Loading ...

General Information

Analysis ID:42374
Start time:12:01:24
Start date:03/04/2014
Overall analysis duration:0h 5m 4s
Report type:full
Sample file name:Internal.scr
Cookbook file name:default.jbs
Analysis system description:XP SP3 (Office 2003 SP2, Java 1.6.0, Acrobat Reader 9.3.4, Internet Explorer 8)
Number of analysed new started processes analysed:5
Number of new started drivers analysed:2
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:3
HCA enabled:true
HCA success:
  • true, ratio: 92%
  • Number of executed functions: 214
  • Number of non-executed functions: 1557
Warnings:
  • Report size getting too big, too many NtMapViewOfSection calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.


Detection

StrategyReport FP/FN
Threshold


Signature Overview

Key, Mouse, Clipboard, Microphone and Screen Caputering:

Contains functionality to record screenshotsShow sources
Contains functionality to retrieve information about pressed keystrokesShow sources
Hooks clipboard functions (used to sniff clipboard data)Show sources

E-Banking Fraud:

Hooks winsocket function (used for sniffing or altering network traffic)Show sources

Networking:

Contains functionality to download additional files from the internetShow sources
Downloads filesShow sources
Urls found in memory or binary dataShow sources
Downloads files from webservers via HTTPShow sources
Performs DNS lookupsShow sources
Posts data to webserverShow sources
HTTP GET or POST without a user agentShow sources
Uses a known web browser user agent for HTTP communicationShow sources

Boot Survival:

Contains functionality to start windows servicesShow sources
Creates an autostart registry keyShow sources
Creates or modifies windows servicesShow sources
Modifies existing windows servicesShow sources
Monitors registry run keys for changesShow sources

Remote Access Functionality:

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)Show sources
Opens a port and listens for incoming connection (possibly a backdoor)Show sources

Persistence and Installation Behavior:

Drops PE filesShow sources
Drops PE files to the windows directory (C:\Windows)Show sources

Data Obfuscation:

Binary may include packed or encrypted dataShow sources
Contains functionality to dynamically determine API callsShow sources
PE file contains an invalid checksumShow sources

Spreading:

Contains functionality to enumerate / list files inside a directoryShow sources

System Summary:

Binary contains paths to debug symbolsShow sources
Contains functionality to access the windows certificate storeShow sources
Contains functionality to adjust token privileges (e.g. debug / backup)Show sources
Contains functionality to check free disk spaceShow sources
Contains functionality to enum processes or threadsShow sources
Creates files inside the user directoryShow sources
Creates temporary filesShow sources
Executes batch filesShow sources
Reads ini filesShow sources
Spawns processesShow sources
Contains functionality to call native functionsShow sources
Contains functionality to communicate with device driversShow sources
Contains functionality to launch a process as a different userShow sources
Contains functionality to shutdown / reboot the systemShow sources
Creates driver filesShow sources
Creates files inside the driver directoryShow sources
Creates files inside the system directoryShow sources
Creates mutexesShow sources
Enables driver privilegesShow sources
Reads the hosts fileShow sources
Spawns driversShow sources
Tries to load missing DLLsShow sources

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to add an ACL to a security descriptorShow sources
Contains functionality to create a new security descriptorShow sources
Contains functionality to inject threads in other processesShow sources
Contains functionality to launch a program with higher privilegesShow sources
May try to detect the Windows Explorer process (often used for injection)Show sources
Allocates memory in foreign processesShow sources
Changes memory attributes in foreign processes to executable or writableShow sources
Contains functionality to write to remote processesShow sources
Creates a thread in another existing process (thread injection)Show sources
Injects a PE file into a foreign processesShow sources
Writes to foreign memory regionsShow sources

Anti Debugging:

Contains functionality to query system informationShow sources
Contains functionality to register its own exception handlerShow sources
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))Show sources
Contains functionality for execution timing, often used to detect debuggersShow sources
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)Show sources
Contains functionality to dynamically determine API callsShow sources
Creates guard pages, often used to prevent reverse engineering and debuggingShow sources
Found dropped PE file which has not been started or loadedShow sources

Virtual Machine Detection:

Contains functionality to enumerate / list files inside a directoryShow sources
Contains functionality to query system informationShow sources
Queries a list of all running processesShow sources

Hooking and other Techniques for Stealthness and Protection:

Creates PE files with a name already existing in WindowsShow sources
Extensive use of GetProcAddress (often used to hide API calls)Show sources
Monitors certain registry keys / values for changes (often done to protect autostart functionality)Show sources
Deletes itself after installationShow sources
Hooks processes query functions (used to hide processes)Show sources
Icon mismatch, uses an Icon from a different legit application in order to fool usersShow sources
Modifies the prolog of user mode functions (user mode inline hooks)Show sources
Modifies the system service dispatch table (places SSDT hooks)Show sources
Registers kernel notifiers (kernel callbacks)Show sources

Lowering of HIPS / PFW / Operating System Security Settings:

May initialize a security null descriptorShow sources
Modifies the windows firewallShow sources

Language, Device and Operating System Detection:

Contains functionality to query local / system timeShow sources
Contains functionality to query the account / user nameShow sources
Contains functionality to query time zone informationShow sources
Contains functionality to query windows versionShow sources
Queries the cryptographic machine GUIDShow sources
Queries the installation date of WindowsShow sources
Queries the installation date of WindowsShow sources
Queries the product ID of WindowsShow sources
Queries the volume information (name, serial number etc) of a deviceShow sources

Startup

  • system is xp
  • Internal.scr (PID: 1988 MD5: C05D7F1CFF16C7AF9B9D3B6F79CE7A02)
    • update.exe (PID: 1524 MD5: 917E21271D4C01B35A881246D8116DEF)
      • winsec.exe (PID: 496 MD5: 25ECDFFA169BEC23946F99782C5455D8)
        • uqny.exe (PID: 244 MD5: 3740968E82FE178B7A18C9673F42E870)
          • 10a0d.sys (PID: 4 MD5: A2F2B24BD6FA13095C319F7F61C21D2F)
          • explorer.exe (PID: 1564 MD5: 12896823FB95BFB3DC9B46BCAEDC9923)
          • ctfmon.exe (PID: 1768 MD5: 5F1D5F88303D4A4DBC8E5F97BA967CC3)
          • wscntfy.exe (PID: 1796 MD5: F92E1076C42FCD6DB3D72D8CFE9816D5)
        • cmd.exe (PID: 3600 cmdline: C:\WINDOWS\system32\cmd.exe /c C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QSOFCB0.bat MD5: 6D778E0F95447E6546553EEEA709D03C)
  • cleanup

Created / dropped Files

File PathType and Hashes
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Cab1.tmp
  • Type: Microsoft Cabinet archive data, 47186 bytes, 1 file
  • MD5: F581048AA8697DA74A9BE736B6035542
  • SHA: 9EA06E2F446782EA60D685520FC38891FB6B8332
  • SHA-256: 8A2B17AC9DCC076AB307854E79854F7906C68A50C8865B289F848341D90750A8
  • SHA-512: E24BB92B27FD97A6409DE096714EE59FAB6B82A5BB72E1DBE92EA7E97324ABD6C64C8584C62E2AC9830700461F05014210B9FC148AB01ECE178DCEA1F0A2D546
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Cab3.tmp
  • Type: Microsoft Cabinet archive data, 47186 bytes, 1 file
  • MD5: F581048AA8697DA74A9BE736B6035542
  • SHA: 9EA06E2F446782EA60D685520FC38891FB6B8332
  • SHA-256: 8A2B17AC9DCC076AB307854E79854F7906C68A50C8865B289F848341D90750A8
  • SHA-512: E24BB92B27FD97A6409DE096714EE59FAB6B82A5BB72E1DBE92EA7E97324ABD6C64C8584C62E2AC9830700461F05014210B9FC148AB01ECE178DCEA1F0A2D546
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Cab5.tmp
  • Type: Microsoft Cabinet archive data, 54007 bytes, 1 file
  • MD5: F44363D23CD082C1A99EB91D33E1C927
  • SHA: DB88A832074CF222B498EEF018E2B4A056456F93
  • SHA-256: 9A81FE41D5360C40F4B51DA948A2E2741C63E37E4713E8D99346372A626D318F
  • SHA-512: 7185229E0D282E551E3B304BDD9F968F42F779697DDE45BA9B33D7EF8DB54632DB7173547602730BB86A2B8BD512A9CB69E3A936FF1F14AAA20BE7694A7FB4DD
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QSOFCB0.bat
  • Type: DOS batch file text
  • MD5: 15BC944C2EF288A79DCFABF6141DDE16
  • SHA: 7E4E15D0A06ACC3FE652452FD3A6A793F2A9A2C0
  • SHA-256: F4BBD361B2FD83C13B0C677FAF52F61E815F09F03D3B06654BFFF95EE89CA637
  • SHA-512: B5DFAFEF403F1661A6323A89D100B87AD6BD058FA87E5B4E9135CA422480D2B57D6495102CEC2454E9593662793112F435C7234FEDA30C96A3DB506BCDCB061C
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Tar2.tmp
  • Type: data
  • MD5: EF9FB765C2D58205E6DCB7BC9B1ED954
  • SHA: AD09FD6B5F537A5ED6654B5AA3C0B84A9107BB7B
  • SHA-256: 0CB216D73402ACE7B2F15F2F7D0D81A464EFC2732EDB001FA6F9A28EAF972BB4
  • SHA-512: E1D552D75996BDEB625BC70FBA6880EA5A6C9D780AFB328228F97418B54F377B37DC4EECAE95A346FAB610B3EBFFB8B85FC986BFA5B602ABEE381DE70AB3BA2F
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Tar4.tmp
  • Type: data
  • MD5: EF9FB765C2D58205E6DCB7BC9B1ED954
  • SHA: AD09FD6B5F537A5ED6654B5AA3C0B84A9107BB7B
  • SHA-256: 0CB216D73402ACE7B2F15F2F7D0D81A464EFC2732EDB001FA6F9A28EAF972BB4
  • SHA-512: E1D552D75996BDEB625BC70FBA6880EA5A6C9D780AFB328228F97418B54F377B37DC4EECAE95A346FAB610B3EBFFB8B85FC986BFA5B602ABEE381DE70AB3BA2F
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Tar6.tmp
  • Type: data
  • MD5: 1941F2EC5BFCE446FE607ACDC513FF25
  • SHA: A4935CFCC137B2056CE7BE35DC6BE98B7A77F21C
  • SHA-256: 5D1789C00B84CEC79E1653C3E74BA8E4068B8A943E4587D81D93B1B38F90660F
  • SHA-512: 23669BBCFD9CFA57B7FD5264F88EA837B53C07F4CC15FA80B7D9F2D746988506762FF269D6D35D7E835130DF7606C23C34B9C311F4532661B679CC4774DE5107
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\update.exe
  • Type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
  • MD5: 917E21271D4C01B35A881246D8116DEF
  • SHA: 81CB74E3C202EBACF804BADC5DAB7B9252669B43
  • SHA-256: DDE937ABDEB4AFDFB1E1C04F6B5A93B70EF7D11D9A7EC2093E7AAC5275E33F61
  • SHA-512: 9992EFE09D25DFDE93DC3CB8C42AEBE819B6F2385A22C7CF43965489FF6050AFB9AE2A46EFCB71B3F68AAA070BB732272DC234CE3247BC6AF1FC709305E9F748
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winsec.exe
  • Type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
  • MD5: 25ECDFFA169BEC23946F99782C5455D8
  • SHA: 5F5BB611EED1B024D7E8EE9D1B6D5D43BC678EAF
  • SHA-256: D86DD56DE7D725F83E038CA6B9D442142682A1DF819E696DE0041AD54453465C
  • SHA-512: DC14A7F91DCDCC18E8259F5D154035AE88F8F2B5EBE2F20DFAD305D37BAECAA77CED983816215DB85304371FA6D7BD6ADF48A3C8BD704C08DEFD4100E2E478E7
C:\Documents and Settings\Administrator\Application Data\Microsoft\Address Book\Administrator.wab
  • Type: data
  • MD5: 02962AB958FD8410CA1B04F6E17678D4
  • SHA: FCA7F88477EC587D7DB697D0304B2CD4C866589E
  • SHA-256: FFCDD9AB874B1D78AC8ADD26AF64C4F30F5D15FCC95313E5D4AA8779A50EB142
  • SHA-512: 19866C137DC835737C3E50A0168BD6FA254496147DB6A7003C2319EDF02733D64D19C1479B6B035D8C6BBC3D13A1A80E287829960CAB4544CFC79A3A7A2C4678
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
  • Type: ASCII text, with no line terminators
  • MD5: FB5EFCBD715B1546755E7410C95FD41E
  • SHA: EB9D0CA3F0C6CC3BB5F41EBCBCDE73FEA88401AF
  • SHA-256: D03C9DC857923C64DF17152258A83B1BA27E83793461469A5CCB7DE4CAC0FE6D
  • SHA-512: 876CD1D06071E16E33D30F00FD62D5154C4C0DD3328C8D88C0C662E6A3ECA8B8DC86DEC365B54E5AB5329AB104635856490E2B60F5872D6FD86C29B39E32BC6E
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
  • Type: Microsoft Cabinet archive data, 54007 bytes, 1 file
  • MD5: F44363D23CD082C1A99EB91D33E1C927
  • SHA: DB88A832074CF222B498EEF018E2B4A056456F93
  • SHA-256: 9A81FE41D5360C40F4B51DA948A2E2741C63E37E4713E8D99346372A626D318F
  • SHA-512: 7185229E0D282E551E3B304BDD9F968F42F779697DDE45BA9B33D7EF8DB54632DB7173547602730BB86A2B8BD512A9CB69E3A936FF1F14AAA20BE7694A7FB4DD
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
  • Type: data
  • MD5: 092ABC6642BC403D96F996375BB0E51A
  • SHA: CCED376AD13FC85EAB1129921AB970A450EDC4D9
  • SHA-256: 22C1B71E71A8B9D5C6026EB95EF101F1FCB5B497EED14A9A671EE6E4A9AD4BDF
  • SHA-512: BD960B3215EC100200209DE35C07DD5D710C638F64EA8E0422FF25ECF79A7B04E5122F2AAE45B376B3BFF63E556B4E16885457E28E8814E82318E9B82684DFEA
C:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
  • Type: data
  • MD5: 972ADE0F741909A70011759F58C04674
  • SHA: 8313E6397EB1801A63B2EB0E07132DF2B9ECD74A
  • SHA-256: D464EE3FDE40EE71150E501489D26B8A8FD580505D19F637B101FFC35AA8B387
  • SHA-512: F9EE718EFF3AC988408ACFD32BBCFBFAA29A54B8E9F52DE2CD22E6E6719E55A4FD8C47C10990BCEDD8C7F34E50A1C73907B6B3031BD0B04E1F2EE61133B87850
C:\Documents and Settings\Administrator\Local Settings\Temp\Zekyn\uqny.exe
  • Type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
  • MD5: 3740968E82FE178B7A18C9673F42E870
  • SHA: C9689BFE6FB6710B0F0D6465F3F263985151FB8A
  • SHA-256: 4C13D97781D1C2F65306355CA339C3CE7D9539B16B69C4B5CB84FF6B0EF35071
  • SHA-512: 0478AE6781C9F822D9F2E1BBB7E7BD13CB8288BAC1263781ADCBC2FD50389F8E8FD9C777E511669B08CFF23DD6E6FBEBC137E7A940C362B541E1FA942A60E6EB
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RC9GAWT2\0104AUm[1].exe
  • Type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
  • MD5: 25ECDFFA169BEC23946F99782C5455D8
  • SHA: 5F5BB611EED1B024D7E8EE9D1B6D5D43BC678EAF
  • SHA-256: D86DD56DE7D725F83E038CA6B9D442142682A1DF819E696DE0041AD54453465C
  • SHA-512: DC14A7F91DCDCC18E8259F5D154035AE88F8F2B5EBE2F20DFAD305D37BAECAA77CED983816215DB85304371FA6D7BD6ADF48A3C8BD704C08DEFD4100E2E478E7
C:\WINDOWS\system32\drivers\10a0d.sys
  • Type: PE32 executable for MS Windows (native) Intel 80386 32-bit
  • MD5: A2F2B24BD6FA13095C319F7F61C21D2F
  • SHA: 38169E6DCC43A7831D1E995D87686AA26D6D4F46
  • SHA-256: F1473D776BCA32DF38F449B5E4E82BDC58825AABF5B5AB03F02E0B3CAAF2A661
  • SHA-512: 28DF947227F3ED6E4E5D474DE7CF4F36FF0F7070B8B0D8E180A4C6B370E4FB3185C1CFDB5A74438A61D99721C4C2255B2B48EFDB44275B1CB45E03D2C3539687
\ROUTER
  • Type: GLS_BINARY_LSB_FIRST
  • MD5: BB03B9FAD108A5ED6DB4E34DB8436349
  • SHA: 0C781135C068643B239C34ABECB5F64F68A53828
  • SHA-256: 834E35A3763FD3D41640D53F68C514C4EBE626C9F89304EF2184DD9C60C7FCDB
  • SHA-512: EF1FC355AA52A7696FC50CFE8F7B3E4FB96A0C03AD43B5FAA91773DBFF304CB1FCE57601973700127931BFE8195B128C3FA2DBCDB059A7225CFA45F5D46D02A0

Contacted Domains

NameIPName ServerActiveRegistrare-Mail
huuofukzdeguflbhmafyivkj.biz23.92.19.67unknowntrueunknownunknown
partners-gs.com94.23.146.92unknowntrueunknownunknown
www.download.windowsupdate.com92.123.155.25unknowntrueunknownunknown
www.google.com173.194.65.105unknowntrueunknownunknown
aulbbiwslxpvvphxnjij.biz50.116.4.71unknowntrueunknownunknown
dikzhhiealaypkbvwlemha.infounknownunknownunknownunknownunknown
mnvrwhzhskyxceucztswavohcegu.orgunknownunknownunknownunknownunknown
emqsfyducjnmbibibhizpcufqnrpo.infounknownunknownunknownunknownunknown
alvohyhgypfyrsgewgifcrgifjz.netunknownunknownunknownunknownunknown
hdrgcshsjbnbobylampt.ruunknownunknownunknownunknownunknown
hdcujzgmhqgweufmjfrwthmdupn.orgunknownunknownunknownunknownunknown
ojamxrwylyxwshgixjzormqo.comunknownunknownunknownunknownunknown
vheaiheudairozltvxwhscx.comunknownunknownunknownunknownunknown

Contacted IPs

IPCountryPingableOpen Ports
125.192.77.86Japanunknownunknown
99.122.66.193United Statesunknownunknown
115.126.143.176Japanunknownunknown
213.123.192.140United Kingdomunknownunknown
50.116.4.71United Statesunknownunknown
173.194.65.105United Statesunknownunknown
195.186.1.121Switzerlandunknownunknown
174.95.148.169Canadaunknownunknown
109.152.14.70United Kingdomunknownunknown
23.92.19.67United Statesunknownunknown
180.32.45.40Japanunknownunknown
124.102.71.137Japanunknownunknown
81.134.111.58United Kingdomunknownunknown
94.23.146.92Franceunknownunknown
181.28.56.2Argentinaunknownunknown
119.172.162.34Japanunknownunknown
50.100.208.136Canadaunknownunknown
99.37.80.46United Statesunknownunknown
92.123.155.25European Unionunknownunknown
121.6.40.64Singaporeunknownunknown
195.186.4.121Switzerlandunknownunknown

Static File Info

File type:PE32 executable for MS Windows (GUI) Intel 80386 32-bit
File name:Internal.scr
File size:25600
MD5:c05d7f1cff16c7af9b9d3b6f79ce7a02
SHA1:68a2d1b034a68a801d612ac24938ea221ee37455
SHA256:3a219057118feabb49d1333d43239563304201af46fdc8b1a0eb4275ba2919a1
SHA512:84f5a96436dae52017007c5eb98dc884ae609766a632f490a1df9f99617513cf9b33c2a25112ed79195dc8e99b63acb2bd8ddd55f855d396f3c4d53340ca0152

File Icon

Static PE Info

General
Entrypoint:0x4021a0
Entrypoint Section:.text
Imagebase:0x400000
Subsystem:windows gui
Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:TERMINAL_SERVER_AWARE
Time Stamp:0x533B2BF1 [Tue Apr 01 21:13:21 2014 UTC]
TLS Callbacks:
Digitally signed:False
CLR (.Net) Version:
Resources
NameRVASizeTypeLanguageCountry
RT_ICON0x60ec0x2a64ump; dataEnglishUnited States
RT_GROUP_ICON0x8b500x14ump; MS Windows icon resource - 1 iconEnglishUnited States
RT_MANIFEST0x8b640x15aump; ASCII text, with CRLF line terminatorsEnglishUnited States
Imports
DLLImport
MSVCRT.dll_adjust_fdiv, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _controlfp, _exit, _initterm, __wgetmainargs, _wcmdln, exit, _XcptFilter, _except_handler3
KERNEL32.dllExitProcess, GetStartupInfoW, UnhandledExceptionFilter, LoadLibraryW, InitializeCriticalSectionAndSpinCount, GetModuleHandleW
USER32.dllDispatchMessageW, CreateWindowExW, RegisterClassExW, ShowWindow, PeekMessageW, DefWindowProcW, AdjustWindowRectEx
SHELL32.dllSHGetDesktopFolder
Sections
NameVirtual AddressVirtual SizeRaw SizeEntropy
.text0x10000x13aa0x14006.52472451551
.rdata0x30000x5980x6005.02690951779
.data0x40000x16ec0x18005.64045748358
.rsrc0x60000x2cc00x2e004.643827612
Possible Origin
Language of compilation systemCountry where language is spokenMap
EnglishUnited States

Network Behavior

TCP Packets
TimestampSource PortDest PortSource IPDest IP
Apr 3, 2014 12:02:05.982043028 MESZ6395253192.168.1.10195.186.1.121
Apr 3, 2014 12:02:06.316936970 MESZ5363952195.186.1.121192.168.1.10
Apr 3, 2014 12:02:06.331769943 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:06.331789017 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:06.331888914 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:06.339533091 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:06.339544058 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:06.574330091 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:06.707801104 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:06.707854033 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:06.713912964 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:06.713926077 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:06.818871975 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:07.036010981 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:07.405324936 MESZ6014653192.168.1.10195.186.1.121
Apr 3, 2014 12:02:07.651335955 MESZ5360146195.186.1.121192.168.1.10
Apr 3, 2014 12:02:07.662128925 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:07.662147045 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:07.662219048 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.645258904 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.645339012 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.645672083 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.680429935 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.680443048 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.796554089 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.830758095 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.830773115 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.906096935 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.908709049 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.908754110 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.908766031 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.909149885 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.909207106 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.909339905 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.918570042 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.918605089 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.918922901 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.918968916 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.919599056 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.926739931 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.945070028 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.945076942 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.945152044 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.945163012 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.945270061 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.945432901 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.945439100 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.945441961 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.945543051 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.945971966 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.945976973 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.946073055 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.946080923 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.946185112 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.958765030 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.959160089 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.959167004 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.959260941 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.959269047 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.959359884 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.964056969 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.964610100 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.964616060 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.964699030 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.964706898 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.964796066 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.964823008 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.964828968 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.964831114 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.964945078 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.965390921 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.965398073 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.965491056 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.965497971 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.965600967 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.977912903 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.984586000 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.984616995 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.984627962 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.985017061 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.985069990 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.985203028 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.985901117 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.985907078 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.986008883 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.986018896 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.986200094 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.987273932 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.988744974 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.988749981 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.988852024 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.988862038 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.988969088 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.995527983 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.997195959 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.997203112 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.997303963 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.997313976 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.997404099 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:10.997545958 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.997554064 MESZ80103492.123.155.25192.168.1.10
Apr 3, 2014 12:02:10.997659922 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:11.058403015 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.058425903 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.224895954 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.228884935 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.228914976 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.229480982 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.229533911 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.229984045 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.239279032 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.239286900 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.239289045 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.239391088 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.251422882 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.251430035 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.251528978 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.251538992 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.251643896 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.263637066 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.264086008 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.264240980 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.264252901 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.270638943 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.270646095 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.270771027 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.270783901 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.270816088 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.270821095 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.270910025 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.270917892 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.270951033 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.282047033 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.282054901 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.282078981 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.282167912 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.282180071 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.282210112 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.283601999 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.283608913 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.283711910 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.283721924 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.283826113 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.301091909 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.301099062 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.301101923 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.301209927 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.306698084 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.306755066 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.307148933 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.307195902 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.307394028 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.307415009 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.307657003 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.307689905 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.307820082 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.308037996 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.308176994 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.308201075 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.308566093 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.312603951 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.312635899 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.312647104 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.313040018 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.320750952 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.320780993 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.321166992 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.321206093 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.321229935 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.321258068 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.321355104 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.321697950 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.321721077 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.322171926 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.325356007 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.326225996 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.326255083 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.326642036 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.326682091 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.326714039 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.326735020 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.327244997 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.327275991 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.327405930 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.327693939 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.327714920 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.327879906 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.327907085 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.328311920 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.328459024 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.331851006 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.331876040 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.331885099 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.332274914 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.343024015 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.343055964 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.343065977 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.343455076 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.343492985 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.343616009 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.346292019 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.346322060 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.346709967 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.346746922 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.346842051 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.346863985 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.347248077 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.347276926 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.347404957 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.347764969 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.347784042 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.347795963 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.347805023 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.348033905 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.348265886 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.348294020 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.348448038 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.349167109 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.356403112 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.356432915 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.356823921 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.356862068 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.357311964 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.359508991 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.359540939 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.359551907 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.359944105 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.360172033 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.360194921 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.360588074 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.360619068 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.360718966 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.360734940 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.361133099 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.361160994 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.361239910 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.361269951 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.361351967 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.361721039 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.361745119 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.361898899 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.362252951 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.366038084 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.366772890 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.366816044 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.367177010 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.367217064 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.367352962 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.367372036 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.367609024 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.367635965 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.367764950 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.368115902 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.380060911 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.380093098 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.380104065 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.380451918 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.393382072 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.393413067 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.393711090 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.393755913 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.393958092 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.394885063 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.395843029 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.395848989 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.395975113 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.395984888 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.396075010 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.396569967 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.397375107 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.397381067 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.397511959 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.397521019 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.397553921 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.398111105 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.398118019 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.398221016 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.398231030 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.398330927 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.399045944 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.399051905 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.399054050 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.399156094 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.399786949 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.399792910 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.399889946 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.399899006 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.399997950 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.406234980 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.406239986 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.406241894 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.406353951 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.406965971 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.406972885 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.407095909 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.407108068 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.407215118 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.410651922 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.411129951 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.411135912 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.411247969 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.411259890 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.411366940 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.411511898 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.411520004 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.411523104 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.411631107 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.411876917 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.411883116 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.411906958 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.412005901 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.412015915 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.412050962 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.412240982 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.412245989 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.412337065 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.412343979 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.412517071 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.417277098 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.417282104 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.417284966 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.417402029 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.418189049 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.418195963 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.418309927 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.418323040 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.418416977 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.418703079 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.424849987 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.424855947 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.424972057 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.424983978 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.425095081 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.425219059 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.425225973 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.425229073 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.425304890 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.425942898 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.425950050 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.426054955 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.426064014 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.426155090 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.427028894 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.427552938 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.427557945 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.427673101 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.427685022 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.427777052 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.429682970 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.430397034 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.430416107 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.430726051 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.430772066 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.430855989 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.430871010 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.431185007 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.431211948 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.431317091 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.431335926 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.431365013 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.431680918 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.431704044 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.431755066 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.431777954 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.431852102 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.432143927 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.432163000 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.432266951 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.432543993 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.434762001 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.434782028 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.434788942 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.435081959 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.435218096 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.435231924 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.435416937 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.435441971 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.435739040 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.436744928 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.436779022 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.436788082 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.437047005 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.437170982 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.437179089 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.437192917 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.437203884 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.437659025 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.456692934 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.456723928 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.456733942 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.457170010 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.457222939 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.457355022 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.471141100 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.471170902 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.471662998 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.471718073 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.471744061 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.471761942 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.471875906 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.472234964 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.472260952 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.472326040 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.472342968 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.472809076 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.472840071 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.472971916 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.473275900 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.473298073 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.473320961 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.473340988 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.473947048 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.474087000 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.474123955 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.474308014 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.474333048 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.474667072 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.474680901 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.474685907 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.474704027 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.475090981 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.475152969 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.475183964 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.475533009 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.475558043 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.475711107 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.475728035 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.475902081 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.475996971 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.476022959 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.476166010 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.476502895 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.477072954 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.477097034 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.477107048 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.477435112 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.478802919 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.481494904 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.481525898 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.481537104 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.481920004 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.482088089 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.482155085 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.482177019 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.482192039 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.482475042 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.490782022 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.490813017 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.491172075 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.491214991 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.491369963 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.491389990 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.491775036 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.491807938 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.491898060 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.491914034 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.491938114 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.492010117 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.492451906 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.492480040 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.492609978 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.492747068 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.498198986 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.498229980 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.498600960 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.498639107 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.499023914 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.511030912 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.511060953 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.511070967 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.511509895 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.513842106 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.513880014 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.513904095 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.514328003 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.514383078 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.514549971 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.514657974 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.514688969 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.514972925 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.515012026 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.515357018 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.515399933 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.515434980 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.515902042 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.516150951 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.516194105 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.516206026 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.516469002 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.519042969 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.519062042 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.519428015 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.519468069 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.519553900 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.519573927 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.519952059 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.519982100 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.520116091 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.520123005 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.520137072 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.520250082 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.520591974 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.520617962 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.520770073 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.520855904 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.520875931 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.521388054 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.521416903 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.521770000 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.522063971 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.522094965 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.522105932 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.522419930 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.522627115 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.522646904 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.522938967 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.522969007 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.523324013 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.524882078 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.526328087 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.527426958 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.527455091 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.527466059 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.527808905 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.527991056 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.528017998 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.529757977 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.529823065 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.530083895 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.530122995 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.530569077 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.530591965 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.530910969 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.530946016 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.531076908 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.540292978 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.540324926 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.540337086 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.540695906 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.540736914 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.540863991 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.542783976 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.542814970 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.543205976 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.543217897 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.543235064 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.543251991 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.543703079 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.543864012 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.549964905 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.556329966 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.556363106 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.556768894 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.556823969 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.557169914 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.557198048 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.557231903 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.557257891 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.557754993 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.557774067 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.557795048 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.557944059 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.558042049 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.558070898 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.558425903 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.558573961 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.558708906 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.558731079 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.558913946 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.558937073 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.559149981 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.559262991 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.559284925 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.559619904 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.559645891 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.559667110 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.559676886 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.560091972 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.560216904 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.560245991 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.560528040 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.560551882 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.560786009 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.560802937 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.560892105 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.560914040 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.561249971 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.561342955 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.561359882 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.561680079 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.561702967 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.561862946 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.561867952 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.561903000 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.561909914 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.562002897 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.562202930 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.562210083 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.562405109 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.562411070 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.562555075 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.562561989 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.562654018 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.562907934 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.562997103 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.564343929 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.564348936 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.564441919 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.564450026 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.564554930 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.564834118 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.565570116 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.565573931 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.565668106 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.565676928 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.565768003 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.569231987 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.569715977 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.569722891 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.569859982 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.569869041 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.569931030 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.569937944 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.569971085 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.569977045 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.570067883 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.570101023 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.576514006 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.583694935 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.583700895 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.583803892 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.583817005 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.583930016 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.588716030 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.588722944 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.588725090 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.588828087 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.589555025 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.589561939 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.589662075 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.589670897 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.589761019 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.595597982 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.597958088 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.597985983 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.598500967 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.598541021 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.598886967 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.598906994 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.598925114 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.598941088 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.598953009 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.599133015 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.599458933 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.599610090 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.599618912 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.599636078 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.599646091 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.599670887 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.599744081 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.600095987 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.600224018 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.600336075 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.600357056 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.600646019 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.600672007 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.600970984 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.600994110 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.601015091 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.601035118 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.601486921 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.601499081 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.601516008 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.601923943 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.601953030 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.602088928 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.602108955 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.602349043 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.602374077 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.602504969 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.602754116 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.602785110 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.603106976 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.603131056 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.603457928 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.603703022 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.603738070 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.603751898 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.604146957 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.604254961 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.604274035 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.604760885 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.604789019 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.605015993 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.605036020 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.605155945 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.605469942 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.605494976 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.606045961 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.607388973 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.609092951 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.609186888 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.609219074 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.609231949 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.609487057 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.609631062 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.609882116 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.610075951 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.610080004 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.610160112 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.610167980 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.610224009 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.627810001 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.627818108 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.627918959 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.627928019 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.628034115 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.666946888 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.675079107 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.675107002 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.675575018 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.675627947 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.676039934 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.677182913 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.677212954 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.677227974 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.677691936 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.678069115 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.678097963 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.678402901 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.678442001 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.678600073 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.678620100 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.679121017 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.679157019 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.679290056 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.704608917 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.704639912 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.705107927 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.705159903 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.705571890 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.714159966 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.714189053 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.714200020 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.714672089 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.714811087 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.714829922 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.714993000 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.715276003 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.715313911 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.715475082 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.717583895 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.718064070 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.718102932 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.764410973 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.764441967 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.764452934 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.764909983 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.764966965 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.765099049 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.765117884 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.765137911 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.765630007 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.765662909 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.766140938 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.768110991 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.768140078 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.768151045 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.768605947 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.768616915 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.768625021 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.769001007 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.769038916 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.769406080 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.769434929 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.770060062 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.770106077 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.770520926 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.770556927 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.770682096 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.770703077 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.771038055 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.771065950 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.771197081 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.771307945 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.771327972 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.771606922 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.771632910 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.771754980 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.771859884 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.771889925 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.772187948 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.772212982 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.772531033 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.772550106 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.772552967 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.772572994 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.773020983 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.773122072 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.773139954 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.773458004 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.773480892 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.773617029 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.773633957 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.773844004 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.773869038 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.773999929 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.774214983 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.774238110 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.774585962 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.774609089 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.774758101 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.774774075 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.774983883 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.775007963 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.775141954 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.775276899 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.775293112 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.775451899 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.775528908 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.775551081 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.775893927 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.775940895 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.775966883 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.776320934 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.776344061 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.776679993 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.778604031 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.784679890 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.785394907 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.785418034 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.785969019 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.785986900 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.785996914 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.786026001 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.786065102 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.786604881 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.786747932 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.787446976 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.787470102 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.787565947 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.787765980 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.787796974 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.787950993 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.806503057 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.806535959 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.806843042 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.806885004 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.810034990 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.815618992 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.816451073 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.816468000 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.816591024 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.816600084 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.816725969 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.818504095 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.818520069 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.818522930 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.818640947 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.818672895 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.819057941 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.819075108 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.819077015 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.819190979 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.819220066 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.819436073 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.819900036 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.819905996 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.820039034 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.820058107 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.820178986 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.821620941 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.821626902 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.821639061 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.821770906 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.823141098 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.823146105 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.823271036 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.823276997 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.823410034 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.824605942 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.824610949 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.824623108 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.824733973 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.825448990 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.825453043 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.825557947 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.825565100 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.825831890 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.826021910 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.826026917 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.826039076 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.826683044 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.826688051 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.826875925 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.826879978 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.826894045 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.827514887 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.827574015 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.827578068 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.827636957 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.827703953 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.827722073 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.827729940 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.827841997 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.827847004 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.827936888 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.828227997 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.828233004 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.828247070 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.828299046 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.828399897 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.828754902 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.828763962 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.829360008 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.834789991 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.834794044 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.834796906 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:11.834897995 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.957402945 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:11.957412958 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:12.137850046 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:12.138350964 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:12.138405085 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:12.286421061 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:12.286473036 MESZ443103394.23.146.92192.168.1.10
Apr 3, 2014 12:02:12.504281044 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:13.324711084 MESZ1033443192.168.1.1094.23.146.92
Apr 3, 2014 12:02:13.325006008 MESZ103480192.168.1.1092.123.155.25
Apr 3, 2014 12:02:33.285137892 MESZ51498656192.168.1.1050.100.208.136
Apr 3, 2014 12:02:38.743045092 MESZ51496781192.168.1.10174.95.148.169
Apr 3, 2014 12:02:45.680710077 MESZ51494283192.168.1.10181.28.56.2
Apr 3, 2014 12:02:54.183640003 MESZ51495693192.168.1.10121.6.40.64
Apr 3, 2014 12:03:02.042473078 MESZ51492453192.168.1.1099.122.66.193
Apr 3, 2014 12:03:08.162892103 MESZ51496589192.168.1.10180.32.45.40
Apr 3, 2014 12:03:16.868084908 MESZ51499551192.168.1.10115.126.143.176
Apr 3, 2014 12:03:17.275559902 MESZ5996553192.168.1.10195.186.1.121
Apr 3, 2014 12:03:18.271532059 MESZ5996553192.168.1.10195.186.4.121
Apr 3, 2014 12:03:18.578278065 MESZ5359965195.186.4.121192.168.1.10
Apr 3, 2014 12:03:18.595432997 MESZ103580192.168.1.1050.116.4.71
Apr 3, 2014 12:03:18.595453024 MESZ80103550.116.4.71192.168.1.10
Apr 3, 2014 12:03:18.595537901 MESZ103580192.168.1.1050.116.4.71
Apr 3, 2014 12:03:18.606722116 MESZ103580192.168.1.1050.116.4.71
Apr 3, 2014 12:03:18.606733084 MESZ80103550.116.4.71192.168.1.10
Apr 3, 2014 12:03:18.606894970 MESZ103580192.168.1.1050.116.4.71
Apr 3, 2014 12:03:18.606900930 MESZ80103550.116.4.71192.168.1.10
Apr 3, 2014 12:03:18.614217997 MESZ5359965195.186.1.121192.168.1.10
Apr 3, 2014 12:03:25.446681023 MESZ51492058192.168.1.1081.134.111.58
Apr 3, 2014 12:03:31.588347912 MESZ51493736192.168.1.1099.37.80.46
Apr 3, 2014 12:03:37.102421045 MESZ51491193192.168.1.10124.102.71.137
Apr 3, 2014 12:03:45.192882061 MESZ51495049192.168.1.10125.192.77.86
Apr 3, 2014 12:03:45.424109936 MESZ80103550.116.4.71192.168.1.10
Apr 3, 2014 12:03:45.424247980 MESZ103580192.168.1.1050.116.4.71
Apr 3, 2014 12:03:45.424695969 MESZ103580192.168.1.1050.116.4.71
Apr 3, 2014 12:03:45.424709082 MESZ80103550.116.4.71192.168.1.10
Apr 3, 2014 12:03:45.522948027 MESZ5661753192.168.1.10195.186.1.121
Apr 3, 2014 12:03:45.767858982 MESZ5356617195.186.1.121192.168.1.10
Apr 3, 2014 12:03:45.779170036 MESZ104080192.168.1.10173.194.65.105
Apr 3, 2014 12:03:45.779242992 MESZ801040173.194.65.105192.168.1.10
Apr 3, 2014 12:03:45.779639006 MESZ104080192.168.1.10173.194.65.105
Apr 3, 2014 12:03:45.784476995 MESZ104080192.168.1.10173.194.65.105
Apr 3, 2014 12:03:45.784528971 MESZ801040173.194.65.105192.168.1.10
Apr 3, 2014 12:03:46.289760113 MESZ801040173.194.65.105192.168.1.10
Apr 3, 2014 12:03:46.291330099 MESZ104080192.168.1.10173.194.65.105
Apr 3, 2014 12:03:46.291552067 MESZ801040173.194.65.105192.168.1.10
Apr 3, 2014 12:03:46.292006016 MESZ104080192.168.1.10173.194.65.105
Apr 3, 2014 12:03:47.802067995 MESZ5118653192.168.1.10195.186.1.121
Apr 3, 2014 12:03:48.075978041 MESZ5351186195.186.1.121192.168.1.10
Apr 3, 2014 12:03:49.570564032 MESZ5826453192.168.1.10195.186.1.121
Apr 3, 2014 12:03:49.863223076 MESZ5358264195.186.1.121192.168.1.10
Apr 3, 2014 12:03:51.378194094 MESZ5464853192.168.1.10195.186.1.121
Apr 3, 2014 12:03:51.635523081 MESZ5354648195.186.1.121192.168.1.10
Apr 3, 2014 12:03:52.337196112 MESZ51497972192.168.1.10119.172.162.34
Apr 3, 2014 12:03:53.143256903 MESZ5583053192.168.1.10195.186.1.121
Apr 3, 2014 12:03:53.457185984 MESZ5355830195.186.1.121192.168.1.10
Apr 3, 2014 12:03:54.967502117 MESZ5734753192.168.1.10195.186.1.121
Apr 3, 2014 12:03:55.228133917 MESZ5357347195.186.1.121192.168.1.10
Apr 3, 2014 12:03:56.742449045 MESZ5522253192.168.1.10195.186.1.121
Apr 3, 2014 12:03:56.985740900 MESZ5355222195.186.1.121192.168.1.10
Apr 3, 2014 12:03:58.496400118 MESZ5331153192.168.1.10195.186.1.121
Apr 3, 2014 12:03:58.774403095 MESZ5353311195.186.1.121192.168.1.10
Apr 3, 2014 12:04:00.052472115 MESZ51492106192.168.1.10109.152.14.70
Apr 3, 2014 12:04:00.273022890 MESZ5817553192.168.1.10195.186.1.121
Apr 3, 2014 12:04:00.534153938 MESZ5358175195.186.1.121192.168.1.10
Apr 3, 2014 12:04:02.047331095 MESZ5899653192.168.1.10195.186.1.121
Apr 3, 2014 12:04:02.321883917 MESZ5358996195.186.1.121192.168.1.10
Apr 3, 2014 12:04:02.329840899 MESZ104280192.168.1.1023.92.19.67
Apr 3, 2014 12:04:02.329910994 MESZ80104223.92.19.67192.168.1.10
Apr 3, 2014 12:04:02.330322981 MESZ104280192.168.1.1023.92.19.67
Apr 3, 2014 12:04:02.342402935 MESZ104280192.168.1.1023.92.19.67
Apr 3, 2014 12:04:02.342423916 MESZ80104223.92.19.67192.168.1.10
Apr 3, 2014 12:04:02.342566967 MESZ104280192.168.1.1023.92.19.67
Apr 3, 2014 12:04:02.342583895 MESZ80104223.92.19.67192.168.1.10
Apr 3, 2014 12:04:08.933561087 MESZ51494392192.168.1.10213.123.192.140
UDP Packets
TimestampSource PortDest PortSource IPDest IP
Apr 3, 2014 12:02:05.982043028 MESZ6395253192.168.1.10195.186.1.121
Apr 3, 2014 12:02:06.316936970 MESZ5363952195.186.1.121192.168.1.10
Apr 3, 2014 12:02:07.405324936 MESZ6014653192.168.1.10195.186.1.121
Apr 3, 2014 12:02:07.651335955 MESZ5360146195.186.1.121192.168.1.10
Apr 3, 2014 12:02:33.285137892 MESZ51498656192.168.1.1050.100.208.136
Apr 3, 2014 12:02:38.743045092 MESZ51496781192.168.1.10174.95.148.169
Apr 3, 2014 12:02:45.680710077 MESZ51494283192.168.1.10181.28.56.2
Apr 3, 2014 12:02:54.183640003 MESZ51495693192.168.1.10121.6.40.64
Apr 3, 2014 12:03:02.042473078 MESZ51492453192.168.1.1099.122.66.193
Apr 3, 2014 12:03:08.162892103 MESZ51496589192.168.1.10180.32.45.40
Apr 3, 2014 12:03:16.868084908 MESZ51499551192.168.1.10115.126.143.176
Apr 3, 2014 12:03:17.275559902 MESZ5996553192.168.1.10195.186.1.121
Apr 3, 2014 12:03:18.271532059 MESZ5996553192.168.1.10195.186.4.121
Apr 3, 2014 12:03:18.578278065 MESZ5359965195.186.4.121192.168.1.10
Apr 3, 2014 12:03:18.614217997 MESZ5359965195.186.1.121192.168.1.10
Apr 3, 2014 12:03:25.446681023 MESZ51492058192.168.1.1081.134.111.58
Apr 3, 2014 12:03:31.588347912 MESZ51493736192.168.1.1099.37.80.46
Apr 3, 2014 12:03:37.102421045 MESZ51491193192.168.1.10124.102.71.137
Apr 3, 2014 12:03:45.192882061 MESZ51495049192.168.1.10125.192.77.86
Apr 3, 2014 12:03:45.522948027 MESZ5661753192.168.1.10195.186.1.121
Apr 3, 2014 12:03:45.767858982 MESZ5356617195.186.1.121192.168.1.10
Apr 3, 2014 12:03:47.802067995 MESZ5118653192.168.1.10195.186.1.121
Apr 3, 2014 12:03:48.075978041 MESZ5351186195.186.1.121192.168.1.10
Apr 3, 2014 12:03:49.570564032 MESZ5826453192.168.1.10195.186.1.121
Apr 3, 2014 12:03:49.863223076 MESZ5358264195.186.1.121192.168.1.10
Apr 3, 2014 12:03:51.378194094 MESZ5464853192.168.1.10195.186.1.121
Apr 3, 2014 12:03:51.635523081 MESZ5354648195.186.1.121192.168.1.10
Apr 3, 2014 12:03:52.337196112 MESZ51497972192.168.1.10119.172.162.34
Apr 3, 2014 12:03:53.143256903 MESZ5583053192.168.1.10195.186.1.121
Apr 3, 2014 12:03:53.457185984 MESZ5355830195.186.1.121192.168.1.10
Apr 3, 2014 12:03:54.967502117 MESZ5734753192.168.1.10195.186.1.121
Apr 3, 2014 12:03:55.228133917 MESZ5357347195.186.1.121192.168.1.10
Apr 3, 2014 12:03:56.742449045 MESZ5522253192.168.1.10195.186.1.121
Apr 3, 2014 12:03:56.985740900 MESZ5355222195.186.1.121192.168.1.10
Apr 3, 2014 12:03:58.496400118 MESZ5331153192.168.1.10195.186.1.121
Apr 3, 2014 12:03:58.774403095 MESZ5353311195.186.1.121192.168.1.10
Apr 3, 2014 12:04:00.052472115 MESZ51492106192.168.1.10109.152.14.70
Apr 3, 2014 12:04:00.273022890 MESZ5817553192.168.1.10195.186.1.121
Apr 3, 2014 12:04:00.534153938 MESZ5358175195.186.1.121192.168.1.10
Apr 3, 2014 12:04:02.047331095 MESZ5899653192.168.1.10195.186.1.121
Apr 3, 2014 12:04:02.321883917 MESZ5358996195.186.1.121192.168.1.10
Apr 3, 2014 12:04:08.933561087 MESZ51494392192.168.1.10213.123.192.140
ICMP Packets
TimestampSource IPDest IPChecksumCodeType
Apr 3, 2014 12:03:18.614321947 MESZ192.168.1.10195.186.1.1218436(Port unreachable)Destination Unreachable
DNS Queries
TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
Apr 3, 2014 12:02:05.982043028 MESZ192.168.1.10195.186.1.1210xd4b7Standard query (0)partners-gs.comA (IP address)IN (0x0001)
Apr 3, 2014 12:02:07.405324936 MESZ192.168.1.10195.186.1.1210xf76dStandard query (0)www.download.windowsupdate.comA (IP address)IN (0x0001)
Apr 3, 2014 12:03:17.275559902 MESZ192.168.1.10195.186.1.1210x6863Standard query (0)aulbbiwslxpvvphxnjij.bizA (IP address)IN (0x0001)
Apr 3, 2014 12:03:18.271532059 MESZ192.168.1.10195.186.4.1210x6863Standard query (0)aulbbiwslxpvvphxnjij.bizA (IP address)IN (0x0001)
Apr 3, 2014 12:03:45.522948027 MESZ192.168.1.10195.186.1.1210x9c28Standard query (0)www.google.comA (IP address)IN (0x0001)
Apr 3, 2014 12:03:47.802067995 MESZ192.168.1.10195.186.1.1210xbf48Standard query (0)hdcujzgmhqgweufmjfrwthmdupn.orgA (IP address)IN (0x0001)
Apr 3, 2014 12:03:49.570564032 MESZ192.168.1.10195.186.1.1210x313eStandard query (0)emqsfyducjnmbibibhizpcufqnrpo.infoA (IP address)IN (0x0001)
Apr 3, 2014 12:03:51.378194094 MESZ192.168.1.10195.186.1.1210x8a6fStandard query (0)vheaiheudairozltvxwhscx.comA (IP address)IN (0x0001)
Apr 3, 2014 12:03:53.143256903 MESZ192.168.1.10195.186.1.1210xcf3bStandard query (0)hdrgcshsjbnbobylampt.ruA (IP address)IN (0x0001)
Apr 3, 2014 12:03:54.967502117 MESZ192.168.1.10195.186.1.1210x4e9bStandard query (0)ojamxrwylyxwshgixjzormqo.comA (IP address)IN (0x0001)
Apr 3, 2014 12:03:56.742449045 MESZ192.168.1.10195.186.1.1210xd18Standard query (0)dikzhhiealaypkbvwlemha.infoA (IP address)IN (0x0001)
Apr 3, 2014 12:03:58.496400118 MESZ192.168.1.10195.186.1.1210x148eStandard query (0)mnvrwhzhskyxceucztswavohcegu.orgA (IP address)IN (0x0001)
Apr 3, 2014 12:04:00.273022890 MESZ192.168.1.10195.186.1.1210xb2e9Standard query (0)alvohyhgypfyrsgewgifcrgifjz.netA (IP address)IN (0x0001)
Apr 3, 2014 12:04:02.047331095 MESZ192.168.1.10195.186.1.1210xabd2Standard query (0)huuofukzdeguflbhmafyivkj.bizA (IP address)IN (0x0001)
DNS Answers
TimestampSource IPDest IPTrans IDReplay CodeNameCNameAddressTypeClass
Apr 3, 2014 12:02:06.316936970 MESZ195.186.1.121192.168.1.100xd4b7No error (0)partners-gs.com94.23.146.92A (IP address)IN (0x0001)
Apr 3, 2014 12:02:07.651335955 MESZ195.186.1.121192.168.1.100xf76dNo error (0)www.download.windowsupdate.com92.123.155.25A (IP address)IN (0x0001)
Apr 3, 2014 12:03:18.578278065 MESZ195.186.4.121192.168.1.100x6863No error (0)aulbbiwslxpvvphxnjij.biz50.116.4.71A (IP address)IN (0x0001)
Apr 3, 2014 12:03:18.614217997 MESZ195.186.1.121192.168.1.100x6863No error (0)aulbbiwslxpvvphxnjij.biz50.116.4.71A (IP address)IN (0x0001)
Apr 3, 2014 12:03:45.767858982 MESZ195.186.1.121192.168.1.100x9c28No error (0)www.google.com173.194.65.105A (IP address)IN (0x0001)
Apr 3, 2014 12:03:48.075978041 MESZ195.186.1.121192.168.1.100xbf48Name error (3)hdcujzgmhqgweufmjfrwthmdupn.orgnonenoneA (IP address)IN (0x0001)
Apr 3, 2014 12:03:49.863223076 MESZ195.186.1.121192.168.1.100x313eName error (3)emqsfyducjnmbibibhizpcufqnrpo.infononenoneA (IP address)IN (0x0001)
Apr 3, 2014 12:03:51.635523081 MESZ195.186.1.121192.168.1.100x8a6fName error (3)vheaiheudairozltvxwhscx.comnonenoneA (IP address)IN (0x0001)
Apr 3, 2014 12:03:53.457185984 MESZ195.186.1.121192.168.1.100xcf3bName error (3)hdrgcshsjbnbobylampt.runonenoneA (IP address)IN (0x0001)
Apr 3, 2014 12:03:55.228133917 MESZ195.186.1.121192.168.1.100x4e9bName error (3)ojamxrwylyxwshgixjzormqo.comnonenoneA (IP address)IN (0x0001)
Apr 3, 2014 12:03:56.985740900 MESZ195.186.1.121192.168.1.100xd18Name error (3)dikzhhiealaypkbvwlemha.infononenoneA (IP address)IN (0x0001)
Apr 3, 2014 12:03:58.774403095 MESZ195.186.1.121192.168.1.100x148eName error (3)mnvrwhzhskyxceucztswavohcegu.orgnonenoneA (IP address)IN (0x0001)
Apr 3, 2014 12:04:00.534153938 MESZ195.186.1.121192.168.1.100xb2e9Name error (3)alvohyhgypfyrsgewgifcrgifjz.netnonenoneA (IP address)IN (0x0001)
Apr 3, 2014 12:04:02.321883917 MESZ195.186.1.121192.168.1.100xabd2No error (0)huuofukzdeguflbhmafyivkj.biz23.92.19.67A (IP address)IN (0x0001)
HTTP Request Dependency Graph
  • www.download.windowsupdate.com
  • default
  • www.google.com
HTTP Packets
TimestampSource PortDest PortSource IPDest IPHeaderTotal Bytes Transfered (KB)
Apr 3, 2014 12:02:10.680429935 MESZ103480192.168.1.1092.123.155.25GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: www.download.windowsupdate.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
3
Apr 3, 2014 12:02:10.796554089 MESZ80103492.123.155.25192.168.1.10HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Wed, 12 Mar 2014 05:29:31 GMT
Accept-Ranges: bytes
ETag: "806f4cbb43dcf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 18
Cache-Control: max-age=3203
Date: Thu, 03 Apr 2014 10:02:10 GMT
Connection: keep-alive
X-CCC: SE
X-CID: 2
Data Raw: 31 34 30 31 43 46 33 44 42 34 30 42 36 30 39 38 39 32
Data Ascii: 1401CF3DB40B609892
3
Apr 3, 2014 12:02:10.830758095 MESZ103480192.168.1.1092.123.155.25GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: www.download.windowsupdate.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
3
Apr 3, 2014 12:02:10.906096935 MESZ80103492.123.155.25192.168.1.10HTTP/1.1 200 OK
Content-Type: application/octet-stream
Last-Modified: Wed, 12 Mar 2014 20:20:10 GMT
Accept-Ranges: bytes
ETag: "0b96c77303ecf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 54007
Cache-Control: max-age=3412
Date: Thu, 03 Apr 2014 10:02:10 GMT
Connection: keep-alive
X-CCC: SE
X-CID: 2
Data Raw: 4d 53 43 46 00 00 00 00 f7 d2 00 00 00 00 00 00 2c 00 00 00 00 00 00 00 03 01 01 00 01 00 00 00 00 00 00 00 49 00 00 00 04 00 01 00 f7 f1 01 00 00 00 00 00 00 00 6c 44 78 61 20 00 61 75 74 68 72 6f 6f 74 2e 73 74 6c 00 c0 82 0c d6 81 38 00 80 43 4b d4 9c 09 3c 54 dd ff c7 67 b8 76 21 4d f6 64 0d d9 66 10 25 64 df f7 7d 4b d6 90 35 fb 9a 46 f6 a5 64 27 4b 92 ca d2 a2 a4 92 25 4b c9 92 25 84 ca 1e 21 da 90 3d ff 6b d4 13 cf 9d a7 e7 c9 d3 ff f5 7b 3d 2f af 19 f7 9e 7b 67 e6 7e de
Data Ascii: MSCF,IlDxa authroot.stl8CK<Tgv!Mdf%d}K5Fd'K%K%!=k{=/{g~
4
Apr 3, 2014 12:02:10.908709049 MESZ80103492.123.155.25192.168.1.10Data Raw: e7 9c ef f9 de ef f9 9e 8b 3c 03 ff f4 19 9f 68 7f 98 62 d8 fc 0e 38 01 ce 45 70 7f 78 bd b0 0f 07 0e 47 91 20 89 f0 f1 b8 c9 70 71 e8 f0 60 60 61 c7 69 7c 22 6e 7c 38 00 0f 16 21 86 83 67 76 b8 ae 17 3a 20 49 f1 89 bf 17 e3 12 e1 10 21 e0 ad e2
Data Ascii: <hb8EpxG pq``ai|"n|8!gv: I!%$;PBHA!AL':0IfD"N#_?Em1\${P:/\YBm:dE)V$Dn:0ES"oqKIK(
5
Apr 3, 2014 12:02:10.908754110 MESZ80103492.123.155.25192.168.1.10Data Raw: ee cc 26 a3 0c 0e 9f d4 5c ed 0d 97 73 d1 f0 79 bd f4 a2 73 dd 3f fb d9 a8 0c 87 42 5c 72 a8 d0 d8 f3 f1 76 fb a8 3e 8f 37 a1 ed f0 c3 ed 42 d4 11 68 bf d3 1a b4 34 f8 e9 e2 d1 50 f5 f8 e7 59 72 7b 4a 34 a0 48 42 97 f9 cf f7 51 72 18 c3 e5 4a 85
Data Ascii: &\sys?B\rv>7Bh4PYr{J4HBQrJu4Bp_Da1S@S+WRmu%+[9cfPqh(<Ts:U_'?PkRJ76uYtA1zB3m&B]>D
7
Apr 3, 2014 12:02:10.908766031 MESZ80103492.123.155.25192.168.1.10Data Raw: 39 14 e2 cb 4a ee c7 f9 a8 3f 1c 8f 47 a0 10 88 93 e8 c5 61 71 6e fb 1c 6e 3a 11 be 9f 69 ac 1b 32 54 2e b7 7a 9a af b0 ff 31 d7 cd b4 99 f9 f3 a8 74 19 6f 73 ab b9 d8 46 64 c0 16 0e ce 80 a3 32 58 f5 ae 98 5b 5e ec 61 87 ef 8d 42 07 73 cc 0b 53
Data Ascii: 9J?Gaqnn:i2T.z1tosFd2X[^aBsS#V0oG@nvbUEm6Bn(=fow_f+LM +B41j ->y)=qSh]@n(,1cYwo{7k
8
Apr 3, 2014 12:02:10.909207106 MESZ80103492.123.155.25192.168.1.10Data Raw: 40 30 a5 c1 4a c5 93 0c 38 11 a4 ed c2 2c 3d 4f c2 2f bf 83 85 a2 d0 35 bf 0e 85 7b 35 dd 75 ac d3 9f 25 bf a5 7e e0 83 df 21 6f 28 14 37 a5 1a 77 a1 27 7a b3 24 5e 6e e8 53 de b3 e1 6f 9f dc 26 fb 29 94 4d 33 5c 50 28 06 70 0d b1 4a ea e0 82 0b
Data Ascii: @0J8,=O/5{5u%~!o(7w'z$^nSo&)M3\P(pJGWu&z!8|
9
Apr 3, 2014 12:02:10.918570042 MESZ80103492.123.155.25192.168.1.10Data Raw: d1 82 a0 ba 51 d0 e1 7d 1b b3 47 5b 9c a1 37 49 a3 88 8e ee 4e 85 58 59 8e c9 0a 0a dd fc eb ea 44 17 82 c9 8a b4 75 c8 39 56 42 82 a2 ad 05 5d a0 ea 6e 3e 91 73 2b ec 1d bf 13 91 c8 5b 36 66 b9 64 1d 96 f8 24 f6 a7 ce 11 ce 3f 9b 2f e7 a7 b0 5c
Data Ascii: Q}G[7INXYDu9VB]n>s+[6fd$?/\y/=,ZzT>tuFx=$zY.=amDZcXvm3cfP9=e3j/1C'g_c@;eftc-u\7}x7
10
Apr 3, 2014 12:02:10.918605089 MESZ80103492.123.155.25192.168.1.10Data Raw: b5 5b 44 e7 e7 eb 21 d6 66 0d 8a e6 be 04 f9 fe 66 6d b7 6e 19 fa 7e b0 c7 d4 61 eb 8c f9 1c 5b 13 d3 a7 af d7 23 61 2e 41 86 27 38 4d 78 4d b0 d6 e1 c8 ac e5 b4 c4 b3 c9 82 fc 07 43 ab a4 23 21 e5 db bb 72 4a 91 32 39 ea f7 d7 b9 f6 ad 56 3f fb
Data Ascii: [D!ffmn~a[#a.A'8MxMC#!rJ29V?Z9a;8iOxT$4X?GB??Tu7zByTIBV@*0-|s{ZS2>D4B+xM{^FViVfNx'kuO3YasfR
12
Apr 3, 2014 12:02:10.918968916 MESZ80103492.123.155.25192.168.1.10Data Raw: ca 13 ad b0 ab bd 6b 6f a0 82 8b 6a 1a ae 0a 9c ba 5e a2 41 df 2c b6 5c 9c 71 bc ff 80 ef 3f 5d 82 8b 2d 91 d8 bd 93 70 bf bf bc 40 82 86 62 5e 33 e3 28 2c 81 ff 38 a3 7e ad 7c 80 69 48 07 42 41 c1 81 14 3a f9 f4 a3 e3 ea 81 0e a1 3d c6 30 5a 63
Data Ascii: koj^A,\q?]-p@b^3(,8~|iHBA:=0Zc&0-l#LeR%Ob}ilLv[DAyE)L5}_kkeOdSoG)4L|<[o>[fpHK(~(~3;XA
12
Apr 3, 2014 12:02:10.926739931 MESZ80103492.123.155.25192.168.1.10Data Raw: e7 67 6f 1d a9 6d f5 bf 1d 1f 66 69 77 4f 8b 45 fc 2e 85 10 5e 13 76 7a a9 2f 56 51 d9 7e 85 78 3b 7b db cc de 45 d4 d2 42 e9 5d e3 4c 6b ce 8b 50 0a 86 0d cf 6b ba a6 0d 31 78 89 67 c1 b6 4f ef 46 fc 04 0c a6 4b 97 55 4e 41 ef 5a 5a 2b 6a 39 97
Data Ascii: gomfiwOE.^vz/VQ~x;{EB]LkPk1xgOFKUNAZZ+j9'W6CwUjcY<o[\NO+W/72+(#hE2bIgt>=6jV}Wug&t_$9 %C|OpZ-[_YU'85
13
Apr 3, 2014 12:02:10.945070028 MESZ80103492.123.155.25192.168.1.10Data Raw: a4 58 6b 27 97 b2 53 3f 95 32 8b e0 c5 32 79 cb 37 30 81 2e 69 0b 59 3d fb 30 bf 6f 91 34 77 64 46 49 07 c9 b9 45 07 1d 40 63 00 5e cb 0f 9b 81 82 1d c2 fc 61 73 8e 03 63 c6 59 58 b8 e3 1e 15 cb 48 d7 5f 43 1c dd cb 76 60 af 1a dd de c1 e9 55 14
Data Ascii: Xk'S?22y70.iY=0o4wdFIE@c^ascYXH_Cv`U#J?/h8k*@cz!Z+\~3T9Go7FzJZBuGdZ{ifk1-n>6U]ct6ikKx2|4=6@@J&,r_::|6BA
14
Apr 3, 2014 12:02:10.945076942 MESZ80103492.123.155.25192.168.1.10Data Raw: f7 8d 9f f5 58 e4 a6 2b df 7d f8 0b dd ab bf 09 8a ff 10 80 d3 cf 9d ba 3c 8f dd cf 95 8b 9a 8c 6b 48 45 55 94 78 e6 6a 5f 34 2d 66 28 49 f1 70 90 f9 d7 84 81 e8 df 9f 04 d8 7c 42 49 07 f4 cc 0e 61 a5 2e 6a 45 d0 58 3f 2d 6a 19 8c 90 4b 85 6d 3e
Data Ascii: X+}<kHEUxj_4-f(Ip|BIa.jEX?-jKm>'_Ucv}6Uq.%Z8Y?o(9Y^,5ud53j`/"~/]_jW41C`|IayfgtD
16
Apr 3, 2014 12:02:10.945163012 MESZ80103492.123.155.25192.168.1.10Data Raw: fb a7 4b 93 8b b1 1d ac bb f5 d0 7f 19 bd b6 05 a0 a8 1d b9 22 7c f5 4e 12 9f 72 4d b3 c1 6d aa ac d7 44 a9 f3 99 48 28 6a 63 87 f2 e9 3e 47 3c 3c 7d 29 c8 26 49 a5 f9 60 df ee d4 45 93 68 a9 16 c2 30 4f ea f2 3c 8e f3 23 d0 ed 78 04 a4 37 da ae
Data Ascii: K"|NrMmDH(jc>G<<})&I`Eh0O<#x7RdRHUV@V}He|>[13=VEtLI5(>iIHn?g%l9L%/>+9hLHQL$AdJ^`,qVl.C,+NJZA.O;/Tbo
17
Apr 3, 2014 12:02:10.945432901 MESZ80103492.123.155.25192.168.1.10Data Raw: 67 3c 4e ab e4 98 2d fe 71 1b cc 45 32 8f 74 b3 9b df c5 50 44 5d a5 61 8d 36 a1 39 5e e0 c5 46 98 a6 13 4f 2b 7b 87 71 d7 ab 6b cc e4 bf cc eb b2 02 c8 a4 16 1f f6 4f bb 43 2f 11 28 90 b9 46 a5 5e 6e 72 7c 3e 67 0f 7f b9 09 d5 a2 75 62 46 d1 68
Data Ascii: g<N-qE2tPD]a69^FO+{qkOC/(F^nr|>gubFhkr*]slKBWxKQ1,@n}#Tt*=?>=1@Zc5v\MB!EZoATbO,Y6LS$.[8iNtTn$+.YvHxkOgm
19
Apr 3, 2014 12:02:10.945439100 MESZ80103492.123.155.25192.168.1.10Data Raw: 0f ed 15 0b 66 80 e2 50 7d 06 87 f6 62 21 2c 71 f9 c4 d1 6b 9f 71 d9 c3 86 c9 d0 c5 83 88 63 c6 90 6e 8a fd a1 aa f5 9b 9f 30 6e 52 d8 0a dc ff cb b7 e9 02 48 f6 28 31 e3 93 ea 3e f3 6f 5c 8e 91 db a6 b7 df 4b 3b 3a f9 0e c2 c9 07 d1 15 72 2e cc
Data Ascii: fP}b!,qkqcn0nRH(1>o\K;:r.M^@u`T&sS$U%kz0t+zGZ83F5ukthqAC0aYXtM8rJME!W=2K+.iAx|`:L?p
20
Apr 3, 2014 12:02:10.945441961 MESZ80103492.123.155.25192.168.1.10Data Raw: a9 e4 22 9e f8 3a 28 88 e6 c4 c5 b8 dc d2 36 bc 26 5d 23 c2 e4 fa 5d a9 c5 9f 70 60 54 fa 03 e2 7d 16 e7 6e be 71 d9 39 1b cd 8f 1f 1c 41 30 6f f4 80 f2 6d d5 f6 e9 84 ad 95 4d fb 73 a5 ae 6d d2 ca 81 8c 55 fe f1 b6 4c 96 af a9 aa 3d 00 c2 96 47
Data Ascii: ":(6&]#]p`T}nq9A0omMsmUL=G^z)0]MUx~kb<e*b/0A&y.Pvi,^8Bz7d:.zfV7O]@Dg5(bIj`$wK-4a6eIt
21
Apr 3, 2014 12:02:10.945971966 MESZ80103492.123.155.25192.168.1.10Data Raw: a0 a0 bc a2 7b 09 75 ad 18 91 c5 c7 09 ba f5 f3 a2 b8 7b 3a e9 2e a1 36 f0 22 c1 f0 5a 5f 06 bb ce ab 80 16 7a cb 74 49 3b 9b d4 3f 40 3e dc b2 7f ef 5c db d3 53 31 09 4f 18 90 8b 21 0e 86 ca 91 53 7b 19 62 bf 7b 00 c6 f3 e3 c2 bb 59 3f 9a a2 c3
Data Ascii: {u{:.6"Z_ztI;?@>\S1O!S{b{Y?~)NG-IUBfDcA((^eekLb{}tLe)?5$L9S;=GU;iZmJDd64ay%~wTzNQ*!T&:6vW-oXy`%
22
Apr 3, 2014 12:02:10.945976973 MESZ80103492.123.155.25192.168.1.10Data Raw: 86 01 19 fb 40 d3 2c fb 77 1f 25 a2 c4 f4 04 5e ca 7e 57 35 6f c1 fd a2 33 11 ec 75 ec 47 5d 8a bf 97 b1 c1 b8 14 10 c1 08 5d 6c 75 ef 09 6c 6c 61 bd 9a f6 c6 b9 be 7f bf fa 1a fb 2e 58 00 84 84 4c 82 2f c1 13 d2 9b 75 fa 8a ea 8d fd ad 69 38 4a
Data Ascii: @,w%^~W5o3uG]]lulla.XL/ui8JKe #>9"\>^c8&OfJcJ*2DeJ23RW[nF%XlpdKZX[v(Kw,*u-79C
24
Apr 3, 2014 12:02:10.946080923 MESZ80103492.123.155.25192.168.1.10Data Raw: 0e a3 a4 3f 84 bd f2 fd 00 3d 7f b4 d7 bc ba 75 2a 42 10 b0 1d cc fb 26 6d 95 57 64 f8 cc a3 5f 16 1a 20 99 94 28 0a c6 a1 60 83 df 19 57 a2 27 b4 3b 4f f9 0b b0 5f 28 a3 07 64 c9 1c fb 6a 7c 07 1f 84 e7 9f a6 99 68 b8 2b bc 29 51 ff ad df 80 72
Data Ascii: ?=u*B&mWd_ (`W';O_(dj|h+)Qr(TF\6Gi[[pt*S=6~XfU+Yak?k$qcRS[|Z%we[bUsfCL\M*ku@pL)@pV\}s0G@7ixI
24
Apr 3, 2014 12:02:10.958765030 MESZ80103492.123.155.25192.168.1.10Data Raw: 19 d2 93 3c 9d 75 5e c4 97 c2 73 05 31 07 95 09 4d d0 bb b2 e4 e1 91 98 96 27 9e 7f 60 22 c2 d1 e7 45 fd 77 5d 18 20 3f e7 08 49 ae 96 d8 c7 a6 8a ab ad d1 ea e0 63 22 bb 4f 7d e4 b0 f0 93 7c 3e 2b af 3a 8a 25 f8 e8 a2 a1 38 d0 26 10 93 a9 e7 86
Data Ascii: <u^s1M'`"Ew] ?Ic"O}|>+:%8&U8N7mBWDRQB&[CK-yJiUxQxBui%VukU %E(w:Q?\B3"\g!WWWNn:4!.XL`Va,
25
Apr 3, 2014 12:02:10.959160089 MESZ80103492.123.155.25192.168.1.10Data Raw: 11 be 16 7c cd 58 ca 2d 43 c7 47 c0 91 aa 27 41 97 49 4e 80 09 96 33 00 62 f5 e6 73 de 35 6e bb e9 9c 74 1a 82 4c f7 c3 55 20 2f 9d 44 e7 9b 1b 09 57 59 50 b5 cd 13 e5 11 f7 07 fd c4 8e 9c 03 51 cd e8 9f 3c 12 aa 3d 1b a6 ec e5 72 c0 b7 ad 18 87
Data Ascii: |X-CG'AIN3bs5ntLU /DWYPQ<=rLLRf{Oelf~+.>Rlk+ko8o[} v\w5IY^+O({:.g@ByA[Q}M1$:IBMds"#4]Q+jQ^c*6@
26
Apr 3, 2014 12:02:10.959167004 MESZ80103492.123.155.25192.168.1.10Data Raw: a1 b9 4b 62 a9 cf a7 43 fb 55 b9 5c e4 b8 4d 81 ff a4 f9 7b de c7 ba 13 8c b7 e7 3a e0 39 ff 28 a7 0b 6b a8 18 79 b2 76 2a ce 19 92 15 21 b5 9c 8b d7 c9 93 d2 15 bc ed 09 b8 a1 e2 cc 59 d4 48 89 f2 ec 98 bc 44 d0 9d 9e a3 cd 20 af 8e 90 f2 17 48
Data Ascii: KbCU\M{:9(kyv*!YHD H"'>58B \cG)##F_U'KSt_^b6P,5QkYZY`I\0)N2=Yo<.414Xm#q|\%M: 1>wUQCT3 H7gL*nk\
28
Apr 3, 2014 12:02:10.959269047 MESZ80103492.123.155.25192.168.1.10Data Raw: fb b8 9e e8 34 b2 66 08 58 2c f8 0c 8b 6d 78 24 4b 1e 12 2e 9d 2f 6c fd 89 47 3f cb a0 e9 27 c9 48 78 df 8b 84 91 b9 c1 de 71 89 51 35 69 5b 7d 5a 1b 81 ad aa ee f3 54 c5 44 d1 28 33 22 1f 0d 9d 38 0a 83 fb 23 60 d3 e5 db de b7 19 96 d9 be f6 42
Data Ascii: 4fX,mx$K./lG?'HxqQ5i[}ZTD(3"8#`BeubE&hvAaT1;ZPVbZ&)i@'S8C1C3Lg%o#11iJeD_R~(QoK:[;q1Lk[.
29
Apr 3, 2014 12:02:10.964056969 MESZ80103492.123.155.25192.168.1.10Data Raw: 65 63 ba 2a c3 a4 46 7d af d0 08 c1 81 08 79 c9 a7 9a 76 bf 3d 68 fc a2 1a d7 0a 67 92 07 24 11 4d 3f 96 e0 88 70 6e 3f 7f ed c5 5a 52 6d 47 73 fe 62 a3 70 90 1c 43 77 d4 e8 8d 73 12 7b 1d 90 2f 8e 11 8f 05 5c a4 1c ae ba 76 f3 2c 4b c6 6b 45 98
Data Ascii: ec*F}yv=hg$M?pn?ZRmGsbpCws{/\v,KkE] zM^~P3YB[yRB+]I52fwyp'8wJB&pA}C@*2xL \~);z<ynTX"@a,>\x
29
Apr 3, 2014 12:02:10.964610100 MESZ80103492.123.155.25192.168.1.10Data Raw: 6a c1 ec 11 10 e9 e0 45 27 d5 03 75 95 bd c6 37 d5 91 39 b4 c2 57 53 1b 2e f9 82 50 19 76 43 1e 7f ea 2d 58 59 62 d2 be c2 d5 20 a8 23 a3 ec a7 d2 52 cd e5 f1 36 7f 55 ef 46 52 88 fb dc 77 8f 1f 88 11 12 c8 f6 df f9 50 19 be f1 e2 e2 03 f5 c2 70
Data Ascii: jE'u79WS.PvC-XYb #R6UFRwPp,w]eKp"ZkxY3ysf/=nC,(^U1|'8[pUVO_;uS$O0[o'g5-,1Q{.w{+cw,vCa
31
Apr 3, 2014 12:02:10.964616060 MESZ80103492.123.155.25192.168.1.10Data Raw: 80 b8 6a 3d 68 7a 3f e4 42 98 2f 1c 93 3c b8 75 61 d7 dd cb 4a 0e 8f 81 b8 8e cf 8d 96 dd f4 15 95 37 90 f7 0b 38 c0 f2 c4 ba 7f bc 18 a3 ac 2f 52 9c cf 73 3c 0e f9 a6 d0 60 9d d0 a7 11 49 e8 53 8a dc 2a 30 c7 a8 52 73 52 d3 82 cf bb 01 fe f3 73
Data Ascii: j=hz?B/<uaJ78/Rs<`IS*0RsRs+(S6*7G!pM",@L1dDd)1D2d<92hj1&@)UF1L0UkaW9sWx^/lWl1q6fYg7Hd$
32
Apr 3, 2014 12:02:10.964706898 MESZ80103492.123.155.25192.168.1.10Data Raw: 36 93 92 5e 17 72 05 20 08 29 3e 29 1e 7a 06 d2 b3 03 23 1a 9a 4d a9 77 3f ed 46 01 3a af 1f 3b 15 6b a4 e0 1f ef f5 da 10 ec 77 91 73 72 5b dd 74 89 cf ac 04 39 c8 a8 bf a5 2d 29 c4 e3 75 43 55 5c 45 11
Data Ascii: 6^r )>)z#Mw?F:;kwsr[t9-)uCU\E
32
Apr 3, 2014 12:02:10.964823008 MESZ80103492.123.155.25192.168.1.10Data Raw: 68 5b 5d 4f 6e a9 52 5e 4f 30 22 a5 37 10 75 29 6b 5f 2f 10 c3 59 a7 79 ac 76 11 5a 8d ba 2b 54 7d 08 4e 57 72 a2 91 7e 2f 70 65 90 d2 98 72 27 a7 7a 24 5f ac 43 fc 04 b3 a9 d8 5f a0 12 c3 7e 38 fe 28 c6 a4 6e 3a 21 78 fc 1b e5 29 1f 54 be d1 b9
Data Ascii: h[]OnR^O0"7u)k_/YyvZ+T}NWr~/per'z$_C_~8(n:!x)T`;umu(.%jI_A@`]{=j~YbUvIc,%0U)k|nn)*ooxS{LV@H(gIgu6Km5TW9
34
Apr 3, 2014 12:02:10.964828968 MESZ80103492.123.155.25192.168.1.10Data Raw: 54 5c 42 df 90 20 51 45 2a 41 4f 0a d6 b4 5d 14 cf 0a 16 0a b2 2c 18 32 99 b5 25 66 4c 79 75 61 57 53 ed cc dd a3 76 23 60 c8 9f 87 e2 46 8f bf cc cf 62 45 68 ce 16 06 3b df b5 f6 d9 a7 0d 86 7c a5 ae 11 eb 4f c9 22 a9 28 ee 98 88 b3 5e fe 48 85
Data Ascii: T\B QE*AO],2%fLyuaWSv#`FbEh;|O"(^HOW7yGu+,kWm6_ok,7EL?E1\kQKYlhb&D"z%KQ@5gEOz>Ys%2G{>V"aU0&/t'fSw7
35
Apr 3, 2014 12:02:10.964831114 MESZ80103492.123.155.25192.168.1.10Data Raw: 02 43 fd b9 07 c7 66 ac bc bb 87 d5 75 15 80 35 4e 2c 55 17 ce 46 1a bb 7b fe d1 77 32 37 36 f1 30 97 4e 1e dc 75 10 0c f5 ba 9b 7b f3 31 7a c1 e9 97 9a b2 61 a4 a4 31 0e 10 25 b9 c1 f7 9d 57 dd ec 27 79 3e 8c 06 1b cb e8 f2 1c ba 7c f2 18 58 08
Data Ascii: Cfu5N,UF{w2760Nu{1za1%W'y>|XzQs:]|JNp7;l6r$O"@ifGG5Y/R&Y%HimEKNeL&=AOfr#_BeL*QT-yq,
36
Apr 3, 2014 12:02:10.965390921 MESZ80103492.123.155.25192.168.1.10Data Raw: 8c db 1d 23 2e 13 c8 f1 1b de cb e8 08 be 66 57 44 0b 83 d7 60 68 a0 d6 87 1e c6 ba fd aa 14 b4 78 0d 1d 35 d1 32 96 71 bd 43 52 7e a1 33 59 7d a2 d8 79 51 5a f0 90 49 2a 74 d4 f4 4c a6 f3 58 6c 55 d7 d0 05 6f 9c 3e f5 1a 33 18 44 b2 7d 90 45 36
Data Ascii: #.fWD`hx52qCR~3Y}yQZI*tLXlUo>3D}E6f]]0z{5Esn-#%f?g'p}h]L@ZGB2){?yBioTUl,n>MUm'3
37
Apr 3, 2014 12:02:10.965398073 MESZ80103492.123.155.25192.168.1.10Data Raw: 88 54 c5 be 58 14 34 52 97 1d 48 33 9a 85 a8 e8 a5 ab 9e 2a 21 69 c3 f5 df 1f e2 b5 72 f1 12 15 cb 8b 99 67 db 77 50 0a 38 fc ee 29 4b 61 93 45 67 73 6e 93 29 de 9f 8f 59 ed 3e 14 be 77 a4 08 92 4c e4 3b cf dc 31 75 1a ec 6e a2 82 da 7b 7f ee 2b
Data Ascii: TX4RH3*!irgwP8)KaEgsn)Y>wL;1un{+E/0\\UyQj@y1AHM9y:gFRciVn|sO:Gc3p~VUGup~Xan:oW<s9mdv~pf
39
Apr 3, 2014 12:02:10.965497971 MESZ80103492.123.155.25192.168.1.10Data Raw: 49 ad e9 93 6d 93 90 cc 89 75 10 7f 47 f2 41 2f a1 8c 41 9a 79 61 06 b6 96 c8 56 0a 63 b0 72 16 90 22 23 96 b7 e6 76 85 5d 76 b7 65 b7 45 84 b6 ab bf 4e 91 57 33 19 21 d1 9d 98 db 56 4b a1 71 2e 0a 40 7f 07 d5 31 f2 ed 48 85 7f 48 b9 73 bf ed 7a
Data Ascii: ImuGA/AyaVcr"#v]veENW3!VKq.@1HHszz]6UM^'A?pjvLfEGLv_9_ddRi^M5oVB{u79VxaII=Z=|}. 4(8L#
40
Apr 3, 2014 12:02:10.977912903 MESZ80103492.123.155.25192.168.1.10Data Raw: e3 04 61 2e 0b e0 f3 97 98 08 3e 42 d8 38 e3 8c 4c 24 0a 6d bc e2 53 c2 7f 74 fe 92 e0 30 ae 57 67 cb b1 ca 87 76 b6 b2 76 ef 87 7e ad 35 34 04 59 4a a5 15 bd 2e f9 68 af be b2 e2 6d 75 b2 a1 f3 84 ac b3 e7 8a 61 4a 25 29 5e 43 16 ef db 93 d3 9d
Data Ascii: a.>B8L$mSt0Wgvv~54YJ.hmuaJ%)^C~xDR11]&?f7Tub4W<^@R[yEa9G3o;T/.W23SqH(Ds<w.*{4tWc._?C6U@{b2|YHM&
41
Apr 3, 2014 12:02:10.984586000 MESZ80103492.123.155.25192.168.1.10Data Raw: 16 b0 19 95 c5 4d cd 64 36 7d 18 b2 df f6 a2 4d 6c 18 e7 3b 72 76 d9 ea dd b2 03 30 60 f8 fb f0 95 bd 6e 05 63 b4 d3 88 bf 9d be d0 bd 0e 9a 92 fb 9a 1a 3a 28 9a f4 10 28 3b b4 6f 86 69 61 93 3a 80 3f 52 31 75 9a b1 1c af c3 bd 0a bc 04 59 3e cd
Data Ascii: Md6}Ml;rv0`nc:((;oia:?R1uY>N1k3@_IA]J]td,^]/J@{k.`i#y[;z`CyjMNCA%V;9rnL$B*)LPd!s)HHBH$
42
Apr 3, 2014 12:02:10.984616995 MESZ80103492.123.155.25192.168.1.10Data Raw: 08 e3 75 fe 4c 6d d9 a6 b8 67 18 26 d1 40 ba aa 63 f0 36 52 b7 d2 5e 9f 57 87 e2 b9 36 9e 9e c0 3d f2 ca 1a 98 69 fc 6f 51 58 a6 af 6a 64 cc a0 8c 2d ab 6f d8 0c 51 15 bf 28 33 d0 20 f4 d1 1d 29 48 8b ec 5c bf e9 46 4d 40 f2 ea 35 5f 3b 75 96 fd
Data Ascii: uLmg&@c6R^W6=ioQXjd-oQ(3 )H\FM@5_;uJcj'Ho!d,{Y*Qk-7H.:JodDX3h|\o9U3&gr4P4M$*>Cu`<!PkmVI:vhbZjXI>U *JaP,-:Ni
44
Apr 3, 2014 12:02:10.984627962 MESZ80103492.123.155.25192.168.1.10Data Raw: 77 b7 08 76 4a 65 b5 48 1c 65 82 2f e1 87 93 d5 da 38 39 a4 86 17 40 df 59 35 bf a3 20 5d da a1 ce d1 3d 25 cc 9c f1 30 7d 97 39 12 56 c7 ee 76 92 eb de 42 cd 42 a3 66 be db ee 63 06 7e 30 62 e8 2a d2 a8 92 ba 57 96 3a 5a c6 59 e8 44 2a 4a a5 f7
Data Ascii: wvJeHe/89@Y5 ]=%0}9VvBBfc~0b*W:ZYD*J<\/_Xu2OE&T]x^XO:#<r=s^%A#%$pahPR"kI&/[esDfy$x{2df+b+#
45
Apr 3, 2014 12:02:10.985069990 MESZ80103492.123.155.25192.168.1.10Data Raw: 26 5b 1e 81 2f 56 36 39 ed 75 cd b6 26 95 85 54 f7 6e 4d 8c 07 2f 93 0a 2f 8f f0 7c 73 1c 8f 44 9a 8e 5f 88 c6 89 7b 14 cb 6a 3a 4c a0 52 fe 70 28 20 6a 57 8d cd 03 e5 b3 34 f7 b3 57 2a 94 02 e4 a0 95 18 b3 89 b5 0a cf 72 87 bb 93 94 3e eb bb 01
Data Ascii: &[/V69u&TnM//|sD_{j:LRp( jW4W*r>7i~(wGlv
45
Apr 3, 2014 12:02:10.985901117 MESZ80103492.123.155.25192.168.1.10Data Raw: be ef f0 ab fa 92 fa df 2b de 76 1e 40 d3 fd 5d 0b e5 5b e2 5f a5 56 f9 8f 89 d3 03 05 42 9a f0 ab 41 8c c2 a1 18 35 99 11 1f 4b 5d cd cf 3c e6 7f 34 c5 26 54 11 46 1e 61 f9 ad e3 17 a5 72 04 db ec a8 a9 1f 43 ec 4e 74 f0 8f 25 06 42 ef 38 f6 68
Data Ascii: +v@][_VBA5K]<4&TFarCNt%B8hItJ"^4P,`js(b@04>(/@XN/@p)=AIou5T\54ir9eB'I"5TE("6}yVHce
47
Apr 3, 2014 12:02:10.985907078 MESZ80103492.123.155.25192.168.1.10Data Raw: 81 f0 10 80 04 0c 47 77 71 24 a1 72 6b e9 83 83 d8 28 54 0d 58 c8 c7 0d e1 a7 b7 07 06 5d 21 4d 5f 1b cb 44 b1 f3 e2 cd b7 47 23 60 bc 9e c7 c5 c5 61 cf 5d 27 4b 6f a9 f2 78 df bc 7d bd 05 61 12 a7 09 85 e7 84 46 6f 47 fe 9a 5a 79 77 7b 7d 9b e8
Data Ascii: Gwq$rk(TX]!M_DG#`a]'Kox}aFoGZyw{}^y>uEY/6pQX4-M ,hsb%EBO5HY!~9ns$__<"dc:OC!wl449Ej&o(HwAW
48
Apr 3, 2014 12:02:10.986018896 MESZ80103492.123.155.25192.168.1.10Data Raw: cd 12 a7 7c 03 f7 a6 bf 14 e7 45 06 a3 d5 32 ec 33 45 e9 bd ba b8 9d 23 35 d7 77 5a 64 75 1b 5e 7c 72 1d 8c 86 4d 84 82 98 5c f5 c3 43 87 2a c8 05 0e 48 f8 9f ca d9 d4 f8 92 57 82 55 7e 5c 21 30 e1 73 7a df ad bf dd dc f5 67 be 3f 9d 88 f9 92 b5
Data Ascii: |E23E#5wZdu^|rM\C*HWU~\!0szg?tHyI/$pHID<x0"qZN9#IJsuH{f(f4%T8N>+CO:~*I]Oo-&!Q1\E_~`'<
49
Apr 3, 2014 12:02:10.987273932 MESZ80103492.123.155.25192.168.1.10Data Raw: a8 0a 1f 5c e2 65 ff 66 ff b8 74 6b dd c0 3b d2 63 38 1f 1b f3 f7 32 ef 86 87 a0 a8 1e ea a0 ed bb fb 89 86 59 2e 65 f2 9d 19 b9 2c 47 8d 51 bf 41 b5 5d 0c fa a8 1d 66 b4 5a c2 ff dc b2 ec 86 50 0f 84 09 82 74 99 aa ea ef 0d 2e c4 02 c8 d2 c2 ab
Data Ascii: \eftk;c82Y.e,GQA]fZPt.</uGvKW;b;M>MtywC`0J,&z>(R|_nW(J):"WL7_S$Eh*HX[n"ZD`E:>7+sU^9\
50
Apr 3, 2014 12:02:10.988744974 MESZ80103492.123.155.25192.168.1.10Data Raw: ef bf 5f f9 69 5e 5d ad df ac e8 69 16 87 db 63 2a 03 46 6a 3a 50 24 a3 dd b6 61 ae 96 33 e1 7c d9 47 24 d3 e2 9c 6f 38 9d a3 89 67 bf e5 b8 3b 61 bc 5f bf 28 72 3a f9 57 3b c3 7e ef 12 dc 01 20 65 94 dc 4d df 62 62 39 37 85 59 aa 70 c8 26 3d b4
Data Ascii: _i^]ic*Fj:P$a3|G$o8g;a_(r:W;~ eMbb97Yp&=$_~wxT^^j3~pep6#Ox;PX4`_o#K Smx_&BAW9s)O}#>&og3$PKO4qmhEIr5K^
51
Apr 3, 2014 12:02:10.988749981 MESZ80103492.123.155.25192.168.1.10Data Raw: 0a 1e 39 1f 18 06 9f b4 f9 36 e8 4d c7 b2 8b 62 9e 41 df 9f 4c 24 87 9d bb 87 fe d5 95 cf b4 f7 74 3f 55 9a 42 df 9f da 8d 42 6b 3d 8a e1 ed f3 c7 15 0e 91 a2 fe 3e 31 59 c7 ee fc 61 f3 d9 f7 95 42 40 a9 80 4a df b2 40 c4 6a a0 de 37 cb 60 4c 22
Data Ascii: 96MbAL$t?UBBk=>1YaB@J@j7`L"M:zk<Uc1#e$A3vZ2YJNcNZ%[FEn(e))}/KBn:-wrq>|>&]lz^0~|sbF )*r*e7EW:d
53
Apr 3, 2014 12:02:10.988862038 MESZ80103492.123.155.25192.168.1.10Data Raw: 5e 2c 55 8a 6c ca e6 77 e8 0c 30 de 67 fb ba ef ca 3d 16 91 ba 4e dc 31 7a 32 79 ce 91 76 10 cc 4f a9 be 3c fa 15 09 d5 5d 24 d3 74 5d aa af c7 fd 3c 51 ec ff a7 88 f9 a7 ae 46 41 d2 32 33 45 b7 6b 43 91 05 ea 7a b2 7d 6d 22 9f 26 43 fd da e2 50
Data Ascii: ^,Ulw0g=N1z2yvO<]$t]<QFA23EkCz}m"&CP35~2<6A`vf>@v]crH9J5oxytntm|s?5B${/u7qLjpUvNKT+_[uv2tmKL%4{.;'H
53
Apr 3, 2014 12:02:10.995527983 MESZ80103492.123.155.25192.168.1.10Data Raw: 38 6b 20 36 7e 3b da ff 03 18 9e 94 03 9e 81 0b a3 27 55 36 47 75 3f 0a 81 87 e8 42 28 f3 54 62 80 ac dc 51 ad 7c 19 fe b9 45 7e 51 a9 c6 bf 52 22 c0 f0 5c 09 df 6f 9b 31 24 c4 e7 8f bd 68 69 61 92 fa d4 01 15 e5 dd 91 7a 1c 16 7a 1e 6e e8 5c e6
Data Ascii: 8k 6~;'U6Gu?B(TbQ|E~QR"\o1$hiazzn\YDW\#&YJwzh;t|'I.Y9%-Rqo6g\z0xnl"S{H}M6i-nLaDR3pa!T)J?
54
Apr 3, 2014 12:02:10.997195959 MESZ80103492.123.155.25192.168.1.10Data Raw: 6b 4a 60 7b b2 a3 e7 bc 02 84 52 70 77 a4 c4 7a 36 d5 da d3 a9 5d 66 9a 62 ca 52 e1 99 b9 32 ce fd 53 a8 81 9a e1 57 b7 ba fd 4d 34 e4 b2 84 93 d8 12 5e ee cb 29 0f d7 25 7a 98 4f f8 7d aa de fb f4 bc ad ec e7 9d 64 92 1c e5 37 d3 7c b7 33 3a 51
Data Ascii: kJ`{Rpwz6]fbR2SWM4^)%zO}d7|3:QsZ&HW{>NJ:*kv~E<%!(D]\sTC&xi[F,7Hk%h^F+F'D]w&&:U1{6_yp'3 `Ks4
56
Apr 3, 2014 12:02:10.997203112 MESZ80103492.123.155.25192.168.1.10Data Raw: 38 78 f0 a0 b8 db 8a 95 88 db 79 b8 49 78 ba 38 49 d8 e1 5d 25 3c f1 1e f6 de 76 04 2f 09 92 11 91 ac 87 64 34 24 8b 21 19 b9 b5 24 00 28 88 01 d2 62 80 a4 38 e9 73 9f bf 89 f4 fb cf 7d 13 60 b9 e2 04 60 30 04 06 d8 05 e8 af 1c 03 94 c1 ea df bf
Data Ascii: 8xyIx8I]%<v/d4$!$(b8s}``0^upQS0){.x;{7"y8$*QXT>M}NGjj1^}3VsJa^Q%BVg+;7Lf'=BF;`g/<86e
57
Apr 3, 2014 12:02:10.997313976 MESZ80103492.123.155.25192.168.1.10Data Raw: ad e9 12 d6 01 55 58 18 ae ed c4 30 7b ad 8d c0 fd b2 a5 c2 7b 61 bb fc 37 ca cd 85 18 ba dc 43 ce 4b 43 12 66 e1 70 c7 1d f3 11 2b 39 38 16 42 50 7b c8 7b e2 9f 4e 04 a6 ff 33 24 f5 8f 8b 7b aa 43 e4 a2 f4 64 20 28 39 09 2e 70 84 10 e4 df 42 99
Data Ascii: UX0{{a7CKCfp+98BP{{N3${Cd (9.pBN=0tmv8=za=\U)gT|O)-<0xnY_oi{z&&b$x_aU0?,# ~ j7IE]>.(3H-
58
Apr 3, 2014 12:02:10.997545958 MESZ80103492.123.155.25192.168.1.10Data Raw: 17 01 c0 e1 df 9c 24 20 05 97 41 22 11 32 bf 3a c9 ef c3 ff 65 27 99 b2 ad 99 cf 2d 93 6f b7 d6 4b 56 bf 4e 2b ed d7 67 39 8e ae 6f ca 54 b6 57 73 f0 f4 8a f1 7a 73 d4 1b d1 ab 60 a1 3c 92 57 11 63 2c 1f aa ab 5a 15 56 c0 ce b4 58 ae cd a4 0f 4b
Data Ascii: $ A"2:e'-oKVN+g9oTWszs`<Wc,ZVXKs,\KHJlQHZPXn#(Pkh'ORn55'=Pid+xTa@J,EDnC_CXdCTWn
59
Apr 3, 2014 12:02:10.997554064 MESZ80103492.123.155.25192.168.1.10Data Raw: 58 46 17 93 f8 ca a5 30 90 e5 f6 7c 69 31 b9 e9 f2 b0 8a 32 e0 04 eb 78 f0 c4 7f e3 74 eb 0c 2e 06 1d 73 9f aa 85 f4 69 26 4c 6d e3 8b 5a 8d 1c 49 b8 40 cd ea 73 c5 9e e3 74 ed 9b cf 4f 81 17 d2 67 c2 51 59 df 50 e8 43 40 a1 17 c0 78 d0 f2 13 32
Data Ascii: XF0|i12xt.si&LmZI@stOgQYPC@x2HM/w4y")|EG+`uZ8zb!w9AHX"1%@t3)5@k%jDwg:*K2Xg(nu1X*7~B4I:
61
Apr 3, 2014 12:03:18.606722116 MESZ103580192.168.1.1050.116.4.71POST /write HTTP/1.1
Host: default
Accept-Encoding:
Connection: close
Content-Length: 328
X-ID: 1616
738
Apr 3, 2014 12:03:18.606894970 MESZ103580192.168.1.1050.116.4.71Data Raw: 62 69 ae c7 8e c7 ee 39 68 7b 5e cb 6e ef 83 1f a0 61 b3 e4 48 01 00 00 00 00 00 00 ce c4 fc bc 5e b0 00 d4 47 84 8f fa a5 91 a8 6e fc 6d db 32 65 00 00 00 00 00 00 00 27 00 00 00 27 00 00 00 5c f9 de cb 53 fa b8 bf 24 f8 a2 be 20 fb d7 cc 21 8c
Data Ascii: bi9h{^naH^Gnm2e''\S$ !S\U# fOaGx/1J>XgW&h!!ihhhhhhhhkj?kmk8
739
Apr 3, 2014 12:03:45.784476995 MESZ104080192.168.1.10173.194.65.105GET / HTTP/1.1
Accept: */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.1; .NET CLR 1.1.4322; .NET CLR 1.0.3705)
Host: www.google.com
Connection: Close
741
Apr 3, 2014 12:03:46.289760113 MESZ801040173.194.65.105192.168.1.10HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: http://www.google.nl/?gfe_rd=cr&ei=AjI9U9XWCYmMOt6CgLAB
Content-Length: 256
Date: Thu, 03 Apr 2014 10:03:46 GMT
Server: GFE/2.0
Alternate-Protocol: 80:quic
Connection: close
Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 6e 6c 2f 3f 67 66 65 5f 72 64 3d 63 72 26 61 6d 70 3b 65 69 3d 41 6a 49 39 55 39 58 57 43 59 6d 4d 4f 74 36
Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="http://www.google.nl/?gfe_rd=cr&amp;ei=AjI9U9XWCYmMOt6
741
Apr 3, 2014 12:04:02.342402935 MESZ104280192.168.1.1023.92.19.67POST /write HTTP/1.1
Host: default
Accept-Encoding:
Connection: close
Content-Length: 328
X-ID: 1616
744
Apr 3, 2014 12:04:02.342566967 MESZ104280192.168.1.1023.92.19.67Data Raw: 00 ce a9 c8 2c 33 90 72 f4 4c 84 5c f4 6d 40 e0 46 1b 93 69 48 01 00 00 00 00 00 00 6f 6f 3a 84 db e5 80 92 7a 30 fd 1c 1b fb ea 99 ce ab d7 67 65 00 00 00 00 00 00 00 27 00 00 00 27 00 00 00 5c 58 56 0d 53 5b 30 79 24 59 2a 78 20 5a 5f 0a 21 2d
Data Ascii: ,3rL\m@FiHoo:z0ge''\XVS[0y$Y*x Z_!-)S,Yy\+-U+V#-V V\f<r%6/G>TgW^_&:h!!iUo:hr{:hoo:hoo:hoo:hoo:hoo:hoo:hkj8kJs:kn18q:
744

Code Manipulation Behavior

SSDT
Function NameNew Address
NtOpenProcessFF7ECE2B
NtOpenThreadFF7ECF49
IRP Handler
Handler FunctionDriverAddressType
IRP_MJ_SET_VOLUME_INFORMATION\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_QUERY_QUOTA\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_PNP\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_CREATE_MAILSLOT\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_POWER\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_DEVICE_CONTROL\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_READ\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_DIRECTORY_CONTROL\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_QUERY_VOLUME_INFORMATION\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_SET_SECURITY\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_WRITE\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_LOCK_CONTROL\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_CLEANUP\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_CLOSE\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_INTERNAL_DEVICE_CONTROL\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_CREATE\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_CREATE_NAMED_PIPE\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_DEVICE_CHANGE\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_SET_INFORMATION\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_QUERY_EA\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_FILE_SYSTEM_CONTROL\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_FLUSH_BUFFERS\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_SET_EA\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_SYSTEM_CONTROL\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_QUERY_SECURITY\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_SET_QUOTA\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_QUERY_INFORMATION\Driver\2e19aac6887a7667FF7EC4A6new
IRP_MJ_SHUTDOWN\Driver\2e19aac6887a7667FF7EC4A6new
New Device
DriverDeviceAttached to (upper)Attached to (lower)
\Driver\2e19aac6887a7667(null)unknown(null)
\Driver\2e19aac6887a7667\Device\NtSecureSysunknownunknown
Kernel Callback Routines
NotifierAddress
LoadImageFF7EE1D9
RegistryFF7ECCDF
User Modules
Hook Summary
Function NameHook TypeActive in Processes
GetClipboardDataINLINEctfmon.exe, explorer.exe, wscntfy.exe
TranslateMessageINLINEctfmon.exe, explorer.exe, wscntfy.exe
UnsealMessageINLINEctfmon.exe, explorer.exe, wscntfy.exe
DeleteSecurityContextINLINEctfmon.exe, explorer.exe, wscntfy.exe
DecryptMessageINLINEctfmon.exe, explorer.exe, wscntfy.exe
EncryptMessageINLINEctfmon.exe, explorer.exe, wscntfy.exe
SealMessageINLINEctfmon.exe, explorer.exe, wscntfy.exe
ZwCreateThreadINLINEctfmon.exe, explorer.exe, wscntfy.exe
LdrLoadDllINLINEctfmon.exe, explorer.exe, wscntfy.exe
NtCreateThreadINLINEctfmon.exe, explorer.exe, wscntfy.exe
closesocketINLINEexplorer.exe
FreeAddrInfoWINLINEexplorer.exe
WSARecvINLINEexplorer.exe
WSAGetOverlappedResultINLINEexplorer.exe
GetAddrInfoWINLINEexplorer.exe
sendINLINEexplorer.exe
gethostbynameINLINEexplorer.exe
freeaddrinfoINLINEexplorer.exe
recvINLINEexplorer.exe
getaddrinfoINLINEexplorer.exe
WSASendINLINEexplorer.exe
PFXImportCertStoreINLINEexplorer.exe
InternetReadFileINLINEexplorer.exe
HttpSendRequestAINLINEexplorer.exe
HttpSendRequestWINLINEexplorer.exe
InternetQueryDataAvailableINLINEexplorer.exe
InternetReadFileExAINLINEexplorer.exe
HttpQueryInfoWINLINEexplorer.exe
HttpSendRequestExAINLINEexplorer.exe
HttpQueryInfoAINLINEexplorer.exe
InternetWriteFileINLINEexplorer.exe
HttpSendRequestExWINLINEexplorer.exe
InternetReadFileExWINLINEexplorer.exe
InternetCloseHandleINLINEexplorer.exe
Processes
Process: ctfmon.exe, Module: USER32.dll
Function NameHook TypeNew Data
GetClipboardDataINLINE0xE9 0x90 0x09 0x94 0x48 0x87
TranslateMessageINLINE0xE9 0x96 0x67 0x7C 0xC9 0x97
Process: ctfmon.exe, Module: Secur32.dll
Function NameHook TypeNew Data
UnsealMessageINLINE0xE9 0x9B 0xBD 0xDF 0xFF 0xFB
DeleteSecurityContextINLINE0xE9 0x9E 0xE5 0x57 0x78 0x8B
DecryptMessageINLINE0xE9 0x9B 0xBD 0xDF 0xFF 0xFB
EncryptMessageINLINE0xE9 0x9C 0xC8 0x8F 0xFF 0xFB
SealMessageINLINE0xE9 0x9C 0xC8 0x8F 0xFF 0xFB
Process: ctfmon.exe, Module: ntdll.dll
Function NameHook TypeNew Data
ZwCreateThreadINLINE0xE9 0x97 0x7A 0xA6 0x62 0x22
LdrLoadDllINLINE0xE9 0x9B 0xBB 0xBD 0xD3 0x32
NtCreateThreadINLINE0xE9 0x97 0x7A 0xA6 0x62 0x22
Process: explorer.exe, Module: USER32.dll
Function NameHook TypeNew Data
GetClipboardDataINLINE0xE9 0x90 0x09 0x94 0x48 0x82
TranslateMessageINLINE0xE9 0x96 0x67 0x7C 0xC9 0x92
Process: explorer.exe, Module: ntdll.dll
Function NameHook TypeNew Data
ZwCreateThreadINLINE0xE9 0x97 0x7A 0xA6 0x62 0x2D
LdrLoadDllINLINE0xE9 0x9B 0xBB 0xBD 0xD3 0x3D
NtCreateThreadINLINE0xE9 0x97 0x7A 0xA6 0x62 0x2D
Process: explorer.exe, Module: WS2_32.dll
Function NameHook TypeNew Data
closesocketINLINE0xE9 0x97 0x70 0x04 0x40 0x0B
FreeAddrInfoWINLINE0xE9 0x99 0x9B 0xB5 0x52 0x2B
WSARecvINLINE0xE9 0x99 0x95 0x53 0x32 0x2B
WSAGetOverlappedResultINLINE0xE9 0x96 0x6C 0xC7 0x74 0x4B
GetAddrInfoWINLINE0xE9 0x99 0x94 0x45 0x53 0x3B
sendINLINE0xE9 0x96 0x62 0x23 0x34 0x4B
gethostbynameINLINE0xE9 0x9D 0xD7 0x72 0x2A 0xAB
freeaddrinfoINLINE0xE9 0x99 0x9B 0xB5 0x52 0x2B
recvINLINE0xE9 0x98 0x83 0x31 0x17 0x7B
getaddrinfoINLINE0xE9 0x9B 0xBD 0xD5 0x52 0x2B
WSASendINLINE0xE9 0x9E 0xE1 0x11 0x17 0x7B
Process: explorer.exe, Module: CRYPT32.dll
Function NameHook TypeNew Data
PFXImportCertStoreINLINE0xE9 0x98 0x82 0x26 0x65 0x5B
Process: explorer.exe, Module: Secur32.dll
Function NameHook TypeNew Data
UnsealMessageINLINE0xE9 0x9B 0xBD 0xDF 0xFF 0xF6
DeleteSecurityContextINLINE0xE9 0x9E 0xE5 0x57 0x78 0x86
DecryptMessageINLINE0xE9 0x9B 0xBD 0xDF 0xFF 0xF6
EncryptMessageINLINE0xE9 0x9C 0xC8 0x8F 0xFF 0xF6
SealMessageINLINE0xE9 0x9C 0xC8 0x8F 0xFF 0xF6
Process: explorer.exe, Module: WININET.dll
Function NameHook TypeNew Data
InternetReadFileINLINE0xE9 0x9E 0xE0 0x09 0x91 0x1D
HttpSendRequestAINLINE0xE9 0x91 0x12 0x20 0x01 0x1D
HttpSendRequestWINLINE0xE9 0x90 0x00 0x0F 0xF5 0x5D
InternetQueryDataAvailableINLINE0xE9 0x91 0x1A 0xA3 0x38 0x8D
InternetReadFileExAINLINE0xE9 0x9D 0xD0 0x0C 0xC3 0x3D
HttpQueryInfoWINLINE0xE9 0x9C 0xC6 0x63 0x3A 0xAD
HttpSendRequestExAINLINE0xE9 0x97 0x7B 0xB4 0x49 0x9C
HttpQueryInfoAINLINE0xE9 0x9A 0xAD 0xD7 0x70 0x0D
InternetWriteFileINLINE0xE9 0x9F 0xF9 0x99 0x90 0x0C
HttpSendRequestExWINLINE0xE9 0x94 0x45 0x54 0x49 0x9C
InternetReadFileExWINLINE0xE9 0x92 0x2E 0xEC 0xC4 0x4D
InternetCloseHandleINLINE0xE9 0x94 0x4F 0xF5 0x54 0x4D
Process: wscntfy.exe, Module: Secur32.dll
Function NameHook TypeNew Data
UnsealMessageINLINE0xE9 0x9B 0xBD 0xDF 0xFF 0xFB
DeleteSecurityContextINLINE0xE9 0x9E 0xE5 0x57 0x78 0x8B
DecryptMessageINLINE0xE9 0x9B 0xBD 0xDF 0xFF 0xFB
EncryptMessageINLINE0xE9 0x9C 0xC8 0x8F 0xFF 0xFB
SealMessageINLINE0xE9 0x9C 0xC8 0x8F 0xFF 0xFB
Process: wscntfy.exe, Module: USER32.dll
Function NameHook TypeNew Data
GetClipboardDataINLINE0xE9 0x90 0x09 0x94 0x48 0x87
TranslateMessageINLINE0xE9 0x96 0x67 0x7C 0xC9 0x97
Process: wscntfy.exe, Module: ntdll.dll
Function NameHook TypeNew Data
ZwCreateThreadINLINE0xE9 0x97 0x7A 0xA6 0x62 0x22
LdrLoadDllINLINE0xE9 0x9B 0xBB 0xBD 0xD3 0x32
NtCreateThreadINLINE0xE9 0x97 0x7A 0xA6 0x62 0x22

System Behavior