Analysis Date2015-09-17 08:31:40
MD5b0beea7235f94921c083497084c1e9f9
SHA186e658c3ce064f7623f48614c4d5318b9d341d18

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 7777651977c982dc47804551941743b9 sha1: 95f1437feae6c82786d18d6b70c4fe8c9dc79c25 size: 976896
Section.rdata md5: 695ed73042bd92514391717e7877a5bc sha1: c0da6ad557952157f1091ae7a26ca304e8e5aacb size: 31232
Section.data md5: e70c9bb050223d7847e158a5b86ec8d6 sha1: 751357d0a9f2ef48bb540e7b602f1b1805832cf7 size: 117248
Timestamp2013-03-13 19:18:58
PackerMicrosoft Visual C++ ?.?
PEhashe55c311065fe49c70e929754d17e3e1c6e1a042e
IMPhasheb56d3cc2f74f721b650c169ad0b4214
AVRisingno_virus
AVMcafeeno_virus
AVAvira (antivir)BDS/Zegost.Gen
AVTwisterVirus.CB0000E978FEFFFF50.mg
AVAd-AwareGen:Variant.Kazy.164619
AVAlwil (avast)Downloader-TLD [Trj]
AVEset (nod32)Win32/Bayrob.N.Gen
AVGrisoft (avg)Generic_r.CDN
AVSymantecTrojan.Bayrob!gen4
AVFortinetW32/Bayrob.N!tr
AVBitDefenderGen:Variant.Kazy.164619
AVK7Backdoor ( 04c540d41 )
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.P
AVMicroWorld (escan)Gen:Variant.Kazy.164619
AVMalwareBytesTrojan.Agent
AVAuthentiumW32/Symmi.G.gen!Eldorado
AVFrisk (f-prot)W32/Symmi.G.gen!Eldorado
AVIkarusTrojan.Win32.Spy
AVEmsisoftGen:Variant.Kazy.164619
AVZillya!Trojan.Bayrob.Win32.1501
AVKasperskyTrojan.Win32.Generic
AVTrend MicroTSPY_NIVDORT.SM
AVCAT (quickheal)no_virus
AVVirusBlokAda (vba32)no_virus
AVPadvishno_virus
AVBullGuardGen:Variant.Kazy.164619
AVArcabit (arcavir)Gen:Variant.Kazy.164619
AVClamAVno_virus
AVDr. Webno_virus
AVF-SecureGen:Variant.Kazy.164619
AVCA (E-Trust Ino)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\h7adhgj31n5cwbxh6zob1i.exe
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\tst
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\h7adhgj31n5cwbxh6zob1i.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\h7adhgj31n5cwbxh6zob1i.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Tunneling Intelligent Visual Image Storage Media ➝
C:\WINDOWS\system32\zxzldwtotd.exe
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Startup\zxzldwtotd.exe
Creates FileC:\WINDOWS\system32\drivers\etc\hosts
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\lck
Creates FileC:\WINDOWS\system32\zxzldwtotd.exe
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\etc
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\tst
Deletes FileC:\WINDOWS\system32\\drivers\etc\hosts
Creates ProcessC:\WINDOWS\system32\zxzldwtotd.exe
Creates ServiceLogon HomeGroup Collector Backup Print Time - C:\WINDOWS\system32\zxzldwtotd.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 804

Process
↳ Pid 852

Process
↳ C:\WINDOWS\System32\svchost.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM\List of event-active namespaces ➝
NULL
Creates FilePIPE\lsarpc
Creates FileC:\WINDOWS\system32\WBEM\Repository\$WinMgmt.CFG
Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ C:\WINDOWS\system32\spoolsv.exe

Process
↳ Pid 1868

Process
↳ Pid 1152

Process
↳ C:\WINDOWS\system32\zxzldwtotd.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝
1
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\cfg
Creates FileC:\WINDOWS\TEMP\h7adhgj31tzfwbl.exe
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\run
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\rng
Creates FileC:\WINDOWS\system32\ugunyocdqk.exe
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\lck
Creates Filepipe\net\NtControlPipe10
Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\tst
Creates ProcessWATCHDOGPROC "c:\windows\system32\zxzldwtotd.exe"
Creates ProcessC:\WINDOWS\TEMP\h7adhgj31tzfwbl.exe -r 38415 tcp

Process
↳ C:\WINDOWS\system32\zxzldwtotd.exe

Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\tst

Process
↳ WATCHDOGPROC "c:\windows\system32\zxzldwtotd.exe"

Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\tst

Process
↳ C:\WINDOWS\TEMP\h7adhgj31tzfwbl.exe -r 38415 tcp

Creates File\Device\Afd\Endpoint
Winsock DNS239.255.255.250

Network Details:

DNSmojoguia.com
Type: A
204.11.56.48
DNSvillemojo.com
Type: A
209.99.40.222
DNSdeepedge.net
Type: A
46.30.211.32
DNSlongstudy.net
Type: A
223.4.7.89
DNSballuncle.net
Type: A
195.22.26.248
DNSlifestudy.com
Type: A
66.252.139.75
DNSenemyloss.net
Type: A
95.211.230.75
DNSlifeloss.net
Type: A
64.99.80.30
DNSmouthonce.net
Type: A
98.139.135.129
DNSfridaystudy.net
Type: A
74.220.215.214
DNSdominoclub-grup.com
Type: A
DNSelementarimagine.com
Type: A
DNSjarybuter.com
Type: A
DNSmojositio.com
Type: A
DNSaminastol.com
Type: A
DNStilledge.net
Type: A
DNSshallgray.net
Type: A
DNSdeepgray.net
Type: A
DNSshallapril.net
Type: A
DNSdeepapril.net
Type: A
DNSshallarmy.net
Type: A
DNSdeeparmy.net
Type: A
DNSshalledge.net
Type: A
DNSpushgray.net
Type: A
DNSfridaygray.net
Type: A
DNSpushapril.net
Type: A
DNSfridayapril.net
Type: A
DNSpusharmy.net
Type: A
DNSfridayarmy.net
Type: A
DNSpushedge.net
Type: A
DNSfridayedge.net
Type: A
DNSalonggray.net
Type: A
DNSdecembergray.net
Type: A
DNSalongapril.net
Type: A
DNSdecemberapril.net
Type: A
DNSalongarmy.net
Type: A
DNSdecemberarmy.net
Type: A
DNSalongedge.net
Type: A
DNSdecemberedge.net
Type: A
DNSlonguncle.net
Type: A
DNSsoiluncle.net
Type: A
DNSsoilstudy.net
Type: A
DNSlongloss.net
Type: A
DNSsoilloss.net
Type: A
DNSlongonce.net
Type: A
DNSsoilonce.net
Type: A
DNSwheeluncle.net
Type: A
DNSsaiduncle.net
Type: A
DNSwheelstudy.net
Type: A
DNSsaidstudy.net
Type: A
DNSwheelloss.net
Type: A
DNSsaidloss.net
Type: A
DNSwheelonce.net
Type: A
DNSsaidonce.net
Type: A
DNSstickuncle.net
Type: A
DNSstickstudy.net
Type: A
DNSballstudy.net
Type: A
DNSstickloss.net
Type: A
DNSballloss.net
Type: A
DNSstickonce.net
Type: A
DNSballonce.net
Type: A
DNSenemyuncle.net
Type: A
DNSlifeuncle.net
Type: A
DNSenemystudy.net
Type: A
DNSlifestudy.net
Type: A
DNSenemyonce.net
Type: A
DNSlifeonce.net
Type: A
DNSmouthuncle.net
Type: A
DNStilluncle.net
Type: A
DNSmouthstudy.net
Type: A
DNStillstudy.net
Type: A
DNSmouthloss.net
Type: A
DNStillloss.net
Type: A
DNStillonce.net
Type: A
DNSshalluncle.net
Type: A
DNSdeepuncle.net
Type: A
DNSshallstudy.net
Type: A
DNSdeepstudy.net
Type: A
DNSshallloss.net
Type: A
DNSdeeploss.net
Type: A
DNSshallonce.net
Type: A
DNSdeeponce.net
Type: A
DNSpushuncle.net
Type: A
DNSfridayuncle.net
Type: A
DNSpushstudy.net
Type: A
DNSpushloss.net
Type: A
DNSfridayloss.net
Type: A
DNSpushonce.net
Type: A
DNSfridayonce.net
Type: A
DNSalonguncle.net
Type: A
DNSdecemberuncle.net
Type: A
DNSalongstudy.net
Type: A
DNSdecemberstudy.net
Type: A
HTTP GEThttp://mojoguia.com/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://villemojo.com/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://deepedge.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://longstudy.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://balluncle.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://lifestudy.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://enemyloss.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://lifeloss.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://mouthonce.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://fridaystudy.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://mojoguia.com/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://villemojo.com/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://deepedge.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://longstudy.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://balluncle.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://lifestudy.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://enemyloss.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://lifeloss.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://mouthonce.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
HTTP GEThttp://fridaystudy.net/forum/search.php?method=validate&mode=sox&v=003&sox=2c4dd200
User-Agent:
Flows TCP192.168.1.1:1036 ➝ 204.11.56.48:80
Flows TCP192.168.1.1:1037 ➝ 209.99.40.222:80
Flows TCP192.168.1.1:1038 ➝ 46.30.211.32:80
Flows TCP192.168.1.1:1039 ➝ 223.4.7.89:80
Flows TCP192.168.1.1:1040 ➝ 195.22.26.248:80
Flows TCP192.168.1.1:1041 ➝ 66.252.139.75:80
Flows TCP192.168.1.1:1043 ➝ 95.211.230.75:80
Flows TCP192.168.1.1:1044 ➝ 64.99.80.30:80
Flows TCP192.168.1.1:1045 ➝ 98.139.135.129:80
Flows TCP192.168.1.1:1046 ➝ 74.220.215.214:80
Flows TCP192.168.1.1:1047 ➝ 204.11.56.48:80
Flows TCP192.168.1.1:1048 ➝ 209.99.40.222:80
Flows TCP192.168.1.1:1049 ➝ 46.30.211.32:80
Flows TCP192.168.1.1:1050 ➝ 223.4.7.89:80
Flows TCP192.168.1.1:1051 ➝ 195.22.26.248:80
Flows TCP192.168.1.1:1052 ➝ 66.252.139.75:80
Flows TCP192.168.1.1:1053 ➝ 95.211.230.75:80
Flows TCP192.168.1.1:1054 ➝ 64.99.80.30:80
Flows TCP192.168.1.1:1055 ➝ 98.139.135.129:80
Flows TCP192.168.1.1:1056 ➝ 74.220.215.214:80

Raw Pcap
0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d6f 6a6f6775 69612e63 6f6d0d0a   : mojoguia.com..
0x00000080 (00128)   0d0a                                  ..

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207669 6c6c656d 6f6a6f2e 636f6d0d   : villemojo.com.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206465 65706564 67652e6e 65740d0a   : deepedge.net..
0x00000080 (00128)   0d0a0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c6f 6e677374 7564792e 6e65740d   : longstudy.net.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206261 6c6c756e 636c652e 6e65740d   : balluncle.net.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c69 66657374 7564792e 6e65740d   : lifestudy.net.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20656e 656d796c 6f73732e 6e65740d   : enemyloss.net.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c69 66656c6f 73732e6e 65740d0a   : lifeloss.net..
0x00000080 (00128)   0d0a0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d6f 7574686f 6e63652e 6e65740d   : mouthonce.net.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206672 69646179 73747564 792e6e65   : fridaystudy.ne
0x00000080 (00128)   740d0a0d 0a                           t....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d6f 6a6f6775 69612e63 6f6d0d0a   : mojoguia.com..
0x00000080 (00128)   0d0a0a0d 0a                           .....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207669 6c6c656d 6f6a6f2e 636f6d0d   : villemojo.com.
0x00000080 (00128)   0a0d0a0d 0a                           .....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206465 65706564 67652e6e 65740d0a   : deepedge.net..
0x00000080 (00128)   0d0a0a0d 0a                           .....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c6f 6e677374 7564792e 6e65740d   : longstudy.net.
0x00000080 (00128)   0a0d0a0d 0a                           .....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206261 6c6c756e 636c652e 6e65740d   : balluncle.net.
0x00000080 (00128)   0a0d0a0d 0a                           .....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c69 66657374 7564792e 6e65740d   : lifestudy.net.
0x00000080 (00128)   0a0d0a0d 0a                           .....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20656e 656d796c 6f73732e 6e65740d   : enemyloss.net.
0x00000080 (00128)   0a0d0a0d 0a                           .....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c69 66656c6f 73732e6e 65740d0a   : lifeloss.net..
0x00000080 (00128)   0d0a0a0d 0a                           .....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d6f 7574686f 6e63652e 6e65740d   : mouthonce.net.
0x00000080 (00128)   0a0d0a0d 0a                           .....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303033 26736f78 3d326334 64643230   =003&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206672 69646179 73747564 792e6e65   : fridaystudy.ne
0x00000080 (00128)   740d0a0d 0a                           t....


Strings