Analysis Date2015-08-15 00:59:58
MD5e4f510fd94491f6ad5e4cebb46fdc535
SHA14e86bdc198c0085f6445e7df560b855442c609ad

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
SectionUPX0 md5: eb7f7b25bd1cc9846ca30f976c11538a sha1: 8c4f7eca4281b603e5cbc4bda6476a78f7b597ea size: 49152
SectionUPX1 md5: e7051d918eda6c0dafec99d3e30ee5f9 sha1: bba43e53a48531a1853ac1be3951fb107352b104 size: 24576
Section.rsrc md5: bebdc1c5c73d7ad8d239ddaaf52cc53d sha1: 0bfa7ef1f05feff2f222a1d5066b10a512bb944d size: 12288
Section.pb md5: fa80423382e67ab0c723dff9e162bc5e sha1: 3813eee10556b7a898259589675952cd72bd8706 size: 2048
Timestamp2012-05-18 20:03:11
VersionLegalCopyright: 1, 0, 0, 1
ProductVersion: 1, 0, 0, 1
FileVersion: 1, 0, 0, 1
OriginalFilename: Mwhto.exe
CompanyName: Uxnxnwc
PackerInstaller VISE Custom
PEhash75465b3911fcfcb56aa94f622f522c8d43d0a502
IMPhash37b3b3ed091e67e601283529ea2dda85
AVCA (E-Trust Ino)no_virus
AVF-SecureTrojan.Downloader.JPIA
AVDr. WebTrojan.Inject1.2047
AVClamAVno_virus
AVArcabit (arcavir)Trojan.Downloader.JPIA
AVBullGuardTrojan.Downloader.JPIA
AVPadvishno_virus
AVVirusBlokAda (vba32)no_virus
AVCAT (quickheal)no_virus
AVTrend MicroTROJ_RANSOM.SMU
AVKasperskyTrojan.Win32.Generic
AVZillya!no_virus
AVEmsisoftTrojan.Downloader.JPIA
AVIkarusTrojan-Downloader.Win32.Kuluoz
AVFrisk (f-prot)no_virus
AVAuthentiumW32/Ransom.IPOC-0583
AVMalwareBytesTrojan.Upatre.Gen
AVMicroWorld (escan)Trojan.Downloader.JPIA
AVMicrosoft Security EssentialsTrojanDownloader:Win32/Kuluoz.A
AVK7Trojan ( 0038e9931 )
AVBitDefenderTrojan.Downloader.JPIA
AVFortinetW32/Zortob.AA!tr
AVSymantecSuspicious.Emit
AVGrisoft (avg)Dropper.Generic6.MUB
AVEset (nod32)Win32/TrojanDownloader.Zortob.A
AVAlwil (avast)Downloader-ONW [Trj]
AVAd-AwareTrojan.Downloader.JPIA
AVTwisterno_virus
AVAvira (antivir)TR/Agent.JH.15
AVMcafeeno_virus
AVRisingno_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates Processsvchost.exe

Process
↳ svchost.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSinfopepsigoood.ru
Winsock DNStwitter.com
Winsock DNSgoogle.com
Winsock DNSfb.com
Winsock DNSbing.com

Network Details:

DNSbing.com
Type: A
204.79.197.200
DNStwitter.com
Type: A
199.16.156.102
DNStwitter.com
Type: A
199.16.156.230
DNStwitter.com
Type: A
199.16.156.6
DNStwitter.com
Type: A
199.16.156.38
DNSgoogle.com
Type: A
216.58.219.142
DNSfb.com
Type: A
173.252.120.6
DNSinfopepsigoood.ru
Type: A
HTTP GEThttp://bing.com/afyu/index.php?r=gate&id=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://twitter.com/nygul/index.php?r=gate&ac=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://google.com/efwgh/index.php?r=gate&cc=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://fb.com/dwrgh/index.php?r=gate&fg=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://bing.com/afyu/index.php?r=gate&id=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://twitter.com/nygul/index.php?r=gate&ac=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://google.com/efwgh/index.php?r=gate&cc=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://fb.com/dwrgh/index.php?r=gate&fg=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://bing.com/afyu/index.php?r=gate&id=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://twitter.com/nygul/index.php?r=gate&ac=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://google.com/efwgh/index.php?r=gate&cc=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://fb.com/dwrgh/index.php?r=gate&fg=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://bing.com/afyu/index.php?r=gate&id=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://twitter.com/nygul/index.php?r=gate&ac=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://google.com/efwgh/index.php?r=gate&cc=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://fb.com/dwrgh/index.php?r=gate&fg=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://bing.com/afyu/index.php?r=gate&id=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://twitter.com/nygul/index.php?r=gate&ac=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://google.com/efwgh/index.php?r=gate&cc=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://fb.com/dwrgh/index.php?r=gate&fg=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://bing.com/afyu/index.php?r=gate&id=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://twitter.com/nygul/index.php?r=gate&ac=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://google.com/efwgh/index.php?r=gate&cc=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://fb.com/dwrgh/index.php?r=gate&fg=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://bing.com/afyu/index.php?r=gate&id=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://twitter.com/nygul/index.php?r=gate&ac=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://google.com/efwgh/index.php?r=gate&cc=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://fb.com/dwrgh/index.php?r=gate&fg=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://bing.com/afyu/index.php?r=gate&id=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://twitter.com/nygul/index.php?r=gate&ac=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://google.com/efwgh/index.php?r=gate&cc=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://fb.com/dwrgh/index.php?r=gate&fg=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://bing.com/afyu/index.php?r=gate&id=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://twitter.com/nygul/index.php?r=gate&ac=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://google.com/efwgh/index.php?r=gate&cc=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://fb.com/dwrgh/index.php?r=gate&fg=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://bing.com/afyu/index.php?r=gate&id=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://twitter.com/nygul/index.php?r=gate&ac=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://google.com/efwgh/index.php?r=gate&cc=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://fb.com/dwrgh/index.php?r=gate&fg=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://bing.com/afyu/index.php?r=gate&id=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
HTTP GEThttp://twitter.com/nygul/index.php?r=gate&ac=c059900a&group=16.05.2012a&debug=0
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Flows TCP192.168.1.1:1031 ➝ 204.79.197.200:80
Flows TCP192.168.1.1:1032 ➝ 199.16.156.102:80
Flows TCP192.168.1.1:1033 ➝ 216.58.219.142:80
Flows TCP192.168.1.1:1034 ➝ 173.252.120.6:80
Flows TCP192.168.1.1:1035 ➝ 204.79.197.200:80
Flows TCP192.168.1.1:1036 ➝ 199.16.156.102:80
Flows TCP192.168.1.1:1037 ➝ 216.58.219.142:80
Flows TCP192.168.1.1:1038 ➝ 173.252.120.6:80
Flows TCP192.168.1.1:1039 ➝ 204.79.197.200:80
Flows TCP192.168.1.1:1040 ➝ 199.16.156.102:80
Flows TCP192.168.1.1:1041 ➝ 216.58.219.142:80
Flows TCP192.168.1.1:1042 ➝ 173.252.120.6:80
Flows TCP192.168.1.1:1043 ➝ 204.79.197.200:80
Flows TCP192.168.1.1:1044 ➝ 199.16.156.102:80
Flows TCP192.168.1.1:1045 ➝ 216.58.219.142:80
Flows TCP192.168.1.1:1046 ➝ 173.252.120.6:80
Flows TCP192.168.1.1:1047 ➝ 204.79.197.200:80
Flows TCP192.168.1.1:1048 ➝ 199.16.156.102:80
Flows TCP192.168.1.1:1049 ➝ 216.58.219.142:80
Flows TCP192.168.1.1:1050 ➝ 173.252.120.6:80
Flows TCP192.168.1.1:1051 ➝ 204.79.197.200:80
Flows TCP192.168.1.1:1052 ➝ 199.16.156.102:80
Flows TCP192.168.1.1:1053 ➝ 216.58.219.142:80
Flows TCP192.168.1.1:1054 ➝ 173.252.120.6:80
Flows TCP192.168.1.1:1055 ➝ 204.79.197.200:80
Flows TCP192.168.1.1:1056 ➝ 199.16.156.102:80
Flows TCP192.168.1.1:1057 ➝ 216.58.219.142:80
Flows TCP192.168.1.1:1058 ➝ 173.252.120.6:80
Flows TCP192.168.1.1:1059 ➝ 204.79.197.200:80
Flows TCP192.168.1.1:1060 ➝ 199.16.156.102:80
Flows TCP192.168.1.1:1061 ➝ 216.58.219.142:80
Flows TCP192.168.1.1:1062 ➝ 173.252.120.6:80
Flows TCP192.168.1.1:1063 ➝ 204.79.197.200:80
Flows TCP192.168.1.1:1064 ➝ 199.16.156.102:80
Flows TCP192.168.1.1:1065 ➝ 216.58.219.142:80
Flows TCP192.168.1.1:1066 ➝ 173.252.120.6:80
Flows TCP192.168.1.1:1067 ➝ 204.79.197.200:80
Flows TCP192.168.1.1:1068 ➝ 199.16.156.102:80
Flows TCP192.168.1.1:1069 ➝ 216.58.219.142:80
Flows TCP192.168.1.1:1070 ➝ 173.252.120.6:80
Flows TCP192.168.1.1:1071 ➝ 204.79.197.200:80
Flows TCP192.168.1.1:1072 ➝ 199.16.156.102:80

Raw Pcap
0x00000000 (00000)   47455420 2f616679 752f696e 6465782e   GET /afyu/index.
0x00000010 (00016)   7068703f 723d6761 74652669 643d6330   php?r=gate&id=c0
0x00000020 (00032)   35393930 30612667 726f7570 3d31362e   59900a&group=16.
0x00000030 (00048)   30352e32 30313261 26646562 75673d30   05.2012a&debug=0
0x00000040 (00064)   20485454 502f312e 310d0a55 7365722d    HTTP/1.1..User-
0x00000050 (00080)   4167656e 743a204d 6f7a696c 6c612f35   Agent: Mozilla/5
0x00000060 (00096)   2e302028 57696e64 6f77733b 20553b20   .0 (Windows; U; 
0x00000070 (00112)   4d534945 20392e30 3b205769 6e646f77   MSIE 9.0; Window
0x00000080 (00128)   73204e54 20392e30 3b20656e 2d555329   s NT 9.0; en-US)
0x00000090 (00144)   0d0a486f 73743a20 62696e67 2e636f6d   ..Host: bing.com
0x000000a0 (00160)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f6e7967 756c2f69 6e646578   GET /nygul/index
0x00000010 (00016)   2e706870 3f723d67 61746526 61633d63   .php?r=gate&ac=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20747769 74746572   )..Host: twitter
0x000000a0 (00160)   2e636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f656677 67682f69 6e646578   GET /efwgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 63633d63   .php?r=gate&cc=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20676f6f 676c652e   )..Host: google.
0x000000a0 (00160)   636f6d0d 0a0d0a0a                     com.....

0x00000000 (00000)   47455420 2f647772 67682f69 6e646578   GET /dwrgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 66673d63   .php?r=gate&fg=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 2066622e 636f6d0d   )..Host: fb.com.
0x000000a0 (00160)   0a0d0a0d 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f616679 752f696e 6465782e   GET /afyu/index.
0x00000010 (00016)   7068703f 723d6761 74652669 643d6330   php?r=gate&id=c0
0x00000020 (00032)   35393930 30612667 726f7570 3d31362e   59900a&group=16.
0x00000030 (00048)   30352e32 30313261 26646562 75673d30   05.2012a&debug=0
0x00000040 (00064)   20485454 502f312e 310d0a55 7365722d    HTTP/1.1..User-
0x00000050 (00080)   4167656e 743a204d 6f7a696c 6c612f35   Agent: Mozilla/5
0x00000060 (00096)   2e302028 57696e64 6f77733b 20553b20   .0 (Windows; U; 
0x00000070 (00112)   4d534945 20392e30 3b205769 6e646f77   MSIE 9.0; Window
0x00000080 (00128)   73204e54 20392e30 3b20656e 2d555329   s NT 9.0; en-US)
0x00000090 (00144)   0d0a486f 73743a20 62696e67 2e636f6d   ..Host: bing.com
0x000000a0 (00160)   0d0a0d0a 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f6e7967 756c2f69 6e646578   GET /nygul/index
0x00000010 (00016)   2e706870 3f723d67 61746526 61633d63   .php?r=gate&ac=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20747769 74746572   )..Host: twitter
0x000000a0 (00160)   2e636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f656677 67682f69 6e646578   GET /efwgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 63633d63   .php?r=gate&cc=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20676f6f 676c652e   )..Host: google.
0x000000a0 (00160)   636f6d0d 0a0d0a0a                     com.....

0x00000000 (00000)   47455420 2f647772 67682f69 6e646578   GET /dwrgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 66673d63   .php?r=gate&fg=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 2066622e 636f6d0d   )..Host: fb.com.
0x000000a0 (00160)   0a0d0a0d 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f616679 752f696e 6465782e   GET /afyu/index.
0x00000010 (00016)   7068703f 723d6761 74652669 643d6330   php?r=gate&id=c0
0x00000020 (00032)   35393930 30612667 726f7570 3d31362e   59900a&group=16.
0x00000030 (00048)   30352e32 30313261 26646562 75673d30   05.2012a&debug=0
0x00000040 (00064)   20485454 502f312e 310d0a55 7365722d    HTTP/1.1..User-
0x00000050 (00080)   4167656e 743a204d 6f7a696c 6c612f35   Agent: Mozilla/5
0x00000060 (00096)   2e302028 57696e64 6f77733b 20553b20   .0 (Windows; U; 
0x00000070 (00112)   4d534945 20392e30 3b205769 6e646f77   MSIE 9.0; Window
0x00000080 (00128)   73204e54 20392e30 3b20656e 2d555329   s NT 9.0; en-US)
0x00000090 (00144)   0d0a486f 73743a20 62696e67 2e636f6d   ..Host: bing.com
0x000000a0 (00160)   0d0a0d0a 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f6e7967 756c2f69 6e646578   GET /nygul/index
0x00000010 (00016)   2e706870 3f723d67 61746526 61633d63   .php?r=gate&ac=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20747769 74746572   )..Host: twitter
0x000000a0 (00160)   2e636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f656677 67682f69 6e646578   GET /efwgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 63633d63   .php?r=gate&cc=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20676f6f 676c652e   )..Host: google.
0x000000a0 (00160)   636f6d0d 0a0d0a0a                     com.....

0x00000000 (00000)   47455420 2f647772 67682f69 6e646578   GET /dwrgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 66673d63   .php?r=gate&fg=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 2066622e 636f6d0d   )..Host: fb.com.
0x000000a0 (00160)   0a0d0a0d 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f616679 752f696e 6465782e   GET /afyu/index.
0x00000010 (00016)   7068703f 723d6761 74652669 643d6330   php?r=gate&id=c0
0x00000020 (00032)   35393930 30612667 726f7570 3d31362e   59900a&group=16.
0x00000030 (00048)   30352e32 30313261 26646562 75673d30   05.2012a&debug=0
0x00000040 (00064)   20485454 502f312e 310d0a55 7365722d    HTTP/1.1..User-
0x00000050 (00080)   4167656e 743a204d 6f7a696c 6c612f35   Agent: Mozilla/5
0x00000060 (00096)   2e302028 57696e64 6f77733b 20553b20   .0 (Windows; U; 
0x00000070 (00112)   4d534945 20392e30 3b205769 6e646f77   MSIE 9.0; Window
0x00000080 (00128)   73204e54 20392e30 3b20656e 2d555329   s NT 9.0; en-US)
0x00000090 (00144)   0d0a486f 73743a20 62696e67 2e636f6d   ..Host: bing.com
0x000000a0 (00160)   0d0a0d0a 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f6e7967 756c2f69 6e646578   GET /nygul/index
0x00000010 (00016)   2e706870 3f723d67 61746526 61633d63   .php?r=gate&ac=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20747769 74746572   )..Host: twitter
0x000000a0 (00160)   2e636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f656677 67682f69 6e646578   GET /efwgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 63633d63   .php?r=gate&cc=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20676f6f 676c652e   )..Host: google.
0x000000a0 (00160)   636f6d0d 0a0d0a0a                     com.....

0x00000000 (00000)   47455420 2f647772 67682f69 6e646578   GET /dwrgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 66673d63   .php?r=gate&fg=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 2066622e 636f6d0d   )..Host: fb.com.
0x000000a0 (00160)   0a0d0a0d 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f616679 752f696e 6465782e   GET /afyu/index.
0x00000010 (00016)   7068703f 723d6761 74652669 643d6330   php?r=gate&id=c0
0x00000020 (00032)   35393930 30612667 726f7570 3d31362e   59900a&group=16.
0x00000030 (00048)   30352e32 30313261 26646562 75673d30   05.2012a&debug=0
0x00000040 (00064)   20485454 502f312e 310d0a55 7365722d    HTTP/1.1..User-
0x00000050 (00080)   4167656e 743a204d 6f7a696c 6c612f35   Agent: Mozilla/5
0x00000060 (00096)   2e302028 57696e64 6f77733b 20553b20   .0 (Windows; U; 
0x00000070 (00112)   4d534945 20392e30 3b205769 6e646f77   MSIE 9.0; Window
0x00000080 (00128)   73204e54 20392e30 3b20656e 2d555329   s NT 9.0; en-US)
0x00000090 (00144)   0d0a486f 73743a20 62696e67 2e636f6d   ..Host: bing.com
0x000000a0 (00160)   0d0a0d0a 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f6e7967 756c2f69 6e646578   GET /nygul/index
0x00000010 (00016)   2e706870 3f723d67 61746526 61633d63   .php?r=gate&ac=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20747769 74746572   )..Host: twitter
0x000000a0 (00160)   2e636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f656677 67682f69 6e646578   GET /efwgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 63633d63   .php?r=gate&cc=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20676f6f 676c652e   )..Host: google.
0x000000a0 (00160)   636f6d0d 0a0d0a0a                     com.....

0x00000000 (00000)   47455420 2f647772 67682f69 6e646578   GET /dwrgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 66673d63   .php?r=gate&fg=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 2066622e 636f6d0d   )..Host: fb.com.
0x000000a0 (00160)   0a0d0a0d 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f616679 752f696e 6465782e   GET /afyu/index.
0x00000010 (00016)   7068703f 723d6761 74652669 643d6330   php?r=gate&id=c0
0x00000020 (00032)   35393930 30612667 726f7570 3d31362e   59900a&group=16.
0x00000030 (00048)   30352e32 30313261 26646562 75673d30   05.2012a&debug=0
0x00000040 (00064)   20485454 502f312e 310d0a55 7365722d    HTTP/1.1..User-
0x00000050 (00080)   4167656e 743a204d 6f7a696c 6c612f35   Agent: Mozilla/5
0x00000060 (00096)   2e302028 57696e64 6f77733b 20553b20   .0 (Windows; U; 
0x00000070 (00112)   4d534945 20392e30 3b205769 6e646f77   MSIE 9.0; Window
0x00000080 (00128)   73204e54 20392e30 3b20656e 2d555329   s NT 9.0; en-US)
0x00000090 (00144)   0d0a486f 73743a20 62696e67 2e636f6d   ..Host: bing.com
0x000000a0 (00160)   0d0a0d0a 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f6e7967 756c2f69 6e646578   GET /nygul/index
0x00000010 (00016)   2e706870 3f723d67 61746526 61633d63   .php?r=gate&ac=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20747769 74746572   )..Host: twitter
0x000000a0 (00160)   2e636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f656677 67682f69 6e646578   GET /efwgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 63633d63   .php?r=gate&cc=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20676f6f 676c652e   )..Host: google.
0x000000a0 (00160)   636f6d0d 0a0d0a0a                     com.....

0x00000000 (00000)   47455420 2f647772 67682f69 6e646578   GET /dwrgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 66673d63   .php?r=gate&fg=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 2066622e 636f6d0d   )..Host: fb.com.
0x000000a0 (00160)   0a0d0a0d 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f616679 752f696e 6465782e   GET /afyu/index.
0x00000010 (00016)   7068703f 723d6761 74652669 643d6330   php?r=gate&id=c0
0x00000020 (00032)   35393930 30612667 726f7570 3d31362e   59900a&group=16.
0x00000030 (00048)   30352e32 30313261 26646562 75673d30   05.2012a&debug=0
0x00000040 (00064)   20485454 502f312e 310d0a55 7365722d    HTTP/1.1..User-
0x00000050 (00080)   4167656e 743a204d 6f7a696c 6c612f35   Agent: Mozilla/5
0x00000060 (00096)   2e302028 57696e64 6f77733b 20553b20   .0 (Windows; U; 
0x00000070 (00112)   4d534945 20392e30 3b205769 6e646f77   MSIE 9.0; Window
0x00000080 (00128)   73204e54 20392e30 3b20656e 2d555329   s NT 9.0; en-US)
0x00000090 (00144)   0d0a486f 73743a20 62696e67 2e636f6d   ..Host: bing.com
0x000000a0 (00160)   0d0a0d0a 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f6e7967 756c2f69 6e646578   GET /nygul/index
0x00000010 (00016)   2e706870 3f723d67 61746526 61633d63   .php?r=gate&ac=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20747769 74746572   )..Host: twitter
0x000000a0 (00160)   2e636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f656677 67682f69 6e646578   GET /efwgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 63633d63   .php?r=gate&cc=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20676f6f 676c652e   )..Host: google.
0x000000a0 (00160)   636f6d0d 0a0d0a0a                     com.....

0x00000000 (00000)   47455420 2f647772 67682f69 6e646578   GET /dwrgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 66673d63   .php?r=gate&fg=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 2066622e 636f6d0d   )..Host: fb.com.
0x000000a0 (00160)   0a0d0a0d 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f616679 752f696e 6465782e   GET /afyu/index.
0x00000010 (00016)   7068703f 723d6761 74652669 643d6330   php?r=gate&id=c0
0x00000020 (00032)   35393930 30612667 726f7570 3d31362e   59900a&group=16.
0x00000030 (00048)   30352e32 30313261 26646562 75673d30   05.2012a&debug=0
0x00000040 (00064)   20485454 502f312e 310d0a55 7365722d    HTTP/1.1..User-
0x00000050 (00080)   4167656e 743a204d 6f7a696c 6c612f35   Agent: Mozilla/5
0x00000060 (00096)   2e302028 57696e64 6f77733b 20553b20   .0 (Windows; U; 
0x00000070 (00112)   4d534945 20392e30 3b205769 6e646f77   MSIE 9.0; Window
0x00000080 (00128)   73204e54 20392e30 3b20656e 2d555329   s NT 9.0; en-US)
0x00000090 (00144)   0d0a486f 73743a20 62696e67 2e636f6d   ..Host: bing.com
0x000000a0 (00160)   0d0a0d0a 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f6e7967 756c2f69 6e646578   GET /nygul/index
0x00000010 (00016)   2e706870 3f723d67 61746526 61633d63   .php?r=gate&ac=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20747769 74746572   )..Host: twitter
0x000000a0 (00160)   2e636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f656677 67682f69 6e646578   GET /efwgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 63633d63   .php?r=gate&cc=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20676f6f 676c652e   )..Host: google.
0x000000a0 (00160)   636f6d0d 0a0d0a0a                     com.....

0x00000000 (00000)   47455420 2f647772 67682f69 6e646578   GET /dwrgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 66673d63   .php?r=gate&fg=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 2066622e 636f6d0d   )..Host: fb.com.
0x000000a0 (00160)   0a0d0a0d 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f616679 752f696e 6465782e   GET /afyu/index.
0x00000010 (00016)   7068703f 723d6761 74652669 643d6330   php?r=gate&id=c0
0x00000020 (00032)   35393930 30612667 726f7570 3d31362e   59900a&group=16.
0x00000030 (00048)   30352e32 30313261 26646562 75673d30   05.2012a&debug=0
0x00000040 (00064)   20485454 502f312e 310d0a55 7365722d    HTTP/1.1..User-
0x00000050 (00080)   4167656e 743a204d 6f7a696c 6c612f35   Agent: Mozilla/5
0x00000060 (00096)   2e302028 57696e64 6f77733b 20553b20   .0 (Windows; U; 
0x00000070 (00112)   4d534945 20392e30 3b205769 6e646f77   MSIE 9.0; Window
0x00000080 (00128)   73204e54 20392e30 3b20656e 2d555329   s NT 9.0; en-US)
0x00000090 (00144)   0d0a486f 73743a20 62696e67 2e636f6d   ..Host: bing.com
0x000000a0 (00160)   0d0a0d0a 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f6e7967 756c2f69 6e646578   GET /nygul/index
0x00000010 (00016)   2e706870 3f723d67 61746526 61633d63   .php?r=gate&ac=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20747769 74746572   )..Host: twitter
0x000000a0 (00160)   2e636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f656677 67682f69 6e646578   GET /efwgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 63633d63   .php?r=gate&cc=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20676f6f 676c652e   )..Host: google.
0x000000a0 (00160)   636f6d0d 0a0d0a0a                     com.....

0x00000000 (00000)   47455420 2f647772 67682f69 6e646578   GET /dwrgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 66673d63   .php?r=gate&fg=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 2066622e 636f6d0d   )..Host: fb.com.
0x000000a0 (00160)   0a0d0a0d 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f616679 752f696e 6465782e   GET /afyu/index.
0x00000010 (00016)   7068703f 723d6761 74652669 643d6330   php?r=gate&id=c0
0x00000020 (00032)   35393930 30612667 726f7570 3d31362e   59900a&group=16.
0x00000030 (00048)   30352e32 30313261 26646562 75673d30   05.2012a&debug=0
0x00000040 (00064)   20485454 502f312e 310d0a55 7365722d    HTTP/1.1..User-
0x00000050 (00080)   4167656e 743a204d 6f7a696c 6c612f35   Agent: Mozilla/5
0x00000060 (00096)   2e302028 57696e64 6f77733b 20553b20   .0 (Windows; U; 
0x00000070 (00112)   4d534945 20392e30 3b205769 6e646f77   MSIE 9.0; Window
0x00000080 (00128)   73204e54 20392e30 3b20656e 2d555329   s NT 9.0; en-US)
0x00000090 (00144)   0d0a486f 73743a20 62696e67 2e636f6d   ..Host: bing.com
0x000000a0 (00160)   0d0a0d0a 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f6e7967 756c2f69 6e646578   GET /nygul/index
0x00000010 (00016)   2e706870 3f723d67 61746526 61633d63   .php?r=gate&ac=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20747769 74746572   )..Host: twitter
0x000000a0 (00160)   2e636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f656677 67682f69 6e646578   GET /efwgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 63633d63   .php?r=gate&cc=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20676f6f 676c652e   )..Host: google.
0x000000a0 (00160)   636f6d0d 0a0d0a0a                     com.....

0x00000000 (00000)   47455420 2f647772 67682f69 6e646578   GET /dwrgh/index
0x00000010 (00016)   2e706870 3f723d67 61746526 66673d63   .php?r=gate&fg=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 2066622e 636f6d0d   )..Host: fb.com.
0x000000a0 (00160)   0a0d0a0d 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f616679 752f696e 6465782e   GET /afyu/index.
0x00000010 (00016)   7068703f 723d6761 74652669 643d6330   php?r=gate&id=c0
0x00000020 (00032)   35393930 30612667 726f7570 3d31362e   59900a&group=16.
0x00000030 (00048)   30352e32 30313261 26646562 75673d30   05.2012a&debug=0
0x00000040 (00064)   20485454 502f312e 310d0a55 7365722d    HTTP/1.1..User-
0x00000050 (00080)   4167656e 743a204d 6f7a696c 6c612f35   Agent: Mozilla/5
0x00000060 (00096)   2e302028 57696e64 6f77733b 20553b20   .0 (Windows; U; 
0x00000070 (00112)   4d534945 20392e30 3b205769 6e646f77   MSIE 9.0; Window
0x00000080 (00128)   73204e54 20392e30 3b20656e 2d555329   s NT 9.0; en-US)
0x00000090 (00144)   0d0a486f 73743a20 62696e67 2e636f6d   ..Host: bing.com
0x000000a0 (00160)   0d0a0d0a 0a0d0a0a                     ........

0x00000000 (00000)   47455420 2f6e7967 756c2f69 6e646578   GET /nygul/index
0x00000010 (00016)   2e706870 3f723d67 61746526 61633d63   .php?r=gate&ac=c
0x00000020 (00032)   30353939 30306126 67726f75 703d3136   059900a&group=16
0x00000030 (00048)   2e30352e 32303132 61266465 6275673d   .05.2012a&debug=
0x00000040 (00064)   30204854 54502f31 2e310d0a 55736572   0 HTTP/1.1..User
0x00000050 (00080)   2d416765 6e743a20 4d6f7a69 6c6c612f   -Agent: Mozilla/
0x00000060 (00096)   352e3020 2857696e 646f7773 3b20553b   5.0 (Windows; U;
0x00000070 (00112)   204d5349 4520392e 303b2057 696e646f    MSIE 9.0; Windo
0x00000080 (00128)   7773204e 5420392e 303b2065 6e2d5553   ws NT 9.0; en-US
0x00000090 (00144)   290d0a48 6f73743a 20747769 74746572   )..Host: twitter
0x000000a0 (00160)   2e636f6d 0d0a0d0a                     .com....


Strings