Analysis Date2018-02-07 00:52:21
MD5e58493f3451c0cd3c0672f2ef244f53c
SHA1b3e0cdffa0aaa6b4e1d3d7e47ef437a92592109a

Static Details:

File typePE32 executable (GUI) Intel 80386, for MS Windows
PEhash
AVArcabit (arcavir)Gen:Variant.Barys.56660
AVAuthentiumW32/Nivdort.I.gen!Eldorado
AVGrisoft (avg)Error Scanning File
AVAvira (antivir)TR/Nivdort.llbmr
AVAlwil (avast)Malware-gen
AVAlwil (avast)Win32:Malware-gen
AVAd-AwareGen:Variant.Barys.56660
AVBitDefenderGen:Variant.Barys.56660
AVBullGuardGen:Variant.Barys.56660
AVClamAVNo Virus
AVDr. WebNo Virus
AVEmsisoftGen:Variant.Barys.56660
AVMicroWorld (escan)Gen:Variant.Barys.56660
AVCA (E-Trust Ino)Gen:Variant.Zusy.141475
AVFortinetW32/Bayrob.BJ!tr
AVFrisk (f-prot)W32/Nivdort.I.gen!Eldorado
AVF-SecureGen:Variant.Barys.56660
AVIkarusTrojan-Spy.Win32.Nivdort
AVK7Error Scanning File
AVKasperskyTrojan.Win32.Bayrob.gen
AVMalwareBytesNo Virus
AVMcafeeGenericR-FZD!E58493F3451C
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort
AVNANONo Virus
AVEset (nod32)Win32/Bayrob.BJ
AVPadvishNo Virus
AVCAT (quickheal)TrojanSpy.Nivdort.DR3
AVRisingNo Virus
AV360 SafeNo Virus
AVSUPERAntiSpywareNo Virus
AVSymantecNo Virus
AVTrend MicroNo Virus
AVTwisterNo Virus
AVVirusBlokAda (vba32)No Virus
AVWindows DefenderTrojanSpy:Win32/Nivdort
AVZillya!No Virus

Runtime Details:

Screenshot

Process
↳ C:\Windows\System32\lsass.exe

Process
↳ C:\Users\THX1138\AppData\Local\Temp\b3e0cdffa0aaa6b4e1d3d7e47ef437a92592109a.exe

Creates Mutex
Creates Mutex
Creates Mutex
Creates FileC:\Windows\jlyhufcuybqk\jgsxbjxvpq
Creates FileC:\jlyhufcuybqk\jgsxbjxvpq
Creates Filec:\Users\THX1138\AppData\Local\Temp\b3e0cdffa0aaa6b4e1d3d7e47ef437a92592109a.exe
Creates FileC:\jlyhufcuybqk\egjkqgi7pzjsmldcjwft0.exe

Process
↳ C:\jlyhufcuybqk\egjkqgi7pzjsmldcjwft0.exe

Creates Mutex
Creates Mutex
Creates Mutex
Creates FileC:\Windows\jlyhufcuybqk\jgsxbjxvpq
Creates FileC:\jlyhufcuybqk\jgsxbjxvpq
Creates FileC:\jlyhufcuybqk\sjeejpdadnn
Creates FileC:\jlyhufcuybqk\run

Process
↳ C:\jlyhufcuybqk\tsjwgoxzcx.exe

Creates Mutex
Creates Mutex
Creates Mutex
Creates FileC:\Windows\jlyhufcuybqk\jgsxbjxvpq
Creates FileC:\jlyhufcuybqk\jgsxbjxvpq
Creates FileC:\jlyhufcuybqk\sjeejpdadnn

Network Details:


Raw Pcap
0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   6561736f 6e6e6561 726c792e 6e65740d   easonnearly.net.
0x00000050 (00080)   0a0d0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2071   : close..Host: q
0x00000040 (00064)   75696574 68617070 656e2e6e 65740d0a   uiethappen.net..
0x00000050 (00080)   0d0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   6561736f 6e686170 70656e2e 6e65740d   easonhappen.net.
0x00000050 (00080)   0a0d0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2071   : close..Host: q
0x00000040 (00064)   75696574 7368616b 652e6e65 740d0a0d   uietshake.net...
0x00000050 (00080)   0a0d0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   6561736f 6e736861 6b652e6e 65740d0a   easonshake.net..
0x00000050 (00080)   0d0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2071   : close..Host: q
0x00000040 (00064)   75696574 73686172 652e6e65 740d0a0d   uietshare.net...
0x00000050 (00080)   0a0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   6561736f 6e736861 72652e6e 65740d0a   easonshare.net..
0x00000050 (00080)   0d0a0a66 746e6373 692e636f 6d0d0a0d   ...ftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2061   : close..Host: a
0x00000040 (00064)   6761696e 73747375 63636565 642e6e65   gainstsucceed.ne
0x00000050 (00080)   740d0a0d 0a6e6373 692e636f 6d0d0a0d   t....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2064   : close..Host: d
0x00000040 (00064)   6f756274 73756363 6565642e 6e65740d   oubtsucceed.net.
0x00000050 (00080)   0a0d0a0d 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2061   : close..Host: a
0x00000040 (00064)   6761696e 73746265 74776565 6e2e6e65   gainstbetween.ne
0x00000050 (00080)   740d0a0d 0a6e6373 692e636f 6d0d0a0d   t....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2064   : close..Host: d
0x00000040 (00064)   6f756274 62657477 65656e2e 6e65740d   oubtbetween.net.
0x00000050 (00080)   0a0d0a0d 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2061   : close..Host: a
0x00000040 (00064)   6761696e 73747072 6f647563 652e6e65   gainstproduce.ne
0x00000050 (00080)   740d0a0d 0a6e6373 692e636f 6d0d0a0d   t....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2064   : close..Host: d
0x00000040 (00064)   6f756274 70726f64 7563652e 6e65740d   oubtproduce.net.
0x00000050 (00080)   0a0d0a0d 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2061   : close..Host: a
0x00000040 (00064)   6761696e 73747374 7564656e 742e6e65   gainststudent.ne
0x00000050 (00080)   740d0a0d 0a6e6373 692e636f 6d0d0a0d   t....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2064   : close..Host: d
0x00000040 (00064)   6f756274 73747564 656e742e 6e65740d   oubtstudent.net.
0x00000050 (00080)   0a0d0a0d 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a206e   : close..Host: n
0x00000040 (00064)   69676874 73756363 6565642e 6e65740d   ightsucceed.net.
0x00000050 (00080)   0a0d0a0d 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2064   : close..Host: d
0x00000040 (00064)   65636964 65737563 63656564 2e6e6574   ecidesucceed.net
0x00000050 (00080)   0d0a0d0a 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a206e   : close..Host: n
0x00000040 (00064)   69676874 62657477 65656e2e 6e65740d   ightbetween.net.
0x00000050 (00080)   0a0d0a0a 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2064   : close..Host: d
0x00000040 (00064)   65636964 65626574 7765656e 2e6e6574   ecidebetween.net
0x00000050 (00080)   0d0a0d0a 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a206e   : close..Host: n
0x00000040 (00064)   69676874 70726f64 7563652e 6e65740d   ightproduce.net.
0x00000050 (00080)   0a0d0a0a 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2064   : close..Host: d
0x00000040 (00064)   65636964 6570726f 64756365 2e6e6574   ecideproduce.net
0x00000050 (00080)   0d0a0d0a 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a206e   : close..Host: n
0x00000040 (00064)   69676874 73747564 656e742e 6e65740d   ightstudent.net.
0x00000050 (00080)   0a0d0a0a 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2064   : close..Host: d
0x00000040 (00064)   65636964 65737475 64656e74 2e6e6574   ecidestudent.net
0x00000050 (00080)   0d0a0d0a 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a206c   : close..Host: l
0x00000040 (00064)   61726765 73756363 6565642e 6e65740d   argesucceed.net.
0x00000050 (00080)   0a0d0a0a 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2063   : close..Host: c
0x00000040 (00064)   61707461 696e7375 63636565 642e6e65   aptainsucceed.ne
0x00000050 (00080)   740d0a0d 0a6e6373 692e636f 6d0d0a0d   t....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a206c   : close..Host: l
0x00000040 (00064)   61726765 62657477 65656e2e 6e65740d   argebetween.net.
0x00000050 (00080)   0a0d0a0d 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2063   : close..Host: c
0x00000040 (00064)   61707461 696e6265 74776565 6e2e6e65   aptainbetween.ne
0x00000050 (00080)   740d0a0d 0a6e6373 692e636f 6d0d0a0d   t....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a206c   : close..Host: l
0x00000040 (00064)   61726765 70726f64 7563652e 6e65740d   argeproduce.net.
0x00000050 (00080)   0a0d0a0d 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2063   : close..Host: c
0x00000040 (00064)   61707461 696e7072 6f647563 652e6e65   aptainproduce.ne
0x00000050 (00080)   740d0a0d 0a6e6373 692e636f 6d0d0a0d   t....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a206c   : close..Host: l
0x00000040 (00064)   61726765 73747564 656e742e 6e65740d   argestudent.net.
0x00000050 (00080)   0a0d0a0d 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2063   : close..Host: c
0x00000040 (00064)   61707461 696e7374 7564656e 742e6e65   aptainstudent.ne
0x00000050 (00080)   740d0a0d 0a6e6373 692e636f 6d0d0a0d   t....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2072   : close..Host: r
0x00000040 (00064)   65636f72 64737563 63656564 2e6e6574   ecordsucceed.net
0x00000050 (00080)   0d0a0d0a 0a6e6373 692e636f 6d0d0a0d   .....ncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2065   : close..Host: e
0x00000040 (00064)   6c656374 72696373 75636365 65642e6e   lectricsucceed.n
0x00000050 (00080)   65740d0a 0d0a6373 692e636f 6d0d0a0d   et....csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2072   : close..Host: r
0x00000040 (00064)   65636f72 64626574 7765656e 2e6e6574   ecordbetween.net
0x00000050 (00080)   0d0a0d0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2065   : close..Host: e
0x00000040 (00064)   6c656374 72696362 65747765 656e2e6e   lectricbetween.n
0x00000050 (00080)   65740d0a 0d0a6373 692e636f 6d0d0a0d   et....csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2072   : close..Host: r
0x00000040 (00064)   65636f72 6470726f 64756365 2e6e6574   ecordproduce.net
0x00000050 (00080)   0d0a0d0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2065   : close..Host: e
0x00000040 (00064)   6c656374 72696370 726f6475 63652e6e   lectricproduce.n
0x00000050 (00080)   65740d0a 0d0a6373 692e636f 6d0d0a0d   et....csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2072   : close..Host: r
0x00000040 (00064)   65636f72 64737475 64656e74 2e6e6574   ecordstudent.net
0x00000050 (00080)   0d0a0d0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2065   : close..Host: e
0x00000040 (00064)   6c656374 72696373 74756465 6e742e6e   lectricstudent.n
0x00000050 (00080)   65740d0a 0d0a6373 692e636f 6d0d0a0d   et....csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   74726565 74737563 63656564 2e6e6574   treetsucceed.net
0x00000050 (00080)   0d0a0d0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2074   : close..Host: t
0x00000040 (00064)   72616465 73756363 6565642e 6e65740d   radesucceed.net.
0x00000050 (00080)   0a0d0a0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   74726565 74626574 7765656e 2e6e6574   treetbetween.net
0x00000050 (00080)   0d0a0d0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2074   : close..Host: t
0x00000040 (00064)   72616465 62657477 65656e2e 6e65740d   radebetween.net.
0x00000050 (00080)   0a0d0a0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   74726565 7470726f 64756365 2e6e6574   treetproduce.net
0x00000050 (00080)   0d0a0d0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2074   : close..Host: t
0x00000040 (00064)   72616465 70726f64 7563652e 6e65740d   radeproduce.net.
0x00000050 (00080)   0a0d0a0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2073   : close..Host: s
0x00000040 (00064)   74726565 74737475 64656e74 2e6e6574   treetstudent.net
0x00000050 (00080)   0d0a0d0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2074   : close..Host: t
0x00000040 (00064)   72616465 73747564 656e742e 6e65740d   radestudent.net.
0x00000050 (00080)   0a0d0a0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2062   : close..Host: b
0x00000040 (00064)   65747465 72737563 63656564 2e6e6574   ettersucceed.net
0x00000050 (00080)   0d0a0d0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2067   : close..Host: g
0x00000040 (00064)   61746865 72737563 63656564 2e6e6574   athersucceed.net
0x00000050 (00080)   0d0a0d0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2062   : close..Host: b
0x00000040 (00064)   65747465 72626574 7765656e 2e6e6574   etterbetween.net
0x00000050 (00080)   0d0a0d0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2067   : close..Host: g
0x00000040 (00064)   61746865 72626574 7765656e 2e6e6574   atherbetween.net
0x00000050 (00080)   0d0a0d0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2062   : close..Host: b
0x00000040 (00064)   65747465 7270726f 64756365 2e6e6574   etterproduce.net
0x00000050 (00080)   0d0a0d0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2067   : close..Host: g
0x00000040 (00064)   61746865 7270726f 64756365 2e6e6574   atherproduce.net
0x00000050 (00080)   0d0a0d0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f696e64 65782e70 68702048   GET /index.php H
0x00000010 (00016)   5454502f 312e300d 0a416363 6570743a   TTP/1.0..Accept:
0x00000020 (00032)   202a2f2a 0d0a436f 6e6e6563 74696f6e    */*..Connection
0x00000030 (00048)   3a20636c 6f73650d 0a486f73 743a2062   : close..Host: b
0x00000040 (00064)   65747465 72737475 64656e74 2e6e6574   etterstudent.net
0x00000050 (00080)   0d0a0d0a 0d0a6373 692e636f 6d0d0a0d   ......csi.com...
0x00000060 (00096)   0a                                    .


Strings