Analysis Date2015-10-15 04:36:54
MD52fc7a8ce3dce0eafd57b39161e7c19da
SHA18907867bd9cc1e01de4fd7cba48e9839b91a3b85

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 5eaf54b235decd19a87ecfbbf771c3ae sha1: 99c94334d07f47064c78045602f9ff1fb247e605 size: 802816
Section.rdata md5: 04c6edad255fa0c40b670f69ee9853f5 sha1: a5bebb4d3957cf271c25e1ba60e29e7aac3ed1ee size: 60928
Section.data md5: 6d2cef622d5232d14f2debce3251e52a sha1: 99162a32904073d053aba17c6aaf09447bff8e39 size: 406016
Timestamp2015-01-27 08:34:22
PackerMicrosoft Visual C++ ?.?
PEhash24d8f3b89aa0f2e7da2ef9903f982fb0ae97efe0
IMPhash0f08e250b9a6fee639ee90531b176631
AVCA (E-Trust Ino)no_virus
AVRisingno_virus
AVMcafeeno_virus
AVAvira (antivir)TR/Crypt.Xpack.292525
AVTwisterno_virus
AVAd-AwareGen:Variant.Symmi.22722
AVAlwil (avast)Downloader-TLD [Trj]
AVEset (nod32)Win32/Kryptik.DXVJ
AVGrisoft (avg)Win32/Cryptor
AVSymantecDownloader.Upatre!g15
AVFortinetW32/Kryptik.DDQD!tr
AVBitDefenderGen:Variant.Symmi.22722
AVK7Trojan ( 004cd0081 )
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.AE
AVMicroWorld (escan)Gen:Variant.Symmi.22722
AVMalwareBytesTrojan.FakePDF
AVAuthentiumW32/Nivdort.A.gen!Eldorado
AVFrisk (f-prot)no_virus
AVIkarusWin32.Cryptor
AVEmsisoftGen:Variant.Symmi.22722
AVZillya!Trojan.Kryptik.Win32.796457
AVKasperskyTrojan.Win32.Generic
AVTrend MicroTROJ_WONTON.SMJ1
AVCAT (quickheal)no_virus
AVVirusBlokAda (vba32)no_virus
AVPadvishno_virus
AVBullGuardGen:Variant.Symmi.22722
AVArcabit (arcavir)Gen:Variant.Symmi.22722
AVClamAVno_virus
AVDr. WebTrojan.KillFiles.29720
AVF-SecureGen:Variant.Symmi.22722

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\pzuut51kqjsasqyifmqg.exe
Creates FileC:\WINDOWS\system32\evtyucvo\tst
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\pzuut51kqjsasqyifmqg.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\pzuut51kqjsasqyifmqg.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Center WWAN Program AuthIP ➝
C:\WINDOWS\system32\qjmwqdres.exe
Creates FileC:\WINDOWS\system32\evtyucvo\lck
Creates FileC:\WINDOWS\system32\drivers\etc\hosts
Creates FileC:\WINDOWS\system32\qjmwqdres.exe
Creates FileC:\WINDOWS\system32\evtyucvo\etc
Creates FileC:\WINDOWS\system32\evtyucvo\tst
Deletes FileC:\WINDOWS\system32\\drivers\etc\hosts
Creates ProcessC:\WINDOWS\system32\qjmwqdres.exe
Creates ServiceTP Enumerator Encryption Tablet Level - C:\WINDOWS\system32\qjmwqdres.exe

Process
↳ Pid 800

Process
↳ Pid 852

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1112

Process
↳ Pid 1208

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1844

Process
↳ Pid 1060

Process
↳ C:\WINDOWS\system32\qjmwqdres.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝
1
Creates FileC:\WINDOWS\system32\evtyucvo\cfg
Creates FileC:\WINDOWS\system32\cetfugzqqea.exe
Creates FileC:\WINDOWS\system32\evtyucvo\run
Creates FileC:\WINDOWS\system32\evtyucvo\rng
Creates FileC:\WINDOWS\system32\evtyucvo\lck
Creates Filepipe\net\NtControlPipe10
Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\evtyucvo\tst
Creates FileC:\WINDOWS\TEMP\pzuut51rcdsas.exe
Creates ProcessWATCHDOGPROC "c:\windows\system32\qjmwqdres.exe"
Creates ProcessC:\WINDOWS\TEMP\pzuut51rcdsas.exe -r 42287 tcp

Process
↳ C:\WINDOWS\system32\qjmwqdres.exe

Creates FileC:\WINDOWS\system32\evtyucvo\tst

Process
↳ WATCHDOGPROC "c:\windows\system32\qjmwqdres.exe"

Creates FileC:\WINDOWS\system32\evtyucvo\tst

Process
↳ C:\WINDOWS\TEMP\pzuut51rcdsas.exe -r 42287 tcp

Creates File\Device\Afd\Endpoint
Winsock DNS239.255.255.250

Network Details:

DNSenemyguess.net
Type: A
208.91.197.241
DNSqueentell.net
Type: A
208.91.197.241
DNSwednesdayhalf.net
Type: A
208.91.197.241
DNSmouthrest.net
Type: A
208.91.197.241
DNSdrivethirteen.net
Type: A
208.91.197.241
DNSfaceboat.net
Type: A
208.91.197.241
DNSmuchhappy.net
Type: A
208.91.197.241
DNSwrongpeace.net
Type: A
82.98.86.173
DNShairhome.net
Type: A
104.219.250.120
DNShumangold.net
Type: A
98.124.198.1
DNSmusichome.net
Type: A
207.148.248.143
DNSyardover.net
Type: A
208.100.26.234
DNSmusicgold.net
Type: A
198.61.166.153
DNSoffergold.net
Type: A
46.166.189.98
DNShangover.net
Type: A
69.172.201.208
DNSjoinhome.net
Type: A
125.65.112.15
DNSwishhome.net
Type: A
8.5.1.58
DNSrockhome.net
Type: A
184.168.221.104
DNSrockover.net
Type: A
97.74.182.1
DNSmadehome.net
Type: A
23.236.62.147
DNSableread.net
Type: A
DNSsoilunder.net
Type: A
DNSsensesound.net
Type: A
DNSmadegift.net
Type: A
DNSwrongtuesday.net
Type: A
DNSmadetuesday.net
Type: A
DNSmadepeace.net
Type: A
DNShumanhome.net
Type: A
DNShumanover.net
Type: A
DNShairover.net
Type: A
DNShumangrain.net
Type: A
DNShairgrain.net
Type: A
DNShairgold.net
Type: A
DNSyardhome.net
Type: A
DNSmusicover.net
Type: A
DNSyardgrain.net
Type: A
DNSmusicgrain.net
Type: A
DNSyardgold.net
Type: A
DNSwenthome.net
Type: A
DNSspendhome.net
Type: A
DNSwentover.net
Type: A
DNSspendover.net
Type: A
DNSwentgrain.net
Type: A
DNSspendgrain.net
Type: A
DNSwentgold.net
Type: A
DNSspendgold.net
Type: A
DNSfronthome.net
Type: A
DNSofferhome.net
Type: A
DNSfrontover.net
Type: A
DNSofferover.net
Type: A
DNSfrontgrain.net
Type: A
DNSoffergrain.net
Type: A
DNSfrontgold.net
Type: A
DNShanghome.net
Type: A
DNSseptemberhome.net
Type: A
DNSseptemberover.net
Type: A
DNShanggrain.net
Type: A
DNSseptembergrain.net
Type: A
DNShanggold.net
Type: A
DNSseptembergold.net
Type: A
DNSjoinover.net
Type: A
DNSwishover.net
Type: A
DNSjoingrain.net
Type: A
DNSwishgrain.net
Type: A
DNSjoingold.net
Type: A
DNSwishgold.net
Type: A
DNSdeadhome.net
Type: A
DNSdeadover.net
Type: A
DNSdeadgrain.net
Type: A
DNSrockgrain.net
Type: A
DNSdeadgold.net
Type: A
DNSrockgold.net
Type: A
DNSwronghome.net
Type: A
DNSwrongover.net
Type: A
DNSmadeover.net
Type: A
DNSwronggrain.net
Type: A
DNSmadegrain.net
Type: A
DNSwronggold.net
Type: A
DNSmadegold.net
Type: A
DNSmilkcloth.net
Type: A
DNStriedcloth.net
Type: A
DNSmilkpaid.net
Type: A
DNStriedpaid.net
Type: A
DNSmilkaugust.net
Type: A
DNStriedaugust.net
Type: A
DNSmilkborn.net
Type: A
DNStriedborn.net
Type: A
DNSwithcloth.net
Type: A
DNSdutycloth.net
Type: A
DNSwithpaid.net
Type: A
DNSdutypaid.net
Type: A
DNSwithaugust.net
Type: A
DNSdutyaugust.net
Type: A
DNSwithborn.net
Type: A
DNSdutyborn.net
Type: A
HTTP GEThttp://enemyguess.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://queentell.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://wednesdayhalf.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://mouthrest.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://drivethirteen.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://faceboat.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://muchhappy.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://wrongpeace.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://hairhome.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://humangold.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://musichome.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://yardover.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://musicgold.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://offergold.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://hangover.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://joinhome.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://wishhome.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://rockhome.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://rockover.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://madehome.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://enemyguess.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://queentell.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://wednesdayhalf.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://mouthrest.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://drivethirteen.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://faceboat.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://muchhappy.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://wrongpeace.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://hairhome.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://humangold.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://musichome.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://yardover.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://musicgold.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://offergold.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://hangover.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://joinhome.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://wishhome.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://rockhome.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://rockover.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
HTTP GEThttp://madehome.net/index.php?method=validate&mode=sox&v=036&sox=4b4f7c01&lenhdr
User-Agent:
Flows TCP192.168.1.1:1036 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1038 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1039 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1040 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1041 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1042 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1043 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1044 ➝ 82.98.86.173:80
Flows TCP192.168.1.1:1045 ➝ 104.219.250.120:80
Flows TCP192.168.1.1:1046 ➝ 98.124.198.1:80
Flows TCP192.168.1.1:1047 ➝ 207.148.248.143:80
Flows TCP192.168.1.1:1048 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1049 ➝ 198.61.166.153:80
Flows TCP192.168.1.1:1050 ➝ 46.166.189.98:80
Flows TCP192.168.1.1:1051 ➝ 69.172.201.208:80
Flows TCP192.168.1.1:1052 ➝ 125.65.112.15:80
Flows TCP192.168.1.1:1053 ➝ 8.5.1.58:80
Flows TCP192.168.1.1:1054 ➝ 184.168.221.104:80
Flows TCP192.168.1.1:1055 ➝ 97.74.182.1:80
Flows TCP192.168.1.1:1056 ➝ 23.236.62.147:80
Flows TCP192.168.1.1:1057 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1202 ➝ 121.43.233.162:8077
Flows TCP192.168.1.1:1058 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1059 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1060 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1061 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1062 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1063 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1064 ➝ 82.98.86.173:80
Flows TCP192.168.1.1:1065 ➝ 104.219.250.120:80
Flows TCP192.168.1.1:1066 ➝ 98.124.198.1:80
Flows TCP192.168.1.1:1067 ➝ 207.148.248.143:80
Flows TCP192.168.1.1:1068 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1069 ➝ 198.61.166.153:80
Flows TCP192.168.1.1:1070 ➝ 46.166.189.98:80
Flows TCP192.168.1.1:1071 ➝ 69.172.201.208:80
Flows TCP192.168.1.1:1072 ➝ 125.65.112.15:80
Flows TCP192.168.1.1:1073 ➝ 8.5.1.58:80
Flows TCP192.168.1.1:1074 ➝ 184.168.221.104:80
Flows TCP192.168.1.1:1075 ➝ 97.74.182.1:80
Flows TCP192.168.1.1:1076 ➝ 23.236.62.147:80

Raw Pcap
0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20656e 656d7967 75657373 2e6e6574   : enemyguess.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207175 65656e74 656c6c2e 6e65740d   : queentell.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207765 646e6573 64617968 616c662e   : wednesdayhalf.
0x00000080 (00128)   6e65740d 0a0d0a                       net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d6f 75746872 6573742e 6e65740d   : mouthrest.net.
0x00000080 (00128)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 69766574 68697274 65656e2e   : drivethirteen.
0x00000080 (00128)   6e65740d 0a0d0a                       net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206661 6365626f 61742e6e 65740d0a   : faceboat.net..
0x00000080 (00128)   0d0a740d 0a0d0a                       ..t....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d75 63686861 7070792e 6e65740d   : muchhappy.net.
0x00000080 (00128)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207772 6f6e6770 65616365 2e6e6574   : wrongpeace.net
0x00000080 (00128)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206861 6972686f 6d652e6e 65740d0a   : hairhome.net..
0x00000080 (00128)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206875 6d616e67 6f6c642e 6e65740d   : humangold.net.
0x00000080 (00128)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d75 73696368 6f6d652e 6e65740d   : musichome.net.
0x00000080 (00128)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207961 72646f76 65722e6e 65740d0a   : yardover.net..
0x00000080 (00128)   0d0a0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d75 73696367 6f6c642e 6e65740d   : musicgold.net.
0x00000080 (00128)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206f66 66657267 6f6c642e 6e65740d   : offergold.net.
0x00000080 (00128)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206861 6e676f76 65722e6e 65740d0a   : hangover.net..
0x00000080 (00128)   0d0a0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206a6f 696e686f 6d652e6e 65740d0a   : joinhome.net..
0x00000080 (00128)   0d0a0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207769 7368686f 6d652e6e 65740d0a   : wishhome.net..
0x00000080 (00128)   0d0a0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20726f 636b686f 6d652e6e 65740d0a   : rockhome.net..
0x00000080 (00128)   0d0a0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20726f 636b6f76 65722e6e 65740d0a   : rockover.net..
0x00000080 (00128)   0d0a0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d61 6465686f 6d652e6e 65740d0a   : madehome.net..
0x00000080 (00128)   0d0a0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20656e 656d7967 75657373 2e6e6574   : enemyguess.net
0x00000080 (00128)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207175 65656e74 656c6c2e 6e65740d   : queentell.net.
0x00000080 (00128)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207765 646e6573 64617968 616c662e   : wednesdayhalf.
0x00000080 (00128)   6e65740d 0a0d0a                       net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d6f 75746872 6573742e 6e65740d   : mouthrest.net.
0x00000080 (00128)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 69766574 68697274 65656e2e   : drivethirteen.
0x00000080 (00128)   6e65740d 0a0d0a                       net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206661 6365626f 61742e6e 65740d0a   : faceboat.net..
0x00000080 (00128)   0d0a740d 0a0d0a                       ..t....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d75 63686861 7070792e 6e65740d   : muchhappy.net.
0x00000080 (00128)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207772 6f6e6770 65616365 2e6e6574   : wrongpeace.net
0x00000080 (00128)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206861 6972686f 6d652e6e 65740d0a   : hairhome.net..
0x00000080 (00128)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206875 6d616e67 6f6c642e 6e65740d   : humangold.net.
0x00000080 (00128)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d75 73696368 6f6d652e 6e65740d   : musichome.net.
0x00000080 (00128)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207961 72646f76 65722e6e 65740d0a   : yardover.net..
0x00000080 (00128)   0d0a0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d75 73696367 6f6c642e 6e65740d   : musicgold.net.
0x00000080 (00128)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206f66 66657267 6f6c642e 6e65740d   : offergold.net.
0x00000080 (00128)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206861 6e676f76 65722e6e 65740d0a   : hangover.net..
0x00000080 (00128)   0d0a0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206a6f 696e686f 6d652e6e 65740d0a   : joinhome.net..
0x00000080 (00128)   0d0a0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207769 7368686f 6d652e6e 65740d0a   : wishhome.net..
0x00000080 (00128)   0d0a0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20726f 636b686f 6d652e6e 65740d0a   : rockhome.net..
0x00000080 (00128)   0d0a0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20726f 636b6f76 65722e6e 65740d0a   : rockover.net..
0x00000080 (00128)   0d0a0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3462 34663763 3031266c 656e6864   x=4b4f7c01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d61 6465686f 6d652e6e 65740d0a   : madehome.net..
0x00000080 (00128)   0d0a0a0a 0a0d0a                       .......


Strings