myNetWatchman KnowledgeBase
Pooling knowledge to
secure the internet.
|
 |
Messenger Spammers now fragging
Created: 2004-03-22 Lawrence Baldwin
myNetWatchman.com
Over the last few weeks I've been noticing some changes in
udp/1026 and udp/1027 activity (usually attributable to hosts
transmitting Windows Messenger Spam. To get a better idea
I setup Ethereal to capture all activity on these ports...it
didn't take more than a few hours to capture some Messenger
Spam that has some new attributes:
Packet Summary:
No. Time RelTime Source SrcPort Destination DstPort Protocol Size Info
1 0.000000 0.000000 24.164.41.216 22979 24.131.63.4 1026 Messenger 1514 NetrSendMessage request[Malformed Packet]
2 116.234360 116.234360 24.131.63.4 24.164.41.216 ICMP 70 Time-to-live exceeded (fragment reassembly timeout)
3 3999.504629 4115.738989 24.164.38.236 14070 24.131.63.4 1026 Messenger 1514 NetrSendMessage request[Malformed Packet]
4 0.000250 4115.739239 24.164.38.236 24.131.63.4 IP 311 Fragmented IP protocol (proto=UDP 0x11, off=1480)
5 0.000047 4115.739286 24.131.63.4 24.164.38.236 ICMP 70 Destination unreachable
Previously, Messenger spammers typically composed and sent
relatively small messages (200 - 800 bytes). Now some are
sending ones in excess of 1500 bytes. As this exceeds the
typical maximum packet size, a side effect is that these messages
are now being sprayed as IP fragments all over the Internet.
Also, because these messages use an unreliable transport (UDP)
over presumably congested links they often result in 'fragment
reassembly timeout' errors on the targetted systems as fragments
often don't make it to their intended destination.
Frame 1 above is an example of such a message. Note that
the second part of this fragmented message was supposed to
follow, but got dropped somewhere along the way, then in Frame
2 (after a 116 second timeout) is a reassembly error send
by the target back to the sending host.
Frames 3-4 demonstrates a successful attempt at delivering
a fragmented Messenger spam to the same host. In Frame 5 the
target host generates an ICMP Destination (port unreachable)
error back to the source IP as the Messenger service is disabled
on this host.
My previous research has indicates thats a significant percentage
of Messenger spam is transmitted using a forged source IP,
The unfortunate owners of these IPs will likely notice a significant
volume of inbound ICMP error packets (both fragment reassembly
and port unreachables) as a result of this activity. End-users
whose systems do not handle fragment timeout errors well could
also be negatively impacted (I'm not aware of any specific
main stream operating systems with this problem).
Packet Details
Frame 1 (1514 bytes on wire, 1514 bytes captured)
Arrival Time: Mar 22, 2004 15:19:44.395238000
Time delta from previous packet: 0.000000000 seconds
Time since reference or first frame: 0.000000000 seconds
Frame Number: 1
Packet Length: 1514 bytes
Capture Length: 1514 bytes
Ethernet II, Src: 00:0b:bf:52:30:8c, Dst: 00:d0:59:0c:bb:50
Destination: 00:d0:59:0c:bb:50 (AmbitMic_0c:bb:50)
Source: 00:0b:bf:52:30:8c (Cisco_52:30:8c)
Type: IP (0x0800)
Internet Protocol, Src Addr: 24.164.41.216 (24.164.41.216), Dst Addr: 24.131.63.4 (24.131.63.4)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1500
Identification: 0x75ef (30191)
Flags: 0x02
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..1. = More fragments: Set
Fragment offset: 0
Time to live: 116
Protocol: UDP (0x11)
Header checksum: 0x111f (correct)
Source: 24.164.41.216 (24.164.41.216)
Destination: 24.131.63.4 (24.131.63.4)
User Datagram Protocol, Src Port: 22979 (22979), Dst Port: 1026 (1026)
Source port: 22979 (22979)
Destination port: 1026 (1026)
Length: 1757
Checksum: 0x0000 (none)
DCE RPC
Version: 4
Packet type: Request (0)
Flags1: 0x28
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..1. .... = Idempotent: Set
...0 .... = Maybe: Not set
.... 1... = No Fack: Set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc
Activity: db3a7835-aa90-dd43-76f7-996c419f98b2
Server boot time: 0x00000000
Interface Ver: 1
Sequence num: 0
Opnum: 0
Interface Hint: 0xffff
Activity Hint: 0xffff
Fragment len: 1669
Fragment num: 0
Auth proto: None (0)
Serial Low: 0x00
Microsoft Messenger Service
Operation: NetrSendMessage (0)
Server
Max Count: 16
Offset: 0
Actual Count: 16
Server: PHARMACOURT.COM
Client
Max Count: 16
Offset: 0
Actual Count: 16
Client: AOL MEMBERS
Message
Max Count: 1601
Offset: 0
Actual Count: 1601
[Malformed Packet: Messenger]
0000 00 d0 59 0c bb 50 00 0b bf 52 30 8c 08 00 45 00 ..Y..P...R0...E.
0010 05 dc 75 ef 20 00 74 11 11 1f 18 a4 29 d8 18 83 ..u. .t.....)...
0020 3f 04 59 c3 04 02 06 dd 00 00 04 00 28 00 10 00 ?.Y.........(...
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 f8 91 7b 5a 00 ff d0 11 a9 b2 00 c0 4f b6 ....{Z........O.
0050 e6 fc 35 78 3a db 90 aa 43 dd 76 f7 99 6c 41 9f ..5x:...C.v..lA.
0060 98 b2 00 00 00 00 01 00 00 00 00 00 00 00 00 00 ................
0070 ff ff ff ff 85 06 00 00 00 00 10 00 00 00 00 00 ................
0080 00 00 10 00 00 00 50 48 41 52 4d 41 43 4f 55 52 ......PHARMACOUR
0090 54 2e 43 4f 4d 00 10 00 00 00 00 00 00 00 10 00 T.COM...........
00a0 00 00 41 4f 4c 20 4d 45 4d 42 45 52 53 00 00 00 ..AOL MEMBERS...
00b0 00 00 41 06 00 00 00 00 00 00 41 06 00 00 20 20 ..A.......A...
00c0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
00d0 20 20 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d -------------
00e0 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d ----------------
00f0 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d ----------------
0100 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a 20 20 ------------..
0110 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
0120 20 20 20 20 50 48 41 52 4d 41 43 4f 55 52 54 2e PHARMACOURT.
0130 43 4f 4d 20 2d 20 2d 20 50 48 41 52 4d 41 43 4f COM - - PHARMACO
0140 55 52 54 2e 43 4f 4d 0d 0a 20 20 20 20 20 20 20 URT.COM..
0150 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2d 2d --
0160 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d ----------------
0170 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d ----------------
0180 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d ----------------
0190 2d 2d 2d 2d 2d 2d 2d 0d 0a 49 73 20 59 6f 75 72 -------..Is Your
01a0 20 4f 6e 65 20 53 74 6f 70 20 53 68 6f 70 20 46 One Stop Shop F
01b0 6f 72 20 4d 65 64 69 63 61 74 69 6f 6e 20 4e 65 or Medication Ne
01c0 65 64 73 20 4f 6e 6c 69 6e 65 21 0d 0a 0d 0a 57 eds Online!....W
01d0 65 20 47 75 61 72 61 6e 74 65 65 20 4c 6f 77 65 e Guarantee Lowe
01e0 73 74 20 50 72 69 63 65 20 41 6e 79 77 68 65 72 st Price Anywher
01f0 65 2e 20 4e 6f 20 50 72 65 73 63 72 69 70 74 69 e. No Prescripti
0200 6f 6e 20 52 65 71 75 69 72 65 64 2e 0d 0a 53 68 on Required...Sh
0210 6f 70 70 69 6e 67 20 57 69 74 68 20 55 73 20 54 opping With Us T
0220 6f 64 61 79 20 49 73 20 43 68 65 61 70 2c 20 43 oday Is Cheap, C
0230 6f 6e 76 65 6e 69 65 6e 74 2c 20 50 72 69 76 61 onvenient, Priva
0240 74 65 20 61 6e 64 20 43 6f 6e 66 69 64 65 6e 74 te and Confident
0250 69 61 6c 0d 0a 0d 0a 3e 3e 3e 3e 4d 41 52 43 48 ial....>>>>MARCH
0260 20 4d 41 44 4e 45 53 53 20 53 50 45 43 49 41 4c MADNESS SPECIAL
0270 53 3c 3c 3c 3c 0d 0a 0d 0a 56 69 63 6f 64 69 6e S<<<<....Vicodin
0280 20 31 30 6d 67 20 5b 33 30 70 69 6c 6c 73 20 20 10mg [30pills
0290 24 31 31 39 2e 39 39 5d 5b 36 30 70 69 6c 6c 73 $119.99][60pills
02a0 20 20 24 31 35 39 2e 39 39 5d 5b 31 30 6d 67 20 $159.99][10mg
02b0 39 30 70 69 6c 6c 73 20 20 24 31 39 39 2e 39 39 90pills $199.99
02c0 5d 0d 0a 56 69 63 6f 64 69 6e 20 37 2e 35 6d 67 ]..Vicodin 7.5mg
02d0 20 5b 39 30 70 69 6c 6c 73 20 20 24 31 38 39 2e [90pills $189.
02e0 39 39 5d 5b 36 30 70 69 6c 6c 73 20 20 24 31 37 99][60pills $17
02f0 39 2e 39 39 5d 5b 39 30 70 69 6c 6c 73 20 20 24 9.99][90pills $
0300 32 31 39 2e 39 39 5d 0d 0a 57 61 74 73 6f 6e 20 219.99]..Watson
0310 42 72 61 6e 64 20 2d 20 53 65 65 20 57 65 62 73 Brand - See Webs
0320 69 74 65 0d 0a 0d 0a 41 4e 58 49 45 54 59 0d 0a ite....ANXIETY..
0330 56 61 6c 69 75 6d 20 0d 0a 31 30 6d 67 20 5b 33 Valium ..10mg [3
0340 30 70 69 6c 6c 73 20 24 34 39 2e 39 39 5d 20 5b 0pills $49.99] [
0350 36 30 70 69 6c 6c 73 20 24 37 34 2e 39 39 5d 20 60pills $74.99]
0360 5b 39 30 70 69 6c 6c 73 20 24 31 30 34 2e 39 39 [90pills $104.99
0370 5d 20 5b 31 32 30 70 69 6c 6c 73 20 24 31 32 39 ] [120pills $129
0380 2e 39 39 5d 20 0d 0a 0d 0a 58 61 6e 61 78 20 20 .99] ....Xanax
0390 20 0d 0a 31 6d 67 20 20 5b 33 30 70 69 6c 6c 73 ..1mg [30pills
03a0 20 24 34 39 2e 39 39 5d 20 5b 36 30 70 69 6c 6c $49.99] [60pill
03b0 73 20 24 36 39 2e 39 39 20 20 5b 39 30 70 69 6c s $69.99 [90pil
03c0 6c 73 20 24 39 39 2e 39 39 5d 20 5b 31 32 30 70 ls $99.99] [120p
03d0 69 6c 6c 73 20 24 31 31 39 2e 39 39 5d 20 0d 0a ills $119.99] ..
03e0 0d 0a 41 74 69 76 61 6e 20 0d 0a 32 2e 35 6d 67 ..Ativan ..2.5mg
03f0 20 5b 35 30 70 69 6c 6c 73 20 24 31 32 39 2e 39 [50pills $129.9
0400 39 20 5b 39 30 70 69 6c 6c 73 20 20 24 31 39 34 9 [90pills $194
0410 2e 39 39 5d 20 2d 20 31 6d 67 20 5b 36 30 70 69 .99] - 1mg [60pi
0420 6c 6c 73 20 24 31 31 32 2e 39 39 20 5b 31 30 30 lls $112.99 [100
0430 70 69 6c 6c 73 20 24 31 38 39 2e 39 39 5d 0d 0a pills $189.99]..
0440 0d 0a 4d 45 4e 27 53 20 48 45 41 4c 54 48 0d 0a ..MEN'S HEALTH..
0450 56 69 61 67 72 61 20 0d 0a 35 30 6d 67 20 20 5b Viagra ..50mg [
0460 32 30 70 69 6c 6c 73 20 24 39 39 2e 39 39 5d 5b 20pills $99.99][
0470 34 30 70 69 6c 6c 73 20 24 31 34 39 2e 39 39 5d 40pills $149.99]
0480 20 5b 31 32 30 70 69 6c 6c 73 20 24 32 36 39 2e [120pills $269.
0490 39 39 5d 5b 32 30 30 70 69 6c 6c 73 20 24 33 34 99][200pills $34
04a0 39 2e 39 39 5d 0d 0a 5b 31 30 30 6d 67 20 5b 32 9.99]..[100mg [2
04b0 30 70 69 6c 6c 73 20 24 31 30 39 2e 39 39 5d 5b 0pills $109.99][
04c0 34 30 70 69 6c 6c 73 20 24 31 37 39 2e 39 39 5d 40pills $179.99]
04d0 5b 37 30 70 69 6c 6c 73 20 24 32 35 39 2e 39 39 [70pills $259.99
04e0 5d 5b 31 32 30 70 69 6c 6c 20 20 24 32 34 39 2e ][120pill $249.
04f0 39 39 5d 20 5b 32 30 30 70 69 6c 6c 73 20 24 34 99] [200pills $4
0500 34 39 2e 39 39 5d 0d 0a 0d 0a 43 69 61 6c 69 73 49.99]....Cialis
0510 20 0d 0a 32 30 6d 67 20 5b 31 30 70 69 6c 6c 73 ..20mg [10pills
0520 20 24 31 31 39 2e 39 39 20 5b 32 30 70 69 6c 6c $119.99 [20pill
0530 73 20 24 31 35 39 2e 39 39 20 5b 33 30 70 69 6c s $159.99 [30pil
0540 6c 73 20 24 31 39 39 2e 39 39 20 5b 36 30 70 69 ls $199.99 [60pi
0550 6c 6c 73 20 24 33 32 39 2e 39 39 5d 0d 0a 0d 0a lls $329.99]....
0560 41 4e 54 49 2d 44 45 50 52 45 53 53 41 4e 54 53 ANTI-DEPRESSANTS
0570 0d 0a 50 72 6f 7a 61 63 20 50 61 78 69 6c 20 73 ..Prozac Paxil s
0580 65 65 20 77 65 62 73 69 74 65 20 66 6f 72 20 70 ee website for p
0590 72 69 63 65 73 0d 0a 0d 0a 4d 55 53 43 4c 45 20 rices....MUSCLE
05a0 52 45 4c 41 58 41 4e 54 53 0d 0a 53 4f 4d 41 20 RELAXANTS..SOMA
05b0 33 35 30 20 6d 67 20 39 30 70 69 6c 6c 73 24 36 350 mg 90pills$6
05c0 39 2e 39 39 0d 0a 0d 0a 50 41 49 4e 20 52 45 4c 9.99....PAIN REL
05d0 49 45 46 0d 0a 55 6c 74 72 61 6d 20 35 30 20 6d IEF..Ultram 50 m
05e0 67 5b 33 30 70 69 6c 6c 73 20 g[30pills
Frame 2 (70 bytes on wire, 70 bytes captured)
Arrival Time: Mar 22, 2004 15:21:40.629598000
Time delta from previous packet: 116.234360000 seconds
Time since reference or first frame: 116.234360000 seconds
Frame Number: 2
Packet Length: 70 bytes
Capture Length: 70 bytes
Ethernet II, Src: 00:d0:59:0c:bb:50, Dst: 00:0b:bf:52:30:54
Destination: 00:0b:bf:52:30:54 (Cisco_52:30:54)
Source: 00:d0:59:0c:bb:50 (AmbitMic_0c:bb:50)
Type: IP (0x0800)
Internet Protocol, Src Addr: 24.131.63.4 (24.131.63.4), Dst Addr: 24.164.41.216 (24.164.41.216)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 56
Identification: 0x5800 (22528)
Flags: 0x00
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: ICMP (0x01)
Header checksum: 0x48c2 (correct)
Source: 24.131.63.4 (24.131.63.4)
Destination: 24.164.41.216 (24.164.41.216)
Internet Control Message Protocol
Type: 11 (Time-to-live exceeded)
Code: 1 (Fragment reassembly time exceeded)
Checksum: 0x905c (correct)
Internet Protocol, Src Addr: 24.164.41.216 (24.164.41.216), Dst Addr: 24.131.63.4 (24.131.63.4)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1500
Identification: 0x75ef (30191)
Flags: 0x02
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..1. = More fragments: Set
Fragment offset: 0
Time to live: 116
Protocol: UDP (0x11)
Header checksum: 0x111f (correct)
Source: 24.164.41.216 (24.164.41.216)
Destination: 24.131.63.4 (24.131.63.4)
User Datagram Protocol, Src Port: 22979 (22979), Dst Port: 1026 (1026)
Source port: 22979 (22979)
Destination port: 1026 (1026)
Length: 1757
Checksum: 0x0000 (none)
0000 00 0b bf 52 30 54 00 d0 59 0c bb 50 08 00 45 00 ...R0T..Y..P..E.
0010 00 38 58 00 00 00 80 01 48 c2 18 83 3f 04 18 a4 .8X.....H...?...
0020 29 d8 0b 01 90 5c 00 00 00 00 45 00 05 dc 75 ef )....\....E...u.
0030 20 00 74 11 11 1f 18 a4 29 d8 18 83 3f 04 59 c3 .t.....)...?.Y.
0040 04 02 06 dd 00 00 ......
Frame 3 (1514 bytes on wire, 1514 bytes captured)
Arrival Time: Mar 22, 2004 16:28:20.134227000
Time delta from previous packet: 3999.504629000 seconds
Time since reference or first frame: 4115.738989000 seconds
Frame Number: 3
Packet Length: 1514 bytes
Capture Length: 1514 bytes
Ethernet II, Src: 00:0b:bf:52:30:8c, Dst: 00:d0:59:0c:bb:50
Destination: 00:d0:59:0c:bb:50 (AmbitMic_0c:bb:50)
Source: 00:0b:bf:52:30:8c (Cisco_52:30:8c)
Type: IP (0x0800)
Internet Protocol, Src Addr: 24.164.38.236 (24.164.38.236), Dst Addr: 24.131.63.4 (24.131.63.4)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1500
Identification: 0x2396 (9110)
Flags: 0x02
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..1. = More fragments: Set
Fragment offset: 0
Time to live: 116
Protocol: UDP (0x11)
Header checksum: 0x6664 (correct)
Source: 24.164.38.236 (24.164.38.236)
Destination: 24.131.63.4 (24.131.63.4)
User Datagram Protocol, Src Port: 14070 (14070), Dst Port: 1026 (1026)
Source port: 14070 (14070)
Destination port: 1026 (1026)
Length: 1757
Checksum: 0x0000 (none)
DCE RPC
Version: 4
Packet type: Request (0)
Flags1: 0x28
0... .... = Reserved: Not set
.0.. .... = Broadcast: Not set
..1. .... = Idempotent: Set
...0 .... = Maybe: Not set
.... 1... = No Fack: Set
.... .0.. = Fragment: Not set
.... ..0. = Last Fragment: Not set
.... ...0 = Reserved: Not set
Flags2: 0x00
0... .... = Reserved: Not set
.0.. .... = Reserved: Not set
..0. .... = Reserved: Not set
...0 .... = Reserved: Not set
.... 0... = Reserved: Not set
.... .0.. = Reserved: Not set
.... ..0. = Cancel Pending: Not set
.... ...0 = Reserved: Not set
Data Representation: 100000
Byte order: Little-endian (1)
Character: ASCII (0)
Floating-point: IEEE (0)
Serial High: 0x00
Object UUID: 00000000-0000-0000-0000-000000000000
Interface: 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc
Activity: 6069285d-e938-8902-b33a-cc1a8328ed0d
Server boot time: 0x00000000
Interface Ver: 1
Sequence num: 0
Opnum: 0
Interface Hint: 0xffff
Activity Hint: 0xffff
Fragment len: 1669
Fragment num: 0
Auth proto: None (0)
Serial Low: 0x00
Microsoft Messenger Service
Operation: NetrSendMessage (0)
Server
Max Count: 16
Offset: 0
Actual Count: 16
Server: PHARMACOURT.COM
Client
Max Count: 16
Offset: 0
Actual Count: 16
Client: AOL MEMBERS
Message
Max Count: 1601
Offset: 0
Actual Count: 1601
[Malformed Packet: Messenger]
0000 00 d0 59 0c bb 50 00 0b bf 52 30 8c 08 00 45 00 ..Y..P...R0...E.
0010 05 dc 23 96 20 00 74 11 66 64 18 a4 26 ec 18 83 ..#. .t.fd..&...
0020 3f 04 36 f6 04 02 06 dd 00 00 04 00 28 00 10 00 ?.6.........(...
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 f8 91 7b 5a 00 ff d0 11 a9 b2 00 c0 4f b6 ....{Z........O.
0050 e6 fc 5d 28 69 60 38 e9 02 89 b3 3a cc 1a 83 28 ..](i`8....:...(
0060 ed 0d 00 00 00 00 01 00 00 00 00 00 00 00 00 00 ................
0070 ff ff ff ff 85 06 00 00 00 00 10 00 00 00 00 00 ................
0080 00 00 10 00 00 00 50 48 41 52 4d 41 43 4f 55 52 ......PHARMACOUR
0090 54 2e 43 4f 4d 00 10 00 00 00 00 00 00 00 10 00 T.COM...........
00a0 00 00 41 4f 4c 20 4d 45 4d 42 45 52 53 00 00 00 ..AOL MEMBERS...
00b0 00 00 41 06 00 00 00 00 00 00 41 06 00 00 20 20 ..A.......A...
00c0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
00d0 20 20 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d -------------
00e0 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d ----------------
00f0 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d ----------------
0100 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a 20 20 ------------..
0110 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
0120 20 20 20 20 50 48 41 52 4d 41 43 4f 55 52 54 2e PHARMACOURT.
0130 43 4f 4d 20 2d 20 2d 20 50 48 41 52 4d 41 43 4f COM - - PHARMACO
0140 55 52 54 2e 43 4f 4d 0d 0a 20 20 20 20 20 20 20 URT.COM..
0150 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2d 2d --
0160 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d ----------------
0170 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d ----------------
0180 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d ----------------
0190 2d 2d 2d 2d 2d 2d 2d 0d 0a 49 73 20 59 6f 75 72 -------..Is Your
01a0 20 4f 6e 65 20 53 74 6f 70 20 53 68 6f 70 20 46 One Stop Shop F
01b0 6f 72 20 4d 65 64 69 63 61 74 69 6f 6e 20 4e 65 or Medication Ne
01c0 65 64 73 20 4f 6e 6c 69 6e 65 21 0d 0a 0d 0a 57 eds Online!....W
01d0 65 20 47 75 61 72 61 6e 74 65 65 20 4c 6f 77 65 e Guarantee Lowe
01e0 73 74 20 50 72 69 63 65 20 41 6e 79 77 68 65 72 st Price Anywher
01f0 65 2e 20 4e 6f 20 50 72 65 73 63 72 69 70 74 69 e. No Prescripti
0200 6f 6e 20 52 65 71 75 69 72 65 64 2e 0d 0a 53 68 on Required...Sh
0210 6f 70 70 69 6e 67 20 57 69 74 68 20 55 73 20 54 opping With Us T
0220 6f 64 61 79 20 49 73 20 43 68 65 61 70 2c 20 43 oday Is Cheap, C
0230 6f 6e 76 65 6e 69 65 6e 74 2c 20 50 72 69 76 61 onvenient, Priva
0240 74 65 20 61 6e 64 20 43 6f 6e 66 69 64 65 6e 74 te and Confident
0250 69 61 6c 0d 0a 0d 0a 3e 3e 3e 3e 4d 41 52 43 48 ial....>>>>MARCH
0260 20 4d 41 44 4e 45 53 53 20 53 50 45 43 49 41 4c MADNESS SPECIAL
0270 53 3c 3c 3c 3c 0d 0a 0d 0a 56 69 63 6f 64 69 6e S<<<<....Vicodin
0280 20 31 30 6d 67 20 5b 33 30 70 69 6c 6c 73 20 20 10mg [30pills
0290 24 31 31 39 2e 39 39 5d 5b 36 30 70 69 6c 6c 73 $119.99][60pills
02a0 20 20 24 31 35 39 2e 39 39 5d 5b 31 30 6d 67 20 $159.99][10mg
02b0 39 30 70 69 6c 6c 73 20 20 24 31 39 39 2e 39 39 90pills $199.99
02c0 5d 0d 0a 56 69 63 6f 64 69 6e 20 37 2e 35 6d 67 ]..Vicodin 7.5mg
02d0 20 5b 39 30 70 69 6c 6c 73 20 20 24 31 38 39 2e [90pills $189.
02e0 39 39 5d 5b 36 30 70 69 6c 6c 73 20 20 24 31 37 99][60pills $17
02f0 39 2e 39 39 5d 5b 39 30 70 69 6c 6c 73 20 20 24 9.99][90pills $
0300 32 31 39 2e 39 39 5d 0d 0a 57 61 74 73 6f 6e 20 219.99]..Watson
0310 42 72 61 6e 64 20 2d 20 53 65 65 20 57 65 62 73 Brand - See Webs
0320 69 74 65 0d 0a 0d 0a 41 4e 58 49 45 54 59 0d 0a ite....ANXIETY..
0330 56 61 6c 69 75 6d 20 0d 0a 31 30 6d 67 20 5b 33 Valium ..10mg [3
0340 30 70 69 6c 6c 73 20 24 34 39 2e 39 39 5d 20 5b 0pills $49.99] [
0350 36 30 70 69 6c 6c 73 20 24 37 34 2e 39 39 5d 20 60pills $74.99]
0360 5b 39 30 70 69 6c 6c 73 20 24 31 30 34 2e 39 39 [90pills $104.99
0370 5d 20 5b 31 32 30 70 69 6c 6c 73 20 24 31 32 39 ] [120pills $129
0380 2e 39 39 5d 20 0d 0a 0d 0a 58 61 6e 61 78 20 20 .99] ....Xanax
0390 20 0d 0a 31 6d 67 20 20 5b 33 30 70 69 6c 6c 73 ..1mg [30pills
03a0 20 24 34 39 2e 39 39 5d 20 5b 36 30 70 69 6c 6c $49.99] [60pill
03b0 73 20 24 36 39 2e 39 39 20 20 5b 39 30 70 69 6c s $69.99 [90pil
03c
|
