| Analysis Date | 2015-10-19 21:30:22 |
|---|---|
| MD5 | 0e147c0275c80eca8af7f487748e5446 |
| SHA1 | 1b2a1ae40e153fbb503ff541367605223c45e327 |
Static Details:
| File type | PE32 executable for MS Windows (GUI) Intel 80386 32-bit | |
|---|---|---|
| Section | .text md5: 88f55561af763127a6cad7d706e698cd sha1: cb48874807005b37cf7c8e39181de349c7c079b0 size: 621568 | |
| Section | .rdata md5: 8d555c5eb3cfcdfcc380b8704d5b40c1 sha1: ecb7823b31789c1ccbbc23185750bd43dd6be0e8 size: 52224 | |
| Section | .data md5: 3a464b1b1a3d581e1aa617a132e4a358 sha1: 5e98e45bd1e92b2671720ea537e07d5a8b42a3e2 size: 123904 | |
| Timestamp | 2014-02-12 17:51:11 | |
| Packer | Microsoft Visual C++ ?.? | |
| PEhash | 3f0e18ccefdfa70e0f78b80d6ef57a8885c26cdb | |
| IMPhash | 9a559a494376c3657142b33b86571b17 | |
| AV | CA (E-Trust Ino) | no_virus |
| AV | F-Secure | Gen:Variant.Sirefef.121 |
| AV | Dr. Web | no_virus |
| AV | ClamAV | no_virus |
| AV | Arcabit (arcavir) | Gen:Variant.Sirefef.121 |
| AV | BullGuard | Gen:Variant.Sirefef.121 |
| AV | Padvish | no_virus |
| AV | VirusBlokAda (vba32) | no_virus |
| AV | CAT (quickheal) | no_virus |
| AV | Trend Micro | TSPY_NIVDORT.SM |
| AV | Kaspersky | Trojan.Win32.Generic |
| AV | Zillya! | no_virus |
| AV | Emsisoft | Gen:Variant.Sirefef.121 |
| AV | Ikarus | Trojan.Crypt2 |
| AV | Frisk (f-prot) | no_virus |
| AV | Authentium | W32/Symmi.AH.gen!Eldorado |
| AV | MalwareBytes | no_virus |
| AV | MicroWorld (escan) | Gen:Variant.Sirefef.121 |
| AV | Microsoft Security Essentials | TrojanSpy:Win32/Nivdort.Y |
| AV | K7 | Trojan ( 004cff7d1 ) |
| AV | BitDefender | Gen:Variant.Sirefef.121 |
| AV | Fortinet | W32/COMROKI.A!tr |
| AV | Symantec | no_virus |
| AV | Grisoft (avg) | Win32/Cryptor |
| AV | Eset (nod32) | Win32/Kryptik.DXVJ |
| AV | Alwil (avast) | Kryptik-NSU [Trj] |
| AV | Ad-Aware | Gen:Variant.Sirefef.121 |
| AV | Twister | Trojan.Girtk.BCFJ.cpsn.mg |
| AV | Avira (antivir) | BDS/Zegost.Gen4 |
| AV | Mcafee | no_virus |
| AV | Rising | no_virus |
Runtime Details:
| Screenshot |  |
|---|
Process
↳ C:\malware.exe
| Creates File | C:\WINDOWS\system32\ewxvrofxqprdunx\tst |
|---|---|
| Creates File | C:\Documents and Settings\Administrator\Local Settings\Temp\ydvzgxjd1libjqs0oqyo.exe |
| Creates Process | C:\Documents and Settings\Administrator\Local Settings\Temp\ydvzgxjd1libjqs0oqyo.exe |
Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\ydvzgxjd1libjqs0oqyo.exe
| Registry | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Computer CardSpace DNS Presentation ➝ C:\WINDOWS\system32\kaxqflnp.exe |
|---|---|
| Creates File | C:\WINDOWS\system32\kaxqflnp.exe |
| Creates File | C:\WINDOWS\system32\ewxvrofxqprdunx\lck |
| Creates File | C:\WINDOWS\system32\ewxvrofxqprdunx\tst |
| Creates File | C:\WINDOWS\system32\drivers\etc\hosts |
| Creates File | C:\WINDOWS\system32\ewxvrofxqprdunx\etc |
| Deletes File | C:\WINDOWS\system32\\drivers\etc\hosts |
| Creates Process | C:\WINDOWS\system32\kaxqflnp.exe |
| Creates Service | COM Thread UserMode Port Panel - C:\WINDOWS\system32\kaxqflnp.exe |
Process
↳ Pid 812
Process
↳ Pid 856
Process
↳ C:\WINDOWS\System32\svchost.exe
| Creates File | \Device\Afd\Endpoint |
|---|---|
| Creates File | C:\WINDOWS\system32\WBEM\Logs\wbemess.log |
Process
↳ Pid 1128
Process
↳ Pid 1212
Process
↳ C:\WINDOWS\system32\spoolsv.exe
Process
↳ Pid 1168
Process
↳ C:\WINDOWS\system32\kaxqflnp.exe
| Registry | HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝ 1 |
|---|---|
| Creates File | C:\WINDOWS\system32\ewxvrofxqprdunx\run |
| Creates File | C:\WINDOWS\system32\ewxvrofxqprdunx\rng |
| Creates File | C:\WINDOWS\system32\ewxvrofxqprdunx\tst |
| Creates File | C:\WINDOWS\system32\ewxvrofxqprdunx\lck |
| Creates File | C:\WINDOWS\TEMP\ydvzgxjd1rsvjq.exe |
| Creates File | pipe\net\NtControlPipe10 |
| Creates File | C:\WINDOWS\system32\brbzkevw.exe |
| Creates File | C:\WINDOWS\system32\ewxvrofxqprdunx\cfg |
| Creates File | \Device\Afd\Endpoint |
| Creates Process | WATCHDOGPROC "c:\windows\system32\kaxqflnp.exe" |
| Creates Process | C:\WINDOWS\TEMP\ydvzgxjd1rsvjq.exe -r 32164 tcp |
Process
↳ C:\WINDOWS\system32\kaxqflnp.exe
| Creates File | C:\WINDOWS\system32\ewxvrofxqprdunx\tst |
|---|
Process
↳ WATCHDOGPROC "c:\windows\system32\kaxqflnp.exe"
| Creates File | C:\WINDOWS\system32\ewxvrofxqprdunx\tst |
|---|
Process
↳ C:\WINDOWS\TEMP\ydvzgxjd1rsvjq.exe -r 32164 tcp
| Creates File | \Device\Afd\Endpoint |
|---|---|
| Winsock DNS | 239.255.255.250 |
Network Details:
| DNS | tablefruit.net Type: A 52.4.209.250 |
|---|---|
| DNS | stickmarch.net Type: A 52.4.209.250 |
| DNS | roomtoday.net Type: A 81.19.145.94 |
| DNS | signtoday.net Type: A 158.181.48.33 |
| DNS | movetoday.net Type: A 184.168.221.52 |
| DNS | jumptoday.net Type: A 184.168.221.18 |
| DNS | hillseven.net Type: A 184.168.221.25 |
| DNS | feltseven.net Type: A 195.22.26.254 |
| DNS | feltseven.net Type: A 195.22.26.231 |
| DNS | feltseven.net Type: A 195.22.26.252 |
| DNS | feltseven.net Type: A 195.22.26.253 |
| DNS | threesome.net Type: A 72.52.4.119 |
| DNS | threeseven.net Type: A 104.217.163.49 |
| DNS | knowbody.net Type: A 208.73.211.192 |
| DNS | knowbody.net Type: A 208.73.211.183 |
| DNS | knowbody.net Type: A 208.73.211.179 |
| DNS | knowbody.net Type: A 208.73.211.195 |
| DNS | ablebody.net Type: A 66.238.232.70 |
| DNS | roomtell.net Type: A 208.100.26.234 |
| DNS | signtell.net Type: A 184.168.221.31 |
| DNS | movedance.net Type: A 183.111.174.25 |
| DNS | jumptell.net Type: A 141.8.226.15 |
| DNS | donaven4guia.com Type: A |
| DNS | fredesecas.com Type: A |
| DNS | laloponea.com Type: A |
| DNS | davedekilai.com Type: A |
| DNS | roomsuch.net Type: A |
| DNS | signsuch.net Type: A |
| DNS | movesome.net Type: A |
| DNS | jumpsome.net Type: A |
| DNS | moveseven.net Type: A |
| DNS | jumpseven.net Type: A |
| DNS | movesuch.net Type: A |
| DNS | jumpsuch.net Type: A |
| DNS | hillsome.net Type: A |
| DNS | whomsome.net Type: A |
| DNS | whomseven.net Type: A |
| DNS | hilltoday.net Type: A |
| DNS | whomtoday.net Type: A |
| DNS | hillsuch.net Type: A |
| DNS | whomsuch.net Type: A |
| DNS | feltsome.net Type: A |
| DNS | looksome.net Type: A |
| DNS | lookseven.net Type: A |
| DNS | felttoday.net Type: A |
| DNS | looktoday.net Type: A |
| DNS | feltsuch.net Type: A |
| DNS | looksuch.net Type: A |
| DNS | lordsome.net Type: A |
| DNS | lordseven.net Type: A |
| DNS | threetoday.net Type: A |
| DNS | lordtoday.net Type: A |
| DNS | threesuch.net Type: A |
| DNS | lordsuch.net Type: A |
| DNS | drinksome.net Type: A |
| DNS | wifesome.net Type: A |
| DNS | drinkseven.net Type: A |
| DNS | wifeseven.net Type: A |
| DNS | drinktoday.net Type: A |
| DNS | wifetoday.net Type: A |
| DNS | drinksuch.net Type: A |
| DNS | wifesuch.net Type: A |
| DNS | knowdare.net Type: A |
| DNS | abledare.net Type: A |
| DNS | knowdance.net Type: A |
| DNS | abledance.net Type: A |
| DNS | knowtell.net Type: A |
| DNS | abletell.net Type: A |
| DNS | pickdare.net Type: A |
| DNS | songdare.net Type: A |
| DNS | pickdance.net Type: A |
| DNS | songdance.net Type: A |
| DNS | pickbody.net Type: A |
| DNS | songbody.net Type: A |
| DNS | picktell.net Type: A |
| DNS | songtell.net Type: A |
| DNS | roomdare.net Type: A |
| DNS | signdare.net Type: A |
| DNS | roomdance.net Type: A |
| DNS | signdance.net Type: A |
| DNS | roombody.net Type: A |
| DNS | signbody.net Type: A |
| DNS | movedare.net Type: A |
| DNS | jumpdare.net Type: A |
| DNS | jumpdance.net Type: A |
| DNS | movebody.net Type: A |
| DNS | jumpbody.net Type: A |
| DNS | movetell.net Type: A |
| DNS | hilldare.net Type: A |
| DNS | whomdare.net Type: A |
| DNS | hilldance.net Type: A |
| DNS | whomdance.net Type: A |
| DNS | hillbody.net Type: A |
| DNS | whombody.net Type: A |
| DNS | hilltell.net Type: A |
| DNS | whomtell.net Type: A |
| DNS | feltdare.net Type: A |
| HTTP GET | http://tablefruit.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://stickmarch.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://roomtoday.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://signtoday.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://movetoday.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://jumptoday.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://hillseven.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://feltseven.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://threesome.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://threeseven.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://knowbody.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://ablebody.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://roomtell.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://signtell.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://movedance.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://jumptell.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://tablefruit.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://stickmarch.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://roomtoday.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://signtoday.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://movetoday.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://jumptoday.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://hillseven.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://feltseven.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://threesome.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://threeseven.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://knowbody.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://ablebody.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://roomtell.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://signtell.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://movedance.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| HTTP GET | http://jumptell.net/forum/search.php?method=validate&mode=sox&v=023&sox=3d6e8c00 User-Agent: |
| Flows TCP | 192.168.1.1:1036 ➝ 52.4.209.250:80 |
| Flows TCP | 192.168.1.1:1037 ➝ 52.4.209.250:80 |
| Flows TCP | 192.168.1.1:1038 ➝ 81.19.145.94:80 |
| Flows TCP | 192.168.1.1:1040 ➝ 158.181.48.33:80 |
| Flows TCP | 192.168.1.1:1038 ➝ 68.235.32.50:443 |
| Flows TCP | 192.168.1.1:1041 ➝ 184.168.221.52:80 |
| Flows TCP | 192.168.1.1:1042 ➝ 184.168.221.18:80 |
| Flows TCP | 192.168.1.1:1043 ➝ 184.168.221.25:80 |
| Flows TCP | 192.168.1.1:1044 ➝ 195.22.26.254:80 |
| Flows TCP | 192.168.1.1:1045 ➝ 72.52.4.119:80 |
| Flows TCP | 192.168.1.1:1046 ➝ 104.217.163.49:80 |
| Flows TCP | 192.168.1.1:1047 ➝ 208.73.211.192:80 |
| Flows TCP | 192.168.1.1:1048 ➝ 66.238.232.70:80 |
| Flows TCP | 192.168.1.1:1049 ➝ 208.100.26.234:80 |
| Flows TCP | 192.168.1.1:1050 ➝ 184.168.221.31:80 |
| Flows TCP | 192.168.1.1:1051 ➝ 183.111.174.25:80 |
| Flows TCP | 192.168.1.1:1052 ➝ 141.8.226.15:80 |
| Flows TCP | 192.168.1.1:1053 ➝ 52.4.209.250:80 |
| Flows TCP | 192.168.1.1:1054 ➝ 52.4.209.250:80 |
| Flows TCP | 192.168.1.1:1055 ➝ 81.19.145.94:80 |
| Flows TCP | 192.168.1.1:1056 ➝ 158.181.48.33:80 |
| Flows TCP | 192.168.1.1:1057 ➝ 184.168.221.52:80 |
| Flows TCP | 192.168.1.1:1058 ➝ 184.168.221.18:80 |
| Flows TCP | 192.168.1.1:1059 ➝ 184.168.221.25:80 |
| Flows TCP | 192.168.1.1:1060 ➝ 195.22.26.254:80 |
| Flows TCP | 192.168.1.1:1061 ➝ 72.52.4.119:80 |
| Flows TCP | 192.168.1.1:1062 ➝ 104.217.163.49:80 |
| Flows TCP | 192.168.1.1:1063 ➝ 208.73.211.192:80 |
| Flows TCP | 192.168.1.1:1064 ➝ 66.238.232.70:80 |
| Flows TCP | 192.168.1.1:1065 ➝ 208.100.26.234:80 |
| Flows TCP | 192.168.1.1:1066 ➝ 184.168.221.31:80 |
| Flows TCP | 192.168.1.1:1067 ➝ 183.111.174.25:80 |
| Flows TCP | 192.168.1.1:1068 ➝ 141.8.226.15:80 |
Raw Pcap
0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a207461 626c6566 72756974 2e6e6574 : tablefruit.net 0x00000080 (00128) 0d0a0d0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a207374 69636b6d 61726368 2e6e6574 : stickmarch.net 0x00000080 (00128) 0d0a0d0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a20726f 6f6d746f 6461792e 6e65740d : roomtoday.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a207369 676e746f 6461792e 6e65740d : signtoday.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206d6f 7665746f 6461792e 6e65740d : movetoday.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206a75 6d70746f 6461792e 6e65740d : jumptoday.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206869 6c6c7365 76656e2e 6e65740d : hillseven.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206665 6c747365 76656e2e 6e65740d : feltseven.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a207468 72656573 6f6d652e 6e65740d : threesome.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a207468 72656573 6576656e 2e6e6574 : threeseven.net 0x00000080 (00128) 0d0a0d0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206b6e 6f77626f 64792e6e 65740d0a : knowbody.net.. 0x00000080 (00128) 0d0a0d0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206162 6c65626f 64792e6e 65740d0a : ablebody.net.. 0x00000080 (00128) 0d0a0d0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a20726f 6f6d7465 6c6c2e6e 65740d0a : roomtell.net.. 0x00000080 (00128) 0d0a0d0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a207369 676e7465 6c6c2e6e 65740d0a : signtell.net.. 0x00000080 (00128) 0d0a0d0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206d6f 76656461 6e63652e 6e65740d : movedance.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206a75 6d707465 6c6c2e6e 65740d0a : jumptell.net.. 0x00000080 (00128) 0d0a0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a207461 626c6566 72756974 2e6e6574 : tablefruit.net 0x00000080 (00128) 0d0a0d0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a207374 69636b6d 61726368 2e6e6574 : stickmarch.net 0x00000080 (00128) 0d0a0d0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a20726f 6f6d746f 6461792e 6e65740d : roomtoday.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a207369 676e746f 6461792e 6e65740d : signtoday.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206d6f 7665746f 6461792e 6e65740d : movetoday.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206a75 6d70746f 6461792e 6e65740d : jumptoday.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206869 6c6c7365 76656e2e 6e65740d : hillseven.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206665 6c747365 76656e2e 6e65740d : feltseven.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a207468 72656573 6f6d652e 6e65740d : threesome.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a207468 72656573 6576656e 2e6e6574 : threeseven.net 0x00000080 (00128) 0d0a0d0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206b6e 6f77626f 64792e6e 65740d0a : knowbody.net.. 0x00000080 (00128) 0d0a0d0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206162 6c65626f 64792e6e 65740d0a : ablebody.net.. 0x00000080 (00128) 0d0a0d0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a20726f 6f6d7465 6c6c2e6e 65740d0a : roomtell.net.. 0x00000080 (00128) 0d0a0d0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a207369 676e7465 6c6c2e6e 65740d0a : signtell.net.. 0x00000080 (00128) 0d0a0d0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206d6f 76656461 6e63652e 6e65740d : movedance.net. 0x00000080 (00128) 0a0d0a0a .... 0x00000000 (00000) 47455420 2f666f72 756d2f73 65617263 GET /forum/searc 0x00000010 (00016) 682e7068 703f6d65 74686f64 3d76616c h.php?method=val 0x00000020 (00032) 69646174 65266d6f 64653d73 6f782676 idate&mode=sox&v 0x00000030 (00048) 3d303233 26736f78 3d336436 65386330 =023&sox=3d6e8c0 0x00000040 (00064) 30204854 54502f31 2e300d0a 41636365 0 HTTP/1.0..Acce 0x00000050 (00080) 70743a20 2a2f2a0d 0a436f6e 6e656374 pt: */*..Connect 0x00000060 (00096) 696f6e3a 20636c6f 73650d0a 486f7374 ion: close..Host 0x00000070 (00112) 3a206a75 6d707465 6c6c2e6e 65740d0a : jumptell.net.. 0x00000080 (00128) 0d0a0a0a ....
Strings