Analysis Date2018-02-06 22:26:45
MD5f03bc615ea8416942349469334449f0c
SHA12adfa2d0b89d3f405c0132f51871b65be41f5725

Static Details:

File typePE32 executable (GUI) Intel 80386, for MS Windows
PEhash
AVArcabit (arcavir)Gen:Variant.Zusy.82682
AVAuthentiumW32/Agent.NK.gen!Eldorado
AVGrisoft (avg)Error Scanning File
AVAvira (antivir)No Virus
AVAlwil (avast)Agent-AUAI [Trj]
AVAd-AwareGen:Variant.Zusy.82682
AVBitDefenderGen:Variant.Zusy.82682
AVBullGuardGen:Variant.Zusy.82682
AVClamAVNo Virus
AVDr. WebNo Virus
AVEmsisoftGen:Variant.Zusy.82682
AVMicroWorld (escan)Gen:Variant.Zusy.82682
AVCA (E-Trust Ino)Gen:Variant.Zusy.82682
AVFortinetW32/Agent.VNC!tr
AVFrisk (f-prot)W32/Agent.NK.gen!Eldorado
AVF-SecureGen:Variant.Zusy.82682
AVIkarusTrojan.FBLock
AVK7Error Scanning File
AVKasperskyTrojan.Win32.Generic
AVMalwareBytesTrojan.Agent
AVMcafeeGeneric-FAOV!F03BC615EA84
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort
AVNANOTrojan.Win32.PEF.dettph
AVEset (nod32)Win32/Agent.VNC
AVPadvishNo Virus
AVCAT (quickheal)Trojan.Scar.16686
AVRisingNo Virus
AV360 SafeNo Virus
AVSUPERAntiSpywareNo Virus
AVSymantecNo Virus
AVTrend MicroNo Virus
AVTwisterTrojan.Agent.VNC.spsn.mg
AVVirusBlokAda (vba32)No Virus
AVWindows DefenderTrojanSpy:Win32/Nivdort
AVZillya!No Virus

Runtime Details:

Screenshot

Process
↳ C:\Windows\System32\lsass.exe

Process
↳ C:\Users\THX1138\AppData\Local\Temp\2adfa2d0b89d3f405c0132f51871b65be41f5725.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Upgrade Interactive Event Offline ➝
C:\Users\THX1138\AppData\Roaming\erswojl\kuveahstat.exe

Process
↳ C:\Users\THX1138\AppData\Roaming\erswojl\kuveahstat.exe

Creates FileC:\Users\THX1138\AppData\Roaming\erswojl\kuveahstat.xx
Creates FileC:\Users\THX1138\AppData\Roaming\erswojl\kuveahstat.xx

Process
↳ C:\Users\THX1138\AppData\Roaming\erswojl\bothyvgzgomk.exe

Process
↳ C:\Users\THX1138\AppData\Roaming\erswojl\bothyvgzgomk.exe

Process
↳ C:\Users\THX1138\AppData\Roaming\erswojl\bothyvgzgomk.exe

Creates FileC:\Users\THX1138\AppData\Roaming\erswojl\bothyvgzgomk.exe

Process
↳ C:\Users\THX1138\AppData\Roaming\erswojl\kuveahstat.exe

Network Details:


Raw Pcap
0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 206e6967   close..Host: nig
0x00000070 (00112)   68747072 6f647563 652e6e65 740d0a0d   htproduce.net...
0x00000080 (00128)   0a                                    .

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20646563   close..Host: dec
0x00000070 (00112)   69646570 726f6475 63652e6e 65740d0a   ideproduce.net..
0x00000080 (00128)   0d0a                                  ..

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 206e6967   close..Host: nig
0x00000070 (00112)   68747374 7564656e 742e6e65 740d0a0d   htstudent.net...
0x00000080 (00128)   0a0a                                  ..

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20646563   close..Host: dec
0x00000070 (00112)   69646573 74756465 6e742e6e 65740d0a   idestudent.net..
0x00000080 (00128)   0d0a                                  ..

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 206c6172   close..Host: lar
0x00000070 (00112)   67657375 63636565 642e6e65 740d0a0d   gesucceed.net...
0x00000080 (00128)   0a0a                                  ..

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20636170   close..Host: cap
0x00000070 (00112)   7461696e 73756363 6565642e 6e65740d   tainsucceed.net.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 206c6172   close..Host: lar
0x00000070 (00112)   67656265 74776565 6e2e6e65 740d0a0d   gebetween.net...
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20636170   close..Host: cap
0x00000070 (00112)   7461696e 62657477 65656e2e 6e65740d   tainbetween.net.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 206c6172   close..Host: lar
0x00000070 (00112)   67657072 6f647563 652e6e65 740d0a0d   geproduce.net...
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20636170   close..Host: cap
0x00000070 (00112)   7461696e 70726f64 7563652e 6e65740d   tainproduce.net.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 206c6172   close..Host: lar
0x00000070 (00112)   67657374 7564656e 742e6e65 740d0a0d   gestudent.net...
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20636170   close..Host: cap
0x00000070 (00112)   7461696e 73747564 656e742e 6e65740d   tainstudent.net.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20726563   close..Host: rec
0x00000070 (00112)   6f726473 75636365 65642e6e 65740d0a   ordsucceed.net..
0x00000080 (00128)   0d0a0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20656c65   close..Host: ele
0x00000070 (00112)   63747269 63737563 63656564 2e6e6574   ctricsucceed.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20726563   close..Host: rec
0x00000070 (00112)   6f726462 65747765 656e2e6e 65740d0a   ordbetween.net..
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20656c65   close..Host: ele
0x00000070 (00112)   63747269 63626574 7765656e 2e6e6574   ctricbetween.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20726563   close..Host: rec
0x00000070 (00112)   6f726470 726f6475 63652e6e 65740d0a   ordproduce.net..
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20656c65   close..Host: ele
0x00000070 (00112)   63747269 6370726f 64756365 2e6e6574   ctricproduce.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20726563   close..Host: rec
0x00000070 (00112)   6f726473 74756465 6e742e6e 65740d0a   ordstudent.net..
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20656c65   close..Host: ele
0x00000070 (00112)   63747269 63737475 64656e74 2e6e6574   ctricstudent.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20737472   close..Host: str
0x00000070 (00112)   65657473 75636365 65642e6e 65740d0a   eetsucceed.net..
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20747261   close..Host: tra
0x00000070 (00112)   64657375 63636565 642e6e65 740d0a0d   desucceed.net...
0x00000080 (00128)   0a0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20737472   close..Host: str
0x00000070 (00112)   65657462 65747765 656e2e6e 65740d0a   eetbetween.net..
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20747261   close..Host: tra
0x00000070 (00112)   64656265 74776565 6e2e6e65 740d0a0d   debetween.net...
0x00000080 (00128)   0a0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20737472   close..Host: str
0x00000070 (00112)   65657470 726f6475 63652e6e 65740d0a   eetproduce.net..
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 696e666f   h.php?email=info
0x00000020 (00032)   40706173 6368616c 74656368 2e636f6d   @paschaltech.com
0x00000030 (00048)   266d6574 686f643d 706f7374 20485454   &method=post HTT
0x00000040 (00064)   502f312e 300d0a41 63636570 743a202a   P/1.0..Accept: *
0x00000050 (00080)   2f2a0d0a 436f6e6e 65637469 6f6e3a20   /*..Connection: 
0x00000060 (00096)   636c6f73 650d0a48 6f73743a 20747261   close..Host: tra
0x00000070 (00112)   64657072 6f647563 652e6e65 740d0a0d   deproduce.net...
0x00000080 (00128)   0a0a0d0a                              ....


Strings