Analysis Date2013-12-14 18:42:54
MD58965299ab7f5e1670b442fa380baed3d
SHA1f987928d425338a42ad28c70450f88907760b97d

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Sectioncode md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Sectiontext md5: 5c339b8205748cda6c6b02fc7b637c9c sha1: 52a6899a1f7ae2d214589197fbdea2c4da93bcbe size: 68608
Sectionrsrc md5: 2d3dc4579d55eb338f1bb9e661c0a0db sha1: 3125043d0bd889de80fc89c0ef45976aeb32f500 size: 512
Timestamp2001-05-30 20:36:28
PackerASPack v1.06b
PEhash0ab568d7563ac57ee0c189fda396234383d188f9
AVmsseWorm:Win32/Leave.B
AVavgI-Worm/Leave
AVaviraWORM/Leave.B
AVclamavWorm.Leave.B
AVmcafeeW32/Leave.worm.gen

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CLASSES_ROOT\Scandisk\i386\s\au1 ➝
4~Uw\\xc4\\xc7k\\xc7\\xfbu(\\xa4***n\\x96-D\\xb5\\x1d+***v\\x1c#}4\\xd8***u\\xe9\\x9e\\xbe\\xc6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00
RegistryHKEY_CLASSES_ROOT\Scandisk\i386\i\vr ➝
DDDAAASDAD51\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\regsv ➝
C:\WINDOWS\regsv.exe\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00
Creates FileC:\WINDOWS\regsv.exe
Creates ProcessC:\WINDOWS\regsv.exe

Process
↳ C:\WINDOWS\regsv.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Mirabilis\ICQ\Agent\Apps\icqrun ➝
C:\WINDOWS\regsv.exe\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00
RegistryHKEY_CLASSES_ROOT\Scandisk\i386\i\vr ➝
DDDAAASDAD51\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\regsv ➝
C:\WINDOWS\regsv.exe\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Deletes FileC:\malware.exe
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!

Network Details:

DNSaltavista.com
Type: A
68.180.206.184
DNSaltavista.com
Type: A
98.139.102.145
DNSl33t.5u.com
Type: A
64.136.20.44
DNSl33t.5u.com
Type: A
64.136.20.35
DNSTick.UH.EDU
Type: A
129.7.1.66
DNSh0h0h0.spites.com
Type: A
176.74.176.179
DNSlove50gb.50megs.com
Type: A
DNSh0h0h0.home.dk3.com
Type: A
DNSslinky.50megs.com
Type: A
DNSbababuhtml.50megs.com
Type: A
DNStonyjameshanks-sux.50megs.com
Type: A
DNSleavemealoneeeeeeeee.50megs.com
Type: A
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://h0h0h0.spites.com/jjhdfmc.html?77565
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://h0h0h0.spites.com/jjhdfmc.html?77565
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://h0h0h0.spites.com/jjhdfmc.html?77565
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://h0h0h0.spites.com/jjhdfmc.html?77565
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://h0h0h0.spites.com/jjhdfmc.html?77565
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://h0h0h0.spites.com/jjhdfmc.html?77565
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://h0h0h0.spites.com/jjhdfmc.html?77565
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://h0h0h0.spites.com/jjhdfmc.html?77565
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://h0h0h0.spites.com/jjhdfmc.html?77565
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
HTTP GEThttp://l33t.5u.com/kdlslm.html?9874
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
Flows TCP192.168.1.1:1031 ➝ 68.180.206.184:80
Flows TCP192.168.1.1:1033 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1034 ➝ 129.7.1.66:13
Flows TCP192.168.1.1:1035 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1037 ➝ 176.74.176.179:80
Flows TCP192.168.1.1:1041 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1044 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1045 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1047 ➝ 176.74.176.179:80
Flows TCP192.168.1.1:1051 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1054 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1055 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1057 ➝ 176.74.176.179:80
Flows TCP192.168.1.1:1061 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1064 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1065 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1067 ➝ 176.74.176.179:80
Flows TCP192.168.1.1:1071 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1074 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1075 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1077 ➝ 176.74.176.179:80
Flows TCP192.168.1.1:1081 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1084 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1085 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1087 ➝ 176.74.176.179:80
Flows TCP192.168.1.1:1091 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1094 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1095 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1097 ➝ 176.74.176.179:80
Flows TCP192.168.1.1:1101 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1104 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1105 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1107 ➝ 176.74.176.179:80
Flows TCP192.168.1.1:1111 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1114 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1115 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1117 ➝ 176.74.176.179:80
Flows TCP192.168.1.1:1121 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1124 ➝ 64.136.20.44:80
Flows TCP192.168.1.1:1125 ➝ 64.136.20.44:80

Raw Pcap
0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a       Keep-Alive....

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a0a20   Keep-Alive..... 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6a6a68 64666d63 2e68746d   GET /jjhdfmc.htm
0x00000010 (00016)   6c3f3737 35363520 48545450 2f312e31   l?77565 HTTP/1.1
0x00000020 (00032)   0d0a4163 63657074 3a20696d 6167652f   ..Accept: image/
0x00000030 (00048)   6769662c 20696d61 67652f78 2d786269   gif, image/x-xbi
0x00000040 (00064)   746d6170 2c20696d 6167652f 6a706567   tmap, image/jpeg
0x00000050 (00080)   2c20696d 6167652f 706a7065 672c202a   , image/pjpeg, *
0x00000060 (00096)   2f2a0d0a 52656665 7265723a 20687474   /*..Referer: htt
0x00000070 (00112)   703a2f2f 7a786376 626e6d2e 636f6d2f   p://zxcvbnm.com/
0x00000080 (00128)   6162632e 68746d6c 0d0a4163 63657074   abc.html..Accept
0x00000090 (00144)   2d4c616e 67756167 653a2065 6e2d6762   -Language: en-gb
0x000000a0 (00160)   0d0a4163 63657074 2d456e63 6f64696e   ..Accept-Encodin
0x000000b0 (00176)   673a2067 7a69702c 20646566 6c617465   g: gzip, deflate
0x000000c0 (00192)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000d0 (00208)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000e0 (00224)   7469626c 653b204d 53494520 352e3031   tible; MSIE 5.01
0x000000f0 (00240)   3b205769 6e646f77 73204e54 20352e30   ; Windows NT 5.0
0x00000100 (00256)   290d0a48 6f73743a 20683068 3068302e   )..Host: h0h0h0.
0x00000110 (00272)   73706974 65732e63 6f6d0d0a 436f6e6e   spites.com..Conn
0x00000120 (00288)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a0a20   Keep-Alive..... 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a0a20   Keep-Alive..... 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6a6a68 64666d63 2e68746d   GET /jjhdfmc.htm
0x00000010 (00016)   6c3f3737 35363520 48545450 2f312e31   l?77565 HTTP/1.1
0x00000020 (00032)   0d0a4163 63657074 3a20696d 6167652f   ..Accept: image/
0x00000030 (00048)   6769662c 20696d61 67652f78 2d786269   gif, image/x-xbi
0x00000040 (00064)   746d6170 2c20696d 6167652f 6a706567   tmap, image/jpeg
0x00000050 (00080)   2c20696d 6167652f 706a7065 672c202a   , image/pjpeg, *
0x00000060 (00096)   2f2a0d0a 52656665 7265723a 20687474   /*..Referer: htt
0x00000070 (00112)   703a2f2f 7a786376 626e6d2e 636f6d2f   p://zxcvbnm.com/
0x00000080 (00128)   6162632e 68746d6c 0d0a4163 63657074   abc.html..Accept
0x00000090 (00144)   2d4c616e 67756167 653a2065 6e2d6762   -Language: en-gb
0x000000a0 (00160)   0d0a4163 63657074 2d456e63 6f64696e   ..Accept-Encodin
0x000000b0 (00176)   673a2067 7a69702c 20646566 6c617465   g: gzip, deflate
0x000000c0 (00192)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000d0 (00208)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000e0 (00224)   7469626c 653b204d 53494520 352e3031   tible; MSIE 5.01
0x000000f0 (00240)   3b205769 6e646f77 73204e54 20352e30   ; Windows NT 5.0
0x00000100 (00256)   290d0a48 6f73743a 20683068 3068302e   )..Host: h0h0h0.
0x00000110 (00272)   73706974 65732e63 6f6d0d0a 436f6e6e   spites.com..Conn
0x00000120 (00288)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6a6a68 64666d63 2e68746d   GET /jjhdfmc.htm
0x00000010 (00016)   6c3f3737 35363520 48545450 2f312e31   l?77565 HTTP/1.1
0x00000020 (00032)   0d0a4163 63657074 3a20696d 6167652f   ..Accept: image/
0x00000030 (00048)   6769662c 20696d61 67652f78 2d786269   gif, image/x-xbi
0x00000040 (00064)   746d6170 2c20696d 6167652f 6a706567   tmap, image/jpeg
0x00000050 (00080)   2c20696d 6167652f 706a7065 672c202a   , image/pjpeg, *
0x00000060 (00096)   2f2a0d0a 52656665 7265723a 20687474   /*..Referer: htt
0x00000070 (00112)   703a2f2f 7a786376 626e6d2e 636f6d2f   p://zxcvbnm.com/
0x00000080 (00128)   6162632e 68746d6c 0d0a4163 63657074   abc.html..Accept
0x00000090 (00144)   2d4c616e 67756167 653a2065 6e2d6762   -Language: en-gb
0x000000a0 (00160)   0d0a4163 63657074 2d456e63 6f64696e   ..Accept-Encodin
0x000000b0 (00176)   673a2067 7a69702c 20646566 6c617465   g: gzip, deflate
0x000000c0 (00192)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000d0 (00208)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000e0 (00224)   7469626c 653b204d 53494520 352e3031   tible; MSIE 5.01
0x000000f0 (00240)   3b205769 6e646f77 73204e54 20352e30   ; Windows NT 5.0
0x00000100 (00256)   290d0a48 6f73743a 20683068 3068302e   )..Host: h0h0h0.
0x00000110 (00272)   73706974 65732e63 6f6d0d0a 436f6e6e   spites.com..Conn
0x00000120 (00288)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6a6a68 64666d63 2e68746d   GET /jjhdfmc.htm
0x00000010 (00016)   6c3f3737 35363520 48545450 2f312e31   l?77565 HTTP/1.1
0x00000020 (00032)   0d0a4163 63657074 3a20696d 6167652f   ..Accept: image/
0x00000030 (00048)   6769662c 20696d61 67652f78 2d786269   gif, image/x-xbi
0x00000040 (00064)   746d6170 2c20696d 6167652f 6a706567   tmap, image/jpeg
0x00000050 (00080)   2c20696d 6167652f 706a7065 672c202a   , image/pjpeg, *
0x00000060 (00096)   2f2a0d0a 52656665 7265723a 20687474   /*..Referer: htt
0x00000070 (00112)   703a2f2f 7a786376 626e6d2e 636f6d2f   p://zxcvbnm.com/
0x00000080 (00128)   6162632e 68746d6c 0d0a4163 63657074   abc.html..Accept
0x00000090 (00144)   2d4c616e 67756167 653a2065 6e2d6762   -Language: en-gb
0x000000a0 (00160)   0d0a4163 63657074 2d456e63 6f64696e   ..Accept-Encodin
0x000000b0 (00176)   673a2067 7a69702c 20646566 6c617465   g: gzip, deflate
0x000000c0 (00192)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000d0 (00208)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000e0 (00224)   7469626c 653b204d 53494520 352e3031   tible; MSIE 5.01
0x000000f0 (00240)   3b205769 6e646f77 73204e54 20352e30   ; Windows NT 5.0
0x00000100 (00256)   290d0a48 6f73743a 20683068 3068302e   )..Host: h0h0h0.
0x00000110 (00272)   73706974 65732e63 6f6d0d0a 436f6e6e   spites.com..Conn
0x00000120 (00288)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6a6a68 64666d63 2e68746d   GET /jjhdfmc.htm
0x00000010 (00016)   6c3f3737 35363520 48545450 2f312e31   l?77565 HTTP/1.1
0x00000020 (00032)   0d0a4163 63657074 3a20696d 6167652f   ..Accept: image/
0x00000030 (00048)   6769662c 20696d61 67652f78 2d786269   gif, image/x-xbi
0x00000040 (00064)   746d6170 2c20696d 6167652f 6a706567   tmap, image/jpeg
0x00000050 (00080)   2c20696d 6167652f 706a7065 672c202a   , image/pjpeg, *
0x00000060 (00096)   2f2a0d0a 52656665 7265723a 20687474   /*..Referer: htt
0x00000070 (00112)   703a2f2f 7a786376 626e6d2e 636f6d2f   p://zxcvbnm.com/
0x00000080 (00128)   6162632e 68746d6c 0d0a4163 63657074   abc.html..Accept
0x00000090 (00144)   2d4c616e 67756167 653a2065 6e2d6762   -Language: en-gb
0x000000a0 (00160)   0d0a4163 63657074 2d456e63 6f64696e   ..Accept-Encodin
0x000000b0 (00176)   673a2067 7a69702c 20646566 6c617465   g: gzip, deflate
0x000000c0 (00192)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000d0 (00208)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000e0 (00224)   7469626c 653b204d 53494520 352e3031   tible; MSIE 5.01
0x000000f0 (00240)   3b205769 6e646f77 73204e54 20352e30   ; Windows NT 5.0
0x00000100 (00256)   290d0a48 6f73743a 20683068 3068302e   )..Host: h0h0h0.
0x00000110 (00272)   73706974 65732e63 6f6d0d0a 436f6e6e   spites.com..Conn
0x00000120 (00288)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6a6a68 64666d63 2e68746d   GET /jjhdfmc.htm
0x00000010 (00016)   6c3f3737 35363520 48545450 2f312e31   l?77565 HTTP/1.1
0x00000020 (00032)   0d0a4163 63657074 3a20696d 6167652f   ..Accept: image/
0x00000030 (00048)   6769662c 20696d61 67652f78 2d786269   gif, image/x-xbi
0x00000040 (00064)   746d6170 2c20696d 6167652f 6a706567   tmap, image/jpeg
0x00000050 (00080)   2c20696d 6167652f 706a7065 672c202a   , image/pjpeg, *
0x00000060 (00096)   2f2a0d0a 52656665 7265723a 20687474   /*..Referer: htt
0x00000070 (00112)   703a2f2f 7a786376 626e6d2e 636f6d2f   p://zxcvbnm.com/
0x00000080 (00128)   6162632e 68746d6c 0d0a4163 63657074   abc.html..Accept
0x00000090 (00144)   2d4c616e 67756167 653a2065 6e2d6762   -Language: en-gb
0x000000a0 (00160)   0d0a4163 63657074 2d456e63 6f64696e   ..Accept-Encodin
0x000000b0 (00176)   673a2067 7a69702c 20646566 6c617465   g: gzip, deflate
0x000000c0 (00192)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000d0 (00208)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000e0 (00224)   7469626c 653b204d 53494520 352e3031   tible; MSIE 5.01
0x000000f0 (00240)   3b205769 6e646f77 73204e54 20352e30   ; Windows NT 5.0
0x00000100 (00256)   290d0a48 6f73743a 20683068 3068302e   )..Host: h0h0h0.
0x00000110 (00272)   73706974 65732e63 6f6d0d0a 436f6e6e   spites.com..Conn
0x00000120 (00288)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6a6a68 64666d63 2e68746d   GET /jjhdfmc.htm
0x00000010 (00016)   6c3f3737 35363520 48545450 2f312e31   l?77565 HTTP/1.1
0x00000020 (00032)   0d0a4163 63657074 3a20696d 6167652f   ..Accept: image/
0x00000030 (00048)   6769662c 20696d61 67652f78 2d786269   gif, image/x-xbi
0x00000040 (00064)   746d6170 2c20696d 6167652f 6a706567   tmap, image/jpeg
0x00000050 (00080)   2c20696d 6167652f 706a7065 672c202a   , image/pjpeg, *
0x00000060 (00096)   2f2a0d0a 52656665 7265723a 20687474   /*..Referer: htt
0x00000070 (00112)   703a2f2f 7a786376 626e6d2e 636f6d2f   p://zxcvbnm.com/
0x00000080 (00128)   6162632e 68746d6c 0d0a4163 63657074   abc.html..Accept
0x00000090 (00144)   2d4c616e 67756167 653a2065 6e2d6762   -Language: en-gb
0x000000a0 (00160)   0d0a4163 63657074 2d456e63 6f64696e   ..Accept-Encodin
0x000000b0 (00176)   673a2067 7a69702c 20646566 6c617465   g: gzip, deflate
0x000000c0 (00192)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000d0 (00208)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000e0 (00224)   7469626c 653b204d 53494520 352e3031   tible; MSIE 5.01
0x000000f0 (00240)   3b205769 6e646f77 73204e54 20352e30   ; Windows NT 5.0
0x00000100 (00256)   290d0a48 6f73743a 20683068 3068302e   )..Host: h0h0h0.
0x00000110 (00272)   73706974 65732e63 6f6d0d0a 436f6e6e   spites.com..Conn
0x00000120 (00288)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6a6a68 64666d63 2e68746d   GET /jjhdfmc.htm
0x00000010 (00016)   6c3f3737 35363520 48545450 2f312e31   l?77565 HTTP/1.1
0x00000020 (00032)   0d0a4163 63657074 3a20696d 6167652f   ..Accept: image/
0x00000030 (00048)   6769662c 20696d61 67652f78 2d786269   gif, image/x-xbi
0x00000040 (00064)   746d6170 2c20696d 6167652f 6a706567   tmap, image/jpeg
0x00000050 (00080)   2c20696d 6167652f 706a7065 672c202a   , image/pjpeg, *
0x00000060 (00096)   2f2a0d0a 52656665 7265723a 20687474   /*..Referer: htt
0x00000070 (00112)   703a2f2f 7a786376 626e6d2e 636f6d2f   p://zxcvbnm.com/
0x00000080 (00128)   6162632e 68746d6c 0d0a4163 63657074   abc.html..Accept
0x00000090 (00144)   2d4c616e 67756167 653a2065 6e2d6762   -Language: en-gb
0x000000a0 (00160)   0d0a4163 63657074 2d456e63 6f64696e   ..Accept-Encodin
0x000000b0 (00176)   673a2067 7a69702c 20646566 6c617465   g: gzip, deflate
0x000000c0 (00192)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000d0 (00208)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000e0 (00224)   7469626c 653b204d 53494520 352e3031   tible; MSIE 5.01
0x000000f0 (00240)   3b205769 6e646f77 73204e54 20352e30   ; Windows NT 5.0
0x00000100 (00256)   290d0a48 6f73743a 20683068 3068302e   )..Host: h0h0h0.
0x00000110 (00272)   73706974 65732e63 6f6d0d0a 436f6e6e   spites.com..Conn
0x00000120 (00288)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6a6a68 64666d63 2e68746d   GET /jjhdfmc.htm
0x00000010 (00016)   6c3f3737 35363520 48545450 2f312e31   l?77565 HTTP/1.1
0x00000020 (00032)   0d0a4163 63657074 3a20696d 6167652f   ..Accept: image/
0x00000030 (00048)   6769662c 20696d61 67652f78 2d786269   gif, image/x-xbi
0x00000040 (00064)   746d6170 2c20696d 6167652f 6a706567   tmap, image/jpeg
0x00000050 (00080)   2c20696d 6167652f 706a7065 672c202a   , image/pjpeg, *
0x00000060 (00096)   2f2a0d0a 52656665 7265723a 20687474   /*..Referer: htt
0x00000070 (00112)   703a2f2f 7a786376 626e6d2e 636f6d2f   p://zxcvbnm.com/
0x00000080 (00128)   6162632e 68746d6c 0d0a4163 63657074   abc.html..Accept
0x00000090 (00144)   2d4c616e 67756167 653a2065 6e2d6762   -Language: en-gb
0x000000a0 (00160)   0d0a4163 63657074 2d456e63 6f64696e   ..Accept-Encodin
0x000000b0 (00176)   673a2067 7a69702c 20646566 6c617465   g: gzip, deflate
0x000000c0 (00192)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000d0 (00208)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000e0 (00224)   7469626c 653b204d 53494520 352e3031   tible; MSIE 5.01
0x000000f0 (00240)   3b205769 6e646f77 73204e54 20352e30   ; Windows NT 5.0
0x00000100 (00256)   290d0a48 6f73743a 20683068 3068302e   )..Host: h0h0h0.
0x00000110 (00272)   73706974 65732e63 6f6d0d0a 436f6e6e   spites.com..Conn
0x00000120 (00288)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f6b646c 736c6d2e 68746d6c   GET /kdlslm.html
0x00000010 (00016)   3f393837 34204854 54502f31 2e310d0a   ?9874 HTTP/1.1..
0x00000020 (00032)   41636365 70743a20 696d6167 652f6769   Accept: image/gi
0x00000030 (00048)   662c2069 6d616765 2f782d78 6269746d   f, image/x-xbitm
0x00000040 (00064)   61702c20 696d6167 652f6a70 65672c20   ap, image/jpeg, 
0x00000050 (00080)   696d6167 652f706a 7065672c 202a2f2a   image/pjpeg, */*
0x00000060 (00096)   0d0a5265 66657265 723a2068 7474703a   ..Referer: http:
0x00000070 (00112)   2f2f7a78 6376626e 6d2e636f 6d2f6162   //zxcvbnm.com/ab
0x00000080 (00128)   632e6874 6d6c0d0a 41636365 70742d4c   c.html..Accept-L
0x00000090 (00144)   616e6775 6167653a 20656e2d 67620d0a   anguage: en-gb..
0x000000a0 (00160)   41636365 70742d45 6e636f64 696e673a   Accept-Encoding:
0x000000b0 (00176)   20677a69 702c2064 65666c61 74650d0a    gzip, deflate..
0x000000c0 (00192)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000000d0 (00208)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000000e0 (00224)   626c653b 204d5349 4520352e 30313b20   ble; MSIE 5.01; 
0x000000f0 (00240)   57696e64 6f777320 4e542035 2e30290d   Windows NT 5.0).
0x00000100 (00256)   0a486f73 743a206c 3333742e 35752e63   .Host: l33t.5u.c
0x00000110 (00272)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000120 (00288)   4b656570 2d416c69 76650d0a 0d0a6c69   Keep-Alive....li
0x00000130 (00304)   76650d0a 0d0a4e6f 20737563 68206669   ve....No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.


Strings
(0dB&d8@D
 0sfel
"&1]Bw	
1IQPV;
1#QNAN
{2-+B!
2!'BN|q
2]Rk`wL
2u(Z!Y,""q}
2yBbF	9$
3`FXX0
3LQVTRS
?;3#od
'{@)4~/
445<vH
4!j(3.^<0
4LT\dw
<(4LU@
4MBP^n|(
4P8TpP
!',+4+Z5+
5M432'
5qCOPD-_
5,`/tU
6\ICQ\Ag
6S[upI
 \6tsxw`
=;7/'#
(7D/L oM
7MY,49!
7S%dOfz
[7]u0_
_*7\/X
7y`\ }Cr
!(! "8!9
<8a0$<
_.+8argu
<}=}8}&d
8h<f<?
8jjhdf
95/98/
976553Kt3[x
987gph{qp
#](9A$s
9GAIsProcessorFeature
9lJtJuJ
9(_"L$,UR
!9$m<m<C
!9m<m<m<
9*msN]f=6/6
!9v	fy
	9$V(V,V
ad!ck/
ADVAPI32.dll
a.fr{V0.mc
ageBoxk\ZZ
anli# 
A]NTNXNy
a"'s'Rn
AtivKJ
.?AViu@
AY4Wjt
: b1elete+/
b5UElS
B8 Pk}
"Ba>gD
B^bFKJ4
%b,C45f
B^eqNu
B``[h,VY
BNyB9(!'
Bpk#e7
BWw!j	w
C2$/1987$C2$652$C2432
',c,d=
c-$m4t#i
Cm<m<9$
$Cr$00r$Cr44@Cr$C@DD$Cr$HH
cr4x8w6v
C*rh`K
	CrLL.
+CW8T8
d00XdT
D144381367827151
D@222H
d4.3^`<
d5e6f9r2
.}d9l"
{d9YN$q
&DA~D*4
d-Cookie:S9
dddd|xtpddddlhd`dddd\XTP
deEToMe
d@hld@
&d JPv
.dKPBF
d#LyPy
DPLAYj
DR,ER@%
dulG S`
dul=NT
!DV#08
{dW|oP
d[\Xt$
e1v8s6v3
E5jE`2
e^&)^8..^%}{"/
<e#`#Ly
&EM(R*,
ent KERNEL329.com
ERROR_PATH_NOT_FO
eRUN SUCCESS
esc+8F
. etar
etq{g[
ExitProcess
-EZd`HgGp
f9{6a'tV5H
F%	"/B
 F%eOu
>@~FILEBAD
fj d_v
FJ;Xzj0
&f>&$QP
 fwlowi8r
g3SokPdT
Gablto iniRaliz
.gD#us.B
g;EthH#C
GetLabA2g
GetProcAddress
Gl)PA0?]2T2
h850 E
-Hd0H#Ld
:h	J$m
[hpD]0f
'HR"9$
H %@s,\
HTQ6B(
 HTTP/1.1GET /
H=X%;z
I4dpX(
IB(ENF
%I+.H eI+
Ih&*Q)
_ik:Wm
IMNY+Mku
InternetGetConnectedState
j?7\[<
Jd9Y8`
JF;sBE
J-h	VI
[Jm6/09
JNa	a	w
JP^\R+
j	q$ItO
K47w7duE
kc_9Uu(
KERNEL32.DLL
KO7KRG3
KvSCKQ
&?kWP*QL
l2e/#khg
L2I048<M6
!L'M'H
LmX|(I
LoadLibraryA
l`oa^_m
)Ltu^9
m/9p`|;
M9VeKUr
m]BjTTz
MBsO;p In2*
mc&C-R)
mdu)y 
|meqy!/
[MIG.+
<m<m<!9$
m<m<m<
m<m<m<$
m<m<ma
m<m<m<J
m+?|/ t
m!u.h|
MYHOSN 
M/z&:a
N1BkDEFRA/"n,l
{ndrMv6z
nm50hgs
NT^$v	tv
Nu7y }B^
nWF?M:
O05{Slm
oBwiL(
OEMCP	
oEUFU_WPh
offn1{Q
O]j6W]k
OlyPcln+
`omm$Ly&E
/opeX1
O'"?PSQ
oryrU~n;
&(O!~#t1
otdndL
o v$S'
|P".`!
p/!00Q
p7'7not=
P:ACHRHW
p_?ch,J
PDQxm+
p@gram 
PI^duV"
pps/cqru
PRIVMSG h	
@psVl*
PuZ\uT
Pwh@AW
PWINNT/2
Q86iH#
^qfl[d
,Qg09y
QVkhK!6,
qX3/s]_y
qyjzsh
[r6{Q%W
R$a }+
rd5U4G%
RegCloseKey
+REG_SZ
_+Rich
R	irB?
`@rKYu
&rmK`WxeU)
ru2ime erNr 
ru.dZgi>
!|(s_02f
!.S^2V@)
s;8UyRRV
S aC0UM$
	SmPoiP
sO;>|C;
SpySlC:
suc<ful
t9UW9,
TEmt*jz
th:5f.G'p
!This program cannot be run in DOS mode.
T|*S]VT
tt;@pdv
TUH.EDU
tuuxuo0ui9
+TvS[U
t\w2$[" ``G2$G
tx^|ma
'TyU_;
TyUyPy
tzO!OH
U $302 M
ugh spa
|u?lu9
uY$s7{:
[u}(z"y
V03E0+3
_\vA{0
 vB%R$n
VC20XC
vch k() e.
 vir"!3
vL=TTj
w,+0+ 
W404/w
WAB.t;+
,]wafZ[4
!@WCr	c
WExlG&m
wgR?-:S(GB
w;http://
WININET.dll
w{l'&p=1#
w~nbd0
Wom%=?pi
WrC27^
WSKGC7yC}
WSOCK32.dll
?wupdmW
XCphX 
xD4E-z
XM,Q+L
x$nt*bn6
["XO	0D
X@=QS_@R
xtl`XP
$@XVQq
}y0tRC
y7y }^
Y95 e~
ya&`nw
$ya/S,x
y!C%,)
Y*CPN$'
^\YGy(
YN /	\Bh
Y/Q3NF`
Y.S]\Qr
Yx0pQK2xy
	yX0xnLB
+Z1g|9
Z'';4l
)ZA,'\X
ZG&loseH
zgTowg
zi]a/4J (
#ZOGh>v
Z'(%s3
zxcvbnmcB-""