Analysis Date2014-09-15 02:19:47
MD5825443cc3014b7e0614bcc59d692104e
SHA1460f20b6b2a604fd731c82d88c23fa0ab87b62d3

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 6905e51b8f726d83a4d667809a3eb224 sha1: d87c39bcfe8d660fbb67a3a32f351ff489cdd61c size: 1024
Section.rdata md5: a2feaf3ba629027ed0b7b0663a4836e0 sha1: 3b0ef5c293336d1f6446110672af463e64f55392 size: 512
Section.data md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rsrc md5: b4097c1811c681ba9fc9e4185006bbb7 sha1: 336524b672aaadd9a6879bd69c45896a6a59e171 size: 37888
Timestamp2004-09-26 21:12:31
VersionLegalCopyright: Copyright (C) 2000
InternalName: MPIRing
FileVersion: 1, 0, 0, 1
CompanyName:
LegalTrademarks:
ProductName: MPIRing Application
ProductVersion: 1, 0, 0, 1
FileDescription: MPIRing MFC Application
OriginalFilename: MPIRing.EXE
PEhashbf471dc64704c73f2e726b42040b59207263ad33
IMPhash8aa48b00dd80d2085cbbd81726a688be

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\xodkalujinha ➝
C:\Documents and Settings\Administrator\xodkalujinha.exe
RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\AppManagement ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\vampirefreaks[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\windermere[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\bluewin[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\netpower[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\knology[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\rcn[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\rwd[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\gallatinriver[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\ufl[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\roadrunner[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\sify[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\ufl[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\talstar[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\conwaycorp[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\supanet[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\ukr[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\xodkalujinha.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\x-men[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\csrlink[1].htm
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\gamil[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\catech-systems[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\eastlink[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\excite[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\micron[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\windermere[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\mail.unomaha[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\aol[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\flemingc.on[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\backpacker[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\ig.com[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\htcomp[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\mail.earthlink[1].htm
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\ufl[1].htm
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates Mutexxodkalujinha
Winsock DNSaol.com
Winsock DNSknology.net
Winsock DNScatech-systems.com
Winsock DNSroadrunner.com
Winsock DNSmicron.net
Winsock DNSrwd.com
Winsock DNSbackpacker.com
Winsock DNScantv.net
Winsock DNSgamil.com
Winsock DNSexcite.fr
Winsock DNSsify.com
Winsock DNSrcn.com
Winsock DNSmail.unomaha.edu
Winsock DNSeastlink.ca
Winsock DNSig.com.br
Winsock DNSconwaycorp.net
Winsock DNSquixnet.net
Winsock DNSnetpower.no
Winsock DNSukr.net
Winsock DNSvampirefreaks.com
Winsock DNShtcomp.net
Winsock DNSx-men.com
Winsock DNSthe-wild-west.com
Winsock DNSmail.earthlink.net
Winsock DNSsupanet.com
Winsock DNSwindermere.com
Winsock DNScsrlink.net
Winsock DNSufl.edu
Winsock DNSflemingc.on.ca
Winsock DNSbluewin.com
Winsock DNStalstar.com
Winsock DNSgallatinriver.net
Winsock DNSwww.aol.com

Network Details:

DNSintuit.com
Type: A
206.108.40.108
DNSvalornet.com
Type: A
162.39.145.20
DNSsupanet.com
Type: A
213.40.190.200
DNScableone.net
Type: A
24.116.1.80
DNSbackpacker.com
Type: A
50.17.192.180
DNSwebound.com
Type: A
216.106.44.50
DNSanthem.com
Type: A
162.95.221.41
DNSpchome.com.tw
Type: A
210.59.230.60
DNSwindermere.com
Type: A
205.234.73.170
DNSflemingc.on.ca
Type: A
192.197.148.244
DNSv6v4.portal-standard.aol.akadns.net
Type: A
64.12.107.131
DNSv6v4.portal-standard.aol.akadns.net
Type: A
205.188.18.208
DNSv6v4.portal-standard.aol.akadns.net
Type: A
205.188.19.16
DNSv6v4.portal-standard.aol.akadns.net
Type: A
64.12.21.3
DNSgallatinriver.net
Type: A
69.168.97.85
DNSufl.edu
Type: A
128.227.9.48
DNSnetpower.no
Type: A
46.255.16.76
DNSx-men.com
Type: A
72.32.138.96
DNSig.com.br
Type: A
54.208.27.227
DNSig.com.br
Type: A
54.208.23.82
DNSrwd.com
Type: A
8.12.5.99
DNSbluewin.com
Type: A
195.186.196.90
DNSbluewin.com
Type: A
195.186.145.90
DNSrcn.com
Type: A
207.172.156.182
DNSrcn.com
Type: A
208.59.90.35
DNSrcn.com
Type: A
207.172.156.181
DNSvampirefreaks.com
Type: A
198.24.37.193
DNSwww.aol.com
Type: A
DNSquixnet.net
Type: A
HTTP POSThttp://backpacker.com/?ptrxcz_LeyHZtCUo7Pi2KdwFEdx02VqY1h2e0
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP POSThttp://windermere.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP POSThttp://www.aol.com/?ptrxcz_o8Rl5Oh2Le4Rl6MpATm5Oh0JcwElEY
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP POSThttp://flemingc.on.ca/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP POSThttp://gallatinriver.net/?ptrxcz_dxGYsBTm5Og0IfzqBVo7Qj3LeyHatC
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP POSThttp://ufl.edu/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP POSThttp://netpower.no/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP POSThttp://x-men.com/?ptrxcz_i2LeyHauDWq9Sl5Ng0JcwFYsBUo7Qi
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP POSThttp://ig.com.br/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP POSThttp://rwd.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP POSThttp://windermere.com/?ptrxcz_wJbuBTkzOgzGXqaLl40Sm7QkGh2Lez
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP POSThttp://bluewin.com/?ptrxcz_BUm4LdvCTl7PgzGXq7OFfxEVm4LbtA
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP POSThttp://rcn.com/?ptrxcz_3Nh1KeyHbvEYsIm63Rl6ezd2cyHbwF
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP POSThttp://vampirefreaks.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Flows TCP192.168.1.1:1037 ➝ 162.95.221.41:25
Flows TCP192.168.1.1:1038 ➝ 216.106.44.50:25
Flows TCP192.168.1.1:1039 ➝ 50.17.192.180:25
Flows TCP192.168.1.1:1040 ➝ 24.116.1.80:25
Flows TCP192.168.1.1:1041 ➝ 162.39.145.20:25
Flows TCP192.168.1.1:1042 ➝ 206.108.40.108:25
Flows TCP192.168.1.1:1043 ➝ 213.40.190.200:25
Flows TCP192.168.1.1:1044 ➝ 210.59.230.60:25
Flows TCP192.168.1.1:1045 ➝ 50.17.192.180:80
Flows TCP192.168.1.1:1046 ➝ 205.234.73.170:80
Flows TCP192.168.1.1:1047 ➝ 64.12.107.131:80
Flows TCP192.168.1.1:1048 ➝ 192.197.148.244:80
Flows TCP192.168.1.1:1049 ➝ 69.168.97.85:80
Flows TCP192.168.1.1:1050 ➝ 128.227.9.48:80
Flows TCP192.168.1.1:1051 ➝ 46.255.16.76:80
Flows TCP192.168.1.1:1052 ➝ 72.32.138.96:80
Flows TCP192.168.1.1:1053 ➝ 54.208.27.227:80
Flows TCP192.168.1.1:1054 ➝ 8.12.5.99:80
Flows TCP192.168.1.1:1055 ➝ 205.234.73.170:80
Flows TCP192.168.1.1:1056 ➝ 195.186.196.90:80
Flows TCP192.168.1.1:1057 ➝ 207.172.156.182:80
Flows TCP192.168.1.1:1058 ➝ 198.24.37.193:80

Raw Pcap
0x00000000 (00000)   504f5354 202f3f70 74727863 7a5f4c65   POST /?ptrxcz_Le
0x00000010 (00016)   79485a74 43556f37 5069324b 64774645   yHZtCUo7Pi2KdwFE
0x00000020 (00032)   64783032 56715931 68326530 20485454   dx02VqY1h2e0 HTT
0x00000030 (00048)   502f312e 310d0a41 63636570 743a202a   P/1.1..Accept: *
0x00000040 (00064)   2f2a0d0a 41636365 70742d4c 616e6775   /*..Accept-Langu
0x00000050 (00080)   6167653a 20656e2d 75730d0a 436f6e74   age: en-us..Cont
0x00000060 (00096)   656e742d 54797065 3a206170 706c6963   ent-Type: applic
0x00000070 (00112)   6174696f 6e2f6f63 7465742d 73747265   ation/octet-stre
0x00000080 (00128)   616d0d0a 436f6e74 656e742d 4c656e67   am..Content-Leng
0x00000090 (00144)   74683a20 3131370d 0a557365 722d4167   th: 117..User-Ag
0x000000a0 (00160)   656e743a 204d6f7a 696c6c61 2f342e30   ent: Mozilla/4.0
0x000000b0 (00176)   2028636f 6d706174 69626c65 3b204d53    (compatible; MS
0x000000c0 (00192)   49452036 2e303b20 57696e64 6f777320   IE 6.0; Windows 
0x000000d0 (00208)   4e542035 2e313b20 53563129 0d0a486f   NT 5.1; SV1)..Ho
0x000000e0 (00224)   73743a20 6261636b 7061636b 65722e63   st: backpacker.c
0x000000f0 (00240)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000100 (00256)   4b656570 2d416c69 76650d0a 43616368   Keep-Alive..Cach
0x00000110 (00272)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000120 (00288)   6368650d 0a0d0a35 cd0ce02c 60efe123   che....5...,`..#
0x00000130 (00304)   f3d1e31a 86b4e51e 7fb0e715 1293e90c   ................
0x00000140 (00320)   a575eb03 3858edfa ca3aeff1 5d1df1e8   .u..8X...:..]...
0x00000150 (00336)   f0fff2df 83e2f4d6 16c5f6cd a9a7f8d1   ................
0x00000160 (00352)   a2a3fac8 3586fcbf c868feb6 5b4b       ....5....h..[K

0x00000000 (00000)   504f5354 202f2048 5454502f 312e310d   POST / HTTP/1.1.
0x00000010 (00016)   0a416363 6570743a 202a2f2a 0d0a4163   .Accept: */*..Ac
0x00000020 (00032)   63657074 2d4c616e 67756167 653a2065   cept-Language: e
0x00000030 (00048)   6e2d7573 0d0a436f 6e74656e 742d5479   n-us..Content-Ty
0x00000040 (00064)   70653a20 6170706c 69636174 696f6e2f   pe: application/
0x00000050 (00080)   6f637465 742d7374 7265616d 0d0a436f   octet-stream..Co
0x00000060 (00096)   6e74656e 742d4c65 6e677468 3a203133   ntent-Length: 13
0x00000070 (00112)   330d0a55 7365722d 4167656e 743a204d   3..User-Agent: M
0x00000080 (00128)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x00000090 (00144)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000a0 (00160)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000b0 (00176)   3b205356 31290d0a 486f7374 3a207769   ; SV1)..Host: wi
0x000000c0 (00192)   6e646572 6d657265 2e636f6d 0d0a436f   ndermere.com..Co
0x000000d0 (00208)   6e6e6563 74696f6e 3a204b65 65702d41   nnection: Keep-A
0x000000e0 (00224)   6c697665 0d0a4361 6368652d 436f6e74   live..Cache-Cont
0x000000f0 (00240)   726f6c3a 206e6f2d 63616368 650d0a0d   rol: no-cache...
0x00000100 (00256)   0a9632cc e93793b8 6a3b8cb4 6c3f85b0   ..2..7..j;..l?..
0x00000110 (00272)   6e437eac 702c3050 7845815d 7e97def1   nC~.p,0PxE.]~...
0x00000120 (00288)   808e71d4 82926ad0 8489fdb2 86f5ae05   ..q...j.........
0x00000130 (00304)   09848991 8a89828d 8c7f1570 8e830e6c   ...........p...l
0x00000140 (00320)   907aa14e 92cd9a4a 94752d2d 96b12629   .z.N...J.u--..&)
0x00000150 (00336)   9893b90b 9a97b207 9c034aea 9dde9b54   ..........J....T
0x00000160 (00352)   056dd1c8 a1b63933 09615da7 a5456b2d   .m....93.a]..Ek-
0x00000170 (00368)   a82cea85 a93c83e9 27727564 ad4e0a47   .,...<..'rud.N.G
0x00000180 (00384)   af4e0123 b36c                         .N.#.l

0x00000000 (00000)   504f5354 202f2048 5454502f 312e310d   POST / HTTP/1.1.
0x00000010 (00016)   0a416363 6570743a 202a2f2a 0d0a4163   .Accept: */*..Ac
0x00000020 (00032)   63657074 2d4c616e 67756167 653a2065   cept-Language: e
0x00000030 (00048)   6e2d7573 0d0a436f 6e74656e 742d5479   n-us..Content-Ty
0x00000040 (00064)   70653a20 6170706c 69636174 696f6e2f   pe: application/
0x00000050 (00080)   6f637465 742d7374 7265616d 0d0a436f   octet-stream..Co
0x00000060 (00096)   6e74656e 742d4c65 6e677468 3a203232   ntent-Length: 22
0x00000070 (00112)   300d0a55 7365722d 4167656e 743a204d   0..User-Agent: M
0x00000080 (00128)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x00000090 (00144)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000a0 (00160)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000b0 (00176)   3b205356 31290d0a 486f7374 3a20666c   ; SV1)..Host: fl
0x000000c0 (00192)   656d696e 67632e6f 6e2e6361 0d0a436f   emingc.on.ca..Co
0x000000d0 (00208)   6e6e6563 74696f6e 3a204b65 65702d41   nnection: Keep-A
0x000000e0 (00224)   6c697665 0d0a4361 6368652d 436f6e74   live..Cache-Cont
0x000000f0 (00240)   726f6c3a 206e6f2d 63616368 650d0a0d   rol: no-cache...
0x00000100 (00256)   0a8f4bbd 2a9344b9 2c8ad79b 2e8ed097   ..K.*.D.,.......
0x00000110 (00272)   3092c993 3296c28f 348d5572 36914e6e   0...2...4.Ur6.Nn
0x00000120 (00288)   3895476a 3a8cda4c 3c90d348 3e94cc44   8.Gj:..L<..H>..D
0x00000130 (00304)   408b5f27 428f5823 4493511f 468ae401   @._'B.X#D.Q.F...
0x00000140 (00320)   488eddfd 4992d6f9 4b8969dc 4dc562d8   H...I...K.i.M.b.
0x00000150 (00336)   4fb45bd4 51abeeb6 5324ecb2 55ff3d1d   O.[.Q...S$..U.=.
0x00000160 (00352)   bd99d9aa 59d7dbfb c08f6589 5d73730f   ....Y.....e.]ss.
0x00000170 (00368)   605af267 6177f1e4 dfade35f 65897842   `Z.gaw....._e.xB
0x00000180 (00384)   67896fce 6ab4683a 6b88fb1c 6d8cf418   g.o.j.h:k...m...
0x00000190 (00400)   6f90ed14 718780f7 728b79f3 748f72ef   o...q...r.y.t.r.
0x000001a0 (00416)   768605d2 788afecd 7a8ef7c9 7c858aac   v...x...z...|...
0x000001b0 (00432)   7e8983a8 808d7ca4 829175a0 84880883   ~.....|...u.....
0x000001c0 (00448)   868c017f 8890fa7a 8a878d5d 8c8b8659   .......z...]...Y
0x000001d0 (00464)   8e8f7f55 90861238 928a0b34 94         ...U...8...4.

0x00000000 (00000)   504f5354 202f3f70 74727863 7a5f6478   POST /?ptrxcz_dx
0x00000010 (00016)   47597342 546d354f 67304966 7a714256   GYsBTm5Og0IfzqBV
0x00000020 (00032)   6f37516a 334c6579 48617443 20485454   o7Qj3LeyHatC HTT
0x00000030 (00048)   502f312e 310d0a41 63636570 743a202a   P/1.1..Accept: *
0x00000040 (00064)   2f2a0d0a 41636365 70742d4c 616e6775   /*..Accept-Langu
0x00000050 (00080)   6167653a 20656e2d 75730d0a 436f6e74   age: en-us..Cont
0x00000060 (00096)   656e742d 54797065 3a206170 706c6963   ent-Type: applic
0x00000070 (00112)   6174696f 6e2f6f63 7465742d 73747265   ation/octet-stre
0x00000080 (00128)   616d0d0a 436f6e74 656e742d 4c656e67   am..Content-Leng
0x00000090 (00144)   74683a20 34330d0a 55736572 2d416765   th: 43..User-Age
0x000000a0 (00160)   6e743a20 4d6f7a69 6c6c612f 342e3020   nt: Mozilla/4.0 
0x000000b0 (00176)   28636f6d 70617469 626c653b 204d5349   (compatible; MSI
0x000000c0 (00192)   4520362e 303b2057 696e646f 7773204e   E 6.0; Windows N
0x000000d0 (00208)   5420352e 313b2053 5631290d 0a486f73   T 5.1; SV1)..Hos
0x000000e0 (00224)   743a2067 616c6c61 74696e72 69766572   t: gallatinriver
0x000000f0 (00240)   2e6e6574 0d0a436f 6e6e6563 74696f6e   .net..Connection
0x00000100 (00256)   3a204b65 65702d41 6c697665 0d0a4361   : Keep-Alive..Ca
0x00000110 (00272)   6368652d 436f6e74 726f6c3a 206e6f2d   che-Control: no-
0x00000120 (00288)   63616368 650d0a0d 0a79144f 5d70a731   cache....y.O]p.1
0x00000130 (00304)   5f673a14 6192655c 6389f83e 65adb91a   _g:.a.e\c..>e...
0x00000140 (00320)   7733af14 7a37a810 7c76b044 883437a0   w3..z7..|v.D.47.
0x00000150 (00336)   8d869434                              ...4

0x00000000 (00000)   504f5354 202f3f70 74727863 7a5f6f38   POST /?ptrxcz_o8
0x00000010 (00016)   526c354f 68324c65 34526c36 4d704154   Rl5Oh2Le4Rl6MpAT
0x00000020 (00032)   6d354f68 304a6377 456c4559 20485454   m5Oh0JcwElEY HTT
0x00000030 (00048)   502f312e 310d0a41 63636570 743a202a   P/1.1..Accept: *
0x00000040 (00064)   2f2a0d0a 41636365 70742d4c 616e6775   /*..Accept-Langu
0x00000050 (00080)   6167653a 20656e2d 75730d0a 436f6e74   age: en-us..Cont
0x00000060 (00096)   656e742d 54797065 3a206170 706c6963   ent-Type: applic
0x00000070 (00112)   6174696f 6e2f6f63 7465742d 73747265   ation/octet-stre
0x00000080 (00128)   616d0d0a 436f6e74 656e742d 4c656e67   am..Content-Leng
0x00000090 (00144)   74683a20 3138310d 0a557365 722d4167   th: 181..User-Ag
0x000000a0 (00160)   656e743a 204d6f7a 696c6c61 2f342e30   ent: Mozilla/4.0
0x000000b0 (00176)   2028636f 6d706174 69626c65 3b204d53    (compatible; MS
0x000000c0 (00192)   49452036 2e303b20 57696e64 6f777320   IE 6.0; Windows 
0x000000d0 (00208)   4e542035 2e313b20 53563129 0d0a486f   NT 5.1; SV1)..Ho
0x000000e0 (00224)   73743a20 7777772e 616f6c2e 636f6d0d   st: www.aol.com.
0x000000f0 (00240)   0a436f6e 6e656374 696f6e3a 204b6565   .Connection: Kee
0x00000100 (00256)   702d416c 6976650d 0a436163 68652d43   p-Alive..Cache-C
0x00000110 (00272)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000120 (00288)   0d0a0d0a 8c7aeb4f b5652252 12485d4f   .....z.O.e"R.H]O
0x00000130 (00304)   9d2412d7 fc17f7d8 b8415456 6cd90fdc   .$.......ATVl...
0x00000140 (00320)   7208be5d 6c9da05f 5af7d0e1 f111be5e   r..]l.._Z......^
0x00000150 (00336)   3bd5d1e5 60b35d67 9a63b0e9 66c46166   ;...`.]g.c..f.af
0x00000160 (00352)   31ed8eed 4972dc29 40f8e370 44f1df72   1...Ir.)@..pD..r
0x00000170 (00368)   7384c274 627dbe76 5910a178 d20d9d7a   s..tb}.vY..x...z
0x00000180 (00384)   a0f9ede1 292f627e 7897cce5 23bb4082   ....)/b~x...#.@.
0x00000190 (00400)   07c9c684 ee471f86 fee08204 34d3fd89   .....G......4...
0x000001a0 (00416)   1068e08b 03f9b28e 2ef2be8f ca7eca12   .h...........~..
0x000001b0 (00432)   fe68dc8e 2724e315 a1b22797 b0450a99   .h..'$....'..E..
0x000001c0 (00448)   b7296a1c 47157c98 e666cb9e 99f7ada0   .)j.G.|..f......
0x000001d0 (00464)   e5402724 14a055a1 36                  .@'$..U.6

0x00000000 (00000)   504f5354 202f2048 5454502f 312e310d   POST / HTTP/1.1.
0x00000010 (00016)   0a416363 6570743a 202a2f2a 0d0a4163   .Accept: */*..Ac
0x00000020 (00032)   63657074 2d4c616e 67756167 653a2065   cept-Language: e
0x00000030 (00048)   6e2d7573 0d0a436f 6e74656e 742d5479   n-us..Content-Ty
0x00000040 (00064)   70653a20 6170706c 69636174 696f6e2f   pe: application/
0x00000050 (00080)   6f637465 742d7374 7265616d 0d0a436f   octet-stream..Co
0x00000060 (00096)   6e74656e 742d4c65 6e677468 3a20370d   ntent-Length: 7.
0x00000070 (00112)   0a557365 722d4167 656e743a 204d6f7a   .User-Agent: Moz
0x00000080 (00128)   696c6c61 2f342e30 2028636f 6d706174   illa/4.0 (compat
0x00000090 (00144)   69626c65 3b204d53 49452036 2e303b20   ible; MSIE 6.0; 
0x000000a0 (00160)   57696e64 6f777320 4e542035 2e313b20   Windows NT 5.1; 
0x000000b0 (00176)   53563129 0d0a486f 73743a20 75666c2e   SV1)..Host: ufl.
0x000000c0 (00192)   6564750d 0a436f6e 6e656374 696f6e3a   edu..Connection:
0x000000d0 (00208)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x000000e0 (00224)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x000000f0 (00240)   61636865 0d0a0d0a 7ca61c43 40a2ef     ache....|..C@..

0x00000000 (00000)   504f5354 202f2048 5454502f 312e310d   POST / HTTP/1.1.
0x00000010 (00016)   0a416363 6570743a 202a2f2a 0d0a4163   .Accept: */*..Ac
0x00000020 (00032)   63657074 2d4c616e 67756167 653a2065   cept-Language: e
0x00000030 (00048)   6e2d7573 0d0a436f 6e74656e 742d5479   n-us..Content-Ty
0x00000040 (00064)   70653a20 6170706c 69636174 696f6e2f   pe: application/
0x00000050 (00080)   6f637465 742d7374 7265616d 0d0a436f   octet-stream..Co
0x00000060 (00096)   6e74656e 742d4c65 6e677468 3a203231   ntent-Length: 21
0x00000070 (00112)   380d0a55 7365722d 4167656e 743a204d   8..User-Agent: M
0x00000080 (00128)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x00000090 (00144)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000a0 (00160)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000b0 (00176)   3b205356 31290d0a 486f7374 3a206e65   ; SV1)..Host: ne
0x000000c0 (00192)   74706f77 65722e6e 6f0d0a43 6f6e6e65   tpower.no..Conne
0x000000d0 (00208)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000e0 (00224)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x000000f0 (00240)   3a206e6f 2d636163 68650d0a 0d0ae3af   : no-cache......
0x00000100 (00256)   15296a44 cfa95471 98ab4b04 7bad4297   .)jD..Tq..K.{.B.
0x00000110 (00272)   5daf392a 40b130bd 22b31aea ebb4e5d6   ].9*@.0.".......
0x00000120 (00288)   60ba3734 f5bc2ec7 d7be0cb5 ae4b5288   `.74.........KR.
0x00000130 (00304)   b3d0a5e5 47d39b78 2ad59f71 26d79604   ....G..x*..q&...
0x00000140 (00320)   09d9dc97 ebda842a cedcb3bd b0de9550   .......*.......P
0x00000150 (00336)   93e08ce3 75e205e1 71e4fafe 0e4c0b2a   ....u...q....L.*
0x00000160 (00352)   7deb8c2a 4d5344b4 daef1eda 1dfa78f9   }..*MSD.......x.
0x00000170 (00368)   0f085dcf 5b4fbaf3 22d5a3ee 1ed7967f   ..].[O..".......
0x00000180 (00384)   41dac178 fdda5d05 095e916f 19dac710   A..x..]..^.o....
0x00000190 (00400)   3b613449 cd635042 c9655716 c267e781   ;a4I.cPB.eW..g..
0x000001a0 (00416)   d2e38663 8a6b39f4 6c6d852d 7f6fb4bc   ...c.k9.lm.-.o..
0x000001b0 (00432)   18f0d687 82727753 17f4b311 62766e9a   .....rwS....bvn.
0x000001c0 (00448)   08792e91 047b42cb 167d79b9 277e755d   .y...{B..}y.'~u]
0x000001d0 (00464)   ccff9c08 1f827002                     ......p.

0x00000000 (00000)   504f5354 202f3f70 74727863 7a5f6932   POST /?ptrxcz_i2
0x00000010 (00016)   4c657948 61754457 7139536c 354e6730   LeyHauDWq9Sl5Ng0
0x00000020 (00032)   4a637746 59734255 6f375169 20485454   JcwFYsBUo7Qi HTT
0x00000030 (00048)   502f312e 310d0a41 63636570 743a202a   P/1.1..Accept: *
0x00000040 (00064)   2f2a0d0a 41636365 70742d4c 616e6775   /*..Accept-Langu
0x00000050 (00080)   6167653a 20656e2d 75730d0a 436f6e74   age: en-us..Cont
0x00000060 (00096)   656e742d 54797065 3a206170 706c6963   ent-Type: applic
0x00000070 (00112)   6174696f 6e2f6f63 7465742d 73747265   ation/octet-stre
0x00000080 (00128)   616d0d0a 436f6e74 656e742d 4c656e67   am..Content-Leng
0x00000090 (00144)   74683a20 3136360d 0a557365 722d4167   th: 166..User-Ag
0x000000a0 (00160)   656e743a 204d6f7a 696c6c61 2f342e30   ent: Mozilla/4.0
0x000000b0 (00176)   2028636f 6d706174 69626c65 3b204d53    (compatible; MS
0x000000c0 (00192)   49452036 2e303b20 57696e64 6f777320   IE 6.0; Windows 
0x000000d0 (00208)   4e542035 2e313b20 53563129 0d0a486f   NT 5.1; SV1)..Ho
0x000000e0 (00224)   73743a20 782d6d65 6e2e636f 6d0d0a43   st: x-men.com..C
0x000000f0 (00240)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x00000100 (00256)   416c6976 650d0a43 61636865 2d436f6e   Alive..Cache-Con
0x00000110 (00272)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000120 (00288)   0d0a6999 1743018d e6c5fc18 c5c9f7a4   ..i..C..........
0x00000130 (00304)   a3cdff96 9bd1dfdb 21dbefbf 11e338b0   ........!.....8.
0x00000140 (00320)   88e7333c 67eb353f 18f9cc93 27fe1098   ..3<g.5?....'...
0x00000150 (00336)   0886e469 0f0aed5b 070eda81 cc11e273   ...i...[.......s
0x00000160 (00352)   c415d099 8919278c 811dc6b1 46212070   ......'.....F! p
0x00000170 (00368)   712565bf fd2baeaf 743011da 3934f024   q%e..+..t0..94.$
0x00000180 (00384)   a09d49cc 6345e2b5 e3ed91d2 538c6c73   ..I.cE......S.ls
0x00000190 (00400)   bc904a85 f79351b1 3d147e36 9b9b515e   ..J...Q.=.~6..Q^
0x000001a0 (00416)   609f48e8 1ea55d0e 04a7fd93 0b2c1beb   `.H...]......,..
0x000001b0 (00432)   f3a9485f e9329c1f 7537afab 533bbd1d   ..H_.2..u7..S;..
0x000001c0 (00448)   183f3776                              .?7v

0x00000000 (00000)   504f5354 202f2048 5454502f 312e310d   POST / HTTP/1.1.
0x00000010 (00016)   0a416363 6570743a 202a2f2a 0d0a4163   .Accept: */*..Ac
0x00000020 (00032)   63657074 2d4c616e 67756167 653a2065   cept-Language: e
0x00000030 (00048)   6e2d7573 0d0a436f 6e74656e 742d5479   n-us..Content-Ty
0x00000040 (00064)   70653a20 6170706c 69636174 696f6e2f   pe: application/
0x00000050 (00080)   6f637465 742d7374 7265616d 0d0a436f   octet-stream..Co
0x00000060 (00096)   6e74656e 742d4c65 6e677468 3a203133   ntent-Length: 13
0x00000070 (00112)   390d0a55 7365722d 4167656e 743a204d   9..User-Agent: M
0x00000080 (00128)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x00000090 (00144)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000a0 (00160)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000b0 (00176)   3b205356 31290d0a 486f7374 3a206967   ; SV1)..Host: ig
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a436163 68652d43 6f6e7472 6f6c3a20   .Cache-Control: 
0x000000f0 (00240)   6e6f2d63 61636865 0d0a0d0a af2d28e0   no-cache.....-(.
0x00000100 (00256)   9d53ede3 8b79b2e7 799f77eb fa2050f2   .S...y..y.w.. P.
0x00000110 (00272)   294594f6 392984fe 411b7c02 d7f4650d   )E..9)..A.|...e.
0x00000120 (00288)   0e0ba215 3d2fe619 4521de1d 3347a321   ....=/..E!..3G.!
0x00000130 (00304)   2ed38125 36c57929 4b1d8b2d 34cf2e35   ...%6.y)K..-4..5
0x00000140 (00320)   2f5b0d39 374d053d 5d73ca40 36998f44   /[.97M.=]s.@6..D
0x00000150 (00336)   31256e48 a1b54c4c 739a99b5 1d953c54   1%nH..LLs.....<T
0x00000160 (00352)   609089bd 0247e05b d0812f60 c85f9d63   `....G.[../`._.c
0x00000170 (00368)   cf8be3e3 efaa276b b56cd36e acf61974   ......'k.l.n...t
0x00000180 (00384)   c11c7776 8c423c3a 6b88fb1c 6d8cf418   ..wv.B<:k...m...
0x00000190 (00400)   6f90ed14 718780f7 728b79f3 748f72ef   o...q...r.y.t.r.
0x000001a0 (00416)   768605d2 788afecd 7a8ef7c9 7c858aac   v...x...z...|...
0x000001b0 (00432)   7e8983a8 808d7ca4 829175a0 84880883   ~.....|...u.....
0x000001c0 (00448)   868c017f 8890fa7a 8a878d5d 8c8b8659   .......z...]...Y
0x000001d0 (00464)   8e8f7f55 90861238 928a0b34 94         ...U...8...4.

0x00000000 (00000)   504f5354 202f2048 5454502f 312e310d   POST / HTTP/1.1.
0x00000010 (00016)   0a416363 6570743a 202a2f2a 0d0a4163   .Accept: */*..Ac
0x00000020 (00032)   63657074 2d4c616e 67756167 653a2065   cept-Language: e
0x00000030 (00048)   6e2d7573 0d0a436f 6e74656e 742d5479   n-us..Content-Ty
0x00000040 (00064)   70653a20 6170706c 69636174 696f6e2f   pe: application/
0x00000050 (00080)   6f637465 742d7374 7265616d 0d0a436f   octet-stream..Co
0x00000060 (00096)   6e74656e 742d4c65 6e677468 3a203137   ntent-Length: 17
0x00000070 (00112)   370d0a55 7365722d 4167656e 743a204d   7..User-Agent: M
0x00000080 (00128)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x00000090 (00144)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x000000a0 (00160)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x000000b0 (00176)   3b205356 31290d0a 486f7374 3a207277   ; SV1)..Host: rw
0x000000c0 (00192)   642e636f 6d0d0a43 6f6e6e65 6374696f   d.com..Connectio
0x000000d0 (00208)   6e3a204b 6565702d 416c6976 650d0a43   n: Keep-Alive..C
0x000000e0 (00224)   61636865 2d436f6e 74726f6c 3a206e6f   ache-Control: no
0x000000f0 (00240)   2d636163 68650d0a 0d0a5529 04985d1b   -cache....U)..].
0x00000100 (00256)   fc9b3edb a79f3967 86a334f3 64a72f7f   ..>...9g..4.d./.
0x00000110 (00272)   43ab1da5 08af1831 e7b213bd c5b601e3   C......1........
0x00000120 (00288)   8abafc6e 69bef7fa 47c2e520 0dc6e0ac   ...ni...G.. ....
0x00000130 (00304)   ebc9db38 cacdf090 dbd1eb1c bad5b01a   ...8............
0x00000140 (00320)   e8e4203d abe953c9 89ed46bb 81f14147   .. =..S...F...AG
0x00000150 (00336)   60f5b1d7 3ef99022 a5622151 150156e6   `...>..".b!Q..V.
0x00000160 (00352)   486a1269 d208ed09 3b0dd881 8f103504   Hj.i....;.....5.
0x00000170 (00368)   6695cab9 8e1daa47 6d2113f7 4f39416e   f......Gm!..O9An
0x00000180 (00384)   9241402c bd45b447 7c4c7f34 f1517ac0   .A@,.E.G|L.4.Qz.
0x00000190 (00400)   cf558f18 e1594d9f 3c5f3bc5 016329eb   .U...YM.<_;..c).
0x000001a0 (00416)   c6660aab 726aeb6a 1e6ecc2d 7f6fb4bc   .f..rj.j.n.-.o..
0x000001b0 (00432)   18f0d687 82727753 17f4b311 62766e9a   .....rwS....bvn.
0x000001c0 (00448)   08792e91 047b42cb 167d79b9 277e755d   .y...{B..}y.'~u]
0x000001d0 (00464)   ccff9c08 1f827002                     ......p.

0x00000000 (00000)   504f5354 202f3f70 74727863 7a5f774a   POST /?ptrxcz_wJ
0x00000010 (00016)   62754254 6b7a4f67 7a475871 614c6c34   buBTkzOgzGXqaLl4
0x00000020 (00032)   30536d37 516b4768 324c657a 20485454   0Sm7QkGh2Lez HTT
0x00000030 (00048)   502f312e 310d0a41 63636570 743a202a   P/1.1..Accept: *
0x00000040 (00064)   2f2a0d0a 41636365 70742d4c 616e6775   /*..Accept-Langu
0x00000050 (00080)   6167653a 20656e2d 75730d0a 436f6e74   age: en-us..Cont
0x00000060 (00096)   656e742d 54797065 3a206170 706c6963   ent-Type: applic
0x00000070 (00112)   6174696f 6e2f6f63 7465742d 73747265   ation/octet-stre
0x00000080 (00128)   616d0d0a 436f6e74 656e742d 4c656e67   am..Content-Leng
0x00000090 (00144)   74683a20 3234380d 0a557365 722d4167   th: 248..User-Ag
0x000000a0 (00160)   656e743a 204d6f7a 696c6c61 2f342e30   ent: Mozilla/4.0
0x000000b0 (00176)   2028636f 6d706174 69626c65 3b204d53    (compatible; MS
0x000000c0 (00192)   49452036 2e303b20 57696e64 6f777320   IE 6.0; Windows 
0x000000d0 (00208)   4e542035 2e313b20 53563129 0d0a486f   NT 5.1; SV1)..Ho
0x000000e0 (00224)   73743a20 77696e64 65726d65 72652e63   st: windermere.c
0x000000f0 (00240)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000100 (00256)   4b656570 2d416c69 76650d0a 43616368   Keep-Alive..Cach
0x00000110 (00272)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000120 (00288)   6368650d 0a0d0ab4 5a390332 e46b8789   che.....Z9.2.k..
0x00000130 (00304)   998986f8 2e3a1042 87b8942e 08c696dc   .....:.B........
0x00000140 (00320)   38faa4d6 c4899e83 5268a2e1 b932b0a0   8.......Rh...2..
0x00000150 (00336)   c819c903 0d4f4d89 7abdd078 a082d472   .....OM.z..x...r
0x00000160 (00352)   2c61d859 39c95c49 11a59e93 90a8e73f   ,a.Y9.\I.......?
0x00000170 (00368)   1c87eb65 424cef3e 6811f32c 8ed6f69c   ...eBL.>h..,....
0x00000180 (00384)   1eb5fa6e 030264ef cb580227 618c6b2e   ...n..d..X.'a.k.
0x00000190 (00400)   e4a3354a 838b3a35 fbdf3d3c 2726be69   ..5J..:5..=<'&.i
0x000001a0 (00416)   ac83453c d4484933 5e3f4e0f 786554e3   ..E<.HI3^?N.xeT.
0x000001b0 (00432)   95d2d916 6cf1a784 de723150 a1e73556   ....l....r1P..5V
0x000001c0 (00448)   c7ac39f9 9ca13d25 cb3dc096 263744d4   ..9...=%.=..&7D.
0x000001d0 (00464)   bd1e48fc c553cb92 2678cab8 316e53cf   ..H..S..&x..1nS.
0x000001e0 (00480)   d71bd2a7 e3115b47 73aa6021 1aa9e3e9   ......[Gs.`!....
0x000001f0 (00496)   0494e208 01df6b19 a78d6fdd ab80ee7b   ......k...o....{
0x00000200 (00512)   70057651                              p.vQ

0x00000000 (00000)   504f5354 202f3f70 74727863 7a5f334e   POST /?ptrxcz_3N
0x00000010 (00016)   68314b65 79486276 45597349 6d363352   h1KeyHbvEYsIm63R
0x00000020 (00032)   6c36657a 64326379 48627746 20485454   l6ezd2cyHbwF HTT
0x00000030 (00048)   502f312e 310d0a41 63636570 743a202a   P/1.1..Accept: *
0x00000040 (00064)   2f2a0d0a 41636365 70742d4c 616e6775   /*..Accept-Langu
0x00000050 (00080)   6167653a 20656e2d 75730d0a 436f6e74   age: en-us..Cont
0x00000060 (00096)   656e742d 54797065 3a206170 706c6963   ent-Type: applic
0x00000070 (00112)   6174696f 6e2f6f63 7465742d 73747265   ation/octet-stre
0x00000080 (00128)   616d0d0a 436f6e74 656e742d 4c656e67   am..Content-Leng
0x00000090 (00144)   74683a20 3131370d 0a557365 722d4167   th: 117..User-Ag
0x000000a0 (00160)   656e743a 204d6f7a 696c6c61 2f342e30   ent: Mozilla/4.0
0x000000b0 (00176)   2028636f 6d706174 69626c65 3b204d53    (compatible; MS
0x000000c0 (00192)   49452036 2e303b20 57696e64 6f777320   IE 6.0; Windows 
0x000000d0 (00208)   4e542035 2e313b20 53563129 0d0a486f   NT 5.1; SV1)..Ho
0x000000e0 (00224)   73743a20 72636e2e 636f6d0d 0a436f6e   st: rcn.com..Con
0x000000f0 (00240)   6e656374 696f6e3a 204b6565 702d416c   nection: Keep-Al
0x00000100 (00256)   6976650d 0a436163 68652d43 6f6e7472   ive..Cache-Contr
0x00000110 (00272)   6f6c3a20 6e6f2d63 61636865 0d0a0d0a   ol: no-cache....
0x00000120 (00288)   99f5c0e9 94819fed 8f0d7ef1 b1cba8f5   ..........~.....
0x00000130 (00304)   ac5787f9 d4115f0d 5e                  .W...._.^

0x00000000 (00000)   504f5354 202f3f70 74727863 7a5f4255   POST /?ptrxcz_BU
0x00000010 (00016)   6d344c64 7643546c 3750677a 47587137   m4LdvCTl7PgzGXq7
0x00000020 (00032)   4f466678 45566d34 4c627441 20485454   OFfxEVm4LbtA HTT
0x00000030 (00048)   502f312e 310d0a41 63636570 743a202a   P/1.1..Accept: *
0x00000040 (00064)   2f2a0d0a 41636365 70742d4c 616e6775   /*..Accept-Langu
0x00000050 (00080)   6167653a 20656e2d 75730d0a 436f6e74   age: en-us..Cont
0x00000060 (00096)   656e742d 54797065 3a206170 706c6963   ent-Type: applic
0x00000070 (00112)   6174696f 6e2f6f63 7465742d 73747265   ation/octet-stre
0x00000080 (00128)   616d0d0a 436f6e74 656e742d 4c656e67   am..Content-Leng
0x00000090 (00144)   74683a20 3233370d 0a557365 722d4167   th: 237..User-Ag
0x000000a0 (00160)   656e743a 204d6f7a 696c6c61 2f342e30   ent: Mozilla/4.0
0x000000b0 (00176)   2028636f 6d706174 69626c65 3b204d53    (compatible; MS
0x000000c0 (00192)   49452036 2e303b20 57696e64 6f777320   IE 6.0; Windows 
0x000000d0 (00208)   4e542035 2e313b20 53563129 0d0a486f   NT 5.1; SV1)..Ho
0x000000e0 (00224)   73743a20 626c7565 77696e2e 636f6d0d   st: bluewin.com.
0x000000f0 (00240)   0a436f6e 6e656374 696f6e3a 204b6565   .Connection: Kee
0x00000100 (00256)   702d416c 6976650d 0a436163 68652d43   p-Alive..Cache-C
0x00000110 (00272)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x00000120 (00288)   0d0a0d0a b7f5667a 1b51d0fc e24449     ......fz.Q...DI

0x00000000 (00000)   504f5354 202f2048 5454502f 312e310d   POST / HTTP/1.1.
0x00000010 (00016)   0a416363 6570743a 202a2f2a 0d0a4163   .Accept: */*..Ac
0x00000020 (00032)   63657074 2d4c616e 67756167 653a2065   cept-Language: e
0x00000030 (00048)   6e2d7573 0d0a436f 6e74656e 742d5479   n-us..Content-Ty
0x00000040 (00064)   70653a20 6170706c 69636174 696f6e2f   pe: application/
0x00000050 (00080)   6f637465 742d7374 7265616d 0d0a436f   octet-stream..Co
0x00000060 (00096)   6e74656e 742d4c65 6e677468 3a203639   ntent-Length: 69
0x00000070 (00112)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x00000080 (00128)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x00000090 (00144)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000a0 (00160)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000b0 (00176)   20535631 290d0a48 6f73743a 2076616d    SV1)..Host: vam
0x000000c0 (00192)   70697265 66726561 6b732e63 6f6d0d0a   pirefreaks.com..
0x000000d0 (00208)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000e0 (00224)   2d416c69 76650d0a 43616368 652d436f   -Alive..Cache-Co
0x000000f0 (00240)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000100 (00256)   0a0d0acb 457514eb c38e183f 39ac17c1   ....Eu.....?9...
0x00000110 (00272)   a843a117 2f0ba5ca eb4a2475 16e9ab72   .C../....J$u...r
0x00000120 (00288)   d8792f63                              .y/c


Strings
.
.d.
m
040904B0
1, 0, 0, 1
About4Quit the application; prompts to save documents
&About MPIRing...
About MPIRing
Account:
Account & Password
&Arrange Icons
Cancel
&Cascade
Close
&Close
Close the active document
CompanyName
&Copy	Ctrl+C
Copyright (C) 2000
Create a new document
Cu&t	Ctrl+X
?Display program information, version number and copyright
&Edit
Enter
Exit
E&xit
&File
FileDescription
FileVersion
Find
&Help
InternalName
LegalCopyright
LegalTrademarks
Make Ring
MPD Ring
MPIRin
MPIRin Document
MPIRing
MPIRing1
MPIRing Application
MPIRing.Document
MPIRing.EXE
MPIRing MFC Application
MPIRing Version 1.0
MS Sans Serif
&New	Ctrl+N
&New Window
Open
Open an existing document
&Open...	Ctrl+O
OriginalFilename
Password:
&Paste	Ctrl+V
Please enter an account to run the mpd's under.  All spawned processes will launch in this context:
ProductName
ProductVersion
Quit
Ready
Refresh
Save0Save the active document with a new name
Save As
Save &As...
&Save	Ctrl+S
Save the active document
SCRL
StringFileInfo
TEXTINCLUDE
&Tile
Translation
&Undo	Ctrl+Z
VarFileInfo
VS_VERSION_INFO
&Window
 18qo8
\1r)zkj
-2SmZxv
4(0ispZB
4H['X]
}6O2$iO
85r"6!
8d_3SC$j:$
((8|un
AA3Vs>Q
A`v:s5
BunF)?y~
C@(K[p
C,m[ @
@.data
#define _AFX_NO_OLE_RESOURCES
#define _AFX_NO_PROPERTY_RESOURCES
#define _AFX_NO_SPLITTER_RESOURCES
#define _AFX_NO_TRACKER_RESOURCES
>D/_ID[!
#endif
#endif //_WIN32
FuA Gp
gdi32.dll
GetModuleHandleA
GetObjectW
GetProcAddress
&Gip@V
'}$$Hj
#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_ENU)
#ifdef _WIN32
#include "afxres.h"
#include "afxres.rc"         // Standard components
#include "res\MPIRing.rc2"  // non-Microsoft Visual C++ edited resources
I,(+)Y
jyhT{m
kernel32.dll
K?"&R`
LANGUAGE 9, 1
LoadImageA
>MA	6+I
MessageBoxW
~ml&kqL
M_vXe7D\[X
'p68$6
P-ogRSP%9
#pragma code_page(1252)
Q8[y&6
q/K|e|
*Q@W!*
`.rdata
resource.h
S5LP{'I
*s:cw^.
sZhu|8kp
$tAwT8
TDNJQ{
!This program cannot be run in DOS mode.
U6/8Rd4E
uA_}.e
user32.dll
$v11'7
VsF=Mv
vuJ[NK
w6)KxS
{wc(aJ?
%#{x1x
ye~^zhB
*=-zQu1D