt_serverip=1e2b0ac5019a3062; uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; pt_local_token=0.7203277854780439

HTTP/1.1 200 OK

Server: QZHTTP-2.38.20

Connection: close

Date: Fri, 06 Jan 2017 10:14:47 GMT

Content-Length: 177

Last-Modified: Tue, 03 Jan 2017 02:07:21 GMT

Content-Type: application/x-javascript

Content-Encoding: gzip

Cache-Control: public; max-age=86400

Expires: Sat, 07 Jan 2017 10:14:47 GMT
..........U....0.._Ev......2....neM..m.............>.Q.SR..KI.v.!.o
..c..U...`xJ&D.4.s.R..G}.....n..$.r.0.5.h@iW.y..,.J....0z......s}.v.I~
.8. ..6....w.3.Z..b...$.:...hL............

GET /2/json2.js HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: captcha.gtimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Date: Fri, 06 Jan 2017 10:14:54 GMT

Cache-Control: max-age=600

Expires: Fri, 06 Jan 2017 10:24:54 GMT

Last-Modified: Tue, 03 Jan 2017 07:41:37 GMT

Content-Type: application/x-javascript

Content-Length: 5426

Content-Encoding: gzip

Keep-Alive: timeout=60 

X-Cache-Lookup: Hit From Disktank Gz
...........<ks.8... 0..PJdY.e27..|.....$N........@..Ej...........l'
;u....D.h4...fv.o....$~9.....h............fQ..w.J.....t,.....~:.&.....
....;q|">|.....wC...H...o._N...O........J.E.......f.....a.^.^f.E...
x..".......I...L.U..A..{..J..:JnV*..u...Jf~.....&.....~..U..^.. ......
....3....uvr....o.....`.........zw$......G'.?:9..........tvr....I.FJ..
......Q2.....dv......@.0...&. ./.y6.Y..oapC.d<.k.fJ../......Q.."..H
_......o..Ec.w.....\.D....Y!.......T.4.7..x.u..H.y...7.R.&.A..9.....a.
.d.aV.5..B.......E=3.6..`A....'(b..!.c._$.....B..T..J.V>.....a<.
..8...X.6...`....T.......#Y.9<...\].b.FQ'4.1 ..h......LI..,B.....[.
.X.@.:.......!.s.R..v.... .....\..TTA..-zY./...7.=d..,.e.}.. nZ/....X.
.'2.P @.-.|.....Pb.&..'%$.#r.i...jZP..u.bG.X.P..".....XUg\'Op..(F....~
l.#V..}.>. .;B..)..<.Jm. CqX.7O`.q.B..PF...1.5U .L....*...U..j..
....k..E...B.Wy.\.....~...L.(.m3..'UE...Pf-3b=.^*0PY.....:....1..Cmd.!
.P...*.....Z....h(..EX.cc...8..(x..!.]..7k5..|S...l./n[....zq...vw...0
%..]......J.fDJf9..yx.27....!b..bo$..7......x.u.}s......B._.../....i..
._.o..w...u.~.]Z...b...S...~......O.[R....S...p.. .<....*...r.?.&..
..D.....A..B..\.e.3k....&U..V.n.... ..R.F...>T4.._....!.6.#...YB...
...b.L`..9f.\.;..2kh.....#.t..yu.G.........k..!.fXS.....5#..C.n....T..
.....f..a.=.. =AV..zV"l.C.f`......B.>........N.R...9,...!.B&.,...D?
......H..8c...S...6..0t4....n..i.^..>.....n...]k7..9.Z...T`..F...g.
..7.....3.U.Z..-..M.m. .._.IKqs...'_r..t.s.r F.......$$.....cq. ......
...1.F:.:.ZA..r...;j..o4.VA1....MCIK0.wp.>..........[. .V..q.[.
<<< skipped >>>

GET /2/TCapIframe.js?v=1.0 HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: captcha.gtimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Date: Fri, 06 Jan 2017 10:14:54 GMT

Cache-Control: max-age=600

Expires: Fri, 06 Jan 2017 10:24:54 GMT

Last-Modified: Tue, 03 Jan 2017 02:10:54 GMT

Content-Type: application/x-javascript

Content-Length: 3148

Content-Encoding: gzip

Keep-Alive: timeout=60 

X-Cache-Lookup: Hit From Disktank Gz
...........Ym..... :N....H.}v. 7.MR...7.k..E.P.$!......%.... ...v.o.p'
b.....g_x.....".Up(...W......Wc.......]x..}2..w..H..../l..C.{.o.].....
....=\~..sE.X.\...5.,K....x..Ro..P.<3...Kr6P....q....t..jq...K....u
.8..E...X..?~y})n3..T.2....\.A.t...dq<.............bj...z.J.U.J...G
.8.$...t....Lp ....'k..."MD...>Ij.9n.Z..  g.a..L'....4azF.p8...#<
;.....Mx.&.l..F....w.....8O..].?|HX9..X...i.p.q.kb...... ;zvv..#......
....~g."1.../)].x......o.H$..L....L^....k.=..x/.z....sG^A...i..c....V.
..h..l...a.h...rv?.2.N.Wl..A..4.....{w...T 6..gR(..36V.ZI.n.q.$.H....i
.....^Q...}.L.....G ..........!.....x=X...............r@... .....ox...
x.._l..b......] ctB8...\.6.......q...m..|.v.....P.H.=x..O....K..p2G). 
.Fd.....a..!..B......x.F.Bq=#IxM....Zh.x.,......#8.m.\..[\..Y..C.w.ow.
 .g........>6.XC1....tn.x(...S{....6]....|..U .5..G/....}.....n....
......7......^.K.....%..9.d..vZ.LR01:.*....^....z..?.y.7...7.@.?e._...
@....DXM...4..q...x.6...@.5.....l...s8.u."8..>.............(.Lc....
...!..........5....{...8O.<<..T.38...p..$=.... .......~I......1.
..IA4...Og.%...OK..K`.!.%..W...x. .Q.`I.....r> g....D..u...4TYV.N..
Og.'x....y.|.p...[........j&>....R>J5........."..(..Ry.J....y.yd
.S...,^....m..&.g..*...4l..K.-R1.5...f.aO..i..T..yE ........m...oI...K
1 ....n......U`).J.@.f.#.'=..Y...vT.G.....&...qd$....02d.>.....!^.\
.j......v....k).....h.V.W.<w).MJ ...\.;.V....q.3{.....F........57.]
At.....F.....;.H.{..k-.....b....8GM.!.....M....>.3.(..........R..".
... 'F....{..7.....Cx;..{..C/.&>z.E...N......0!.7L..l.._.$.....
<<< skipped >>>

GET /template/TCapIframeApi.js?aid=21000124&rand=0.8873663435230374&clientype=2&lang=2052&apptype=2 HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: captcha.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: tencent http server

Accept-Ranges: bytes

Pragma: No-cache

P3P: CP=CAO PSA OUR

Content-Length: 2727

Connection: close

Content-Type: application/x-javascript
!function(t,e){var n=e(t);"undefined"!=typeof define&&(define.cmd||def
ine.amd)&&define(function(){return n})}(window,function(t){function e(
e){var n=0;j=!1;for(var c=0;c<e.length;c  ){var o=t.document.create
Element("script");o.type="text/javascript",o.async=!0,o.src=e[c],o.onl
oad=o.onreadystatechange=function(){"undefined"!=typeof this.readyStat
e&&"loaded"!==this.readyState&&"complete"!==this.readyState||(j=  n>
;=e.length,j&&(E(),E=function(){}))},t.document.getElementsByTagName("
head").item(0).appendChild(o)}}function n(){if("undefined"==typeof JSO
N.stringify||"undefined"==typeof Messenger||"undefined"==typeof AqSCod
e)return void(t.console&&t.console.log("script onload not ready"));_&&
_.lang&&("2052"==_.lang||"1033"==_.lang)&&($=_.lang);var e=p({ele:q,sr
c:b[0],domain:y,s_type:b[1],s_type_suffix:m,uin:g,lang:$},_||{});S=new
 AqSCode(e),S.listen(k),S.start(w),S.end(C)}function c(){return S.getT
icket()}function o(t,e,c){"function"==typeof e?(k=e,_=c):(_=e,_.callba
ck&&"function"==typeof _.callback?k=_.callback:"function"==typeof c&&(
k=c)),_&&_.start&&"[object Function]"==Object.prototype.toString.call(
_.start)&&(w=function(){_.start&&_.start(),u.start()}),_&&_.end&&"[obj
ect Function]"==Object.prototype.toString.call(_.end)&&(C=function(){_
.end&&_.end(),u.end()}),q=t,j?n():E=n}function a(t){S&&S.refresh&&S.re
fresh(t)}function i(){S&&S.destroy&&S.destroy()}function r(t){var e=ne
w AqSCode({ele:t,src:b[0]});return e}var d={add:function(e,n,c){t.docu
ment.addEventListener?e.addEventListener(n,c,!1):t.document.attach
<<< skipped >>>

GET /cgi-bin/ptlogin_report?id=294059&msg=访问ui延时超过5s:delay=12680;domContentLoadedEventEnd=1483697690498;navigationStart=1483697677818;clientip=;serverip=|_|http://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1%3Dhttp%3A//cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http%3A//cf.qq.com/clan-system/index.shtml&|_|Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)&v=0.8188962360270577 HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: log.wtlogin.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Connection: close

Server: QZHTTP-2.38.20

Date: Fri, 06 Jan 2017 10:14:51 GMT

Content-Type: image/bmp;

Content-Length: 66
BMB.......>...(....................................................
.

GET /ptlogin/v4/style/20/images/shouQ_v2/small_8.png HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: imgcache.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Date: Fri, 06 Jan 2017 10:14:46 GMT

Cache-Control: max-age=259200

Expires: Mon, 09 Jan 2017 10:14:46 GMT

Last-Modified: Mon, 06 Jun 2016 09:14:56 GMT

Content-Type: image/png

Content-Length: 8566

Keep-Alive: timeout=60 

Vary:  Accept

X-Cache-Lookup: Hit From Disktank
.PNG........IHDR.............b.{X....gAMA......a.....sRGB.........PLTE
Liq....................................^^^............................
................................zzzccc................................
......................................................................
................................................fff......7............
......................................................................
..........{yx...............ONP.........bba>>>&..$$(stsYXZ...
...mml...U..[.................ppp...v.....D.....z........k....K`>,.
.....p[Q...Q. ...2........C.....Q..}..A........r....u.~...?......qr.l.
.=&......~eP>......=..,...ka....a@...[....q.......b.......<{...w
.............~^...&m......O......,..O....`..H...ck{....|*.kZ......>
...q9.PY.....B......*h~.Bq.J'yJC|...BY.kk...3....Gu.V...&...%.Y.....x.
..z...l[.&...8.......6....0tRNS..%....0.. I7U>..z.e....U.....\...xI
.............?-.....IDATx...mL......1..(I.4.M.Vj.I~sv...g|G.........1.
.cc.Mx.v0.......b..4.....R..i...:.......)..-...E.v.....c'.a.ot._...>
;....p...m.J.r)..;.[..).y.HI^nV...G..wI.O..*."...Rp..e".......e...2..]
Y;3.{..e...2,...rA..k.%..0. ..lr.r3Y...P.s  /..de...d.).....%s...$..gg
..........w.I..wd....-....Z...B.......-.....F..p......C....~..`(...B..
....;.......lW......q.b0......CC...p(..W...&..-...D<..`4..x...C.^..
....F.....p....c.cC..1...p.......#....b...P..k>|h...b...%...E{4@.P.
....'h.D...#j.2R..t.5.{.6.....&. ..@`)...I. .D....]......x..uW,..J.~p.
x=.$.^.D...U{=.E/.........]....I.......c5.......c$..=..v........v4
<<< skipped >>>

GET /cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml& HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ui.ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Connection: keep-alive

Keep-Alive: timeout=50, max=1024

Server: QZHTTP-2.38.20

Date: Fri, 06 Jan 2017 10:14:33 GMT

P3P: CP="CAO PSA OUR"

Cache-Control: max-age=86400

Set-Cookie: pt_user_id=18433456486385466354; EXPIRES=Mon, 04-Jan-2027 10:14:33 GMT; PATH=/; DOMAIN=ui.ptlogin2.qq.com;

Set-Cookie: pt_login_sig=9dDIJo3YWVL5l8Hsu80Qsyn1TFpe9NMpxFedzMeEXipcBhSpPANYHVlZEP-t5UZk; PATH=/; DOMAIN=ptlogin2.qq.com;

Set-Cookie: pt_clientip=7accc2f260e2f09b; PATH=/; DOMAIN=ptlogin2.qq.com;

Set-Cookie: pt_serverip=1e2b0ac5019a3062; PATH=/; DOMAIN=ptlogin2.qq.com;

Set-Cookie: login_param=qlogin_jumpname=jump&qlogin_param=u1%3Dhttp%3A//cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http%3A//cf.qq.com/clan-system/index.shtml&; PATH=/; DOMAIN=ui.ptlogin2.qq.com;

Set-Cookie: uikey=0ba590fa525c9cb2fd0a75fd9709ecc154500628f4979f123354e39d354a3ab1; PATH=/; DOMAIN=ptlogin2.qq.com;

Set-Cookie: ptui_identifier=000DF9BBF2BAC0007C39294D555E97DA34547B2DD5A6FBF5A2E8546E; PATH=/; DOMAIN=ui.ptlogin2.qq.com;

Last-Modified: Thu, 08 Mar 2012 02:04:00 GMT

Content-Encoding: gzip

Content-Type: text/html

Content-Length: 9990
...........]{s........M.b...G..G.m..S$.......Z3=R...x.G....IH0..l.%.]B
..v..!....aV3...W..9....#.XJvc....8......=....N....N[.a.c=.....=e..b..
.....s .?>r...Z.B.:7pz..z~......i[.z..k....fa.Z..k.s..^...TY^.C.f..
.......n...3Z)/....T.uZ...n.....w/....}...n/........wu;t/.Ej}.j.;.....
.._....As...e.......LMooz...Y.{.`....M/......g`....f.....P.B...~..<
....B.t.....~...;... 6...*.........a....b.MQX..T'.......1...........l.
.fO....k.-.;.>{...1".....m<k..._W....9.......0p.'.Pez.Q...zx..Z.
..le~.h7X....c.Q`..7.p..............i..l..O....u...s........A8.o......
..s..}...w.......OG..jt........e;.B..Vf..?........4....|y..eU..m.N...,
.....7..v.....R)...7.....?.\...L..{...D.. .n].2~.?0.t;....'......>.
..O....h......`}<..K.w~.w.W...7..^}_....oF.....|.?...s~.....m..@...
..._.s..~..3b$..\...U..1...z....83..@../_.....W~...vv@.B?.z...1.t....X
=q.b....lK.......[A.v....^,.$.v.BsqK.a...v.=...2...........f.d.B...v..
.;.Yv...41Y...,.F.e..n;.........z!..9..0.H. x.h..QfN.B..F[]...t..B....
.G.h.0D.1.....;....d..x.-.<.....~.k.].\*....z.r....a.Q.{........5.v
..A_x}... .....Td....R....f@|......h^.......G.......?.e..%F.t...R.J.n.
..p...gJv.j...du!.3.h....T....<^@...V...l......V... .k.eJ...gp3.`..
.oJ..... .f._.....u ....(........[...zO...@`........t.9..R#.......tQ .
...i.J.....j....\.{.RE%...63...4...;....&..*..F...$T.....=.........C.-
nX.76........f..TZ.../..8sz~nvee.R9]=.x..|evn.T..9Y.9=.xf.4.gK...33.@.
.3^.4#....d./J..8S....Ho.Ln[..6.-);.*.~k 7.lwA..ri.......`....r{;Tj...
'.v.^g...v6..k:9g.9....k{._....o}...........v?......g.Z......z.u.q
<<< skipped >>>

GET /2/TCapMsg.js HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: captcha.gtimg.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Date: Fri, 06 Jan 2017 10:14:54 GMT

Cache-Control: max-age=600

Expires: Fri, 06 Jan 2017 10:24:54 GMT

Last-Modified: Tue, 03 Jan 2017 07:41:37 GMT

Content-Type: application/x-javascript

Content-Length: 636

Content-Encoding: gzip

Keep-Alive: timeout=60 

X-Cache-Lookup: Hit From Disktank Gz
..........}S]o.0.. ..*X......-.L..i.&MQ49`.7bg......^0.N.....s|.......
!."..j#....*..*...nPF...>c...o.._ ..P........I..#.9B.]T$..s.1.u..f.
......\s.1.....pH...z..%W.R| .7...k............B....F...z.G...A(..m..{
..ZL...wN...:#..-...#.......=p.q....(q@l..V..iSO@.2......M...;...xR.HE
.i..o...."..w8.}..3.~ ........N.ev5W."....#..`Q.xh..:..(T..v...h...Hi.
*QK.3.Z....hO.....mr..J....F. .Q.....f.4.ZF.....2.d.J..#....2....G2k..
w.....5....=.y^..g!...%^..l...[................y.tA?..:....D.. 0kp.,V.
B...,.bh.=@.}.....t9.3.&_....v.z......91.;..f.......k.B5.`.y....S..3..
.....m........s..T.........Hr2.&..g..,m..?..F..q..:..2_.t..M.#.....8..
3I.RL....HTTP/1.1 200 OK..Server: X2S_Platform..Connection: keep-alive
..Date: Fri, 06 Jan 2017 10:14:54 GMT..Cache-Control: max-age=600..Exp
ires: Fri, 06 Jan 2017 10:24:54 GMT..Last-Modified: Tue, 03 Jan 2017 0
7:41:37 GMT..Content-Type: application/x-javascript..Content-Length: 6
36..Content-Encoding: gzip..Keep-Alive: timeout=60 ..X-Cache-Lookup: H
it From Disktank Gz............}S]o.0.. ..*X......-.L..i.&MQ49`.7bg...
...^0.N.....s|.......!."..j#....*..*...nPF...>c...o.._ ..P........I
..#.9B.]T$..s.1.u..f.......\s.1.....pH...z..%W.R| .7...k............B.
...F...z.G...A(..m..{..ZL...wN...:#..-...#.......=p.q....(q@l..V..iSO@
.2......M...;...xR.HE.i..o...."..w8.}..3.~ ........N.ev5W."....#..`Q.x
h..:..(T..v...h...Hi.*QK.3.Z....hO.....mr..J....F. .Q.....f.4.ZF.....2
.d.J..#....2....G2k..w.....5....=.y^..g!...%^..l...[................y.
tA?..:....D.. 0kp.,V.B...,.bh.=@.}.....t9.3.&_....v.z......91.;..f
<<< skipped >>>

GET /最新版本.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: VVV.hts88.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/plain

Last-Modified: Fri, 09 Dec 2016 00:19:05 GMT

Accept-Ranges: bytes

ETag: "501f24dab151d21:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 06 Jan 2017 08:39:19 GMT

Content-Length: 3
3.2HTTP/1.1 200 OK..Content-Type: text/plain..Last-Modified: Fri, 09 D
ec 2016 00:19:05 GMT..Accept-Ranges: bytes..ETag: "501f24dab151d21:0".
.Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Fri, 06 Jan 2
017 08:39:19 GMT..Content-Length: 3..3.2..

GET /ptlogin/v4/style/40/images/icon_3_tiny.png HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: imgcache.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Date: Fri, 06 Jan 2017 10:14:44 GMT

Cache-Control: max-age=259200

Expires: Mon, 09 Jan 2017 10:14:44 GMT

Last-Modified: Wed, 18 May 2016 07:00:15 GMT

Content-Type: image/png

Content-Length: 10711

Keep-Alive: timeout=60 

Vary:  Accept

X-Cache-Lookup: Hit From Disktank
.PNG........IHDR.............D.Q.....PLTE.....................r..q..r.
...................342JOE.......-..*..*..&..$.....%..&.|.........Y....
....$..$.. .. .....%..%..'.................$..........................
............................W..........................e..............
/n.%...../l.$.......................}../..}../...<..u.)u.)......[..
B...................................t.(...x.)}. ......!.(.............
....-.. ../..................r....#n.....k...........A.....Z....#..!u.
.w..{..~....%...................................}../........%.......*.
..B%"-........"z....0.....A.#..........**6....&....9:I......12AN....%.
................................BDW.....b.....z.....Njlp..............
3...= ....TV`..........;5......R3 .=...S.qri.....wP.z|........C,.tr...
..9....J*....g..s.....:'.|..TH....i.sEJ..........ltRNS.n2I..,.2.....&.
......)....}..C.'#..WA<l`6..iO.L..v.=RV.....^....3........3......SV
X.dqT.~..........H.............&.IDATx....j"Q....0.h5..4..$w.:..$..I#.
H!.$..n`....*..^Q..6{...h>.k....8.../........C.9...92.G..y.......3,
.HB....$.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I.I...0k.
0.}F.J..mA{.C0i....$i.I.<.A.E.fp..h.(.H......j..51W...Dps..X..^....
.....U..JZ..Kk.a.....d5IfY.$K.:IHB.....$.$.$.$.$.$.$.$.$.$.$.$.$.$.$.$
.$.$.$.$.$.$.$.$b.I.S.....Nn.V..*Y.*.|..Z%....kR...4,.S`..A..'.'......
.....T.<7.sq.....K......gD...p......l..[......../Q.;..gf....b..}...
>$.v..^mU.)2..[d.I..t.nw.8...$....?&I.#.I.GV%q.gc5..z......y..$."[$
.....H....&....}dSw.sdSI..c#....$...M....z.A..N2...#...&..,$.j.$.w
<<< skipped >>>

GET /ptlogin/ver/10191/js/c_login_2.js?max_age=604800&ptui_identifier=000D9288C52C261746D6A3CB229D592492596A2493DB595A7ABB516C HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: imgcache.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Date: Fri, 06 Jan 2017 10:14:45 GMT

Cache-Control: max-age=604800

Expires: Fri, 13 Jan 2017 10:14:45 GMT

Last-Modified: Tue, 03 Jan 2017 02:17:58 GMT

Content-Type: application/x-javascript

Content-Length: 33966

Content-Encoding: gzip

Keep-Alive: timeout=60 

X-Cache-Lookup: Hit From Disktank Gz
...............Hr ....U...P.Y..7.E..L.v.tw...nu..H&..M.l....".$....$..
.......N...g.}.Ow.I.c.......#".@....G...M............9].......ly..w..Q
.ko....GQ0....n0_.X..8...U.....'O.R.U[..x|....z...k...![.a\.X|.`l.4..X
.U.u..h2...3..U.]..s.......9S5M...Ip..1&X..T.......A/.\7..Z.....i...7|
3.0..;j.3....K..#j....&u..:.^....(.;...5=..>vg36.vC....).....^6d./d
c..%....4.i.Q...}*b.....M.p..oB.R..$%:...,.UO.5. .6u..X....p.......b..
.S.o...t......].....\.J.....8q........k...w.DN...=..T.........g.y..V.k
..8..?.{..2:W..|/.}w.z@WqX_...q...#p..q.......,b....*.@.V.@_b.B.?.....
...3|.HH@P....!et.........km.E....G^...u.H.-......zl...(..'.Q.d..E.]oF
.#Go..g|$............1..k.....A..uy<.}...7aDFZ?...~...;..........;.
3i..:..$....8X..4.<Y....c.....eo...u.A.|$....eC....E.G.8.R...{....q
..1.y.{1.i.....nj.G....q.e...g..\..._.....h..*...V....&......c?ba P..m
Z.V.Ns_..k/~w../x*..;;.4hg.".a'?..\U`.x.L).>.x%.C.s)[i..,K@5...i.h9
.{.....!s.$c.f@].r}}.F.....n~...kE..F...[.v....&.m..KZD.4...!D.Z...ai.
.I..rR....S.feJ..F.F....8^.q1>.....v]NA](P..7..EOo....$....1..q.n..
.....0..j..,...Q...%.Ec..Jn^...\N..a|.z'...r.^.3....|..U)..b...VO....A
.....4I.....so..*.@..:J%..f.F3.....T.a..j..g..hu...C.....LfH.i:.....&l
t;d...a.M..T..A.Y#...-..E.#gW..r..P0..j7.C7..-.i.p~.N..........._$....
....O....*./o...E...ywD#..........B.$oE.Ui..`dz9..%.-.....*.f...].;.0.
......x..<....... .... |..W......8.[. d.!.CZnm."|q7G.$..9....X.nZJ.
.MS....Rb...BX.C..".&...d...}.Bo....<MU<....(.)..d..E:v*...T ..9
4vr|"...Q.. w.M..VG..<f....1;))D..b...o/z...p..p.,.P. !........
<<< skipped >>>

GET /ptlogin/v4/style/0/images/load.gif HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: imgcache.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Date: Fri, 06 Jan 2017 10:14:46 GMT

Cache-Control: max-age=2592000

Expires: Sun, 05 Feb 2017 10:14:46 GMT

Last-Modified: Mon, 16 Mar 2015 08:46:52 GMT

Content-Type: image/gif

Content-Length: 817

Keep-Alive: timeout=60 

X-Cache-Lookup: Hit From Disktank
GIF89a.....................................wul..y............!..NETSCA
PE2.0.....!.......,..........O.......{....Y..`....I.D8.. S.....(......
.D..(.I~.. .H`....Z.f....k.N..q...;'.L..!.......,..........N.......{..
@.1....Q]AiN.:..)S.T...,........b....$?...Q(0.).j.f....{....n.-~N....!
.......,..........M.........,Eeu......%5..E...f3. ......g(..<...L..
.D".X`.RJ.J.N..........9...=..!.......,..........N...J..Z.'B. ..q`....
.P)8./,S&.$.$.......y....D...."..`.R.ak.b.........m..^S....!.......,..
........M......Z.gJ.....}.H..I...b$.(.t..}.......~9..@Y,2..........i00
......|......t;..!.......,..........M...R..Z..R.. ..}.H..I.l....t.P0..
..B....v>.CG1.2...i.P....J.0.R-.....J....t;..!.......,..........M..
....Z..Z..$..}.H..I.l...at..0..........8..B d..L.I.B)...q80...&..t....
...3..;/*  |xGv00|a0977a7e1f04529fe4ad7ac9aebd6177 */HTTP/1.1 200 OK..
Server: X2S_Platform..Connection: keep-alive..Date: Fri, 06 Jan 2017 1
0:14:46 GMT..Cache-Control: max-age=2592000..Expires: Sun, 05 Feb 2017
 10:14:46 GMT..Last-Modified: Mon, 16 Mar 2015 08:46:52 GMT..Content-T
ype: image/gif..Content-Length: 817..Keep-Alive: timeout=60 ..X-Cache-
Lookup: Hit From Disktank..GIF89a.....................................
wul..y............!..NETSCAPE2.0.....!.......,..........O.......{....Y
..`....I.D8.. S.....(.......D..(.I~.. .H`....Z.f....k.N..q...;'.L..!..
.....,..........N.......{..@.1....Q]AiN.:..)S.T...,........b....$?...Q
(0.).j.f....{....n.-~N....!.......,..........M.........,Eeu......%5..E
...f3. ......g(..<...L...D".X`.RJ.J.N..........9...=..!.......,
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

t$(SSh

~%UVW

u$SShe

Hw2.Hw

kernel32.dll

ole32.dll

wininet.dll

MsgWaitForMultipleObjects

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

1%SqlnD

U[5%u

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

hXXp://VVV.hts88.com/最新版本.txt

hXXp://VVV.hts88.com

<SPAN id=login_qq_span>

hXXp://VVV.cf23.pw/?action=loginok

&submit1= &is_cs=0&is_get=1&show_msg=&jz=0&no_new=0

&logpassword=

:<input name="adurl" id="adurl" style="height:40px;" size="45" value="

hXXp://VVV.htsqq.com/cpa

@qq.com

&cardpwd[]=

&cardnum[]=

&cardquantity=1&cardvalue[]=

hXXp://VVV.520faka.com/product/req.php

WinHttp.WinHttpRequest.5.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Content-Type: application/x-www-form-urlencoded

.html

C:\cf

<meta http-equiv="refresh" content="0;url=hXXp://VVV.baidu.com/link?url=X9jEcyiKSvihYY40IP4B0-EFUzsa2b-YQKgsWn6qSp7">

D:\cf

<meta http-equiv="refresh" content="0;url=hXXp://VVV.baidu.com/link?url=zfXX_O_vWd6h8Dvl2QJb9jZGK9lMcYYZP-lYne-6Y43">

E:\cf

<meta http-equiv="refresh" content="0;url=hXXp://VVV.baidu.com/link?url=gH7TSOe105MLhtNIv62dzn1WtRQN64V0kv9nXQLeaG0hlvVB3nwVRn1K7juJ8eKh">

F:\cf

<meta http-equiv="refresh" content="0;url=hXXp://VVV.baidu.com/link?url=nFKttDQvgPuV3HSEGmB4zxiacGeAKhShnCnp2_HQ0q3">

VVV.hts88.com

hXXp://wpa.qq.com/msgrd?v=3&uin=895585828&site=qq&menu=yes

 hXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:ECDED2F5B9E611E5AE48DDC27B426B9F" xmpMM:DocumentID="xmp.did:ECDED2F6B9E611E5AE48DDC27B426B9F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ECDED2F3B9E611E5AE48DDC27B426B9F" stRef:documentID="xmp.did:ECDED2F4B9E611E5AE48DDC27B426B9F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:038C35B6B9E711E5B107FB9405C031AF" xmpMM:DocumentID="xmp.did:038C35B7B9E711E5B107FB9405C031AF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:038C35B4B9E711E5B107FB9405C031AF" stRef:documentID="xmp.did:038C35B5B9E711E5B107FB9405C031AF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:DF768F0C667611E5B2A3D64239882D5A" xmpMM:DocumentID="xmp.did:DF768F0D667611E5B2A3D64239882D5A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DF768F0A667611E5B2A3D64239882D5A" stRef:documentID="xmp.did:DF768F0B667611E5B2A3D64239882D5A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

}.IH_

&%SWl

, #&')*)

-0-(0%()(

j%.Usl6

(7),01444

'9=82<.342

JO.NO

K'%sS

.omo.\

1.eob

FTp0z

g.zc8

}YF*.RzB;

wZ7%f

.GR)9r

Sn-5}

Zi]%ue{

H.lo4

;.kE9

o5}.ssH

eA.me

^h7{%u

)].iT

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:AEC1EEE1F0A611E28D3CA493856091E0" xmpMM:DocumentID="xmp.did:AEC1EEE2F0A611E28D3CA493856091E0"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AEC1EEDFF0A611E28D3CA493856091E0" stRef:documentID="xmp.did:AEC1EEE0F0A611E28D3CA493856091E0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

ohXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8DA0E07BA5F0E211A11BDD5BAAFCABBB" xmpMM:DocumentID="xmp.did:F975992AF0AB11E2B70B8608A4D07F17" xmpMM:InstanceID="xmp.iid:F9759929F0AB11E2B70B8608A4D07F17" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8DA0E07BA5F0E211A11BDD5BAAFCABBB" stRef:documentID="xmp.did:8DA0E07BA5F0E211A11BDD5BAAFCABBB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8DA0E07BA5F0E211A11BDD5BAAFCABBB" xmpMM:DocumentID="xmp.did:33D4AD42F0AA11E28562C3ED2FED1CE2" xmpMM:InstanceID="xmp.iid:33D4AD41F0AA11E28562C3ED2FED1CE2" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8DA0E07BA5F0E211A11BDD5BAAFCABBB" stRef:documentID="xmp.did:8DA0E07BA5F0E211A11BDD5BAAFCABBB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8DA0E07BA5F0E211A11BDD5BAAFCABBB" xmpMM:DocumentID="xmp.did:8DE15E84F0AA11E2A6EE93A304B60F62" xmpMM:InstanceID="xmp.iid:8DE15E83F0AA11E2A6EE93A304B60F62" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8DA0E07BA5F0E211A11BDD5BAAFCABBB" stRef:documentID="xmp.did:8DA0E07BA5F0E211A11BDD5BAAFCABBB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

.vtW4

.gJ_}

K[M.yLV

c?z-v}

3I!9.rrs

,.RI5 -i

I:\;'C

.tWe)#a-k9

O$.UZs

H=`%s

.tA?8

@0@@ 0```@

{.mz9n

t].bE

1`%Ss&,

Q.wuy%

),($ !$%$

 . &.#&'&

.gSkZOKX

3.RY<:s

s.Wl<P*e

d.rswo^

m.HrCl

:%ss)

e-.KY

M%s xN

.ZQ6\

&4'*./121

%6:60:,010

.RS$0

M.Re.

.Or?0

@%uQ'

s.LM:

"]=.Jc

%fP[u

o%%S-,

%UxUt

 u%X]

.mkNn]3R

%UEQX

M&

$lrs

'P.EK

%2%(,-/0/

#484.7*./.

!9W%8sE

!%0)!#-$

*9*-13666 (;?:4>0563

#'2*#%/%

#0$&* -.-

"251,5(,-,

z=%uh

,%FYq3

wh.WP

Im%DT

Q6.ZE

lK.eJ

>F.VX

H@|T%c

E%StM

i×i

-9}{ 2G

{[%x7rA

dV.IF8

; À}

.bA\U;Z

@.Ay$

H<%SL

4.AbA

P(7p7p7p7p4[G.kpv

#S.fA$

"b%XX{

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:5EBFCC05E32411E181FFDDD0136AAF34" xmpMM:DocumentID="xmp.did:5EBFCC06E32411E181FFDDD0136AAF34"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5EBFCC03E32411E181FFDDD0136AAF34" stRef:documentID="xmp.did:5EBFCC04E32411E181FFDDD0136AAF34"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:91C45DE1E32411E18492F48C9F0535E2" xmpMM:DocumentID="xmp.did:91C45DE2E32411E18492F48C9F0535E2"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:91C45DDFE32411E18492F48C9F0535E2" stRef:documentID="xmp.did:91C45DE0E32411E18492F48C9F0535E2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

o>.KIh

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:AD9F7767E32411E1ABA981218EA6ACFC" xmpMM:DocumentID="xmp.did:AD9F7768E32411E1ABA981218EA6ACFC"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AD9F7765E32411E1ABA981218EA6ACFC" stRef:documentID="xmp.did:AD9F7766E32411E1ABA981218EA6ACFC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

Sp.Qi

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:E871FBDFE32411E1BDEAFC98E82C213C" xmpMM:DocumentID="xmp.did:E871FBE0E32411E1BDEAFC98E82C213C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E871FBDDE32411E1BDEAFC98E82C213C" stRef:documentID="xmp.did:E871FBDEE32411E1BDEAFC98E82C213C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

Dt%U&

jW%Uo

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:CF6E0F93E32411E18EDCC419BDB90863" xmpMM:DocumentID="xmp.did:CF6E0F94E32411E18EDCC419BDB90863"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CF6E0F91E32411E18EDCC419BDB90863" stRef:documentID="xmp.did:CF6E0F92E32411E18EDCC419BDB90863"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

.zh/I

.Ib_U

z:\mm

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:02B300EDE32511E19B8982A085631B0A" xmpMM:DocumentID="xmp.did:02B300EEE32511E19B8982A085631B0A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:02B300EBE32511E19B8982A085631B0A" stRef:documentID="xmp.did:02B300ECE32511E19B8982A085631B0A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:2095DB17E32511E1AD0A9FF24BD1D7AE" xmpMM:DocumentID="xmp.did:2095DB18E32511E1AD0A9FF24BD1D7AE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2095DB15E32511E1AD0A9FF24BD1D7AE" stRef:documentID="xmp.did:2095DB16E32511E1AD0A9FF24BD1D7AE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

bCjK%C

X,x%u4

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:3A6933F9E32511E1896FBFE15BE5F22D" xmpMM:DocumentID="xmp.did:3A6933FAE32511E1896FBFE15BE5F22D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3A6933F7E32511E1896FBFE15BE5F22D" stRef:documentID="xmp.did:3A6933F8E32511E1896FBFE15BE5F22D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

R:\UnO

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:53A3F65BE32511E1A2C8DFDAEBC3A6BC" xmpMM:DocumentID="xmp.did:53A3F65CE32511E1A2C8DFDAEBC3A6BC"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:53A3F659E32511E1A2C8DFDAEBC3A6BC" stRef:documentID="xmp.did:53A3F65AE32511E1A2C8DFDAEBC3A6BC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

V.Is"

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:6B95B439E32511E18220817BCA69620D" xmpMM:DocumentID="xmp.did:6B95B43AE32511E18220817BCA69620D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6B95B437E32511E18220817BCA69620D" stRef:documentID="xmp.did:6B95B438E32511E18220817BCA69620D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

k.Iu4

Gi,%D

6?.qe

.bt.P

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:817FB173E32511E1BE23FCF9B7F9657D" xmpMM:DocumentID="xmp.did:817FB174E32511E1BE23FCF9B7F9657D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:817FB171E32511E1BE23FCF9B7F9657D" stRef:documentID="xmp.did:817FB172E32511E1BE23FCF9B7F9657D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

.mQ^%

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:99E17DD7E32511E1B5B3BFB58B3AE7D8" xmpMM:DocumentID="xmp.did:99E17DD8E32511E1B5B3BFB58B3AE7D8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:99E17DD5E32511E1B5B3BFB58B3AE7D8" stRef:documentID="xmp.did:99E17DD6E32511E1B5B3BFB58B3AE7D8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D06DAAF1E32511E1BA96DC1C3A373E2B" xmpMM:DocumentID="xmp.did:D06DAAF2E32511E1BA96DC1C3A373E2B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D06DAAEFE32511E1BA96DC1C3A373E2B" stRef:documentID="xmp.did:D06DAAF0E32511E1BA96DC1C3A373E2B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

}35.RBRT

8EI%D

$(4,$&1'

hXXp://ptlogin2.qq.com/getface?appid=1006102&imgtype=3&encrytype=0&devtype=0&keytpye=0&uin=

hXXp://q4.qlogo.cn/g?b=qq&k=

VVV.hts88.com

ip.qq.com

hXXp://VVV.cf23.pw/reg.asp?action=regok

&textarea=CFˢǹÈí¼þÊÚȨЭÒ飺
1¡¢ÇëÑϸñ°´ÕÕÈí¼þÖлý·Ö¹æÔòÍƹ㡣
2¡¢ÇëÎð·´»ã±àÆƽâ´ËÈí¼þ,·ñÔò·´Æƽâ´úÂë»áÈÃÄã³Ô²»ÏûµÄ£¡&submit1=Ìá½»ÐÅÏ¢

®password2=

®password=

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

https

HTTP/1.1

hXXps://

hXXp://

<li><input type="radio" name="pid" value="18" /> <img src="default/images/JUNNET.jpg" align="absmiddle" alt="

<li><input type="radio" name="pid" value="7" /> <img src="default/images/UNICOM.jpg" align="absmiddle" alt="

<li><input type="radio" name="pid" value="2" /> <img src="default/images/SZX.jpg" align="absmiddle" alt="

<li><input type="radio" name="pid" value="10" /> <img src="default/images/TELECOM.jpg" align="absmiddle" alt="

<li><input type="radio" name="pid" value="15" /> <img src="default/images/QQ.jpg" align="absmiddle" alt="

</li> <li><input type="radio" name="pid" value="1" /> <img src="default/images/SNDACARD.jpg" align="absmiddle" alt="

<li><input type="radio" name="pid" value="3" /> <img src="default/images/ZHENGTU.jpg" align="absmiddle" alt="

<li><input type="radio" name="pid" value="24" /> <img src="default/images/51KA.jpg" align="absmiddle" alt="

<li><input type="radio" name="pid" value="23" /> <img src="default/images/GUANGYU.jpg" align="absmiddle" alt="

<li><input type="radio" name="pid" value="8" /> <img src="default/images/WANMEI.jpg" align="absmiddle" alt="

<li><input type="radio" name="pid" value="5" /> <img src="default/images/JIUYOU.jpg" align="absmiddle" alt="

<li><input type="radio" name="pid" value="9" /> <img src="default/images/NETEASE.jpg" align="absmiddle" alt="

<li><input type="radio" name="pid" value="4" /> <img src="default/images/SOHU.jpg" align="absmiddle" alt="

<li><input type="radio" name="pid" value="12" /> <img src="default/images/TIANXIA.jpg" align="absmiddle" alt="

hXXp://VVV.waqiang.com/index.php/url/shorten

(*^__^*)

\SkinH_EL.dll

hXXp://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?url=http://VVV.hts88.com/&showcount=1&desc=&summary=&title=&site=&pics=&style=101&width=199&height=30&otype=share

.UL?6>RF:

s_=%f

2'%c`rx

O8$.GJ

.yFJS

K.pxR;

Me-5}

W.tgSuR

<5.EN

ro .Nu

.kE'v

R:i.IGGQm&

-.oY"

%X]js

0.fmYu

.owWf

[t.UF

6.xzr

b[q\.YC

Gsj.cmBq

{-.ZjFu

o.onu

?x.FH#?%>!

-e.xi

m,l>.XZ

z.JU'N

#Rz.iAJZ:

).iiy

.oK=n

KXm%s

5m.kY

x.oii'

%yEs.ID

h8q.wJ

.Kmm;

Nm{%S

.ogxm

.XJZ{

3W%ur

.no{o

n.NNJ6

5.iJ{|M

6..lb

.DS0Þ

-.ui'{

].Dr|{

g5u%x

<N.uO

\],%uR

.ZQn2i7

%~W.mV

NM]%u

E.Wy^

l-n.RM.

~weBXw^

C&vI1O%c,

J.RPs

0{c(%D

c.Sh'

NSNT/%f

.eYet

.XM"e

.mak_

AbŸ

s5x.eh

%.nU{

9MB.pm

i.iEAs7)

.gyI'd

WI.kZ);s?

.kME8o

 )J.qrp

%XI7d

%HZ.SN

#w).Ut

.Lmok

mdV%F

t!'%5x

%ui[O6

N*umSG

H.cSm

lV.JT

.Ex9r

NI.mZK\

k.XBRs{

-c}:c

]&.XK

axabþ

g8Bu9g.HJr

m.Get

%c!P$"\md

%.jzFN

=Ik.Zqu

"ZY'%f

j-.ey6

7.YKF

'<=.jpjM

M%.ev

k"OxZ%xM

g.YII

rah.QP

#.gm<

.DFO8l:Bp

6u%x.X^

g.zoGih

m%.ov

E.WqEe

.Wy^<

.RK}Z

.RvzE-]

QKEY

UB#R..QwQW

zxL.gB

i.dqN

MbU%FV

.Eniu

y.eyf

_m7.Uev

ay.oq

-ory}

KI.gkh

hF77.YL@6

K^SQL38:

.fcn/

;Xp>tp%x'

H@%ut

C8tCp

"TJQ!R.Hp

M:\<`,

hf%ClR

%F |*

S0%S)

[@?A5&nT2

SQlZ

fm%C,

%sXZg

^>cm%DQ

%fmb4

%sB&u

r =url":*j

4p.tU

{%xP2

yX8

d.eRm

Y"?z%fxr?

?5.oL

%c;pb 

.bS~C

&s-9s6}

Q!5R%uR)

"8uK#g.sR

c.riI

g, .CO7

XFq%.X

KM.Nx

7XA%D

rxI.Ef[

I.lYI

-4I.lB

ÑDWZ

T 0%X

5G%qB%C#S

`EZTA%XAX

2 U%X\

e.xD6Xu/

wEBR3`

@C.Qs

vow.ww

tL%uTI

%ur'q

8.CMo

61

cr%cMo

-mM7i}

Im%Cl

.fn[j

.RC}E

%<.SVa1

7T5%f

.TC^S

iurl

KEY?r_

d-%x8

$.cE8

!.LWqJw

&BX.BPm

<.nLd

D.rXH

920707683

$8!%.fF_a

.EZCif`

je%N.Rz#j4'

Tn'i%s

N.svH

|Ng%S

`3<.oF

j.uMB

I%d~5)Jrr

o.YAN

hXXp://ui.ptlogin2.qq.com/cgi-bin/login?qlogin_jumpname=jump&qlogin_param=u1=http://cf.qq.com/clan-system/index.shtml&f_url=loginerroralert&no_verifyimg=1&appid=21000124&daid=8&s_url=http://cf.qq.com/clan-system/index.shtml&

895585828

hXXp://VVV.hts88.com/jiaocheng/shuad

hXXp://VVV.hts88.com/jiaocheng/jihuo

%d&&'

123456789

00003333

deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly

inflate 1.1.3 Copyright 1995-1998 Mark Adler

? deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly

inflate 1.1.4 Copyright 1995-2002 Mark Adler

1.2.18

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

MSWHEEL_ROLLMSG

__MSVCRT_HEAP_SELECT

Broken pipe

Inappropriate I/O control operation

Operation not permitted

user32.dll

F%D,3

iphlpapi.dll

SHLWAPI.dll

MPR.dll

WINMM.dll

WS2_32.dll

VERSION.dll

RASAPI32.dll

AVIFIL32.dll

GetProcessHeap

WinExec

GetCPInfo

KERNEL32.dll

GetKeyState

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

GetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

WINSPOOL.DRV

comdlg32.dll

RegCloseKey

RegOpenKeyExA

RegCreateKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

OLEAUT32.dll

oledlg.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

WSOCK32.dll

.PAVCException@@

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

1.1.3

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) CometHTTP

1.1.4

(*.htm;*.html)|*.htm;*.html

VVV.dywt.com.cn

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

(*.avi)|*.avi

WPFT532.CNV

WPFT632.CNV

EXCEL32.CNV

write32.wpc

Windows Write

mswrd632.wpc

Word for Windows 6.0

wword5.cnv

Word for Windows 5.0

mswrd832.cnv

mswrd632.cnv

Word 6.0/95 for Windows & Macintosh

html32.cnv

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

zcÁ

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.2.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

1, 0, 6, 6

- Skin.dll

(*.*)

1.0.0.0

%original file name%.exe_3856_rwx_10028000_00015000:

Gw2.Hw

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ð<

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$<#$#=

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7ACIT357.txt (99 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIR4YGN2\load[1].gif (817 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\json2[1].js (7098 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IBPSKBRA\TCapIframeApi[1].js (73 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X66G0HIG\c_login_2[1].js (71284 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X66G0HIG\ptui_ver[1].js (227 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\ptqrshow[1].png (446 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IBPSKBRA\cross_proxy[1].htm (223 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIR4YGN2\ptlogin_report[1].bmp (66 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X66G0HIG\TCapMsg[1].js (25 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LQUMIDKJ\login[1].htm (4192 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIR4YGN2\TCapIframe[1].js (4280 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.