Analysis Date2015-11-04 00:00:52
MD554336c8b8a2e97f6b7f2364ad6555d2b
SHA19d18f73938a0e4e68293910473e0143510bba8f7

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 0e869c7aed8ce5e3345c5e9f7920bd75 sha1: e019dd5ce1814ce208570ee803bab444bfbc86f1 size: 804864
Section.rdata md5: 8a21646504d7a8f1b69847ca68863079 sha1: 61ed369fafb4426a6ed05f997eddb40880211e24 size: 60416
Section.data md5: f462d5296e007383cfd44ce403a3ee33 sha1: b15200f7a849cc55ded1a22295292fde0ee1025a size: 403456
Timestamp2015-01-27 09:21:13
PackerMicrosoft Visual C++ ?.?
PEhash28dcfded1dc9d0371d5df4e280f06151e35d7573
IMPhash812719bf8d6da06a58044171736f78d2
AVRisingno_virus
AVMcafeeno_virus
AVAvira (antivir)TR/Crypt.Xpack.309665
AVTwisterno_virus
AVAd-AwareGen:Variant.Symmi.22722
AVAlwil (avast)Downloader-TLD [Trj]
AVEset (nod32)Win32/Kryptik.CCLE
AVGrisoft (avg)Win32/Cryptor
AVSymantecDownloader.Upatre!g15
AVFortinetW32/Kryptik.DDQD!tr
AVBitDefenderGen:Variant.Symmi.22722
AVK7Trojan ( 004cd0081 )
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.AE
AVMicroWorld (escan)Gen:Variant.Symmi.22722
AVMalwareBytesno_virus
AVAuthentiumW32/Nivdort.A.gen!Eldorado
AVFrisk (f-prot)no_virus
AVIkarusTrojan.Win32.Crypt
AVEmsisoftGen:Variant.Symmi.22722
AVZillya!no_virus
AVKasperskyTrojan.Win32.Generic
AVTrend MicroTROJ_WONTON.SMJ1
AVCAT (quickheal)no_virus
AVVirusBlokAda (vba32)no_virus
AVPadvishno_virus
AVBullGuardGen:Variant.Symmi.22722
AVArcabit (arcavir)Gen:Variant.Symmi.22722
AVClamAVno_virus
AVDr. Webno_virus
AVF-SecureGen:Variant.Symmi.22722
AVCA (E-Trust Ino)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\jgkhwdhk1m0zuvtulnling.exe
Creates FileC:\WINDOWS\system32\gtfixvkttwfel\tst
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\jgkhwdhk1m0zuvtulnling.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\jgkhwdhk1m0zuvtulnling.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Workstation Panel Logon Locator Now ➝
C:\WINDOWS\system32\lmszrzlgmf.exe
Creates FileC:\WINDOWS\system32\gtfixvkttwfel\lck
Creates FileC:\WINDOWS\system32\lmszrzlgmf.exe
Creates FileC:\WINDOWS\system32\drivers\etc\hosts
Creates FileC:\WINDOWS\system32\gtfixvkttwfel\etc
Creates FileC:\WINDOWS\system32\gtfixvkttwfel\tst
Deletes FileC:\WINDOWS\system32\\drivers\etc\hosts
Creates ProcessC:\WINDOWS\system32\lmszrzlgmf.exe
Creates ServiceStorage Audio Identity Interface Tools Portable - C:\WINDOWS\system32\lmszrzlgmf.exe

Process
↳ Pid 804

Process
↳ Pid 848

Process
↳ C:\WINDOWS\System32\svchost.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM\List of event-active namespaces ➝
NULL
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\WBEM\Repository\$WinMgmt.CFG
Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1108

Process
↳ Pid 1204

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1128

Process
↳ C:\WINDOWS\system32\lmszrzlgmf.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝
1
Creates FileC:\WINDOWS\system32\gtfixvkttwfel\cfg
Creates FileC:\WINDOWS\system32\gtfixvkttwfel\rng
Creates FileC:\WINDOWS\system32\dklnpjj.exe
Creates FileC:\WINDOWS\system32\gtfixvkttwfel\lck
Creates FileC:\WINDOWS\system32\gtfixvkttwfel\run
Creates FileC:\WINDOWS\system32\gtfixvkttwfel\tst
Creates Filepipe\net\NtControlPipe10
Creates FileC:\WINDOWS\TEMP\jgkhwdhk1sdpuvtu.exe
Creates File\Device\Afd\Endpoint
Creates ProcessWATCHDOGPROC "c:\windows\system32\lmszrzlgmf.exe"
Creates ProcessC:\WINDOWS\TEMP\jgkhwdhk1sdpuvtu.exe -r 29442 tcp

Process
↳ C:\WINDOWS\system32\lmszrzlgmf.exe

Creates FileC:\WINDOWS\system32\gtfixvkttwfel\tst

Process
↳ WATCHDOGPROC "c:\windows\system32\lmszrzlgmf.exe"

Creates FileC:\WINDOWS\system32\gtfixvkttwfel\tst

Process
↳ C:\WINDOWS\TEMP\jgkhwdhk1sdpuvtu.exe -r 29442 tcp

Creates File\Device\Afd\Endpoint
Winsock DNS239.255.255.250

Network Details:

DNSmelbourneit.hotkeysparking.com
Type: A
8.5.1.16
DNSenemyguess.net
Type: A
208.91.197.241
DNSqueentell.net
Type: A
208.91.197.241
DNSwednesdayhalf.net
Type: A
208.91.197.241
DNSmouthrest.net
Type: A
208.91.197.241
DNSdrivethirteen.net
Type: A
208.91.197.241
DNSfaceboat.net
Type: A
208.91.197.241
DNSmuchhappy.net
Type: A
208.91.197.241
DNSfairhope.net
Type: A
69.85.206.115
DNSdreamhope.net
Type: A
202.172.26.32
DNSthishope.net
Type: A
208.100.26.234
DNSwhichkind.net
Type: A
69.41.183.180
DNSableread.net
Type: A
DNSsoilunder.net
Type: A
DNSsensesound.net
Type: A
DNSarivethirteen.net
Type: A
DNSsouththirteen.net
Type: A
DNSarivehurry.net
Type: A
DNSsouthhurry.net
Type: A
DNSuponhope.net
Type: A
DNSwhichhope.net
Type: A
DNSuponleft.net
Type: A
DNSwhichleft.net
Type: A
DNSuponthirteen.net
Type: A
DNSwhichthirteen.net
Type: A
DNSuponhurry.net
Type: A
DNSwhichhurry.net
Type: A
DNSspothope.net
Type: A
DNSsalthope.net
Type: A
DNSspotleft.net
Type: A
DNSsaltleft.net
Type: A
DNSspotthirteen.net
Type: A
DNSsaltthirteen.net
Type: A
DNSspothurry.net
Type: A
DNSsalthurry.net
Type: A
DNSgladhope.net
Type: A
DNStakenhope.net
Type: A
DNSgladleft.net
Type: A
DNStakenleft.net
Type: A
DNSgladthirteen.net
Type: A
DNStakenthirteen.net
Type: A
DNSgladhurry.net
Type: A
DNStakenhurry.net
Type: A
DNSequalhope.net
Type: A
DNSgrouphope.net
Type: A
DNSequalleft.net
Type: A
DNSgroupleft.net
Type: A
DNSequalthirteen.net
Type: A
DNSgroupthirteen.net
Type: A
DNSequalhurry.net
Type: A
DNSgrouphurry.net
Type: A
DNSspokehope.net
Type: A
DNSvisithope.net
Type: A
DNSspokeleft.net
Type: A
DNSvisitleft.net
Type: A
DNSspokethirteen.net
Type: A
DNSvisitthirteen.net
Type: A
DNSspokehurry.net
Type: A
DNSvisithurry.net
Type: A
DNSwatchhope.net
Type: A
DNSwatchleft.net
Type: A
DNSfairleft.net
Type: A
DNSwatchthirteen.net
Type: A
DNSfairthirteen.net
Type: A
DNSwatchhurry.net
Type: A
DNSfairhurry.net
Type: A
DNSdreamleft.net
Type: A
DNSthisleft.net
Type: A
DNSdreamthirteen.net
Type: A
DNSthisthirteen.net
Type: A
DNSdreamhurry.net
Type: A
DNSthishurry.net
Type: A
DNSarivewild.net
Type: A
DNSsouthwild.net
Type: A
DNSarivejune.net
Type: A
DNSsouthjune.net
Type: A
DNSarivebegan.net
Type: A
DNSsouthbegan.net
Type: A
DNSarivekind.net
Type: A
DNSsouthkind.net
Type: A
DNSuponwild.net
Type: A
DNSwhichwild.net
Type: A
DNSuponjune.net
Type: A
DNSwhichjune.net
Type: A
DNSuponbegan.net
Type: A
DNSwhichbegan.net
Type: A
DNSuponkind.net
Type: A
DNSspotwild.net
Type: A
DNSsaltwild.net
Type: A
DNSspotjune.net
Type: A
DNSsaltjune.net
Type: A
DNSspotbegan.net
Type: A
DNSsaltbegan.net
Type: A
DNSspotkind.net
Type: A
DNSsaltkind.net
Type: A
DNSgladwild.net
Type: A
HTTP GEThttp://ableread.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://enemyguess.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://queentell.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://wednesdayhalf.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://mouthrest.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://drivethirteen.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://faceboat.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://muchhappy.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://fairhope.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://dreamhope.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://thishope.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://whichkind.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://ableread.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://enemyguess.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://queentell.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://wednesdayhalf.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://mouthrest.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://drivethirteen.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://faceboat.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://muchhappy.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://fairhope.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://dreamhope.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://thishope.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
HTTP GEThttp://whichkind.net/index.php?method=validate&mode=sox&v=036&sox=430a4a01&lenhdr
User-Agent:
Flows TCP192.168.1.1:1036 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1037 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1039 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1040 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1041 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1042 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1043 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1044 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1045 ➝ 69.85.206.115:80
Flows TCP192.168.1.1:1046 ➝ 202.172.26.32:80
Flows TCP192.168.1.1:1047 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1048 ➝ 69.41.183.180:80
Flows TCP192.168.1.1:1049 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1050 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1051 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1052 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1053 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1054 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1055 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1056 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1057 ➝ 69.85.206.115:80
Flows TCP192.168.1.1:1058 ➝ 202.172.26.32:80
Flows TCP192.168.1.1:1059 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1060 ➝ 69.41.183.180:80

Raw Pcap
0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206162 6c657265 61642e6e 65740d0a   : ableread.net..
0x00000080 (00128)   0d0a                                  ..

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20656e 656d7967 75657373 2e6e6574   : enemyguess.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207175 65656e74 656c6c2e 6e65740d   : queentell.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207765 646e6573 64617968 616c662e   : wednesdayhalf.
0x00000080 (00128)   6e65740d 0a0d0a                       net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d6f 75746872 6573742e 6e65740d   : mouthrest.net.
0x00000080 (00128)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 69766574 68697274 65656e2e   : drivethirteen.
0x00000080 (00128)   6e65740d 0a0d0a                       net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206661 6365626f 61742e6e 65740d0a   : faceboat.net..
0x00000080 (00128)   0d0a740d 0a0d0a                       ..t....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d75 63686861 7070792e 6e65740d   : muchhappy.net.
0x00000080 (00128)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206661 6972686f 70652e6e 65740d0a   : fairhope.net..
0x00000080 (00128)   0d0a0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 65616d68 6f70652e 6e65740d   : dreamhope.net.
0x00000080 (00128)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 6973686f 70652e6e 65740d0a   : thishope.net..
0x00000080 (00128)   0d0a0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207768 6963686b 696e642e 6e65740d   : whichkind.net.
0x00000080 (00128)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206162 6c657265 61642e6e 65740d0a   : ableread.net..
0x00000080 (00128)   0d0a0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20656e 656d7967 75657373 2e6e6574   : enemyguess.net
0x00000080 (00128)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207175 65656e74 656c6c2e 6e65740d   : queentell.net.
0x00000080 (00128)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207765 646e6573 64617968 616c662e   : wednesdayhalf.
0x00000080 (00128)   6e65740d 0a0d0a                       net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d6f 75746872 6573742e 6e65740d   : mouthrest.net.
0x00000080 (00128)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 69766574 68697274 65656e2e   : drivethirteen.
0x00000080 (00128)   6e65740d 0a0d0a                       net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206661 6365626f 61742e6e 65740d0a   : faceboat.net..
0x00000080 (00128)   0d0a740d 0a0d0a                       ..t....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d75 63686861 7070792e 6e65740d   : muchhappy.net.
0x00000080 (00128)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206661 6972686f 70652e6e 65740d0a   : fairhope.net..
0x00000080 (00128)   0d0a0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 65616d68 6f70652e 6e65740d   : dreamhope.net.
0x00000080 (00128)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 6973686f 70652e6e 65740d0a   : thishope.net..
0x00000080 (00128)   0d0a0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3626736f   ode=sox&v=036&so
0x00000030 (00048)   783d3433 30613461 3031266c 656e6864   x=430a4a01&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207768 6963686b 696e642e 6e65740d   : whichkind.net.
0x00000080 (00128)   0a0d0a0d 0a0d0a                       .......


Strings