Analysis Date2015-11-13 07:23:42
MD5292d703eedcb79b48f7d41c79819869f
SHA1e4379079ff687a3eed2396846f2907c251a6fde1

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 287c928be7580f88b9d3d30a5598ceb6 sha1: 9aae9bad6f4b9a9720baf581fd1d7398f15b56e3 size: 802304
Section.rdata md5: 98b7cf0e8f8f4e2f8c42d2da121917be sha1: 41b7db2e660972e634ceb130cabcb422d9c59430 size: 60416
Section.data md5: 41594f60ed481a014d820a70adb4c865 sha1: eef14c57f96b8e37208626548db9b06f626f0838 size: 392704
Timestamp2014-11-28 22:59:23
PackerMicrosoft Visual C++ ?.?
PEhash041cf376969cf78e1893f7e3cf03d0835ba9f90d
IMPhashec78a8bad0af738b32339c20f3423a27
AVRisingno_virus
AVMcafeeno_virus
AVAvira (antivir)BDS/Zegost.Gen
AVTwisterno_virus
AVAd-AwareGen:Variant.Symmi.22722
AVAlwil (avast)Kryptik-OOC [Trj]
AVEset (nod32)Win32/Kryptik.CCLE
AVGrisoft (avg)Win32/Cryptor
AVSymantecDownloader.Upatre!g15
AVFortinetW32/Kryptik.CCLE!tr
AVBitDefenderGen:Variant.Symmi.22722
AVK7Trojan ( 004cd0081 )
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.BW
AVMicroWorld (escan)Gen:Variant.Symmi.22722
AVMalwareBytesno_virus
AVAuthentiumW32/Nivdort.A.gen!Eldorado
AVFrisk (f-prot)no_virus
AVIkarusWin32.Cryptor
AVEmsisoftGen:Variant.Symmi.22722
AVZillya!no_virus
AVKasperskyTrojan.Win32.Generic
AVTrend MicroTROJ_WONTON.SMJ1
AVCAT (quickheal)no_virus
AVVirusBlokAda (vba32)no_virus
AVPadvishno_virus
AVBullGuardGen:Variant.Symmi.22722
AVArcabit (arcavir)Gen:Variant.Symmi.22722
AVClamAVno_virus
AVDr. Webno_virus
AVF-SecureGen:Variant.Symmi.22722
AVCA (E-Trust Ino)no_virus
AVRisingno_virus
AVMcafeeno_virus
AVAvira (antivir)BDS/Zegost.Gen
AVTwisterno_virus
AVAd-AwareGen:Variant.Symmi.22722
AVAlwil (avast)Kryptik-OOC [Trj]
AVEset (nod32)Win32/Kryptik.CCLE
AVGrisoft (avg)Win32/Cryptor
AVSymantecDownloader.Upatre!g15
AVFortinetW32/Kryptik.CCLE!tr
AVBitDefenderGen:Variant.Symmi.22722
AVK7Trojan ( 004cd0081 )
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.BW
AVMicroWorld (escan)Gen:Variant.Symmi.22722
AVMalwareBytesno_virus
AVAuthentiumW32/Nivdort.A.gen!Eldorado
AVFrisk (f-prot)no_virus
AVIkarusWin32.Cryptor

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\WINDOWS\system32\ipnmdnyufulymik\tst
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\e6jhokja1mairvgejkuz32.exe
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\e6jhokja1mairvgejkuz32.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\e6jhokja1mairvgejkuz32.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Smart Awareness Microsoft Networking Sharing ➝
C:\WINDOWS\system32\aihkfgghvbi.exe
Creates FileC:\WINDOWS\system32\ipnmdnyufulymik\tst
Creates FileC:\WINDOWS\system32\drivers\etc\hosts
Creates FileC:\WINDOWS\system32\aihkfgghvbi.exe
Creates FileC:\WINDOWS\system32\ipnmdnyufulymik\lck
Creates FileC:\WINDOWS\system32\ipnmdnyufulymik\etc
Deletes FileC:\WINDOWS\system32\\drivers\etc\hosts
Creates ProcessC:\WINDOWS\system32\aihkfgghvbi.exe
Creates ServiceExtender Presentation Procedure Connection - C:\WINDOWS\system32\aihkfgghvbi.exe

Process
↳ Pid 804

Process
↳ Pid 852

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates Filepipe\PCHFaultRepExecPipe

Process
↳ Pid 1112

Process
↳ Pid 1208

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00
Creates FileWMIDataDevice

Process
↳ Pid 1132

Process
↳ C:\WINDOWS\system32\aihkfgghvbi.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝
1
Creates FileC:\WINDOWS\TEMP\e6jhokja1so4rv.exe
Creates FileC:\WINDOWS\system32\oxljesmacou.exe
Creates FileC:\WINDOWS\system32\ipnmdnyufulymik\lck
Creates FileC:\WINDOWS\system32\ipnmdnyufulymik\tst
Creates FileC:\WINDOWS\system32\ipnmdnyufulymik\rng
Creates FileC:\WINDOWS\system32\ipnmdnyufulymik\run
Creates Filepipe\net\NtControlPipe10
Creates FileC:\WINDOWS\system32\ipnmdnyufulymik\cfg
Creates File\Device\Afd\Endpoint
Creates ProcessC:\WINDOWS\TEMP\e6jhokja1so4rv.exe -r 26522 tcp
Creates ProcessWATCHDOGPROC "c:\windows\system32\aihkfgghvbi.exe"

Process
↳ C:\WINDOWS\system32\aihkfgghvbi.exe

Creates FileC:\WINDOWS\system32\ipnmdnyufulymik\tst

Process
↳ WATCHDOGPROC "c:\windows\system32\aihkfgghvbi.exe"

Creates FileC:\WINDOWS\system32\ipnmdnyufulymik\tst

Process
↳ C:\WINDOWS\TEMP\e6jhokja1so4rv.exe -r 26522 tcp

Creates File\Device\Afd\Endpoint
Winsock DNS239.255.255.250

Network Details:

DNSsaltsecond.net
Type: A
74.220.199.6
DNSmelbourneit.hotkeysparking.com
Type: A
8.5.1.16
DNSableread.net
Type: A
208.91.197.241
DNSmelbourneit.hotkeysparking.com
Type: A
8.5.1.16
DNSmelbourneit.hotkeysparking.com
Type: A
8.5.1.16
DNSmelbourneit.hotkeysparking.com
Type: A
8.5.1.16
DNSmelbourneit.hotkeysparking.com
Type: A
8.5.1.16
DNSmelbourneit.hotkeysparking.com
Type: A
8.5.1.16
DNSmelbourneit.hotkeysparking.com
Type: A
8.5.1.16
DNSmelbourneit.hotkeysparking.com
Type: A
8.5.1.16
DNSmelbourneit.hotkeysparking.com
Type: A
8.5.1.16
DNSdrinkwide.net
Type: A
208.91.197.241
DNSpickmake.net
Type: A
208.91.197.241
DNSfeltroad.net
Type: A
208.100.26.234
DNSlookmail.net
Type: A
162.216.4.203
DNSlookmail.net
Type: A
68.233.226.231
DNSthreemail.net
Type: A
212.48.115.82
DNSablelift.net
Type: A
205.178.189.129
DNSablehand.net
Type: A
184.168.221.28
DNSsignsound.net
Type: A
210.188.201.9
DNSmovesound.net
Type: A
81.169.171.142
DNShillgreen.net
Type: A
176.227.198.3
DNShillsound.net
Type: A
65.39.205.57
DNSlooksound.net
Type: A
88.198.46.88
DNSthreegreen.net
Type: A
185.26.230.129
DNSsouthblood.net
Type: A
DNSpickgrave.net
Type: A
DNSroomstock.net
Type: A
DNSwatcheasy.net
Type: A
DNSuponmail.net
Type: A
DNStakenhand.net
Type: A
DNSwatchsince.net
Type: A
DNSspotdont.net
Type: A
DNSofferaunt.net
Type: A
DNSmadethan.net
Type: A
DNSwhomfifth.net
Type: A
DNShillwore.net
Type: A
DNSwhomwore.net
Type: A
DNShillwhere.net
Type: A
DNSwhomwhere.net
Type: A
DNSlookroad.net
Type: A
DNSfeltmail.net
Type: A
DNSfeltwore.net
Type: A
DNSlookwore.net
Type: A
DNSfeltwhere.net
Type: A
DNSlookwhere.net
Type: A
DNSthreeroad.net
Type: A
DNSlordroad.net
Type: A
DNSlordmail.net
Type: A
DNSthreewore.net
Type: A
DNSlordwore.net
Type: A
DNSthreewhere.net
Type: A
DNSlordwhere.net
Type: A
DNSdrinkroad.net
Type: A
DNSwiferoad.net
Type: A
DNSdrinkmail.net
Type: A
DNSwifemail.net
Type: A
DNSdrinkwore.net
Type: A
DNSwifewore.net
Type: A
DNSdrinkwhere.net
Type: A
DNSwifewhere.net
Type: A
DNSknowlift.net
Type: A
DNSknowgreen.net
Type: A
DNSablegreen.net
Type: A
DNSknowsound.net
Type: A
DNSablesound.net
Type: A
DNSknowhand.net
Type: A
DNSpicklift.net
Type: A
DNSsonglift.net
Type: A
DNSpickgreen.net
Type: A
DNSsonggreen.net
Type: A
DNSpicksound.net
Type: A
DNSsongsound.net
Type: A
DNSpickhand.net
Type: A
DNSsonghand.net
Type: A
DNSroomlift.net
Type: A
DNSsignlift.net
Type: A
DNSroomgreen.net
Type: A
DNSsigngreen.net
Type: A
DNSroomsound.net
Type: A
DNSroomhand.net
Type: A
DNSsignhand.net
Type: A
DNSmovelift.net
Type: A
DNSjumplift.net
Type: A
DNSmovegreen.net
Type: A
DNSjumpgreen.net
Type: A
DNSjumpsound.net
Type: A
DNSmovehand.net
Type: A
DNSjumphand.net
Type: A
DNShilllift.net
Type: A
DNSwhomlift.net
Type: A
DNSwhomgreen.net
Type: A
DNSwhomsound.net
Type: A
DNShillhand.net
Type: A
DNSwhomhand.net
Type: A
DNSfeltlift.net
Type: A
DNSlooklift.net
Type: A
DNSfeltgreen.net
Type: A
DNSlookgreen.net
Type: A
DNSfeltsound.net
Type: A
DNSfelthand.net
Type: A
DNSlookhand.net
Type: A
DNSthreelift.net
Type: A
DNSlordlift.net
Type: A
DNSlordgreen.net
Type: A
DNSthreesound.net
Type: A
DNSlordsound.net
Type: A
DNSthreehand.net
Type: A
DNSlordhand.net
Type: A
DNSdrinklift.net
Type: A
HTTP GEThttp://saltsecond.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://pickgrave.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://ableread.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://roomstock.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://watcheasy.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://uponmail.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://takenhand.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://watchsince.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://spotdont.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://offeraunt.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://madethan.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://drinkwide.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://pickmake.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://feltroad.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://lookmail.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://threemail.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://ablelift.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://ablehand.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://signsound.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://movesound.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://hillgreen.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://hillsound.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://looksound.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://threegreen.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://saltsecond.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://pickgrave.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://ableread.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://roomstock.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://watcheasy.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://uponmail.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://takenhand.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://watchsince.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://spotdont.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://offeraunt.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://madethan.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://drinkwide.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://pickmake.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://feltroad.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://lookmail.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://threemail.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://ablelift.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://ablehand.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://signsound.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://movesound.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://hillgreen.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://hillsound.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://looksound.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
HTTP GEThttp://threegreen.net/index.php?method=validate&mode=sox&v=034&sox=48db1e00&lenhdr
User-Agent:
Flows TCP192.168.1.1:1036 ➝ 74.220.199.6:80
Flows TCP192.168.1.1:1037 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1038 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1039 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1040 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1041 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1042 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1043 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1044 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1045 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1046 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1047 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1048 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1050 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1051 ➝ 162.216.4.203:80
Flows TCP192.168.1.1:1052 ➝ 212.48.115.82:80
Flows TCP192.168.1.1:1053 ➝ 205.178.189.129:80
Flows TCP192.168.1.1:1054 ➝ 184.168.221.28:80
Flows TCP192.168.1.1:1055 ➝ 210.188.201.9:80
Flows TCP192.168.1.1:1056 ➝ 81.169.171.142:80
Flows TCP192.168.1.1:1057 ➝ 176.227.198.3:80
Flows TCP192.168.1.1:1058 ➝ 65.39.205.57:80
Flows TCP192.168.1.1:1059 ➝ 88.198.46.88:80
Flows TCP192.168.1.1:1060 ➝ 185.26.230.129:80
Flows TCP192.168.1.1:1061 ➝ 74.220.199.6:80
Flows TCP192.168.1.1:1062 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1063 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1064 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1065 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1066 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1067 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1068 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1069 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1070 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1071 ➝ 8.5.1.16:80
Flows TCP192.168.1.1:1072 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1073 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1074 ➝ 208.100.26.234:80
Flows TCP192.168.1.1:1075 ➝ 162.216.4.203:80
Flows TCP192.168.1.1:1076 ➝ 212.48.115.82:80
Flows TCP192.168.1.1:1077 ➝ 205.178.189.129:80
Flows TCP192.168.1.1:1078 ➝ 184.168.221.28:80
Flows TCP192.168.1.1:1079 ➝ 210.188.201.9:80
Flows TCP192.168.1.1:1080 ➝ 81.169.171.142:80
Flows TCP192.168.1.1:1081 ➝ 176.227.198.3:80
Flows TCP192.168.1.1:1082 ➝ 65.39.205.57:80
Flows TCP192.168.1.1:1083 ➝ 88.198.46.88:80
Flows TCP192.168.1.1:1084 ➝ 185.26.230.129:80

Raw Pcap
0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207361 6c747365 636f6e64 2e6e6574   : saltsecond.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207069 636b6772 6176652e 6e65740d   : pickgrave.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206162 6c657265 61642e6e 65740d0a   : ableread.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20726f 6f6d7374 6f636b2e 6e65740d   : roomstock.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207761 74636865 6173792e 6e65740d   : watcheasy.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207570 6f6e6d61 696c2e6e 65740d0a   : uponmail.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207461 6b656e68 616e642e 6e65740d   : takenhand.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207761 74636873 696e6365 2e6e6574   : watchsince.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207370 6f74646f 6e742e6e 65740d0a   : spotdont.net..
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206f66 66657261 756e742e 6e65740d   : offeraunt.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d61 64657468 616e2e6e 65740d0a   : madethan.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 696e6b77 6964652e 6e65740d   : drinkwide.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207069 636b6d61 6b652e6e 65740d0a   : pickmake.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206665 6c74726f 61642e6e 65740d0a   : feltroad.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c6f 6f6b6d61 696c2e6e 65740d0a   : lookmail.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 7265656d 61696c2e 6e65740d   : threemail.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206162 6c656c69 66742e6e 65740d0a   : ablelift.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206162 6c656861 6e642e6e 65740d0a   : ablehand.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207369 676e736f 756e642e 6e65740d   : signsound.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d6f 7665736f 756e642e 6e65740d   : movesound.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206869 6c6c6772 65656e2e 6e65740d   : hillgreen.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206869 6c6c736f 756e642e 6e65740d   : hillsound.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c6f 6f6b736f 756e642e 6e65740d   : looksound.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 72656567 7265656e 2e6e6574   : threegreen.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207361 6c747365 636f6e64 2e6e6574   : saltsecond.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207069 636b6772 6176652e 6e65740d   : pickgrave.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206162 6c657265 61642e6e 65740d0a   : ableread.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20726f 6f6d7374 6f636b2e 6e65740d   : roomstock.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207761 74636865 6173792e 6e65740d   : watcheasy.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207570 6f6e6d61 696c2e6e 65740d0a   : uponmail.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207461 6b656e68 616e642e 6e65740d   : takenhand.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207761 74636873 696e6365 2e6e6574   : watchsince.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207370 6f74646f 6e742e6e 65740d0a   : spotdont.net..
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206f66 66657261 756e742e 6e65740d   : offeraunt.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d61 64657468 616e2e6e 65740d0a   : madethan.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 696e6b77 6964652e 6e65740d   : drinkwide.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207069 636b6d61 6b652e6e 65740d0a   : pickmake.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206665 6c74726f 61642e6e 65740d0a   : feltroad.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c6f 6f6b6d61 696c2e6e 65740d0a   : lookmail.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 7265656d 61696c2e 6e65740d   : threemail.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206162 6c656c69 66742e6e 65740d0a   : ablelift.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206162 6c656861 6e642e6e 65740d0a   : ablehand.net..
0x00000080 (00128)   0d0a0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207369 676e736f 756e642e 6e65740d   : signsound.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d6f 7665736f 756e642e 6e65740d   : movesound.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206869 6c6c6772 65656e2e 6e65740d   : hillgreen.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206869 6c6c736f 756e642e 6e65740d   : hillsound.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c6f 6f6b736f 756e642e 6e65740d   : looksound.net.
0x00000080 (00128)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3033 3426736f   ode=sox&v=034&so
0x00000030 (00048)   783d3438 64623165 3030266c 656e6864   x=48db1e00&lenhd
0x00000040 (00064)   72204854 54502f31 2e300d0a 41636365   r HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 72656567 7265656e 2e6e6574   : threegreen.net
0x00000080 (00128)   0d0a0d0a                              ....


Strings