Analysis Date2013-08-31 10:48:07
MD5368d47e650302bc17f927ebfa37868d2
SHA131caa332bb69dbcfdca4cb57b9b2390d1453adbe

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 454b1b22c6244dae015bf0f5aa56df5a sha1: ac2f70bb5bf872a5cb698a2f9337f7d125ea3b1c size: 237568
Section.rdata md5: 27415029460501b5b3b8b4d9bff132d3 sha1: 1b09e786fe6a602499a42bf5280fa463d8ab7fe7 size: 29184
Section.data md5: 7562074a4554e45b80c299953ddd6d7e sha1: 0990dbd35e5217efa627f140581c1a609bf053d7 size: 9216
Timestamp2011-12-07 00:45:30
PackerMicrosoft Visual C++ ?.?
PEhash748efe097c54b7b8b536ce9ac912607d398de85b
AVavgAgent_r.AVD
AVmsseVirTool:Win32/Obfuscator.AAV

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Peer Time Copy Computer Function ➝
C:\Documents and Settings\Administrator\Local Settings\Application Data\wwrampsvmcpvhy\kuifiuzrmzyz.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\wwrampsvmcpvhy\kuifiuzrmzyz.exe
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Application Data\wwrampsvmcpvhy\kuifiuzrmzyz.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Application Data\wwrampsvmcpvhy\kuifiuzrmzyz.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\wwrampsvmcpvhy\kuifiuzrmzyz.rxo
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\wwrampsvmcpvhy\trgajqlt.exe
Creates File\Device\Afd\Endpoint
Creates ProcessWATCHDOGPROC "C:\Documents and Settings\Administrator\Local Settings\Application Data\wwrampsvmcpvhy\kuifiuzrmzyz.exe"

Process
↳ WATCHDOGPROC "C:\Documents and Settings\Administrator\Local Settings\Application Data\wwrampsvmcpvhy\kuifiuzrmzyz.exe"

Network Details:

DNShaselopricezat.com
Type: A
208.73.210.155
DNSoppored.com
Type: A
69.43.161.169
DNSpulaminacee.com
Type: A
208.73.210.155
DNSburitosasrl.com
Type: A
69.43.161.170
DNSrebalt.com
Type: A
184.168.221.2
DNSgonotar.com
Type: A
208.73.210.155
DNSelverot.com
Type: A
208.73.210.155
DNSfalaterest.com
Type: A
208.73.210.155
DNSpapadov.com
Type: A
208.73.211.230
DNSbadero.com
Type: A
50.63.202.67
DNSjimberolipop.com
Type: A
208.73.210.155
DNSglostmec.com
Type: A
208.73.210.155
DNSiberan.com
Type: A
208.73.211.246
DNSburitoriso.com
Type: A
208.73.211.230
DNSpoleric.com
Type: A
208.73.210.155
DNSvadelt.com
Type: A
208.73.210.155
DNSgehereiroplop.com
Type: A
208.73.210.155
DNSelectow.com
Type: A
208.73.210.155
DNSekendar.com
Type: A
208.73.210.155
DNSswcopilserits.com
Type: A
208.73.210.155
DNSmelixe.com
Type: A
208.73.210.155
DNSbilode.com
Type: A
209.99.40.226
DNSmarjepolirst.com
Type: A
208.73.210.155
DNShartend.com
Type: A
208.73.210.155
DNSferetolopazerns.com
Type: A
208.73.210.155
DNSmacandpa.com
Type: A
208.73.211.249
DNSlocoand.com
Type: A
208.73.210.155
DNSnerlestitops.com
Type: A
208.73.211.247
DNSjondiret.com
Type: A
208.73.211.246
DNSbinerat.com
Type: A
208.73.210.155
DNSherolopcazers.com
Type: A
208.73.210.155
DNSvadaxer.com
Type: A
208.73.210.155
DNSfontored.com
Type: A
64.15.71.22
DNSaderino.com
Type: A
209.99.40.223
DNSklestar.com
Type: A
72.10.147.5
DNSklestar.com
Type: A
72.10.147.6
DNSmianaf.com
Type: A
208.73.210.155
DNSnaimied.com
Type: A
208.73.210.155
DNSdengodar.com
Type: A
208.73.210.155
DNSbezedete.com
Type: A
209.99.40.227
DNSmogohet.com
Type: A
DNSgesqwaserops.com
Type: A
DNSfiatelox.com
Type: A
DNSdafatan.com
Type: A
HTTP GEThttp://haselopricezat.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://oppored.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://pulaminacee.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://buritosasrl.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://rebalt.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://gonotar.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://elverot.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://falaterest.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://papadov.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://badero.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://jimberolipop.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://glostmec.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://iberan.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://buritoriso.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://poleric.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://vadelt.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://gehereiroplop.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://electow.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://ekendar.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://swcopilserits.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://melixe.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://bilode.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://marjepolirst.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://hartend.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://feretolopazerns.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://macandpa.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://locoand.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://nerlestitops.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://jondiret.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://binerat.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://herolopcazers.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://vadaxer.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://fontored.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://aderino.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://falaterest.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://klestar.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://mianaf.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://naimied.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://dengodar.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
HTTP GEThttp://bezedete.com/forum/search.php?email=rmejias1@hotmail.com
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1032 ➝ 69.43.161.169:80
Flows TCP192.168.1.1:1033 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1034 ➝ 69.43.161.170:80
Flows TCP192.168.1.1:1035 ➝ 184.168.221.2:80
Flows TCP192.168.1.1:1036 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1037 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1038 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1039 ➝ 208.73.211.230:80
Flows TCP192.168.1.1:1040 ➝ 50.63.202.67:80
Flows TCP192.168.1.1:1041 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1042 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1043 ➝ 208.73.211.246:80
Flows TCP192.168.1.1:1044 ➝ 208.73.211.230:80
Flows TCP192.168.1.1:1045 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1046 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1047 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1048 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1049 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1050 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1051 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1052 ➝ 209.99.40.226:80
Flows TCP192.168.1.1:1053 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1054 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1055 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1056 ➝ 208.73.211.249:80
Flows TCP192.168.1.1:1057 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1058 ➝ 208.73.211.247:80
Flows TCP192.168.1.1:1059 ➝ 208.73.211.246:80
Flows TCP192.168.1.1:1060 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1061 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1062 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1063 ➝ 64.15.71.22:80
Flows TCP192.168.1.1:1064 ➝ 209.99.40.223:80
Flows TCP192.168.1.1:1065 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1066 ➝ 72.10.147.5:80
Flows TCP192.168.1.1:1067 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1068 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1069 ➝ 208.73.210.155:80
Flows TCP192.168.1.1:1070 ➝ 209.99.40.227:80

Raw Pcap
0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20686173 656c6f70 72696365 7a61742e    haselopricezat.
0x00000070 (00112)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206f7070 6f726564 2e636f6d 0d0a0d0a    oppored.com....
0x00000070 (00112)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   2070756c 616d696e 61636565 2e636f6d    pulaminacee.com
0x00000070 (00112)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20627572 69746f73 6173726c 2e636f6d    buritosasrl.com
0x00000070 (00112)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20726562 616c742e 636f6d0d 0a0d0a6d    rebalt.com....m
0x00000070 (00112)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20676f6e 6f746172 2e636f6d 0d0a0d0a    gonotar.com....
0x00000070 (00112)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20656c76 65726f74 2e636f6d 0d0a0d0a    elverot.com....
0x00000070 (00112)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   2066616c 61746572 6573742e 636f6d0d    falaterest.com.
0x00000070 (00112)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20706170 61646f76 2e636f6d 0d0a0d0a    papadov.com....
0x00000070 (00112)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20626164 65726f2e 636f6d0d 0a0d0a0a    badero.com.....
0x00000070 (00112)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206a696d 6265726f 6c69706f 702e636f    jimberolipop.co
0x00000070 (00112)   6d0d0a0d 0a0d0a                       m......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20676c6f 73746d65 632e636f 6d0d0a0d    glostmec.com...
0x00000070 (00112)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20696265 72616e2e 636f6d0d 0a0d0a0d    iberan.com.....
0x00000070 (00112)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20627572 69746f72 69736f2e 636f6d0d    buritoriso.com.
0x00000070 (00112)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20706f6c 65726963 2e636f6d 0d0a0d0a    poleric.com....
0x00000070 (00112)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20766164 656c742e 636f6d0d 0a0d0a0a    vadelt.com.....
0x00000070 (00112)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20676568 65726569 726f706c 6f702e63    gehereiroplop.c
0x00000070 (00112)   6f6d0d0a 0d0a0a                       om.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20656c65 63746f77 2e636f6d 0d0a0d0a    electow.com....
0x00000070 (00112)   6f6d0d0a 0d0a0a                       om.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20656b65 6e646172 2e636f6d 0d0a0d0a    ekendar.com....
0x00000070 (00112)   6f6d0d0a 0d0a0a                       om.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20737763 6f70696c 73657269 74732e63    swcopilserits.c
0x00000070 (00112)   6f6d0d0a 0d0a0a                       om.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206d656c 6978652e 636f6d0d 0a0d0a63    melixe.com....c
0x00000070 (00112)   6f6d0d0a 0d0a0a                       om.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   2062696c 6f64652e 636f6d0d 0a0d0a63    bilode.com....c
0x00000070 (00112)   6f6d0d0a 0d0a0a                       om.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206d6172 6a65706f 6c697273 742e636f    marjepolirst.co
0x00000070 (00112)   6d0d0a0d 0a0a0a                       m......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20686172 74656e64 2e636f6d 0d0a0d0a    hartend.com....
0x00000070 (00112)   6d0d0a0d 0a0a0a                       m......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20666572 65746f6c 6f70617a 65726e73    feretolopazerns
0x00000070 (00112)   2e636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206d6163 616e6470 612e636f 6d0d0a0d    macandpa.com...
0x00000070 (00112)   0a636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206c6f63 6f616e64 2e636f6d 0d0a0d0a    locoand.com....
0x00000070 (00112)   0a636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206e6572 6c657374 69746f70 732e636f    nerlestitops.co
0x00000070 (00112)   6d0d0a0d 0a0a0d0a                     m.......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206a6f6e 64697265 742e636f 6d0d0a0d    jondiret.com...
0x00000070 (00112)   0a0d0a0d 0a0a0d0a                     ........

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   2062696e 65726174 2e636f6d 0d0a0d0a    binerat.com....
0x00000070 (00112)   0a0d0a0d 0a0a0d0a                     ........

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20686572 6f6c6f70 63617a65 72732e63    herolopcazers.c
0x00000070 (00112)   6f6d0d0a 0d0a0d0a                     om......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20766164 61786572 2e636f6d 0d0a0d0a    vadaxer.com....
0x00000070 (00112)   6f6d0d0a 0d0a0d0a                     om......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20666f6e 746f7265 642e636f 6d0d0a0d    fontored.com...
0x00000070 (00112)   0a6d0d0a                              .m..

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20616465 72696e6f 2e636f6d 0d0a0d0a    aderino.com....
0x00000070 (00112)   0a6d0d0a                              .m..

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   2066616c 61746572 6573742e 636f6d0d    falaterest.com.
0x00000070 (00112)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206b6c65 73746172 2e636f6d 0d0a0d0a    klestar.com....
0x00000070 (00112)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206d6961 6e61662e 636f6d0d 0a0d0a0a    mianaf.com.....
0x00000070 (00112)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206e6169 6d696564 2e636f6d 0d0a0d0a    naimied.com....
0x00000070 (00112)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   2064656e 676f6461 722e636f 6d0d0a0d    dengodar.com...
0x00000070 (00112)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 726d656a   h.php?email=rmej
0x00000020 (00032)   69617331 40686f74 6d61696c 2e636f6d   ias1@hotmail.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   2062657a 65646574 652e636f 6d0d0a0d    bezedete.com...
0x00000070 (00112)   0a0d0a0a                              ....


Strings