Analysis Date2018-02-07 09:46:26
MD5bbe7dc9cd86d80b150cea2e65f25f51e
SHA17f4a4d96b65f45e74828de23cc68febfcf820a94

Static Details:

File typePE32 executable (GUI) Intel 80386, for MS Windows
PEhash
AVArcabit (arcavir)Gen:Variant.Barys.56679
AVAuthentiumW32/Nivdort.I.gen!Eldorado
AVGrisoft (avg)Error Scanning File
AVAvira (antivir)TR/Taranis.2075
AVAlwil (avast)Evo-gen [Susp]
AVAd-AwareGen:Variant.Barys.56679
AVBitDefenderGen:Variant.Barys.56679
AVBullGuardError Scanning File
AVClamAVError Scanning File
AVDr. WebNo Virus
AVEmsisoftGen:Variant.Barys.56679
AVMicroWorld (escan)Gen:Variant.Barys.56679
AVCA (E-Trust Ino)Error Scanning File
AVFortinetW32/Bayrob.AQ!tr
AVFrisk (f-prot)W32/Nivdort.I.gen!Eldorado
AVF-SecureGen:Variant.Barys.56679
AVIkarusError Scanning File
AVK7Trojan ( 004dc2a31 )
AVKasperskyError Scanning File
AVMalwareBytesNo Virus
AVMcafeeGenericR-FZD!BBE7DC9CD86D
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort
AVNANOTrojan.Win32.Swizzor.exmssv
AVEset (nod32)Win32/Bayrob.BJ
AVPadvishNo Virus
AVCAT (quickheal)TrojanSpy.Nivdort.DR3
AVRisingNo Virus
AV360 SafeNo Virus
AVSUPERAntiSpywareNo Virus
AVSymantecNo Virus
AVTrend MicroNo Virus
AVTwisterNo Virus
AVVirusBlokAda (vba32)No Virus
AVWindows DefenderTrojanSpy:Win32/Nivdort
AVZillya!Error Scanning File

Runtime Details:

Screenshot

Process
↳ C:\Windows\System32\lsass.exe

Process
↳ C:\Users\THX1138\AppData\Local\Temp\7f4a4d96b65f45e74828de23cc68febfcf820a94.exe

Creates Mutex
Creates Mutex
Creates Mutex
Creates FileC:\Windows\dvtcxqrnxp\heoshfeuqff
Creates FileC:\dvtcxqrnxp\heoshfeuqff
Creates Filec:\Users\THX1138\AppData\Local\Temp\7f4a4d96b65f45e74828de23cc68febfcf820a94.exe
Creates FileC:\dvtcxqrnxp\vwf3492xpiziuhzpzd.exe

Process
↳ C:\dvtcxqrnxp\vwf3492xpiziuhzpzd.exe

Creates Mutex
Creates Mutex
Creates Mutex
Creates FileC:\Windows\dvtcxqrnxp\heoshfeuqff
Creates FileC:\dvtcxqrnxp\heoshfeuqff
Creates FileC:\dvtcxqrnxp\pe5kzhx
Creates FileC:\dvtcxqrnxp\run

Process
↳ C:\dvtcxqrnxp\fusjgkqvb.exe

Creates Mutex
Creates Mutex
Creates Mutex
Creates FileC:\Windows\dvtcxqrnxp\heoshfeuqff
Creates FileC:\dvtcxqrnxp\heoshfeuqff
Creates FileC:\dvtcxqrnxp\pe5kzhx

Network Details:


Raw Pcap
0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2074   : close..Host: t
0x00000040 (00064)   72616465 7368616b 652e6e65 740d0a0d   radeshake.net...
0x00000050 (00080)   0a6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   74726565 74736861 72652e6e 65740d0a   treetshare.net..
0x00000050 (00080)   0d0a7366 746e6373 692e636f 6d0d0a0d   ..sftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2074   : close..Host: t
0x00000040 (00064)   72616465 73686172 652e6e65 740d0a0d   radeshare.net...
0x00000050 (00080)   0a0a7366 746e6373 692e636f 6d0d0a0d   ..sftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2062   : close..Host: b
0x00000040 (00064)   65747465 726e6561 726c792e 6e65740d   etternearly.net.
0x00000050 (00080)   0a0d0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2067   : close..Host: g
0x00000040 (00064)   61746865 726e6561 726c792e 6e65740d   athernearly.net.
0x00000050 (00080)   0a0d0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2062   : close..Host: b
0x00000040 (00064)   65747465 72686170 70656e2e 6e65740d   etterhappen.net.
0x00000050 (00080)   0a0d0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2067   : close..Host: g
0x00000040 (00064)   61746865 72686170 70656e2e 6e65740d   atherhappen.net.
0x00000050 (00080)   0a0d0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2062   : close..Host: b
0x00000040 (00064)   65747465 72736861 6b652e6e 65740d0a   ettershake.net..
0x00000050 (00080)   0d0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2067   : close..Host: g
0x00000040 (00064)   61746865 72736861 6b652e6e 65740d0a   athershake.net..
0x00000050 (00080)   0d0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2062   : close..Host: b
0x00000040 (00064)   65747465 72736861 72652e6e 65740d0a   ettershare.net..
0x00000050 (00080)   0d0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2067   : close..Host: g
0x00000040 (00064)   61746865 72736861 72652e6e 65740d0a   athershare.net..
0x00000050 (00080)   0d0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2066   : close..Host: f
0x00000040 (00064)   6c696572 6e656172 6c792e6e 65740d0a   liernearly.net..
0x00000050 (00080)   0d0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2062   : close..Host: b
0x00000040 (00064)   72656164 6e656172 6c792e6e 65740d0a   readnearly.net..
0x00000050 (00080)   0d0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2066   : close..Host: f
0x00000040 (00064)   6c696572 68617070 656e2e6e 65740d0a   lierhappen.net..
0x00000050 (00080)   0d0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2062   : close..Host: b
0x00000040 (00064)   72656164 68617070 656e2e6e 65740d0a   readhappen.net..
0x00000050 (00080)   0d0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2066   : close..Host: f
0x00000040 (00064)   6c696572 7368616b 652e6e65 740d0a0d   liershake.net...
0x00000050 (00080)   0a0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2062   : close..Host: b
0x00000040 (00064)   72656164 7368616b 652e6e65 740d0a0d   readshake.net...
0x00000050 (00080)   0a0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2066   : close..Host: f
0x00000040 (00064)   6c696572 73686172 652e6e65 740d0a0d   liershare.net...
0x00000050 (00080)   0a0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2062   : close..Host: b
0x00000040 (00064)   72656164 73686172 652e6e65 740d0a0d   readshare.net...
0x00000050 (00080)   0a0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2071   : close..Host: q
0x00000040 (00064)   75696574 6e656172 6c792e6e 65740d0a   uietnearly.net..
0x00000050 (00080)   0d0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   6561736f 6e6e6561 726c792e 6e65740d   easonnearly.net.
0x00000050 (00080)   0a0d0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2071   : close..Host: q
0x00000040 (00064)   75696574 68617070 656e2e6e 65740d0a   uiethappen.net..
0x00000050 (00080)   0d0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   6561736f 6e686170 70656e2e 6e65740d   easonhappen.net.
0x00000050 (00080)   0a0d0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2071   : close..Host: q
0x00000040 (00064)   75696574 7368616b 652e6e65 740d0a0d   uietshake.net...
0x00000050 (00080)   0a0d0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   6561736f 6e736861 6b652e6e 65740d0a   easonshake.net..
0x00000050 (00080)   0d0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2071   : close..Host: q
0x00000040 (00064)   75696574 73686172 652e6e65 740d0a0d   uietshare.net...
0x00000050 (00080)   0a0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   6561736f 6e736861 72652e6e 65740d0a   easonshare.net..
0x00000050 (00080)   0d0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2061   : close..Host: a
0x00000040 (00064)   6761696e 73747375 63636565 642e6e65   gainstsucceed.ne
0x00000050 (00080)   740d0a0d 0a6e6373 692e636f 6d0d0a0d   t....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2064   : close..Host: d
0x00000040 (00064)   6f756274 73756363 6565642e 6e65740d   oubtsucceed.net.
0x00000050 (00080)   0a0d0a0d 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2061   : close..Host: a
0x00000040 (00064)   6761696e 73746265 74776565 6e2e6e65   gainstbetween.ne
0x00000050 (00080)   740d0a0d 0a6e6373 692e636f 6d0d0a0d   t....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2064   : close..Host: d
0x00000040 (00064)   6f756274 62657477 65656e2e 6e65740d   oubtbetween.net.
0x00000050 (00080)   0a0d0a0d 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2061   : close..Host: a
0x00000040 (00064)   6761696e 73747072 6f647563 652e6e65   gainstproduce.ne
0x00000050 (00080)   740d0a0d 0a6e6373 692e636f 6d0d0a0d   t....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2064   : close..Host: d
0x00000040 (00064)   6f756274 70726f64 7563652e 6e65740d   oubtproduce.net.
0x00000050 (00080)   0a0d0a0d 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2061   : close..Host: a
0x00000040 (00064)   6761696e 73747374 7564656e 742e6e65   gainststudent.ne
0x00000050 (00080)   740d0a0d 0a6e6373 692e636f 6d0d0a0d   t....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2064   : close..Host: d
0x00000040 (00064)   6f756274 73747564 656e742e 6e65740d   oubtstudent.net.
0x00000050 (00080)   0a0d0a0d 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a206e   : close..Host: n
0x00000040 (00064)   69676874 73756363 6565642e 6e65740d   ightsucceed.net.
0x00000050 (00080)   0a0d0a0d 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .


Strings