17:11:58.792095 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: P [tcp sum ok] 560146583:560146632(49) ack 76809233 win 5840 >>> NBT Packet NBT Session Packet Flags=0x0 Length=45 (0x2d) SMB PACKET: SMBchkpth (REQUEST) SMB Command = 0x10 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x8 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 0 (0x0) smbbuf[]= Path=\windows (DF) (ttl 64, id 36127, len 89) 0x0000 4500 0059 8d1f 4000 4006 2a10 c0a8 0112 E..Y..@.@.*..... 0x0010 c0a8 010d 83fd 008b 2163 2897 0494 0411 ........!c(..... 0x0020 5018 16d0 fc54 0000 0000 002d ff53 4d42 P....T.....-.SMB 0x0030 1000 0000 0008 0100 0000 0000 0000 0000 ................ 0x0040 0000 0000 03f8 3d45 0000 0100 000a 0004 ......=E........ 0x0050 5c77 696e 646f 7773 00 \windows. 17:11:58.792709 192.168.1.13.netbios-ssn > 192.168.1.18.33789: P [tcp sum ok] 1:40(39) ack 49 win 63679 >>> NBT Packet NBT Session Packet Flags=0x0 Length=35 (0x23) SMB PACKET: SMBchkpth (REPLY) SMB Command = 0x10 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x88 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 0 (0x0) smb_bcc=0 (DF) (ttl 128, id 3552, len 79) 0x0000 4500 004f 0de0 4000 8006 6959 c0a8 010d E..O..@...iY.... 0x0010 c0a8 0112 008b 83fd 0494 0411 2163 28c8 ............!c(. 0x0020 5018 f8bf bb9e 0000 0000 0023 ff53 4d42 P..........#.SMB 0x0030 1000 0000 0088 0100 0000 0000 0000 0000 ................ 0x0040 0000 0000 03f8 3d45 0000 0100 0000 00 ......=E....... 17:11:58.792715 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: . [tcp sum ok] 49:49(0) ack 40 win 5840 (DF) (ttl 64, id 36128, len 40) 0x0000 4500 0028 8d20 4000 4006 2a40 c0a8 0112 E..(..@.@.*@.... 0x0010 c0a8 010d 83fd 008b 2163 28c8 0494 0438 ........!c(....8 0x0020 5010 16d0 3e15 0000 P...>... 17:11:59.556180 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: P [tcp sum ok] 49:144(95) ack 40 win 5840 >>> NBT Packet NBT Session Packet Flags=0x0 Length=91 (0x5b) SMB PACKET: SMBtrans2 (REQUEST) SMB Command = 0x32 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x8 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 15 (0xf) TRANSACT2_FINDFIRST param_length=23 data_length=0 TotParam=23 (0x17) TotData=0 (0x0) MaxParam=10 (0xa) MaxData=2920 (0xb68) MaxSetup=0 (0x0) Flags=0x0 TimeOut=0 (0x0) Res1=0x0 ParamCnt=23 (0x17) ParamOff=68 (0x44) DataCnt=0 (0x0) DataOff=91 (0x5b) SetupCnt=1 (0x1) TransactionName=Attribute=HIDDEN SYSTEM DIR SearchCount=512 (0x200) Flags=0x6 Level=1 (0x1) File=windows\* (DF) (ttl 64, id 36129, len 135) 0x0000 4500 0087 8d21 4000 4006 29e0 c0a8 0112 E....!@.@.)..... 0x0010 c0a8 010d 83fd 008b 2163 28c8 0494 0438 ........!c(....8 0x0020 5018 16d0 0107 0000 0000 005b ff53 4d42 P..........[.SMB 0x0030 3200 0000 0008 0100 0000 0000 0000 0000 2............... 0x0040 0000 0000 03f8 3d45 0000 0100 0f17 0000 ......=E........ 0x0050 000a 0068 0b00 0000 0000 0000 0000 0017 ...h............ 0x0060 0044 0000 005b 0001 0001 001a 0000 4420 .D...[........D. 0x0070 1600 0002 0600 0100 0000 0000 5c77 696e ............\win 0x0080 646f 7773 5c2a 00 dows\*. 17:11:59.558666 192.168.1.13.netbios-ssn > 192.168.1.18.33789: . [tcp sum ok] 40:1492(1452) ack 144 win 63584 >>> NBT Packet NBT Session Packet Flags=0x0 Length=2966 (0xb96) WARNING: Short packet. Try increasing the snap length (1448) SMB PACKET: SMBtrans2 (REPLY) SMB Command = 0x32 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x88 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 10 (0xa) TRANSACT2_FINDFIRST param_length=10 data_length=2900 TotParam=10 (0xa) TotData=2900 (0xb54) Res1=0x0 ParamCnt=10 (0xa) ParamOff=55 (0x37) ParamDisp0 (0x0) DataCnt=2900 (0xb54) DataOff=66 (0x42) DataDisp=0 (0x0) SetupCnt=0 (0x0) Handle=0x8168 Count=74 (0x4a) EOS=0x0 Eoffset=0 (0x0) LastNameOfs=0xB48 data: [000] 00 00 00 00 92 2C D8 64 92 2C 00 00 92 2C D9 64 \000\000\000\000\222,\330d \222,\000\000\222,\331d [010] 00 00 00 00 00 00 00 00 10 00 01 2E 00 01 00 00 \000\000\000\000\000\000\000\000 \020\000\001.\000\001\000\000 [020] 00 92 2C D8 64 92 2C 00 00 92 2C D9 64 00 00 00 \000\222,\330d\222,\000 \000\222,\331d\000\000\000 [030] 00 00 00 00 00 10 00 02 2E 2E 00 02 00 00 00 92 \000\000\000\000\000\020\000\002 ..\000\002\000\000\000\222 [040] 2C 82 6C 92 2C 00 00 92 2C 83 6C 00 00 00 00 00 ,\202l\222,\000\000\222 ,\203l\000\000\000\000\000 [050] 00 00 00 12 00 06 41 50 50 4C 4F 47 00 03 00 00 \000\000\000\022\000\006AP PLOG\000\003\000\000 [060] 00 44 32 53 54 44 32 00 00 44 32 54 54 D1 5E 00 \000D2STD2\000 \000D2TT\321^\000 [070] 00 D1 5E 00 00 20 00 0C 41 44 30 41 32 33 33 30 \000\321^\000\000 \000\014 AD0A2330 [080] 2E 4D 46 44 00 04 00 00 00 27 27 6F B8 83 31 00 .MFD\000\004\000\000 \000''o\270\2031\000 [090] 00 97 26 C0 B2 EE 05 00 00 EE 05 00 00 00 00 0B \000\227&\300\262\356\005\000 \000\356\005\000\000\000\000\013 [0A0] 31 53 54 42 4F 4F 54 2E 42 4D 50 00 05 00 00 00 1STBOOT. BMP\000\005\000\000\000 [0B0] 31 2C BB A9 83 31 00 00 E7 2E 14 69 EA 01 00 00 1,\273\251\2031\000\000 \347.\024i\352\001\000\000 [0C0] EA 01 00 00 00 00 07 39 4C 57 2E 49 4E 49 00 06 \352\001\000\000\000\000\0079 LW.INI\000\006 [0D0] 00 00 00 74 26 2A 05 83 31 00 00 28 1D 08 71 70 \000\000\000t&*\005\203 1\000\000(\035\010qp [0E0] 05 00 00 70 05 00 00 00 00 0B 41 43 52 4F 43 41 \005\000\000p\005\000\000\000 \000\013ACROCA [0F0] 54 2E 49 4E 49 00 07 00 00 00 74 26 1A 05 58 32 T.INI\000\007\000 \000\000t&\032\005X2 [100] 00 00 58 32 07 67 DA 27 00 00 DA 27 00 00 20 00 \000\000X2\007g\332' \000\000\332'\000\000 \000 [110] 0C 41 43 52 4F 45 58 43 48 2E 49 4E 49 00 08 00 \014ACROEXC H.INI\000\010\000 [120] 00 00 50 2E 18 AB 58 32 00 00 50 2E 19 AB CF 5E \000\000P.\030\253X2 \000\000P.\031\253\317^ [130] 00 00 CF 5E 00 00 00 00 0C 41 44 38 31 39 46 33 \000\000\317^\000\000\000\000 \014AD819F3 [140] 37 2E 4D 46 44 00 09 00 00 00 50 2E D4 AA 75 32 7.MFD\000\011\000 \000\000P.\324\252u2 [150] 00 00 50 2E D5 AA BC 70 00 00 BC 70 00 00 00 00 \000\000P.\325\252\274p \000\000\274p\000\000\000\000 [160] 0A 41 54 4D 52 45 47 2E 41 54 4D 00 0A 00 00 00 \012ATMREG. ATM\000\012\000\000\000 [170] 50 2E 18 AB 58 32 00 00 50 2E 19 AB DA 5E 00 00 P.\030\253X2\000\000 P.\031\253\332^\000\000 [180] DA 5E 00 00 00 00 0C 41 44 39 39 41 46 33 37 2E \332^\000\000\000\000\014A D99AF37. [190] 4D 46 44 00 0B 00 00 00 74 26 36 05 83 31 00 00 MFD\000\013\000\000\000 t&6\005\2031\000\000 [1A0] 74 26 37 05 C4 00 00 00 C4 00 00 00 00 00 08 41 t&7\005\304\000\000\000 \304\000\000\000\000\000\010A [1B0] 44 41 4D 2E 49 4E 49 00 0C 00 00 00 66 2E 9D 78 DAM.INI\000 \014\000\000\000f.\235x [1C0] 44 32 00 00 66 2E A0 78 D1 5E 00 00 D1 5E 00 00 D2\000\000f.\240x \321^\000\000\321^\000\000 [1D0] 00 00 0C 41 44 38 35 41 33 45 43 2E 4D 46 44 00 \000\000\014AD85A 3EC.MFD\000 [1E0] 0D 00 00 00 74 26 CC 02 58 32 00 00 74 26 CD 02 \015\000\000\000t&\314\002 X2\000\000t&\315\002 [1F0] 3A 36 00 00 3A 36 00 00 00 00 0B 41 44 46 4F 4E :6\000\000:6\000\000 \000\000\013ADFON [200] 54 53 2E 4D 46 44 00 0E 00 00 00 8E 29 AB AE 83 TS.MFD\000\016 \000\000\000\216)\253\256\203 [210] 31 00 00 97 26 C0 B2 00 70 00 00 00 70 00 00 00 1\000\000\227&\300\262\000 p\000\000\000p\000\000\000 [220] 00 07 41 52 50 2E 45 58 45 00 0F 00 00 00 EB 22 \000\007ARP.EX E\000\017\000\000\000\353" [230] 00 00 83 31 00 00 EB 22 00 00 02 00 00 00 02 00 \000\000\2031\000\000\353" \000\000\002\000\000\000\002\000 [240] 00 00 00 00 0C 41 52 54 47 41 4C 52 59 2E 43 41 \000\000\000\000\014ART GALRY.CA [250] 47 00 10 00 00 00 27 27 9A B8 83 31 00 00 97 26 G\000\020\000\000\000'' \232\270\2031\000\000\227& [260] C0 B2 00 F0 00 00 00 F0 00 00 00 00 07 41 53 44 \300\262\000\360\000\000\000\360 \000\000\000\000\007ASD [270] 2E 45 58 45 00 11 00 00 00 27 27 B3 B8 83 31 00 .EXE\000\021\000\000 \000''\263\270\2031\000 [280] 00 97 26 C0 B2 51 04 00 00 51 04 00 00 00 00 0C \000\227&\300\262Q\004\000 \000Q\004\000\000\000\000\014 [290] 41 53 50 49 32 48 4C 50 2E 53 59 53 00 12 00 00 ASPI2HLP .SYS\000\022\000\000 [2A0] 00 73 26 00 A9 75 32 00 00 50 2E D4 AA 2E 22 00 \000s&\000\251u2\000 \000P.\324\252."\000 [2B0] 00 2E 22 00 00 00 00 07 41 54 4D 2E 49 4E 49 00 \000."\000\000\000\000\007 ATM.INI\000 [2C0] 13 00 00 00 13 2F CC 03 83 31 00 00 13 2F DC 03 \023\000\000\000\023/\314\003 \2031\000\000\023/\334\003 [2D0] 36 15 00 00 36 15 00 00 00 00 0B 57 49 4E 49 4E 6\025\000\0006\025\000\000 \000\000\013WININ [2E0] 49 54 2E 53 41 56 00 14 00 00 00 05 31 94 5E 83 IT.SAV\000\024 \000\000\000\0051\224^\203 [2F0] 31 00 00 05 31 95 5E FA 5B 00 00 FA 5B 00 00 00 1\000\000\0051\225^\372 [\000\000\372[\000\000\000 [300] 00 14 41 63 74 69 76 65 20 53 65 74 75 70 20 4C \000\024Active Setup L [310] 6F 67 2E 42 41 4B 00 17 00 00 00 05 31 02 65 83 og.BAK\000\027 \000\000\000\0051\002e\203 [320] 31 00 00 05 31 03 65 4D 90 00 00 4D 90 00 00 00 1\000\000\0051\003eM \220\000\000M\220\000\000\000 [330] 00 14 41 63 74 69 76 65 20 53 65 74 75 70 20 4C \000\024Active Setup L [340] 6F 67 2E 74 78 74 00 1A 00 00 00 7E 26 59 45 58 og.txt\000\032 \000\000\000~&YEX [350] 32 00 00 13 31 F3 65 10 16 00 00 10 16 00 00 00 2\000\000\0231\363e\020 \026\000\000\020\026\000\000\000 [360] 00 0C 41 64 6F 62 65 50 44 46 2E 69 6E 69 00 1C \000\014AdobeP DF.ini\000\034 [370] 00 00 00 27 27 09 B8 83 31 00 00 97 26 C0 B2 9E \000\000\000''\011\270\203 1\000\000\227&\300\262\236 [380] 94 01 00 9E 94 01 00 00 00 0C 42 41 43 4B 47 52 \224\001\000\236\224\001\000\000 \000\014BACKGR [390] 4E 44 2E 47 49 46 00 1D 00 00 00 27 27 70 B8 83 ND.GIF\000\035 \000\000\000''p\270\203 [3A0] 31 00 00 97 26 C0 B2 B6 00 00 00 B6 00 00 00 00 1\000\000\227&\300\262\266 \000\000\000\266\000\000\000\000 [3B0] 00 10 42 6C 61 63 6B 20 54 68 61 74 63 68 2E 62 \000\020Black Thatch.b [3C0] 6D 70 00 20 00 00 00 27 27 70 B8 83 31 00 00 97 mp\000 \000\000\000' 'p\270\2031\000\000\227 [3D0] 26 C0 B2 C2 00 00 00 C2 00 00 00 00 00 0F 42 6C &\300\262\302\000\000\000\302 \000\000\000\000\000\017Bl [3E0] 75 65 20 52 69 76 65 74 73 2E 62 6D 70 00 23 00 ue Rivet s.bmp\000#\000 [3F0] 00 00 7D 27 C5 96 83 31 00 00 97 26 C0 B2 46 08 \000\000}'\305\226\2031 \000\000\227&\300\262F\010 [400] 00 00 46 08 00 00 00 00 0B 42 75 62 62 6C 65 73 \000\000F\010\000\000\000\000 \013Bubbles [410] 2E 62 6D 70 00 25 00 00 00 27 27 CC B8 83 31 00 .bmp\000%\000\000 \000''\314\270\2031\000 [420] 00 97 26 C0 B2 00 A0 01 00 00 A0 01 00 00 00 0C \000\227&\300\262\000\240\001 \000\000\240\001\000\000\000\014 [430] 43 44 50 4C 41 59 45 52 2E 45 58 45 00 26 00 00 CDPLAYER .EXE\000&\000\000 [440] 00 27 27 CD B8 83 31 00 00 97 26 C0 B2 20 44 00 \000''\315\270\2031\000 \000\227&\300\262 D\000 [450] 00 20 44 00 00 00 00 0B 43 48 41 52 4D 41 50 2E \000 D\000\000\000\000\013 CHARMAP. [460] 45 58 45 00 27 00 00 00 27 27 9B B8 83 31 00 00 EXE\000'\000\000\000 ''\233\270\2031\000\000 [470] 97 26 C0 B2 00 00 02 00 00 00 02 00 00 00 0C 43 \227&\300\262\000\000\002\000 \000\000\002\000\000\000\014C [480] 4C 45 41 4E 4D 47 52 2E 45 58 45 00 28 00 00 00 LEANMGR. EXE\000(\000\000\000 [490] 54 2A 75 9B 83 31 00 00 54 2A 76 9B 7F 00 00 00 T*u\233\2031\000\000 T*v\233\177\000\000\000 [4A0] 7F 00 00 00 00 00 11 43 4C 45 41 52 45 58 50 4C \177\000\000\000\000\000\021C LEAREXPL [4B0] 4F 52 45 52 2E 49 4E 49 00 2B 00 00 00 27 27 CD ORER.INI \000+\000\000\000''\315 [4C0] B8 83 31 00 00 97 26 C0 B2 00 48 00 00 00 48 00 \270\2031\000\000\227&\300 \262\000H\000\000\000H\000 [4D0] 00 00 00 0B 43 4C 49 50 42 52 44 2E 45 58 45 00 \000\000\000\013CLIP BRD.EXE\000 [4E0] 2C 00 00 00 7F 26 4E 04 83 31 00 00 61 1B 60 01 ,\000\000\000\177&N\004 \2031\000\000a\033`\001 [4F0] 20 40 00 00 20 40 00 00 00 00 09 43 4C 4F 43 4B @\000\000 @\000\000 \000\000\011CLOCK [500] 2E 45 58 45 00 2D 00 00 00 7F 26 4E 04 83 31 00 .EXE\000-\000\000 \000\177&N\004\2031\000 [510] 00 54 2C E6 75 44 00 00 00 44 00 00 00 00 00 09 \000T,\346uD\000\000 \000D\000\000\000\000\000\011 [520] 43 4C 4F 43 4B 2E 49 4E 49 00 2E 00 00 00 27 27 CLOCK.IN I\000.\000\000\000'' [530] 0A B8 83 31 00 00 97 26 C0 B2 2A 2C 00 00 2A 2C \012\270\2031\000\000\227& \300\262*,\000\000*, [540] 00 00 00 00 09 43 4C 4F 55 44 2E 47 49 46 00 2F \000\000\000\000\011CLO UD.GIF\000/ [550] 00 00 00 13 2F A3 02 83 31 00 00 5C 2E 4D 93 10 \000\000\000\023/\243\002\203 1\000\000\.M\223\020 [560] C1 00 00 10 C1 00 00 00 00 00 00 00 00 00 00 00 \301\000\000\020\301\000\000\000 \000\000\000\000\000\000\000\000 [570] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [580] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [590] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [600] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [610] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [620] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [630] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [640] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [650] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [660] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [670] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [680] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [690] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [700] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [710] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [720] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [730] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [740] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [750] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [760] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [770] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [780] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [790] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [800] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [810] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [820] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [830] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [840] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [850] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [860] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [870] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [880] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [890] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [900] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [910] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [920] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [930] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [940] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [950] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [960] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [970] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [980] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [990] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A00] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A10] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A20] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A30] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A40] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A50] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A60] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A70] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A80] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A90] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AA0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AB0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AC0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AD0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AE0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AF0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B00] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B10] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B20] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B30] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B40] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B50] 00 00 00 00 \000\000\000\000 (DF) (ttl 128, id 3808, len 1492) 0x0000 4500 05d4 0ee0 4000 8006 62d4 c0a8 010d E.....@...b..... 0x0010 c0a8 0112 008b 83fd 0494 0438 2163 2927 ...........8!c)' 0x0020 5010 f860 eecc 0000 0000 0b96 ff53 4d42 P..`.........SMB 0x0030 3200 0000 0088 0100 0000 0000 0000 0000 2............... 0x0040 0000 0000 03f8 3d45 0000 0100 0a0a 0054 ......=E.......T 0x0050 0b00 000a 0037 0000 0054 0b42 0000 0000 .....7...T.B.... 0x0060 005f 0b68 814a 0000 0000 0048 0b00 0000 ._.h.J.....H.... 0x0070 0000 922c d864 922c 0000 922c d964 0000 ...,.d.,...,.d.. 0x0080 0000 0000 0000 1000 012e 0001 0000 0092 ................ 0x0090 2cd8 6492 2c00 0092 2cd9 6400 0000 0000 ,.d.,...,.d..... 0x00a0 0000 0010 0002 2e2e 0002 0000 0092 2c82 ..............,. 0x00b0 6c92 2c00 0092 2c83 6c00 0000 0000 0000 l.,...,.l....... 0x00c0 0012 0006 4150 504c 4f47 0003 0000 0044 ....APPLOG.....D 0x00d0 3253 5444 3200 0044 3254 54d1 5e00 00d1 2STD2..D2TT.^... 0x00e0 5e00 0020 000c 4144 3041 3233 3330 2e4d ^.....AD0A2330.M 0x00f0 4644 0004 0000 0027 276f b883 3100 0097 FD.....''o..1... 0x0100 26c0 b2ee 0500 00ee 0500 0000 000b 3153 &.............1S 0x0110 5442 4f4f 542e 424d 5000 0500 0000 312c TBOOT.BMP.....1, 0x0120 bba9 8331 0000 e72e 1469 ea01 0000 ea01 ...1.....i...... 0x0130 0000 0000 0739 4c57 2e49 4e49 0006 0000 .....9LW.INI.... 0x0140 0074 262a 0583 3100 0028 1d08 7170 0500 .t&*..1..(..qp.. 0x0150 0070 0500 0000 000b 4143 524f 4341 542e .p......ACROCAT. 0x0160 494e 4900 0700 0000 7426 1a05 5832 0000 INI.....t&..X2.. 0x0170 5832 0767 da27 0000 da27 0000 2000 0c41 X2.g.'...'.....A 0x0180 4352 4f45 5843 482e 494e 4900 0800 0000 CROEXCH.INI..... 0x0190 502e 18ab 5832 0000 502e 19ab cf5e 0000 P...X2..P....^.. 0x01a0 cf5e 0000 0000 0c41 4438 3139 4633 372e .^.....AD819F37. 0x01b0 4d46 4400 0900 0000 502e d4aa 7532 0000 MFD.....P...u2.. 0x01c0 502e d5aa bc70 0000 bc70 0000 0000 0a41 P....p...p.....A 0x01d0 544d 5245 472e 4154 4d00 0a00 0000 502e TMREG.ATM.....P. 0x01e0 18ab 5832 0000 502e 19ab da5e 0000 da5e ..X2..P....^...^ 0x01f0 0000 0000 0c41 4439 3941 4633 372e 4d46 .....AD99AF37.MF 0x0200 4400 0b00 0000 7426 3605 8331 0000 7426 D.....t&6..1..t& 0x0210 3705 c400 0000 c400 0000 0000 0841 4441 7............ADA 0x0220 4d2e 494e 4900 0c00 0000 662e 9d78 4432 M.INI.....f..xD2 0x0230 0000 662e a078 d15e 0000 d15e 0000 0000 ..f..x.^...^.... 0x0240 0c41 4438 3541 3345 432e 4d46 4400 0d00 .AD85A3EC.MFD... 0x0250 0000 7426 cc02 5832 0000 7426 cd02 3a36 ..t&..X2..t&..:6 0x0260 0000 3a36 0000 0000 0b41 4446 4f4e 5453 ..:6.....ADFONTS 0x0270 2e4d 4644 000e 0000 008e 29ab ae83 3100 .MFD......)...1. 0x0280 0097 26c0 b200 7000 0000 7000 0000 0007 ..&...p...p..... 0x0290 4152 502e 4558 4500 0f00 0000 eb22 0000 ARP.EXE......".. 0x02a0 8331 0000 eb22 0000 0200 0000 0200 0000 .1...".......... 0x02b0 0000 0c41 5254 4741 4c52 592e 4341 4700 ...ARTGALRY.CAG. 0x02c0 1000 0000 2727 9ab8 8331 0000 9726 c0b2 ....''...1...&.. 0x02d0 00f0 0000 00f0 0000 0000 0741 5344 2e45 ...........ASD.E 0x02e0 5845 0011 0000 0027 27b3 b883 3100 0097 XE.....''...1... 0x02f0 26c0 b251 0400 0051 0400 0000 000c 4153 &..Q...Q......AS 0x0300 5049 3248 4c50 2e53 5953 0012 0000 0073 PI2HLP.SYS.....s 0x0310 2600 a975 3200 0050 2ed4 aa2e 2200 002e &..u2..P...."... 0x0320 2200 0000 0007 4154 4d2e 494e 4900 1300 ".....ATM.INI... 0x0330 0000 132f cc03 8331 0000 132f dc03 3615 .../...1.../..6. 0x0340 0000 3615 0000 0000 0b57 494e 494e 4954 ..6......WININIT 0x0350 2e53 4156 0014 0000 0005 3194 5e83 3100 .SAV......1.^.1. 0x0360 0005 3195 5efa 5b00 00fa 5b00 0000 0014 ..1.^.[...[..... 0x0370 4163 7469 7665 2053 6574 7570 204c 6f67 Active.Setup.Log 0x0380 2e42 414b 0017 0000 0005 3102 6583 3100 .BAK......1.e.1. 0x0390 0005 3103 654d 9000 004d 9000 0000 0014 ..1.eM...M...... 0x03a0 4163 7469 7665 2053 6574 7570 204c 6f67 Active.Setup.Log 0x03b0 2e74 7874 001a 0000 007e 2659 4558 3200 .txt.....~&YEX2. 0x03c0 0013 31f3 6510 1600 0010 1600 0000 000c ..1.e........... 0x03d0 4164 6f62 6550 4446 2e69 6e69 001c 0000 AdobePDF.ini.... 0x03e0 0027 2709 b883 3100 0097 26c0 b29e 9401 .''...1...&..... 0x03f0 009e 9401 0000 000c 4241 434b 4752 4e44 ........BACKGRND 0x0400 2e47 4946 001d 0000 0027 2770 b883 3100 .GIF.....''p..1. 0x0410 0097 26c0 b2b6 0000 00b6 0000 0000 0010 ..&............. 0x0420 426c 6163 6b20 5468 6174 6368 2e62 6d70 Black.Thatch.bmp 0x0430 0020 0000 0027 2770 b883 3100 0097 26c0 .....''p..1...&. 0x0440 b2c2 0000 00c2 0000 0000 000f 426c 7565 ............Blue 0x0450 2052 6976 6574 732e 626d 7000 2300 0000 .Rivets.bmp.#... 0x0460 7d27 c596 8331 0000 9726 c0b2 4608 0000 }'...1...&..F... 0x0470 4608 0000 0000 0b42 7562 626c 6573 2e62 F......Bubbles.b 0x0480 6d70 0025 0000 0027 27cc b883 3100 0097 mp.%...''...1... 0x0490 26c0 b200 a001 0000 a001 0000 000c 4344 &.............CD 0x04a0 504c 4159 4552 2e45 5845 0026 0000 0027 PLAYER.EXE.&...' 0x04b0 27cd b883 3100 0097 26c0 b220 4400 0020 '...1...&...D... 0x04c0 4400 0000 000b 4348 4152 4d41 502e 4558 D.....CHARMAP.EX 0x04d0 4500 2700 0000 2727 9bb8 8331 0000 9726 E.'...''...1...& 0x04e0 c0b2 0000 0200 0000 0200 0000 0c43 4c45 .............CLE 0x04f0 414e 4d47 522e 4558 4500 2800 0000 542a ANMGR.EXE.(...T* 0x0500 759b 8331 0000 542a 769b 7f00 0000 7f00 u..1..T*v....... 0x0510 0000 0000 1143 4c45 4152 4558 504c 4f52 .....CLEAREXPLOR 0x0520 4552 2e49 4e49 002b 0000 0027 27cd b883 ER.INI.+...''... 0x0530 3100 0097 26c0 b200 4800 0000 4800 0000 1...&...H...H... 0x0540 000b 434c 4950 4252 442e 4558 4500 2c00 ..CLIPBRD.EXE.,. 0x0550 0000 7f26 4e04 8331 0000 611b 6001 2040 ...&N..1..a.`..@ 0x0560 0000 2040 0000 0000 0943 4c4f 434b 2e45 ...@.....CLOCK.E 0x0570 5845 002d 0000 007f 264e 0483 3100 0054 XE.-....&N..1..T 0x0580 2ce6 7544 0000 0044 0000 0000 0009 434c ,.uD...D......CL 0x0590 4f43 4b2e 494e 4900 2e00 0000 2727 0ab8 OCK.INI.....''.. 0x05a0 8331 0000 9726 c0b2 2a2c 0000 2a2c 0000 .1...&..*,..*,.. 0x05b0 0000 0943 4c4f 5544 2e47 4946 002f 0000 ...CLOUD.GIF./.. 0x05c0 0013 2fa3 0283 3100 005c 2e4d 9310 c100 ../...1..\.M.... 0x05d0 0010 c100 .... 17:11:59.558674 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: . [tcp sum ok] 144:144(0) ack 1492 win 8712 (DF) (ttl 64, id 36130, len 40) 0x0000 4500 0028 8d22 4000 4006 2a3e c0a8 0112 E..(."@.@.*>.... 0x0010 c0a8 010d 83fd 008b 2163 2927 0494 09e4 ........!c)'.... 0x0020 5010 2208 2cd2 0000 P.".,... 17:11:59.558801 192.168.1.13.netbios-ssn > 192.168.1.18.33789: . [tcp sum ok] 1492:2944(1452) ack 144 win 63584 >>> NBT Packet NBT Session Packet Flags=0x0 Length=11 (0xb) Session packet:(raw data?) (DF) (ttl 128, id 4064, len 1492) 0x0000 4500 05d4 0fe0 4000 8006 61d4 c0a8 010d E.....@...a..... 0x0010 c0a8 0112 008b 83fd 0494 09e4 2163 2927 ............!c)' 0x0020 5010 f860 ace7 0000 0000 000b 434c 5350 P..`........CLSP 0x0030 4143 4b2e 4558 4500 3000 0000 2727 b3b8 ACK.EXE.0...''.. 0x0040 8331 0000 9726 c0b2 3260 0000 3260 0000 .1...&..2`..2`.. 0x0050 0000 0b43 4d44 3634 3058 2e53 5953 0031 ...CMD640X.SYS.1 0x0060 0000 0027 27b3 b883 3100 0097 26c0 b2a5 ...''...1...&... 0x0070 5100 00a5 5100 0000 000c 434d 4436 3430 Q...Q.....CMD640 0x0080 5832 2e53 5953 0032 0000 0027 27d7 b875 X2.SYS.2...''..u 0x0090 3200 0097 26c0 b2c2 6e01 00c2 6e01 0000 2...&...n...n... 0x00a0 000b 434f 4d4d 414e 442e 434f 4d00 3300 ..COMMAND.COM.3. 0x00b0 0000 2727 73b8 8331 0000 9726 c0b2 0511 ..''s..1...&.... 0x00c0 0000 0511 0000 0000 0c43 4f4e 4644 454e .........CONFDEN 0x00d0 542e 4350 4500 3400 0000 2727 30b8 8331 T.CPE.4...''0..1 0x00e0 0000 9726 c0b2 eb44 0000 eb44 0000 0000 ...&...D...D.... 0x00f0 0a43 4f4e 4649 472e 5458 5400 3500 0000 .CONFIG.TXT.5... 0x0100 2727 0ab8 8331 0000 9726 c0b2 f800 0000 ''...1...&...... 0x0110 f800 0000 0000 0b43 4f4e 5445 4e54 2e47 .......CONTENT.G 0x0120 4946 0036 0000 0027 279b b883 3100 0097 IF.6...''...1... 0x0130 26c0 b240 0800 0040 0800 0000 000b 434f &..@...@......CO 0x0140 4e54 524f 4c2e 4558 4500 3700 0000 2727 NTROL.EXE.7...'' 0x0150 dab8 7532 0000 5b2d 739c 7c03 0000 7c03 ..u2..[-s.|...|. 0x0160 0000 0000 0b43 4f4e 5452 4f4c 2e49 4e49 .....CONTROL.INI 0x0170 0038 0000 0027 279b b883 3100 0097 26c0 .8...''...1...&. 0x0180 b200 c001 0000 c001 0000 0008 4356 5431 ............CVT1 0x0190 2e45 5845 0039 0000 0027 279b b883 3100 .EXE.9...''...1. 0x01a0 0097 26c0 b200 3001 0000 3001 0000 000c ..&...0...0..... 0x01b0 4356 5441 504c 4f47 2e45 5845 003a 0000 CVTAPLOG.EXE.:.. 0x01c0 0027 276f b883 3100 0097 26c0 b246 0200 .''o..1...&..F.. 0x01d0 0046 0200 0000 0010 4361 7276 6564 2053 .F......Carved.S 0x01e0 746f 6e65 2e62 6d70 003d 0000 00b6 2cb3 tone.bmp.=....,. 0x01f0 6083 3100 00b6 2cb4 6010 1901 0010 1901 `.1...,.`....... 0x0200 0000 0018 4368 616e 6e65 6c20 5363 7265 ....Channel.Scre 0x0210 656e 2053 6176 6572 2e53 4352 0040 0000 en.Saver.SCR.@.. 0x0220 007d 27c7 9683 3100 0097 26c0 b2be 0000 .}'...1...&..... 0x0230 00be 0000 0000 000b 4369 7263 6c65 732e ........Circles. 0x0240 626d 7000 4200 0000 2727 b3b8 7532 0000 bmp.B...''..u2.. 0x0250 9726 c0b2 360a 0000 360a 0000 0000 0b44 .&..6...6......D 0x0260 424c 4255 4646 2e53 5953 0043 0000 0027 BLBUFF.SYS.C...' 0x0270 279b b883 3100 0097 26c0 b200 e003 0000 '...1...&....... 0x0280 e003 0000 000a 4445 4652 4147 2e45 5845 ......DEFRAG.EXE 0x0290 0044 0000 0027 2723 b883 3100 0097 26c0 .D...''#..1...&. 0x02a0 b2cc 1300 00cc 1300 0000 000c 4445 4c45 ............DELE 0x02b0 5445 4649 2e49 4e49 0045 0000 0027 279c TEFI.INI.E...''. 0x02c0 b883 3100 0097 26c0 b200 1001 0000 1001 ..1...&......... 0x02d0 0000 000c 4449 5245 4354 4343 2e45 5845 ....DIRECTCC.EXE 0x02e0 0046 0000 0027 2730 b883 3100 0097 26c0 .F...''0..1...&. 0x02f0 b255 5100 0055 5100 0000 000b 4449 5350 .UQ..UQ.....DISP 0x0300 4c41 592e 5458 5400 4700 0000 7d27 c796 LAY.TXT.G...}'.. 0x0310 8331 0000 ab24 2098 2102 0000 2102 0000 .1...$..!...!... 0x0320 0000 0c44 4f53 5052 4d50 542e 5049 4600 ...DOSPRMPT.PIF. 0x0330 4800 0000 2727 7db7 8331 0000 9726 c0b2 H...''}..1...&.. 0x0340 3b5c 0100 3b5c 0100 0000 0a44 4f53 5245 ;\..;\.....DOSRE 0x0350 502e 4558 4500 4900 0000 2727 24b8 8331 P.EXE.I...''$..1 0x0360 0000 9726 c0b2 6103 0000 6103 0000 0000 ...&..a...a..... 0x0370 0a44 4f53 5245 502e 494e 4900 4a00 0000 .DOSREP.INI.J... 0x0380 2727 7db7 8331 0000 9726 c0b2 0020 0200 ''}..1...&...... 0x0390 0020 0200 0000 0c44 5257 4154 534f 4e2e .......DRWATSON. 0x03a0 4558 4500 4b00 0000 7426 4007 8331 0000 EXE.K...t&@..1.. 0x03b0 9726 0c8b 7a2a 0100 7a2a 0100 0000 0b44 .&..z*..z*.....D 0x03c0 6566 6175 6c74 2e73 6630 004d 0000 0027 efault.sf0.M...' 0x03d0 274d bb83 3100 0027 274e bbb5 2501 00b5 'M..1..''N..%... 0x03e0 2501 0000 000b 4465 6661 756c 742e 7366 %.....Default.sf 0x03f0 6300 4f00 0000 2727 9cb8 8331 0000 9726 c.O...''...1...& 0x0400 c0b2 37ea 0100 37ea 0100 0000 0a45 4d4d ..7...7......EMM 0x0410 3338 362e 4558 4500 5000 0000 7a26 282f 386.EXE.P...z&(/ 0x0420 8331 0000 7a26 2134 8427 0000 8427 0000 .1..z&!4.'...'.. 0x0430 0000 0a45 5843 454c 382e 584c 4200 5100 ...EXCEL8.XLB.Q. 0x0440 0000 2727 00b8 7532 0000 9726 c0b2 00c0 ..''..u2...&.... 0x0450 0200 00c0 0200 0000 0c45 5850 4c4f 5245 .........EXPLORE 0x0460 522e 4558 4500 5200 0000 2727 2bb8 7532 R.EXE.R...''+.u2 0x0470 0000 9726 c0b2 5000 0000 5000 0000 0000 ...&..P...P..... 0x0480 0c45 5850 4c4f 5245 522e 5343 4600 5300 .EXPLORER.SCF.S. 0x0490 0000 c628 0000 8331 0000 c628 0000 0006 ...(...1...(.... 0x04a0 0200 0006 0200 0000 0c45 5854 5241 4333 .........EXTRAC3 0x04b0 322e 4558 4500 5400 0000 8e29 5bae 8331 2.EXE.T....)[..1 0x04c0 0000 8e29 90ae c601 0000 c601 0000 0000 ...)............ 0x04d0 1345 6e74 6572 4e65 7449 6e73 7461 6c6c .EnterNetInstall 0x04e0 2e6c 6f67 0057 0000 0074 26d4 0d83 3100 .log.W...t&...1. 0x04f0 0087 2726 9d03 0600 0003 0600 0000 000f ..'&............ 0x0500 4578 6974 2054 6f20 446f 732e 7069 6600 Exit.To.Dos.pif. 0x0510 5a00 0000 2727 30b8 8331 0000 9726 c0b2 Z...''0..1...&.. 0x0520 b433 0000 b433 0000 0000 0746 4151 2e54 .3...3.....FAQ.T 0x0530 5854 005b 0000 0027 2701 b883 3100 0097 XT.[...''...1... 0x0540 26c0 b200 c000 0000 c000 0000 000c 464f &.............FO 0x0550 4e54 5649 4557 2e45 5845 005c 0000 008e NTVIEW.EXE.\.... 0x0560 29ac ae63 3200 0097 26c0 b200 b000 0000 )..c2...&....... 0x0570 b000 0000 0007 4654 502e 4558 4500 5d00 ......FTP.EXE.]. 0x0580 0000 2727 73b8 8331 0000 9726 c0b2 7911 ..''s..1...&..y. 0x0590 0000 7911 0000 0000 0746 5949 2e43 5045 ..y......FYI.CPE 0x05a0 005e 0000 0027 2730 b883 3100 0097 26c0 .^...''0..1...&. 0x05b0 b250 a000 0050 a000 0000 000b 4745 4e45 .P...P......GENE 0x05c0 5241 4c2e 5458 5400 5f00 0000 2727 73b8 RAL.TXT._...''s. 0x05d0 8331 0000 .1.. 17:11:59.558806 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: . [tcp sum ok] 144:144(0) ack 2944 win 11616 (DF) (ttl 64, id 36131, len 40) 0x0000 4500 0028 8d23 4000 4006 2a3d c0a8 0112 E..(.#@.@.*=.... 0x0010 c0a8 010d 83fd 008b 2163 2927 0494 0f90 ........!c)'.... 0x0020 5010 2d60 1bce 0000 P.-`.... 17:11:59.558821 192.168.1.13.netbios-ssn > 192.168.1.18.33789: P [tcp sum ok] 2944:3010(66) ack 144 win 63584 >>> NBT Packet flags=0x97 NBT - Unknown packet type Type=0x9726C0B2 Data: (62 bytes) [000] 2F 17 00 00 2F 17 00 00 00 00 0B 47 45 4E 45 52 /\027\000\000/\027\000\000 \000\000\013GENER [010] 49 43 2E 43 50 45 00 60 00 00 00 C6 28 00 00 69 IC.CPE\000` \000\000\000\306(\000\000i [020] 32 00 00 C6 28 00 00 10 95 00 00 10 95 00 00 00 2\000\000\306(\000\000\020 \225\000\000\020\225\000\000\000 [030] 00 0B 47 52 50 43 4F 4E 56 2E 45 58 45 00 \000\013GRPCON V.EXE\000 (DF) (ttl 128, id 4320, len 106) 0x0000 4500 006a 10e0 4000 8006 663e c0a8 010d E..j..@...f>.... 0x0010 c0a8 0112 008b 83fd 0494 0f90 2163 2927 ............!c)' 0x0020 5018 f860 c6db 0000 9726 c0b2 2f17 0000 P..`.....&../... 0x0030 2f17 0000 0000 0b47 454e 4552 4943 2e43 /......GENERIC.C 0x0040 5045 0060 0000 00c6 2800 0069 3200 00c6 PE.`....(..i2... 0x0050 2800 0010 9500 0010 9500 0000 000b 4752 (.............GR 0x0060 5043 4f4e 562e 4558 4500 PCONV.EXE. 17:11:59.558824 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: . [tcp sum ok] 144:144(0) ack 3010 win 11616 (DF) (ttl 64, id 36132, len 40) 0x0000 4500 0028 8d24 4000 4006 2a3c c0a8 0112 E..(.$@.@.*<.... 0x0010 c0a8 010d 83fd 008b 2163 2927 0494 0fd2 ........!c)'.... 0x0020 5010 2d60 1b8c 0000 P.-`.... 17:11:59.559304 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: P [tcp sum ok] 144:239(95) ack 3010 win 11616 >>> NBT Packet NBT Session Packet Flags=0x0 Length=91 (0x5b) SMB PACKET: SMBtrans2 (REQUEST) SMB Command = 0x32 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x8 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 15 (0xf) TRANSACT2_FINDNEXT param_length=23 data_length=0 TotParam=23 (0x17) TotData=0 (0x0) MaxParam=10 (0xa) MaxData=2920 (0xb68) MaxSetup=0 (0x0) Flags=0x0 TimeOut=0 (0x0) Res1=0x0 ParamCnt=23 (0x17) ParamOff=68 (0x44) DataCnt=0 (0x0) DataOff=91 (0x5b) SetupCnt=1 (0x1) TransactionName=Parameters= Data: (23 bytes) [000] 68 81 00 02 01 00 00 00 00 00 0E 00 52 50 43 4F h\201\000\002\001\000\000\000 \000\000\016\000RPCO [010] 4E 56 2E 45 58 45 00 NV.EXE\000 Data= (DF) (ttl 64, id 36133, len 135) 0x0000 4500 0087 8d25 4000 4006 29dc c0a8 0112 E....%@.@.)..... 0x0010 c0a8 010d 83fd 008b 2163 2927 0494 0fd2 ........!c)'.... 0x0020 5018 2d60 176e 0000 0000 005b ff53 4d42 P.-`.n.....[.SMB 0x0030 3200 0000 0008 0100 0000 0000 0000 0000 2............... 0x0040 0000 0000 03f8 3d45 0000 0100 0f17 0000 ......=E........ 0x0050 000a 0068 0b00 0000 0000 0000 0000 0017 ...h............ 0x0060 0044 0000 005b 0001 0002 001a 0000 4420 .D...[........D. 0x0070 6881 0002 0100 0000 0000 0e00 5250 434f h...........RPCO 0x0080 4e56 2e45 5845 00 NV.EXE. 17:11:59.561611 192.168.1.13.netbios-ssn > 192.168.1.18.33789: . [tcp sum ok] 3010:4462(1452) ack 239 win 63489 >>> NBT Packet NBT Session Packet Flags=0x0 Length=2945 (0xb81) WARNING: Short packet. Try increasing the snap length (1448) SMB PACKET: SMBtrans2 (REPLY) SMB Command = 0x32 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x88 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 10 (0xa) TRANSACT2_FINDNEXT param_length=8 data_length=2881 TotParam=8 (0x8) TotData=2881 (0xb41) Res1=0x0 ParamCnt=8 (0x8) ParamOff=55 (0x37) ParamDisp0 (0x0) DataCnt=2881 (0xb41) DataOff=64 (0x40) DataDisp=0 (0x0) SetupCnt=0 (0x0) Parameters= Data: (8 bytes) [000] 49 00 00 00 00 00 35 0B I\000\000\000\000\0005\013 Data= Data: (2881 bytes) [000] 00 00 00 00 27 27 30 B8 83 31 00 00 97 26 C0 B2 \000\000\000\000''0\270 \2031\000\000\227&\300\262 [010] 23 9B 00 00 23 9B 00 00 00 00 0C 48 41 52 44 57 #\233\000\000#\233\000\000 \000\000\014HARDW [020] 41 52 45 2E 54 58 54 00 62 00 00 00 27 27 56 B8 ARE.TXT\000 b\000\000\000''V\270 [030] 83 31 00 00 97 26 C0 B2 90 0C 00 00 90 0C 00 00 \2031\000\000\227&\300\262 \220\014\000\000\220\014\000\000 [040] 00 00 09 48 49 44 43 49 2E 44 4C 4C 00 63 00 00 \000\000\011HIDCI .DLL\000c\000\000 [050] 00 27 27 56 B8 75 32 00 00 97 26 C0 B2 A7 81 00 \000''V\270u2\000 \000\227&\300\262\247\201\000 [060] 00 A7 81 00 00 00 00 09 48 49 4D 45 4D 2E 53 59 \000\247\201\000\000\000\000\011 HIMEM.SY [070] 53 00 64 00 00 00 27 27 0B B8 83 31 00 00 97 26 S\000d\000\000\000'' \013\270\2031\000\000\227& [080] C0 B2 7F 05 00 00 7F 05 00 00 00 00 0B 48 4C 50 \300\262\177\005\000\000\177\005 \000\000\000\000\013HLP [090] 42 45 4C 4C 2E 47 49 46 00 65 00 00 00 27 27 0B BELL.GIF \000e\000\000\000''\013 [0A0] B8 83 31 00 00 97 26 C0 B2 D4 05 00 00 D4 05 00 \270\2031\000\000\227&\300 \262\324\005\000\000\324\005\000 [0B0] 00 00 00 09 48 4C 50 43 44 2E 47 49 46 00 66 00 \000\000\000\011HLPC D.GIF\000f\000 [0C0] 00 00 27 27 0B B8 83 31 00 00 97 26 C0 B2 43 06 \000\000''\013\270\2031 \000\000\227&\300\262C\006 [0D0] 00 00 43 06 00 00 00 00 0C 48 4C 50 47 4C 4F 42 \000\000C\006\000\000\000\000 \014HLPGLOB [0E0] 45 2E 47 49 46 00 67 00 00 00 27 27 0B B8 83 31 E.GIF\000g\000 \000\000''\013\270\2031 [0F0] 00 00 97 26 C0 B2 A1 04 00 00 A1 04 00 00 00 00 \000\000\227&\300\262\241\004 \000\000\241\004\000\000\000\000 [100] 0B 48 4C 50 4C 4F 47 4F 2E 47 49 46 00 68 00 00 \013HLPLOGO .GIF\000h\000\000 [110] 00 27 27 0B B8 83 31 00 00 97 26 C0 B2 53 04 00 \000''\013\270\2031\000 \000\227&\300\262S\004\000 [120] 00 53 04 00 00 00 00 0C 48 4C 50 53 54 45 50 31 \000S\004\000\000\000\000\014 HLPSTEP1 [130] 2E 47 49 46 00 69 00 00 00 27 27 0B B8 83 31 00 .GIF\000i\000\000 \000''\013\270\2031\000 [140] 00 97 26 C0 B2 82 04 00 00 82 04 00 00 00 00 0C \000\227&\300\262\202\004\000 \000\202\004\000\000\000\000\014 [150] 48 4C 50 53 54 45 50 32 2E 47 49 46 00 6A 00 00 HLPSTEP2 .GIF\000j\000\000 [160] 00 27 27 0B B8 83 31 00 00 97 26 C0 B2 E1 04 00 \000''\013\270\2031\000 \000\227&\300\262\341\004\000 [170] 00 E1 04 00 00 00 00 0C 48 4C 50 53 54 45 50 33 \000\341\004\000\000\000\000\014 HLPSTEP3 [180] 2E 47 49 46 00 6B 00 00 00 8E 29 AD AE 83 31 00 .GIF\000k\000\000 \000\216)\255\256\2031\000 [190] 00 97 26 C0 B2 E0 02 00 00 E0 02 00 00 00 00 09 \000\227&\300\262\340\002\000 \000\340\002\000\000\000\000\011 [1A0] 48 4F 53 54 53 2E 53 41 4D 00 6C 00 00 00 27 27 HOSTS.SA M\000l\000\000\000'' [1B0] 14 B8 83 31 00 00 97 26 C0 B2 08 02 00 00 08 02 \024\270\2031\000\000\227& \300\262\010\002\000\000\010\002 [1C0] 00 00 00 00 0C 48 54 4D 4C 48 45 4C 50 2E 48 54 \000\000\000\000\014HTM LHELP.HT [1D0] 4D 00 6D 00 00 00 27 27 24 B8 4F 32 00 00 97 26 M\000m\000\000\000'' $\270O2\000\000\227& [1E0] C0 B2 0E 0E 00 00 0E 0E 00 00 00 00 0C 48 54 4D \300\262\016\016\000\000\016\016 \000\000\000\000\014HTM [1F0] 4C 48 45 4C 50 2E 49 4E 49 00 6E 00 00 00 69 2D LHELP.IN I\000n\000\000\000i- [200] 48 B6 83 31 00 00 69 2D 49 B6 20 90 0A 00 20 90 H\266\2031\000\000i- I\266 \220\012\000 \220 [210] 0A 00 03 00 0A 48 57 49 4E 46 4F 2E 44 41 54 00 \012\000\003\000\012HWI NFO.DAT\000 [220] 6F 00 00 00 27 27 10 B7 83 31 00 00 97 26 C0 B2 o\000\000\000''\020\267 \2031\000\000\227&\300\262 [230] 00 B0 01 00 00 B0 01 00 00 00 0A 48 57 49 4E 46 \000\260\001\000\000\260\001\000 \000\000\012HWINF [240] 4F 2E 45 58 45 00 70 00 00 00 27 27 70 B8 83 31 O.EXE\000p\000 \000\000''p\270\2031 [250] 00 00 97 26 C0 B2 D6 01 00 00 D6 01 00 00 00 00 \000\000\227&\300\262\326\001 \000\000\326\001\000\000\000\000 [260] 0F 48 6F 75 6E 64 73 74 6F 6F 74 68 2E 62 6D 70 \017Houndst ooth.bmp [270] 00 73 00 00 00 BD 26 E9 12 83 31 00 00 BD 26 EA \000s\000\000\000\275&\351 \022\2031\000\000\275&\352 [280] 12 1C 00 00 00 1C 00 00 00 00 00 08 49 43 4F 41 \022\034\000\000\000\034\000\000 \000\000\000\010ICOA [290] 2E 49 4E 49 00 74 00 00 00 1C 27 0E 0C 83 31 00 .INI\000t\000\000 \000\034'\016\014\2031\000 [2A0] 00 05 31 E2 64 BE 44 01 00 BE 44 01 00 00 00 10 \000\0051\342d\276D\001 \000\276D\001\000\000\000\020 [2B0] 49 45 20 53 65 74 75 70 20 4C 6F 67 2E 54 78 74 IE Setup Log.Txt [2C0] 00 77 00 00 00 29 28 28 9B 83 31 00 00 29 28 29 \000w\000\000\000)(( \233\2031\000\000)() [2D0] 9B 4D 04 00 00 4D 04 00 00 00 00 11 49 45 34 20 \233M\004\000\000M\004\000 \000\000\000\021IE4 [2E0] 45 72 72 6F 72 20 4C 6F 67 2E 74 78 74 00 7A 00 Error Lo g.txt\000z\000 [2F0] 00 00 27 27 B3 B8 75 32 00 00 97 26 C0 B2 7C 0E \000\000''\263\270u2 \000\000\227&\300\262|\016 [300] 00 00 7C 0E 00 00 00 00 0A 49 46 53 48 4C 50 2E \000\000|\016\000\000\000\000 \012IFSHLP. [310] 53 59 53 00 7B 00 00 00 8E 29 AA AE 35 32 00 00 SYS\000{\000\000\000 \216)\252\25652\000\000 [320] 97 26 C0 B2 00 D0 00 00 00 D0 00 00 00 00 0C 49 \227&\300\262\000\320\000\000 \000\320\000\000\000\000\014I [330] 4E 45 54 4D 49 42 31 2E 44 4C 4C 00 7C 00 00 00 NETMIB1. DLL\000|\000\000\000 [340] 24 27 A0 26 83 31 00 00 2D 28 F3 A1 3B 00 00 00 $'\240&\2031\000\000 -(\363\241;\000\000\000 [350] 3B 00 00 00 00 00 0A 49 4E 54 55 49 54 2E 49 4E ;\000\000\000\000\000\012I NTUIT.IN [360] 49 00 7D 00 00 00 24 27 21 22 83 31 00 00 24 27 I\000}\000\000\000$' !"\2031\000\000$' [370] 22 22 1E 00 00 00 1E 00 00 00 00 00 0A 49 4E 54 ""\036\000\000\000\036\000 \000\000\000\000\012INT [380] 55 52 53 2E 44 41 54 00 7E 00 00 00 27 27 AF B8 URS.DAT\000 ~\000\000\000''\257\270 [390] 75 32 00 00 97 26 C0 B2 27 30 00 00 27 30 00 00 u2\000\000\227&\300\262 '0\000\000'0\000\000 [3A0] 00 00 07 49 4F 53 2E 49 4E 49 00 7F 00 00 00 8E \000\000\007IOS.I NI\000\177\000\000\000\216 [3B0] 29 AC AE 6E 32 00 00 97 26 C0 B2 00 D0 00 00 00 )\254\256n2\000\000\227 &\300\262\000\320\000\000\000 [3C0] D0 00 00 00 00 0C 49 50 43 4F 4E 46 49 47 2E 45 \320\000\000\000\000\014IP CONFIG.E [3D0] 58 45 00 80 00 00 00 98 28 5D B0 83 31 00 00 98 XE\000\200\000\000\000\230 (]\260\2031\000\000\230 [3E0] 28 60 B0 00 00 00 00 00 00 00 00 00 00 0C 49 52 (`\260\000\000\000\000\000 \000\000\000\000\000\014IR [3F0] 4F 54 56 49 45 57 2E 49 4E 49 00 81 00 00 00 27 OTVIEW.I NI\000\201\000\000\000' [400] 27 5A B9 83 31 00 00 97 26 C0 B2 00 90 01 00 00 'Z\271\2031\000\000\227 &\300\262\000\220\001\000\000 [410] 90 01 00 00 00 0A 49 52 58 46 45 52 2E 45 58 45 \220\001\000\000\000\012IR XFER.EXE [420] 00 82 00 00 00 AE 26 98 8C 83 31 00 00 FF 24 1C \000\202\000\000\000\256&\230 \214\2031\000\000\377$\034 [430] 88 00 FE 00 00 00 FE 00 00 00 00 09 49 63 67 33 \210\000\376\000\000\000\376\000 \000\000\000\011Icg3 [440] 32 2E 64 6C 6C 00 84 00 00 00 AE 26 98 8C 83 31 2.dll\000\204\000 \000\000\256&\230\214\2031 [450] 00 00 DD 24 E9 84 48 19 00 00 48 19 00 00 00 00 \000\000\335$\351\204H\031 \000\000H\031\000\000\000\000 [460] 0C 49 63 6F 61 64 62 33 32 2E 64 61 74 00 86 00 \014Icoadb3 2.dat\000\206\000 [470] 00 00 59 30 74 99 83 31 00 00 5D 25 A3 7D 00 AE \000\000Y0t\231\2031 \000\000]%\243}\000\256 [480] 04 00 00 AE 04 00 00 00 0C 49 73 55 6E 69 6E 73 \004\000\000\256\004\000\000\000 \014IsUnins [490] 74 2E 65 78 65 00 88 00 00 00 0C 29 88 7B 90 31 t.exe\000\210\000 \000\000\014)\210{\2201 [4A0] 00 00 0C 29 89 7B 00 00 00 00 00 00 00 00 00 00 \000\000\014)\211{\000\000 \000\000\000\000\000\000\000\000 [4B0] 05 4A 2E 49 4E 49 00 89 00 00 00 13 2F AE 02 83 \005J.INI\000\211 \000\000\000\023/\256\002\203 [4C0] 31 00 00 5C 2E 6D 84 96 19 00 00 96 19 00 00 00 1\000\000\.m\204\226 \031\000\000\226\031\000\000\000 [4D0] 00 0C 4A 41 55 54 4F 45 58 50 2E 44 41 54 00 8A \000\014JAUTOE XP.DAT\000\212 [4E0] 00 00 00 9E 2D 4A B1 9E 2D 00 00 9E 2D 4B B1 00 \000\000\000\236-J\261\236 -\000\000\236-K\261\000 [4F0] 00 00 00 00 00 00 00 10 00 05 4D 53 44 55 4E 00 \000\000\000\000\000\000\000\020 \000\005MSDUN\000 [500] 8B 00 00 00 27 27 CD B8 28 32 00 00 97 26 C0 B2 \213\000\000\000''\315\270 (2\000\000\227&\300\262 [510] 00 10 08 00 00 10 08 00 00 00 0C 4B 4F 44 41 4B \000\020\010\000\000\020\010\000 \000\000\014KODAK [520] 49 4D 47 2E 45 58 45 00 8C 00 00 00 27 27 CD B8 IMG.EXE\000 \214\000\000\000''\315\270 [530] 32 32 00 00 97 26 C0 B2 00 C0 01 00 00 C0 01 00 22\000\000\227&\300\262 \000\300\001\000\000\300\001\000 [540] 00 00 0C 4B 4F 44 41 4B 50 52 56 2E 45 58 45 00 \000\000\014KODAK PRV.EXE\000 [550] 8D 00 00 00 74 26 00 08 75 32 00 00 24 32 76 88 \215\000\000\000t&\000\010 u2\000\000$2v\210 [560] 80 05 00 00 80 05 00 00 00 00 00 00 00 00 00 00 \200\005\000\000\200\005\000\000 \000\000\000\000\000\000\000\000 [570] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [580] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [590] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [600] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [610] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [620] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [630] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [640] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [650] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [660] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [670] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [680] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [690] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [700] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [710] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [720] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [730] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [740] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [750] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [760] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [770] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [780] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [790] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [800] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [810] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [820] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [830] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [840] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [850] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [860] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [870] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [880] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [890] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [900] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [910] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [920] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [930] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [940] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [950] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [960] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [970] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [980] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [990] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A00] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A10] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A20] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A30] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A40] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A50] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A60] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A70] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A80] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A90] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AA0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AB0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AC0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AD0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AE0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AF0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B00] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B10] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B20] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B30] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B40] 00 \000 (DF) (ttl 128, id 4576, len 1492) 0x0000 4500 05d4 11e0 4000 8006 5fd4 c0a8 010d E.....@..._..... 0x0010 c0a8 0112 008b 83fd 0494 0fd2 2163 2986 ............!c). 0x0020 5010 f801 985d 0000 0000 0b81 ff53 4d42 P....].......SMB 0x0030 3200 0000 0088 0100 0000 0000 0000 0000 2............... 0x0040 0000 0000 03f8 3d45 0000 0100 0a08 0041 ......=E.......A 0x0050 0b00 0008 0037 0000 0041 0b40 0000 0000 .....7...A.@.... 0x0060 004a 0b49 0000 0000 0035 0b1a 0000 0000 .J.I.....5...... 0x0070 2727 30b8 8331 0000 9726 c0b2 239b 0000 ''0..1...&..#... 0x0080 239b 0000 0000 0c48 4152 4457 4152 452e #......HARDWARE. 0x0090 5458 5400 6200 0000 2727 56b8 8331 0000 TXT.b...''V..1.. 0x00a0 9726 c0b2 900c 0000 900c 0000 0000 0948 .&.............H 0x00b0 4944 4349 2e44 4c4c 0063 0000 0027 2756 IDCI.DLL.c...''V 0x00c0 b875 3200 0097 26c0 b2a7 8100 00a7 8100 .u2...&......... 0x00d0 0000 0009 4849 4d45 4d2e 5359 5300 6400 ....HIMEM.SYS.d. 0x00e0 0000 2727 0bb8 8331 0000 9726 c0b2 7f05 ..''...1...&.... 0x00f0 0000 7f05 0000 0000 0b48 4c50 4245 4c4c .........HLPBELL 0x0100 2e47 4946 0065 0000 0027 270b b883 3100 .GIF.e...''...1. 0x0110 0097 26c0 b2d4 0500 00d4 0500 0000 0009 ..&............. 0x0120 484c 5043 442e 4749 4600 6600 0000 2727 HLPCD.GIF.f...'' 0x0130 0bb8 8331 0000 9726 c0b2 4306 0000 4306 ...1...&..C...C. 0x0140 0000 0000 0c48 4c50 474c 4f42 452e 4749 .....HLPGLOBE.GI 0x0150 4600 6700 0000 2727 0bb8 8331 0000 9726 F.g...''...1...& 0x0160 c0b2 a104 0000 a104 0000 0000 0b48 4c50 .............HLP 0x0170 4c4f 474f 2e47 4946 0068 0000 0027 270b LOGO.GIF.h...''. 0x0180 b883 3100 0097 26c0 b253 0400 0053 0400 ..1...&..S...S.. 0x0190 0000 000c 484c 5053 5445 5031 2e47 4946 ....HLPSTEP1.GIF 0x01a0 0069 0000 0027 270b b883 3100 0097 26c0 .i...''...1...&. 0x01b0 b282 0400 0082 0400 0000 000c 484c 5053 ............HLPS 0x01c0 5445 5032 2e47 4946 006a 0000 0027 270b TEP2.GIF.j...''. 0x01d0 b883 3100 0097 26c0 b2e1 0400 00e1 0400 ..1...&......... 0x01e0 0000 000c 484c 5053 5445 5033 2e47 4946 ....HLPSTEP3.GIF 0x01f0 006b 0000 008e 29ad ae83 3100 0097 26c0 .k....)...1...&. 0x0200 b2e0 0200 00e0 0200 0000 0009 484f 5354 ............HOST 0x0210 532e 5341 4d00 6c00 0000 2727 14b8 8331 S.SAM.l...''...1 0x0220 0000 9726 c0b2 0802 0000 0802 0000 0000 ...&............ 0x0230 0c48 544d 4c48 454c 502e 4854 4d00 6d00 .HTMLHELP.HTM.m. 0x0240 0000 2727 24b8 4f32 0000 9726 c0b2 0e0e ..''$.O2...&.... 0x0250 0000 0e0e 0000 0000 0c48 544d 4c48 454c .........HTMLHEL 0x0260 502e 494e 4900 6e00 0000 692d 48b6 8331 P.INI.n...i-H..1 0x0270 0000 692d 49b6 2090 0a00 2090 0a00 0300 ..i-I........... 0x0280 0a48 5749 4e46 4f2e 4441 5400 6f00 0000 .HWINFO.DAT.o... 0x0290 2727 10b7 8331 0000 9726 c0b2 00b0 0100 ''...1...&...... 0x02a0 00b0 0100 0000 0a48 5749 4e46 4f2e 4558 .......HWINFO.EX 0x02b0 4500 7000 0000 2727 70b8 8331 0000 9726 E.p...''p..1...& 0x02c0 c0b2 d601 0000 d601 0000 0000 0f48 6f75 .............Hou 0x02d0 6e64 7374 6f6f 7468 2e62 6d70 0073 0000 ndstooth.bmp.s.. 0x02e0 00bd 26e9 1283 3100 00bd 26ea 121c 0000 ..&...1...&..... 0x02f0 001c 0000 0000 0008 4943 4f41 2e49 4e49 ........ICOA.INI 0x0300 0074 0000 001c 270e 0c83 3100 0005 31e2 .t....'...1...1. 0x0310 64be 4401 00be 4401 0000 0010 4945 2053 d.D...D.....IE.S 0x0320 6574 7570 204c 6f67 2e54 7874 0077 0000 etup.Log.Txt.w.. 0x0330 0029 2828 9b83 3100 0029 2829 9b4d 0400 .)((..1..)().M.. 0x0340 004d 0400 0000 0011 4945 3420 4572 726f .M......IE4.Erro 0x0350 7220 4c6f 672e 7478 7400 7a00 0000 2727 r.Log.txt.z...'' 0x0360 b3b8 7532 0000 9726 c0b2 7c0e 0000 7c0e ..u2...&..|...|. 0x0370 0000 0000 0a49 4653 484c 502e 5359 5300 .....IFSHLP.SYS. 0x0380 7b00 0000 8e29 aaae 3532 0000 9726 c0b2 {....)..52...&.. 0x0390 00d0 0000 00d0 0000 0000 0c49 4e45 544d ...........INETM 0x03a0 4942 312e 444c 4c00 7c00 0000 2427 a026 IB1.DLL.|...$'.& 0x03b0 8331 0000 2d28 f3a1 3b00 0000 3b00 0000 .1..-(..;...;... 0x03c0 0000 0a49 4e54 5549 542e 494e 4900 7d00 ...INTUIT.INI.}. 0x03d0 0000 2427 2122 8331 0000 2427 2222 1e00 ..$'!".1..$'"".. 0x03e0 0000 1e00 0000 0000 0a49 4e54 5552 532e .........INTURS. 0x03f0 4441 5400 7e00 0000 2727 afb8 7532 0000 DAT.~...''..u2.. 0x0400 9726 c0b2 2730 0000 2730 0000 0000 0749 .&..'0..'0.....I 0x0410 4f53 2e49 4e49 007f 0000 008e 29ac ae6e OS.INI......)..n 0x0420 3200 0097 26c0 b200 d000 0000 d000 0000 2...&........... 0x0430 000c 4950 434f 4e46 4947 2e45 5845 0080 ..IPCONFIG.EXE.. 0x0440 0000 0098 285d b083 3100 0098 2860 b000 ....(]..1...(`.. 0x0450 0000 0000 0000 0000 000c 4952 4f54 5649 ..........IROTVI 0x0460 4557 2e49 4e49 0081 0000 0027 275a b983 EW.INI.....''Z.. 0x0470 3100 0097 26c0 b200 9001 0000 9001 0000 1...&........... 0x0480 000a 4952 5846 4552 2e45 5845 0082 0000 ..IRXFER.EXE.... 0x0490 00ae 2698 8c83 3100 00ff 241c 8800 fe00 ..&...1...$..... 0x04a0 0000 fe00 0000 0009 4963 6733 322e 646c ........Icg32.dl 0x04b0 6c00 8400 0000 ae26 988c 8331 0000 dd24 l......&...1...$ 0x04c0 e984 4819 0000 4819 0000 0000 0c49 636f ..H...H......Ico 0x04d0 6164 6233 322e 6461 7400 8600 0000 5930 adb32.dat.....Y0 0x04e0 7499 8331 0000 5d25 a37d 00ae 0400 00ae t..1..]%.}...... 0x04f0 0400 0000 0c49 7355 6e69 6e73 742e 6578 .....IsUninst.ex 0x0500 6500 8800 0000 0c29 887b 9031 0000 0c29 e......).{.1...) 0x0510 897b 0000 0000 0000 0000 0000 054a 2e49 .{...........J.I 0x0520 4e49 0089 0000 0013 2fae 0283 3100 005c NI....../...1..\ 0x0530 2e6d 8496 1900 0096 1900 0000 000c 4a41 .m............JA 0x0540 5554 4f45 5850 2e44 4154 008a 0000 009e UTOEXP.DAT...... 0x0550 2d4a b19e 2d00 009e 2d4b b100 0000 0000 -J..-...-K...... 0x0560 0000 0010 0005 4d53 4455 4e00 8b00 0000 ......MSDUN..... 0x0570 2727 cdb8 2832 0000 9726 c0b2 0010 0800 ''..(2...&...... 0x0580 0010 0800 0000 0c4b 4f44 414b 494d 472e .......KODAKIMG. 0x0590 4558 4500 8c00 0000 2727 cdb8 3232 0000 EXE.....''..22.. 0x05a0 9726 c0b2 00c0 0100 00c0 0100 0000 0c4b .&.............K 0x05b0 4f44 414b 5052 562e 4558 4500 8d00 0000 ODAKPRV.EXE..... 0x05c0 7426 0008 7532 0000 2432 7688 8005 0000 t&..u2..$2v..... 0x05d0 8005 0000 .... 17:11:59.561740 192.168.1.13.netbios-ssn > 192.168.1.18.33789: . [tcp sum ok] 4462:5914(1452) ack 239 win 63489 >>> NBT Packet NBT Session Packet Flags=0x0 Length=2892 (0xb4c) Session packet:(raw data?) (DF) (ttl 128, id 4832, len 1492) 0x0000 4500 05d4 12e0 4000 8006 5ed4 c0a8 010d E.....@...^..... 0x0010 c0a8 0112 008b 83fd 0494 157e 2163 2986 ...........~!c). 0x0020 5010 f801 e5ff 0000 0000 0b4c 4157 4c45 P..........LAWLE 0x0030 5353 2e50 574c 008e 0000 0073 2671 bd58 SS.PWL.....s&q.X 0x0040 3200 00ee 2c23 08e3 1e00 00e3 1e00 0000 2...,#.......... 0x0050 0009 4c45 5850 532e 494e 4900 8f00 0000 ..LEXPS.INI..... 0x0060 2727 18b7 8331 0000 9726 c0b2 5c66 0000 ''...1...&..\f.. 0x0070 5c66 0000 0000 0b4c 4943 454e 5345 2e54 \f.....LICENSE.T 0x0080 5854 0090 0000 008e 29ad ae83 3100 0097 XT......)...1... 0x0090 26c0 b285 0e00 0085 0e00 0000 000b 4c4d &.............LM 0x00a0 484f 5354 532e 5341 4d00 9100 0000 2827 HOSTS.SAM.....(' 0x00b0 5703 7532 0000 7326 ada0 06f9 0100 06f9 W.u2..s&........ 0x00c0 0100 0000 094c 4f47 4f53 2e53 5953 0092 .....LOGOS.SYS.. 0x00d0 0000 0028 275c 0375 3200 0073 264a a01c ...('\.u2..s&J.. 0x00e0 f901 001c f901 0000 0009 4c4f 474f 572e ..........LOGOW. 0x00f0 5359 5300 9300 0000 7426 f31d 5832 0000 SYS.....t&..X2.. 0x0100 5832 5b65 f501 0000 f501 0000 2000 104c X2[e...........L 0x0110 5420 5769 6e20 4d6f 6465 6d2e 6c6f 6700 T.Win.Modem.log. 0x0120 9600 0000 1c27 610c 8331 0000 1c27 670c .....'a..1...'g. 0x0130 ff5f 0000 ff5f 0000 0000 0b4d 4441 4353 ._..._.....MDACS 0x0140 4554 2e6c 6f67 0098 0000 0027 27a0 b883 ET.log.....''... 0x0150 3100 0097 26c0 b200 8000 0000 8000 0000 1...&........... 0x0160 000a 4d4d 3245 4e54 2e45 5845 0099 0000 ..MM2ENT.EXE.... 0x0170 0074 265b 3083 3100 0028 2f72 2d8d 0000 .t&[0.1..(/r-... 0x0180 008d 0000 0000 0007 4d4d 432e 494e 4900 ........MMC.INI. 0x0190 9a00 0000 2c27 300b 8331 0000 4929 a48c ....,'0..1..I).. 0x01a0 3a00 0000 3a00 0000 0000 0c4d 4f44 454d :...:......MODEM 0x01b0 4445 542e 5458 5400 9b00 0000 2727 83b8 DET.TXT.....''.. 0x01c0 8331 0000 9726 c0b2 c049 0100 c049 0100 .1...&...I...I.. 0x01d0 0000 0c4d 4f52 4943 4f4e 532e 444c 4c00 ...MORICONS.DLL. 0x01e0 9c00 0000 2727 30b8 8331 0000 9726 c0b2 ....''0..1...&.. 0x01f0 3a17 0000 3a17 0000 0000 094d 4f55 5345 :...:......MOUSE 0x0200 2e54 5854 009d 0000 0027 2725 b783 3100 .TXT.....''%..1. 0x0210 0097 26c0 b200 7002 0000 7002 0000 000b ..&...p...p..... 0x0220 4d50 4c41 5945 522e 4558 4500 9e00 0000 MPLAYER.EXE..... 0x0230 2727 b2b8 8331 0000 9726 c0b2 2c0d 0000 ''...1...&..,... 0x0240 2c0d 0000 0000 324d 532d 444f 5320 4d6f ,.....2MS-DOS.Mo 0x0250 6465 2066 6f72 2047 616d 6573 2077 6974 de.for.Games.wit 0x0260 6820 454d 5320 616e 6420 584d 5320 5375 h.EMS.and.XMS.Su 0x0270 7070 6f72 742e 7069 6600 a300 0000 2727 pport.pif.....'' 0x0280 b2b8 8331 0000 9726 c0b2 6d0c 0000 6d0c ...1...&..m...m. 0x0290 0000 0000 194d 532d 444f 5320 4d6f 6465 .....MS-DOS.Mode 0x02a0 2066 6f72 2047 616d 6573 2e70 6966 00a6 .for.Games.pif.. 0x02b0 0000 007d 27cc 9683 3100 0078 2540 40f8 ...}'...1..x%@@. 0x02c0 0000 00f8 0000 0000 000b 4d53 4241 5443 ..........MSBATC 0x02d0 482e 494e 4600 a700 0000 2c26 a79e 8331 H.INF.....,&...1 0x02e0 0000 2c26 a79e 7d05 0000 7d05 0000 0000 ..,&..}...}..... 0x02f0 0b4d 5344 464d 4150 2e49 4e49 00a8 0000 .MSDFMAP.INI.... 0x0300 0027 2730 b883 3100 0097 26c0 b207 b200 .''0..1...&..... 0x0310 0007 b200 0000 000c 4d53 444f 5344 5256 ........MSDOSDRV 0x0320 2e54 5854 00a9 0000 0074 26a9 7a83 3100 .TXT.....t&.z.1. 0x0330 00b4 2c6f 6900 4000 0000 4000 0000 000c ..,oi.@...@..... 0x0340 4d53 494d 4753 495a 2e44 4154 00aa 0000 MSIMGSIZ.DAT.... 0x0350 0074 269d 2483 3100 0074 26a0 2400 0000 .t&.$.1..t&.$... 0x0360 0000 0000 0000 000c 4d53 494e 464f 3332 ........MSINFO32 0x0370 2e49 4e49 00ab 0000 0027 27cd b883 3100 .INI.....''...1. 0x0380 0097 26c0 b200 b000 0000 b000 0000 000c ..&............. 0x0390 4d53 4e43 5245 4154 2e45 5845 00ac 0000 MSNCREAT.EXE.... 0x03a0 007d 27cc 9683 3100 00ab 2420 9800 d000 .}'...1...$..... 0x03b0 0000 d000 0000 000b 4d53 4e49 434f 4e2e ........MSNICON. 0x03c0 4558 4500 ad00 0000 2727 04b8 8331 0000 EXE.....''...1.. 0x03d0 9726 c0b2 0000 0100 0000 0100 0000 0c4d .&.............M 0x03e0 534e 4d47 5352 312e 4558 4500 ae00 0000 SNMGSR1.EXE..... 0x03f0 eb22 0000 8331 0000 eb22 0000 be89 0000 ."...1..."...... 0x0400 be89 0000 0100 094d 534f 3937 2e41 434c .......MSO97.ACL 0x0410 00af 0000 0027 27da b883 3100 0027 27db .....''...1..''. 0x0420 b81a 0000 001a 0000 0000 000c 4d53 4f46 ............MSOF 0x0430 4649 4345 2e49 4e49 00b0 0000 0027 2787 FICE.INI.....''. 0x0440 b883 3100 0097 26c0 b238 e001 0038 e001 ..1...&..8...8.. 0x0450 0000 000c 4d53 4f57 5334 3039 2e44 4c4c ....MSOWS409.DLL 0x0460 00b1 0000 008e 29ac ae83 3100 0097 26c0 ......)...1...&. 0x0470 b2ef 8600 00ef 8600 0000 000b 4e42 5453 ............NBTS 0x0480 5441 542e 4558 4500 b200 0000 2727 65b7 TAT.EXE.....''e. 0x0490 8331 0000 9726 c0b2 d036 0000 d036 0000 .1...&...6...6.. 0x04a0 0000 0b4e 4444 4541 5049 2e44 4c4c 00b3 ...NDDEAPI.DLL.. 0x04b0 0000 0027 2765 b783 3100 0097 26c0 b2e0 ...''e..1...&... 0x04c0 2a00 00e0 2a00 0000 000a 4e44 4445 4e42 *...*.....NDDENB 0x04d0 2e44 4c4c 00b4 0000 0000 0000 0075 3200 .DLL.........u2. 0x04e0 0075 3269 9e00 0000 0000 0000 0020 000b .u2i............ 0x04f0 4e44 4953 4c4f 472e 5458 5400 b500 0000 NDISLOG.TXT..... 0x0500 2727 62b8 8331 0000 9726 c0b2 266f 0500 ''b..1...&..&o.. 0x0510 266f 0500 0000 074e 4554 2e45 5845 00b6 &o.....NET.EXE.. 0x0520 0000 0027 2763 b883 3100 0097 26c0 b28c ...''c..1...&... 0x0530 aa01 008c aa01 0000 0007 4e45 542e 4d53 ..........NET.MS 0x0540 4700 b700 0000 2727 04b8 8331 0000 9726 G.....''...1...& 0x0550 c0b2 30de 0000 30de 0000 0000 0a4e 4554 ..0...0......NET 0x0560 4444 452e 4558 4500 b800 0000 2727 12b7 DDE.EXE.....''.. 0x0570 8331 0000 9726 c0b2 cd1e 0000 cd1e 0000 .1...&.......... 0x0580 0000 0a4e 4554 4445 542e 494e 4900 b900 ...NETDET.INI... 0x0590 0000 2727 64b8 8331 0000 9726 c0b2 3b1e ..''d..1...&..;. 0x05a0 0100 3b1e 0100 0000 084e 4554 482e 4d53 ..;......NETH.MS 0x05b0 4700 ba00 0000 7426 cf35 8331 0000 bb30 G.....t&.5.1...0 0x05c0 13b6 bf00 0000 bf00 0000 0000 0c4e 4554 .............NET 0x05d0 5343 4150 SCAP 17:11:59.561744 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: . [tcp sum ok] 239:239(0) ack 5914 win 17424 (DF) (ttl 64, id 36134, len 40) 0x0000 4500 0028 8d26 4000 4006 2a3a c0a8 0112 E..(.&@.@.*:.... 0x0010 c0a8 010d 83fd 008b 2163 2986 0494 1b2a ........!c)....* 0x0020 5010 4410 f924 0000 P.D..$.. 17:11:59.561760 192.168.1.13.netbios-ssn > 192.168.1.18.33789: P [tcp sum ok] 5914:5959(45) ack 239 win 63489 >>> NBT Packet flags=0x45 NBT - Unknown packet type Type=0x452E494E Data: (41 bytes) [000] 49 00 BB 00 00 00 8E 29 AC AE 35 32 00 00 97 26 I\000\273\000\000\000\216) \254\25652\000\000\227& [010] C0 B2 00 80 00 00 00 80 00 00 00 00 0B 4E 45 54 \300\262\000\200\000\000\000\200 \000\000\000\000\013NET [020] 53 54 41 54 2E 45 58 45 00 STAT.EXE \000 (DF) (ttl 128, id 5088, len 85) 0x0000 4500 0055 13e0 4000 8006 6353 c0a8 010d E..U..@...cS.... 0x0010 c0a8 0112 008b 83fd 0494 1b2a 2163 2986 ...........*!c). 0x0020 5018 f801 7dc7 0000 452e 494e 4900 bb00 P...}...E.INI... 0x0030 0000 8e29 acae 3532 0000 9726 c0b2 0080 ...)..52...&.... 0x0040 0000 0080 0000 0000 0b4e 4554 5354 4154 .........NETSTAT 0x0050 2e45 5845 00 .EXE. 17:11:59.562209 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: P [tcp sum ok] 239:334(95) ack 5959 win 17424 >>> NBT Packet NBT Session Packet Flags=0x0 Length=91 (0x5b) SMB PACKET: SMBtrans2 (REQUEST) SMB Command = 0x32 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x8 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 15 (0xf) TRANSACT2_FINDNEXT param_length=23 data_length=0 TotParam=23 (0x17) TotData=0 (0x0) MaxParam=10 (0xa) MaxData=2920 (0xb68) MaxSetup=0 (0x0) Flags=0x0 TimeOut=0 (0x0) Res1=0x0 ParamCnt=23 (0x17) ParamOff=68 (0x44) DataCnt=0 (0x0) DataOff=91 (0x5b) SetupCnt=1 (0x1) TransactionName=Parameters= Data: (23 bytes) [000] 68 81 00 02 01 00 00 00 00 00 0E 00 45 54 53 54 h\201\000\002\001\000\000\000 \000\000\016\000ETST [010] 41 54 2E 45 58 45 00 AT.EXE\000 Data= (DF) (ttl 64, id 36135, len 135) 0x0000 4500 0087 8d27 4000 4006 29da c0a8 0112 E....'@.@.)..... 0x0010 c0a8 010d 83fd 008b 2163 2986 0494 1b57 ........!c)....W 0x0020 5018 4410 fed2 0000 0000 005b ff53 4d42 P.D........[.SMB 0x0030 3200 0000 0008 0100 0000 0000 0000 0000 2............... 0x0040 0000 0000 03f8 3d45 0000 0100 0f17 0000 ......=E........ 0x0050 000a 0068 0b00 0000 0000 0000 0000 0017 ...h............ 0x0060 0044 0000 005b 0001 0002 001a 0000 4420 .D...[........D. 0x0070 6881 0002 0100 0000 0000 0e00 4554 5354 h...........ETST 0x0080 4154 2e45 5845 00 AT.EXE. 17:11:59.564541 192.168.1.13.netbios-ssn > 192.168.1.18.33789: . [tcp sum ok] 5959:7411(1452) ack 334 win 63394 >>> NBT Packet NBT Session Packet Flags=0x0 Length=2943 (0xb7f) WARNING: Short packet. Try increasing the snap length (1448) SMB PACKET: SMBtrans2 (REPLY) SMB Command = 0x32 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x88 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 10 (0xa) TRANSACT2_FINDNEXT param_length=8 data_length=2879 TotParam=8 (0x8) TotData=2879 (0xb3f) Res1=0x0 ParamCnt=8 (0x8) ParamOff=55 (0x37) ParamDisp0 (0x0) DataCnt=2879 (0xb3f) DataOff=64 (0x40) DataDisp=0 (0x0) SetupCnt=0 (0x0) Parameters= Data: (8 bytes) [000] 49 00 00 00 00 00 33 0B I\000\000\000\000\0003\013 Data= Data: (2879 bytes) [000] 00 00 00 00 27 27 CD B8 83 31 00 00 97 26 C0 B2 \000\000\000\000''\315\270 \2031\000\000\227&\300\262 [010] 00 20 01 00 00 20 01 00 00 00 0C 4E 45 54 57 41 \000 \001\000\000 \001\000 \000\000\014NETWA [020] 54 43 48 2E 45 58 45 00 BD 00 00 00 27 27 30 B8 TCH.EXE\000 \275\000\000\000''0\270 [030] 83 31 00 00 97 26 C0 B2 31 89 00 00 31 89 00 00 \2031\000\000\227&\300\262 1\211\000\0001\211\000\000 [040] 00 00 0B 4E 45 54 57 4F 52 4B 2E 54 58 54 00 BE \000\000\013NETWO RK.TXT\000\276 [050] 00 00 00 8E 29 A9 AE 83 31 00 00 97 26 C0 B2 97 \000\000\000\216)\251\256\203 1\000\000\227&\300\262\227 [060] 01 00 00 97 01 00 00 00 00 08 4E 45 54 57 4F 52 \001\000\000\227\001\000\000\000 \000\010NETWOR [070] 4B 53 00 BF 00 00 00 27 27 A1 B8 28 32 00 00 97 KS\000\277\000\000\000' '\241\270(2\000\000\227 [080] 26 C0 B2 00 D0 00 00 00 D0 00 00 00 00 0B 4E 4F &\300\262\000\320\000\000\000 \320\000\000\000\000\013NO [090] 54 45 50 41 44 2E 45 58 45 00 C0 00 00 00 38 2A TEPAD.EX E\000\300\000\000\0008* [0A0] F4 54 83 31 00 00 D6 2A 9C 5B 58 06 00 00 58 06 \364T\2031\000\000\326* \234[X\006\000\000X\006 [0B0] 00 00 00 00 2A 4E 6F 76 61 74 65 6C 20 57 69 72 \000\000\000\000*Nov atel Wir [0C0] 65 6C 65 73 73 20 4D 65 72 6C 69 6E 20 52 69 63 eless Me rlin Ric [0D0] 6F 63 68 65 74 20 4D 6F 64 65 6D 2E 6C 6F 67 00 ochet Mo dem.log\000 [0E0] C5 00 00 00 37 2A B5 A9 83 31 00 00 68 28 A7 90 \305\000\000\0007*\265\251 \2031\000\000h(\247\220 [0F0] 00 90 04 00 00 90 04 00 00 00 0E 4E 77 74 43 6C \000\220\004\000\000\220\004\000 \000\000\016NwtCl [100] 65 61 6E 75 70 2E 65 78 65 00 C8 00 00 00 74 26 eanup.ex e\000\310\000\000\000t& [110] 78 12 83 31 00 00 7D 2B A1 1D A1 05 00 00 A1 05 x\022\2031\000\000}+ \241\035\241\005\000\000\241\005 [120] 00 00 00 00 08 4F 44 42 43 2E 49 4E 49 00 C9 00 \000\000\000\000\010ODB C.INI\000\311\000 [130] 00 00 74 26 78 12 83 31 00 00 77 2A 9B 83 76 0A \000\000t&x\022\2031 \000\000w*\233\203v\012 [140] 00 00 76 0A 00 00 00 00 0C 4F 44 42 43 49 4E 53 \000\000v\012\000\000\000\000 \014ODBCINS [150] 54 2E 49 4E 49 00 CA 00 00 00 27 27 1D BB 83 31 T.INI\000\312\000 \000\000''\035\273\2031 [160] 00 00 05 31 EF 64 39 11 00 00 39 11 00 00 00 00 \000\000\0051\357d9\021 \000\0009\021\000\000\000\000 [170] 0C 4F 45 57 41 42 4C 6F 67 2E 74 78 74 00 CC 00 \014OEWABLo g.txt\000\314\000 [180] 00 00 4B 2A 6C 56 83 31 00 00 53 2A 25 B0 18 00 \000\000K*lV\2031 \000\000S*%\260\030\000 [190] 00 00 18 00 00 00 00 00 08 4F 50 37 30 2E 49 4E \000\000\030\000\000\000\000\000 \010OP70.IN [1A0] 49 00 CD 00 00 00 4B 2A 5C 56 83 31 00 00 50 25 I\000\315\000\000\000K* \V\2031\000\000P% [1B0] A4 4D 00 AC 00 00 00 AC 00 00 00 00 0C 4F 50 39 \244M\000\254\000\000\000\254 \000\000\000\000\014OP9 [1C0] 44 65 69 6E 73 2E 65 78 65 00 CF 00 00 00 27 27 Deins.ex e\000\317\000\000\000'' [1D0] A1 B8 83 31 00 00 97 26 C0 B2 00 30 01 00 00 30 \241\270\2031\000\000\227& \300\262\0000\001\000\0000 [1E0] 01 00 00 00 0C 50 41 43 4B 41 47 45 52 2E 45 58 \001\000\000\000\014PAC KAGER.EX [1F0] 45 00 D0 00 00 00 27 27 A1 B8 83 31 00 00 97 26 E\000\320\000\000\000'' \241\270\2031\000\000\227& [200] C0 B2 00 50 00 00 00 50 00 00 00 00 0A 50 42 52 \300\262\000P\000\000\000P \000\000\000\000\012PBR [210] 55 53 48 2E 45 58 45 00 D1 00 00 00 52 29 93 A0 USH.EXE\000 \321\000\000\000R)\223\240 [220] 49 32 00 00 52 29 94 A0 CF 08 00 00 CF 08 00 00 I2\000\000R)\224\240 \317\010\000\000\317\010\000\000 [230] 00 00 18 50 47 50 4D 61 63 42 69 6E 61 72 79 4D \000\000\030PGPMa cBinaryM [240] 61 70 70 69 6E 67 73 2E 74 78 74 00 D4 00 00 00 appings. txt\000\324\000\000\000 [250] 52 29 C8 AA 34 32 00 00 52 29 C9 AA 92 00 00 00 R)\310\25242\000\000 R)\311\252\222\000\000\000 [260] 92 00 00 00 00 00 0C 50 47 50 67 72 6F 75 70 2E \222\000\000\000\000\000\014P GPgroup. [270] 70 67 72 00 D6 00 00 00 52 29 6A A0 49 32 00 00 pgr\000\326\000\000\000 R)j\240I2\000\000 [280] 19 29 40 37 17 1B 00 00 17 1B 00 00 00 00 0E 50 \031)@7\027\033\000\000 \027\033\000\000\000\000\016P [290] 47 50 6D 65 6D 6C 6F 63 6B 2E 76 78 64 00 D9 00 GPmemloc k.vxd\000\331\000 [2A0] 00 00 52 29 93 A0 49 32 00 00 57 30 5D 26 08 01 \000\000R)\223\240I2 \000\000W0]&\010\001 [2B0] 00 00 08 01 00 00 00 00 0A 50 47 50 73 64 6B 2E \000\000\010\001\000\000\000\000 \012PGPsdk. [2C0] 64 61 74 00 DB 00 00 00 27 27 05 B8 83 31 00 00 dat\000\333\000\000\000 ''\005\270\2031\000\000 [2D0] 97 26 C0 B2 00 A0 00 00 00 A0 00 00 00 00 0A 50 \227&\300\262\000\240\000\000 \000\240\000\000\000\000\012P [2E0] 49 44 53 45 54 2E 45 58 45 00 DC 00 00 00 8E 29 IDSET.EX E\000\334\000\000\000\216) [2F0] AC AE 25 32 00 00 97 26 C0 B2 00 60 00 00 00 60 \254\256%2\000\000\227& \300\262\000`\000\000\000` [300] 00 00 00 00 08 50 49 4E 47 2E 45 58 45 00 DD 00 \000\000\000\000\010PIN G.EXE\000\335\000 [310] 00 00 75 32 75 9E 75 32 00 00 75 32 76 9E 3C 00 \000\000u2u\236u2 \000\000u2v\236<\000 [320] 00 00 3C 00 00 00 20 00 0C 50 4F 57 45 52 50 4E \000\000<\000\000\000 \000 \014POWERPN [330] 54 2E 49 4E 49 00 DE 00 00 00 27 27 30 B8 83 31 T.INI\000\336\000 \000\000''0\270\2031 [340] 00 00 97 26 C0 B2 4E 63 00 00 4E 63 00 00 00 00 \000\000\227&\300\262Nc \000\000Nc\000\000\000\000 [350] 0C 50 52 49 4E 54 45 52 53 2E 54 58 54 00 DF 00 \014PRINTER S.TXT\000\337\000 [360] 00 00 75 26 54 32 83 31 00 00 75 26 55 32 00 00 \000\000u&T2\2031 \000\000u&U2\000\000 [370] 00 00 00 00 00 00 00 00 0A 50 52 4F 47 4D 41 4E \000\000\000\000\000\000\000\000 \012PROGMAN [380] 2E 30 31 00 E0 00 00 00 27 27 A2 B8 83 31 00 00 .01\000\340\000\000\000 ''\242\270\2031\000\000 [390] 97 26 C0 B2 30 BB 01 00 30 BB 01 00 00 00 0B 50 \227&\300\2620\273\001\000 0\273\001\000\000\000\013P [3A0] 52 4F 47 4D 41 4E 2E 45 58 45 00 E1 00 00 00 27 ROGMAN.E XE\000\341\000\000\000' [3B0] 27 30 B8 83 31 00 00 97 26 C0 B2 D5 BA 00 00 D5 '0\270\2031\000\000\227 &\300\262\325\272\000\000\325 [3C0] BA 00 00 00 00 0C 50 52 4F 47 52 41 4D 53 2E 54 \272\000\000\000\000\014PR OGRAMS.T [3D0] 58 54 00 E2 00 00 00 8E 29 A9 AE 8C 31 00 00 97 XT\000\342\000\000\000\216 )\251\256\2141\000\000\227 [3E0] 26 C0 B2 20 03 00 00 20 03 00 00 00 00 08 50 52 &\300\262 \003\000\000 \003\000\000\000\000\010PR [3F0] 4F 54 4F 43 4F 4C 00 E3 00 00 00 27 27 70 B8 83 OTOCOL\000\343 \000\000\000''p\270\203 [400] 31 00 00 97 26 C0 B2 42 02 00 00 42 02 00 00 00 1\000\000\227&\300\262B \002\000\000B\002\000\000\000 [410] 00 0D 50 69 6E 73 74 72 69 70 65 2E 62 6D 70 00 \000\015Pinstr ipe.bmp\000 [420] E5 00 00 00 4B 2B 64 8B 83 31 00 00 4B 2B 64 8B \345\000\000\000K+d\213 \2031\000\000K+d\213 [430] 00 40 02 00 00 40 02 00 00 00 0C 50 77 72 42 73 \000@\002\000\000@\002\000 \000\000\014PwrBs [440] 74 32 6B 2E 65 78 65 00 E7 00 00 00 AE 26 9A 8C t2k.exe\000 \347\000\000\000\256&\232\214 [450] 83 31 00 00 B6 2C 47 5F 0C 00 00 00 0C 00 00 00 \2031\000\000\266,G_ \014\000\000\000\014\000\000\000 [460] 00 00 09 51 42 57 43 44 2E 49 4E 49 00 E8 00 00 \000\000\011QBWCD .INI\000\350\000\000 [470] 00 BD 26 E2 12 83 31 00 00 FB 26 4F 78 00 00 00 \000\275&\342\022\2031\000 \000\373&Ox\000\000\000 [480] 00 00 00 00 00 00 00 0A 51 44 51 49 43 4B 2E 69 \000\000\000\000\000\000\000\012 QDQICK.i [490] 6E 69 00 EA 00 00 00 69 32 FB 4C 69 32 00 00 FB ni\000\352\000\000\000i 2\373Li2\000\000\373 [4A0] 24 0D 76 00 90 00 00 00 90 00 00 20 00 0C 51 46 $\015v\000\220\000\000\000 \220\000\000 \000\014QF [4B0] 45 43 48 45 43 4B 2E 45 58 45 00 EB 00 00 00 BD ECHECK.E XE\000\353\000\000\000\275 [4C0] 26 E2 12 83 31 00 00 FB 26 4F 78 00 00 00 00 00 &\342\022\2031\000\000\373 &Ox\000\000\000\000\000 [4D0] 00 00 00 00 00 07 51 46 4E 2E 69 6E 69 00 ED 00 \000\000\000\000\000\007QF N.ini\000\355\000 [4E0] 00 00 27 27 DA B8 75 32 00 00 27 27 DB B8 1C 00 \000\000''\332\270u2 \000\000''\333\270\034\000 [4F0] 00 00 1C 00 00 00 00 00 07 51 54 57 2E 49 4E 49 \000\000\034\000\000\000\000\000 \007QTW.INI [500] 00 EE 00 00 00 FB 26 E2 78 33 32 00 00 57 30 6B \000\356\000\000\000\373&\342 x32\000\000W0k [510] 3E F1 05 00 00 F1 05 00 00 00 00 0B 51 55 49 43 >\361\005\000\000\361\005\000 \000\000\000\013QUIC [520] 4B 45 4E 2E 49 4E 49 00 EF 00 00 00 27 27 56 B8 KEN.INI\000 \357\000\000\000''V\270 [530] 83 31 00 00 97 26 C0 B2 77 31 00 00 77 31 00 00 \2031\000\000\227&\300\262 w1\000\000w1\000\000 [540] 00 00 0C 52 41 4D 44 52 49 56 45 2E 53 59 53 00 \000\000\014RAMDR IVE.SYS\000 [550] F0 00 00 00 27 27 15 B8 83 31 00 00 97 26 C0 B2 \360\000\000\000''\025\270 \2031\000\000\227&\300\262 [560] 69 02 00 00 69 02 00 00 00 00 00 00 00 00 00 00 i\002\000\000i\002\000\000 \000\000\000\000\000\000\000\000 [570] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [580] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [590] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [600] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [610] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [620] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [630] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [640] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [650] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [660] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [670] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [680] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [690] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [700] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [710] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [720] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [730] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [740] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [750] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [760] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [770] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [780] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [790] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [800] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [810] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [820] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [830] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [840] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [850] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [860] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [870] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [880] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [890] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [900] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [910] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [920] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [930] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [940] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [950] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [960] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [970] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [980] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [990] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A00] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A10] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A20] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A30] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A40] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A50] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A60] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A70] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A80] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A90] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AA0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AB0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AC0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AD0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AE0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AF0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B00] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B10] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B20] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B30] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000 (DF) (ttl 128, id 5344, len 1492) 0x0000 4500 05d4 14e0 4000 8006 5cd4 c0a8 010d E.....@...\..... 0x0010 c0a8 0112 008b 83fd 0494 1b57 2163 29e5 ...........W!c). 0x0020 5010 f7a2 846d 0000 0000 0b7f ff53 4d42 P....m.......SMB 0x0030 3200 0000 0088 0100 0000 0000 0000 0000 2............... 0x0040 0000 0000 03f8 3d45 0000 0100 0a08 003f ......=E.......? 0x0050 0b00 0008 0037 0000 003f 0b40 0000 0000 .....7...?.@.... 0x0060 0048 0b49 0000 0000 0033 0b1a 0000 0000 .H.I.....3...... 0x0070 2727 cdb8 8331 0000 9726 c0b2 0020 0100 ''...1...&...... 0x0080 0020 0100 0000 0c4e 4554 5741 5443 482e .......NETWATCH. 0x0090 4558 4500 bd00 0000 2727 30b8 8331 0000 EXE.....''0..1.. 0x00a0 9726 c0b2 3189 0000 3189 0000 0000 0b4e .&..1...1......N 0x00b0 4554 574f 524b 2e54 5854 00be 0000 008e ETWORK.TXT...... 0x00c0 29a9 ae83 3100 0097 26c0 b297 0100 0097 )...1...&....... 0x00d0 0100 0000 0008 4e45 5457 4f52 4b53 00bf ......NETWORKS.. 0x00e0 0000 0027 27a1 b828 3200 0097 26c0 b200 ...''..(2...&... 0x00f0 d000 0000 d000 0000 000b 4e4f 5445 5041 ..........NOTEPA 0x0100 442e 4558 4500 c000 0000 382a f454 8331 D.EXE.....8*.T.1 0x0110 0000 d62a 9c5b 5806 0000 5806 0000 0000 ...*.[X...X..... 0x0120 2a4e 6f76 6174 656c 2057 6972 656c 6573 *Novatel.Wireles 0x0130 7320 4d65 726c 696e 2052 6963 6f63 6865 s.Merlin.Ricoche 0x0140 7420 4d6f 6465 6d2e 6c6f 6700 c500 0000 t.Modem.log..... 0x0150 372a b5a9 8331 0000 6828 a790 0090 0400 7*...1..h(...... 0x0160 0090 0400 0000 0e4e 7774 436c 6561 6e75 .......NwtCleanu 0x0170 702e 6578 6500 c800 0000 7426 7812 8331 p.exe.....t&x..1 0x0180 0000 7d2b a11d a105 0000 a105 0000 0000 ..}+............ 0x0190 084f 4442 432e 494e 4900 c900 0000 7426 .ODBC.INI.....t& 0x01a0 7812 8331 0000 772a 9b83 760a 0000 760a x..1..w*..v...v. 0x01b0 0000 0000 0c4f 4442 4349 4e53 542e 494e .....ODBCINST.IN 0x01c0 4900 ca00 0000 2727 1dbb 8331 0000 0531 I.....''...1...1 0x01d0 ef64 3911 0000 3911 0000 0000 0c4f 4557 .d9...9......OEW 0x01e0 4142 4c6f 672e 7478 7400 cc00 0000 4b2a ABLog.txt.....K* 0x01f0 6c56 8331 0000 532a 25b0 1800 0000 1800 lV.1..S*%....... 0x0200 0000 0000 084f 5037 302e 494e 4900 cd00 .....OP70.INI... 0x0210 0000 4b2a 5c56 8331 0000 5025 a44d 00ac ..K*\V.1..P%.M.. 0x0220 0000 00ac 0000 0000 0c4f 5039 4465 696e .........OP9Dein 0x0230 732e 6578 6500 cf00 0000 2727 a1b8 8331 s.exe.....''...1 0x0240 0000 9726 c0b2 0030 0100 0030 0100 0000 ...&...0...0.... 0x0250 0c50 4143 4b41 4745 522e 4558 4500 d000 .PACKAGER.EXE... 0x0260 0000 2727 a1b8 8331 0000 9726 c0b2 0050 ..''...1...&...P 0x0270 0000 0050 0000 0000 0a50 4252 5553 482e ...P.....PBRUSH. 0x0280 4558 4500 d100 0000 5229 93a0 4932 0000 EXE.....R)..I2.. 0x0290 5229 94a0 cf08 0000 cf08 0000 0000 1850 R).............P 0x02a0 4750 4d61 6342 696e 6172 794d 6170 7069 GPMacBinaryMappi 0x02b0 6e67 732e 7478 7400 d400 0000 5229 c8aa ngs.txt.....R).. 0x02c0 3432 0000 5229 c9aa 9200 0000 9200 0000 42..R).......... 0x02d0 0000 0c50 4750 6772 6f75 702e 7067 7200 ...PGPgroup.pgr. 0x02e0 d600 0000 5229 6aa0 4932 0000 1929 4037 ....R)j.I2...)@7 0x02f0 171b 0000 171b 0000 0000 0e50 4750 6d65 ...........PGPme 0x0300 6d6c 6f63 6b2e 7678 6400 d900 0000 5229 mlock.vxd.....R) 0x0310 93a0 4932 0000 5730 5d26 0801 0000 0801 ..I2..W0]&...... 0x0320 0000 0000 0a50 4750 7364 6b2e 6461 7400 .....PGPsdk.dat. 0x0330 db00 0000 2727 05b8 8331 0000 9726 c0b2 ....''...1...&.. 0x0340 00a0 0000 00a0 0000 0000 0a50 4944 5345 ...........PIDSE 0x0350 542e 4558 4500 dc00 0000 8e29 acae 2532 T.EXE......)..%2 0x0360 0000 9726 c0b2 0060 0000 0060 0000 0000 ...&...`...`.... 0x0370 0850 494e 472e 4558 4500 dd00 0000 7532 .PING.EXE.....u2 0x0380 759e 7532 0000 7532 769e 3c00 0000 3c00 u.u2..u2v.<...<. 0x0390 0000 2000 0c50 4f57 4552 504e 542e 494e .....POWERPNT.IN 0x03a0 4900 de00 0000 2727 30b8 8331 0000 9726 I.....''0..1...& 0x03b0 c0b2 4e63 0000 4e63 0000 0000 0c50 5249 ..Nc..Nc.....PRI 0x03c0 4e54 4552 532e 5458 5400 df00 0000 7526 NTERS.TXT.....u& 0x03d0 5432 8331 0000 7526 5532 0000 0000 0000 T2.1..u&U2...... 0x03e0 0000 0000 0a50 524f 474d 414e 2e30 3100 .....PROGMAN.01. 0x03f0 e000 0000 2727 a2b8 8331 0000 9726 c0b2 ....''...1...&.. 0x0400 30bb 0100 30bb 0100 0000 0b50 524f 474d 0...0......PROGM 0x0410 414e 2e45 5845 00e1 0000 0027 2730 b883 AN.EXE.....''0.. 0x0420 3100 0097 26c0 b2d5 ba00 00d5 ba00 0000 1...&........... 0x0430 000c 5052 4f47 5241 4d53 2e54 5854 00e2 ..PROGRAMS.TXT.. 0x0440 0000 008e 29a9 ae8c 3100 0097 26c0 b220 ....)...1...&... 0x0450 0300 0020 0300 0000 0008 5052 4f54 4f43 ..........PROTOC 0x0460 4f4c 00e3 0000 0027 2770 b883 3100 0097 OL.....''p..1... 0x0470 26c0 b242 0200 0042 0200 0000 000d 5069 &..B...B......Pi 0x0480 6e73 7472 6970 652e 626d 7000 e500 0000 nstripe.bmp..... 0x0490 4b2b 648b 8331 0000 4b2b 648b 0040 0200 K+d..1..K+d..@.. 0x04a0 0040 0200 0000 0c50 7772 4273 7432 6b2e .@.....PwrBst2k. 0x04b0 6578 6500 e700 0000 ae26 9a8c 8331 0000 exe......&...1.. 0x04c0 b62c 475f 0c00 0000 0c00 0000 0000 0951 .,G_...........Q 0x04d0 4257 4344 2e49 4e49 00e8 0000 00bd 26e2 BWCD.INI......&. 0x04e0 1283 3100 00fb 264f 7800 0000 0000 0000 ..1...&Ox....... 0x04f0 0000 000a 5144 5149 434b 2e69 6e69 00ea ....QDQICK.ini.. 0x0500 0000 0069 32fb 4c69 3200 00fb 240d 7600 ...i2.Li2...$.v. 0x0510 9000 0000 9000 0020 000c 5146 4543 4845 ..........QFECHE 0x0520 434b 2e45 5845 00eb 0000 00bd 26e2 1283 CK.EXE......&... 0x0530 3100 00fb 264f 7800 0000 0000 0000 0000 1...&Ox......... 0x0540 0007 5146 4e2e 696e 6900 ed00 0000 2727 ..QFN.ini.....'' 0x0550 dab8 7532 0000 2727 dbb8 1c00 0000 1c00 ..u2..''........ 0x0560 0000 0000 0751 5457 2e49 4e49 00ee 0000 .....QTW.INI.... 0x0570 00fb 26e2 7833 3200 0057 306b 3ef1 0500 ..&.x32..W0k>... 0x0580 00f1 0500 0000 000b 5155 4943 4b45 4e2e ........QUICKEN. 0x0590 494e 4900 ef00 0000 2727 56b8 8331 0000 INI.....''V..1.. 0x05a0 9726 c0b2 7731 0000 7731 0000 0000 0c52 .&..w1..w1.....R 0x05b0 414d 4452 4956 452e 5359 5300 f000 0000 AMDRIVE.SYS..... 0x05c0 2727 15b8 8331 0000 9726 c0b2 6902 0000 ''...1...&..i... 0x05d0 6902 0000 i... 17:11:59.564670 192.168.1.13.netbios-ssn > 192.168.1.18.33789: . [tcp sum ok] 7411:8863(1452) ack 334 win 63394 >>> NBT Packet NBT Session Packet Flags=0x0 Length=2642 (0xa52) Session packet:(raw data?) (DF) (ttl 128, id 5600, len 1492) 0x0000 4500 05d4 15e0 4000 8006 5bd4 c0a8 010d E.....@...[..... 0x0010 c0a8 0112 008b 83fd 0494 2103 2163 29e5 ..........!.!c). 0x0020 5010 f7a2 4129 0000 0000 0a52 4541 444d P...A).....READM 0x0030 452e 4854 4d00 f100 0000 2727 16b8 8331 E.HTM.....''...1 0x0040 0000 9726 c0b2 6102 0000 6102 0000 0000 ...&..a...a..... 0x0050 0c52 4541 444d 5f30 312e 4854 5a00 f200 .READM_01.HTZ... 0x0060 0000 2727 16b8 8331 0000 9726 c0b2 4a11 ..''...1...&..J. 0x0070 0000 4a11 0000 0000 0c52 4541 444d 5f30 ..J......READM_0 0x0080 322e 4854 5a00 f300 0000 2727 30b8 8331 2.HTZ.....''0..1 0x0090 0000 9726 c0b2 f30f 0000 f30f 0000 0000 ...&............ 0x00a0 0b52 4543 4f56 4552 2e54 5854 00f4 0000 .RECOVER.TXT.... 0x00b0 0027 27a2 b875 3200 0097 26c0 b200 d001 .''..u2...&..... 0x00c0 0000 d001 0000 000b 5245 4745 4449 542e ........REGEDIT. 0x00d0 4558 4500 f500 0000 0531 0065 8331 0000 EXE......1.e.1.. 0x00e0 702a a905 00a0 0000 00a0 0000 0000 0b52 p*.............R 0x00f0 4547 544c 4942 2e45 5845 00f6 0000 0027 EGTLIB.EXE.....' 0x0100 27a2 b883 3100 0097 26c0 b200 a000 0000 '...1...&....... 0x0110 a000 0000 000c 5247 3243 4154 4442 2e45 ......RG2CATDB.E 0x0120 5845 00f7 0000 008e 29ac ae83 3100 0097 XE......)...1... 0x0130 26c0 b200 8000 0000 8000 0000 0009 524f &.............RO 0x0140 5554 452e 4558 4500 f800 0000 2727 a2b8 UTE.EXE.....''.. 0x0150 8331 0000 9726 c0b2 6013 0000 6013 0000 .1...&..`...`... 0x0160 0000 0a52 554e 444c 4c2e 4558 4500 f900 ...RUNDLL.EXE... 0x0170 0000 2727 a2b8 7532 0000 9726 c0b2 0060 ..''..u2...&...` 0x0180 0000 0060 0000 0000 0c52 554e 444c 4c33 ...`.....RUNDLL3 0x0190 322e 4558 4500 fa00 0000 2727 2ab7 8331 2.EXE.....''*..1 0x01a0 0000 9726 c0b2 b518 0000 b518 0000 0000 ...&............ 0x01b0 0b52 554e 4845 4c50 2e43 4142 00fb 0000 .RUNHELP.CAB.... 0x01c0 0075 3275 9e75 3200 0075 3276 9ed3 0800 .u2u.u2..u2v.... 0x01d0 00d3 0800 0020 000a 5359 5354 454d 2e49 ........SYSTEM.I 0x01e0 4e49 00fc 0000 005c 2df9 205c 2d00 005c NI.....\-..\-..\ 0x01f0 2dfa 2000 0000 0000 0000 0010 0007 4f50 -.............OP 0x0200 5449 4f4e 5300 fd00 0000 7532 759e 7532 TIONS.....u2u.u2 0x0210 0000 7532 769e 3600 0000 3600 0000 2000 ..u2v.6...6..... 0x0220 0b57 4156 454d 4958 2e49 4e49 00fe 0000 .WAVEMIX.INI.... 0x0230 0005 31cd ad58 3200 0005 31ce ad40 1900 ..1..X2...1..@.. 0x0240 0040 1900 0000 000c 2430 3141 3032 4645 .@......$01A02FE 0x0250 2e57 5058 0000 0100 009b 31b2 b375 3200 .WPX......1..u2. 0x0260 0075 3200 aa20 8099 0020 8099 0003 000a .u2............. 0x0270 5359 5354 454d 2e44 4154 0001 0100 007e SYSTEM.DAT.....~ 0x0280 2668 9a83 3100 0005 3143 862a 0300 002a &h..1...1C.*...* 0x0290 0300 0000 0007 526e 612e 5057 4c00 0301 ......Rna.PWL... 0x02a0 0000 2727 a2b8 8331 0000 9726 c0b2 2013 ..''...1...&.... 0x02b0 0000 2013 0000 0000 0c53 4341 4e44 534b .........SCANDSK 0x02c0 572e 4558 4500 0401 0000 2727 afb8 7532 W.EXE.....''..u2 0x02d0 0000 9726 c0b2 1303 0000 1303 0000 0000 ...&............ 0x02e0 0b53 4341 4e52 4547 2e49 4e49 0005 0100 .SCANREG.INI.... 0x02f0 0027 27a3 b875 3200 0097 26c0 b200 5001 .''..u2...&...P. 0x0300 0000 5001 0000 000c 5343 414e 5245 4757 ..P.....SCANREGW 0x0310 2e45 5845 0006 0100 0027 277a b783 3100 .EXE.....''z..1. 0x0320 0097 26c0 b200 9600 0000 9600 0000 000a ..&............. 0x0330 5343 5249 5054 2e44 4f43 0007 0100 0027 SCRIPT.DOC.....' 0x0340 27d2 b883 3100 0097 26c0 b20a 1400 000a '...1...&....... 0x0350 1400 0000 000c 5345 5256 4943 4553 2e54 ......SERVICES.T 0x0360 5854 0008 0100 0013 2fae 0283 3100 005c XT....../...1..\ 0x0370 2e4f 9310 b500 0010 b500 0000 000c 5345 .O............SE 0x0380 5444 4542 5547 2e45 5845 0009 0100 008e TDEBUG.EXE...... 0x0390 298f ae83 3100 0095 3024 95e9 0900 00e9 )...1...0$...... 0x03a0 0900 0000 000b 5345 5455 5039 352e 4c4f ......SETUP95.LO 0x03b0 4700 0a01 0000 2727 d8b8 8331 0000 2727 G.....''...1..'' 0x03c0 d5b8 fb49 0000 fb49 0000 0000 0a53 4554 ...I...I.....SET 0x03d0 5645 522e 4558 4500 0b01 0000 2727 b7b8 VER.EXE.....''.. 0x03e0 8331 0000 9726 c0b2 c706 0000 c706 0000 .1...&.......... 0x03f0 0000 0b53 4643 5359 4e43 2e54 5854 000c ...SFCSYNC.TXT.. 0x0400 0100 0027 2706 b883 3100 0097 26c0 b200 ...''...1...&... 0x0410 0002 0000 0002 0000 000c 5349 4756 4552 ..........SIGVER 0x0420 4946 2e45 5845 000d 0100 0027 2753 b875 IF.EXE.....''S.u 0x0430 3200 0097 26c0 b243 b100 0043 b100 0000 2...&..C...C.... 0x0440 000c 534d 4152 5444 5256 2e45 5845 000e ..SMARTDRV.EXE.. 0x0450 0100 009b 27f0 7983 3100 0097 2079 801f ....'.y.1....y.. 0x0460 0200 001f 0200 0000 000b 534d 4152 5455 ..........SMARTU 0x0470 4e2e 494e 4600 0f01 0000 4b2a 8656 8331 N.INF.....K*.V.1 0x0480 0000 4b2a 8756 0000 0000 0000 0000 0000 ..K*.V.......... 0x0490 0d53 4d43 5452 4c50 4e4c 2e49 4e49 0011 .SMCTRLPNL.INI.. 0x04a0 0100 0027 27a3 b883 3100 0097 26c0 b200 ...''...1...&... 0x04b0 b001 0000 b001 0000 000c 534e 4452 4543 ..........SNDREC 0x04c0 3332 2e45 5845 0012 0100 0027 27a3 b875 32.EXE.....''..u 0x04d0 3200 0097 26c0 b200 1001 0000 1001 0000 2...&........... 0x04e0 000c 534e 4456 4f4c 3332 2e45 5845 0013 ..SNDVOL32.EXE.. 0x04f0 0100 0071 2d7d 6b35 3200 0091 2ce3 8810 ...q-}k52...,... 0x0500 4700 0010 4700 0000 000b 534e 4d50 4150 G...G.....SNMPAP 0x0510 492e 444c 4c00 1401 0000 9828 c9a8 8331 I.DLL......(...1 0x0520 0000 d828 6eb1 400a 0000 400a 0000 0000 ...(n.@...@..... 0x0530 0c53 4f4c 4649 5245 332e 494e 4900 1501 .SOLFIRE3.INI... 0x0540 0000 5329 38bf 8331 0000 5329 49bf ea00 ..S)8..1..S)I... 0x0550 0000 ea00 0000 0000 0c53 5550 4552 5041 .........SUPERPA 0x0560 442e 494e 4900 1601 0000 2727 18b7 8331 D.INI.....''...1 0x0570 0000 9726 c0b2 b41f 0000 b41f 0000 0000 ...&............ 0x0580 0b53 5550 504f 5254 2e54 5854 0017 0100 .SUPPORT.TXT.... 0x0590 0027 27cd b883 3100 0097 26c0 b200 4001 .''...1...&...@. 0x05a0 0000 4001 0000 000a 5359 534d 4f4e 2e45 ..@.....SYSMON.E 0x05b0 5845 0018 0100 0027 27da b883 3100 007d XE.....''...1..} 0x05c0 278d ab74 0000 0074 0000 0000 0009 5359 '..t...t......SY 0x05d0 5354 454d STEM 17:11:59.564674 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: . [tcp sum ok] 334:334(0) ack 8863 win 23232 (DF) (ttl 64, id 36136, len 40) 0x0000 4500 0028 8d28 4000 4006 2a38 c0a8 0112 E..(.(@.@.*8.... 0x0010 c0a8 010d 83fd 008b 2163 29e5 0494 26af ........!c)...&. 0x0020 5010 5ac0 d690 0000 P.Z..... 17:11:59.564691 192.168.1.13.netbios-ssn > 192.168.1.18.33789: P [tcp sum ok] 8863:8906(43) ack 334 win 63394 >>> NBT Packet flags=0x2e NBT - Unknown packet type Type=0x2E434200 Data: (39 bytes) [000] 19 01 00 00 B6 2C B1 61 83 31 00 00 CC 2E 27 76 \031\001\000\000\266,\261a \2031\000\000\314.'v [010] 49 28 00 00 49 28 00 00 00 00 0B 62 72 6E 64 6C I(\000\000I(\000\000 \000\000\013brndl [020] 6F 67 2E 62 61 6B 00 og.bak\000 (DF) (ttl 128, id 5856, len 83) 0x0000 4500 0053 16e0 4000 8006 6055 c0a8 010d E..S..@...`U.... 0x0010 c0a8 0112 008b 83fd 0494 26af 2163 29e5 ..........&.!c). 0x0020 5018 f7a2 5e0f 0000 2e43 4200 1901 0000 P...^....CB..... 0x0030 b62c b161 8331 0000 cc2e 2776 4928 0000 .,.a.1....'vI(.. 0x0040 4928 0000 0000 0b62 726e 646c 6f67 2e62 I(.....brndlog.b 0x0050 616b 00 ak. 17:11:59.565117 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: P [tcp sum ok] 334:429(95) ack 8906 win 23232 >>> NBT Packet NBT Session Packet Flags=0x0 Length=91 (0x5b) SMB PACKET: SMBtrans2 (REQUEST) SMB Command = 0x32 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x8 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 15 (0xf) TRANSACT2_FINDNEXT param_length=23 data_length=0 TotParam=23 (0x17) TotData=0 (0x0) MaxParam=10 (0xa) MaxData=2920 (0xb68) MaxSetup=0 (0x0) Flags=0x0 TimeOut=0 (0x0) Res1=0x0 ParamCnt=23 (0x17) ParamOff=68 (0x44) DataCnt=0 (0x0) DataOff=91 (0x5b) SetupCnt=1 (0x1) TransactionName=Parameters= Data: (23 bytes) [000] 68 81 00 02 01 00 00 00 00 00 0E 00 72 6E 64 6C h\201\000\002\001\000\000\000 \000\000\016\000rndl [010] 6F 67 2E 62 61 6B 00 og.bak\000 Data= (DF) (ttl 64, id 36137, len 135) 0x0000 4500 0087 8d29 4000 4006 29d8 c0a8 0112 E....)@.@.)..... 0x0010 c0a8 010d 83fd 008b 2163 29e5 0494 26da ........!c)...&. 0x0020 5018 5ac0 66b8 0000 0000 005b ff53 4d42 P.Z.f......[.SMB 0x0030 3200 0000 0008 0100 0000 0000 0000 0000 2............... 0x0040 0000 0000 03f8 3d45 0000 0100 0f17 0000 ......=E........ 0x0050 000a 0068 0b00 0000 0000 0000 0000 0017 ...h............ 0x0060 0044 0000 005b 0001 0002 001a 0000 4420 .D...[........D. 0x0070 6881 0002 0100 0000 0000 0e00 726e 646c h...........rndl 0x0080 6f67 2e62 616b 00 og.bak. 17:11:59.567499 192.168.1.13.netbios-ssn > 192.168.1.18.33789: . [tcp sum ok] 8906:10358(1452) ack 429 win 63299 >>> NBT Packet NBT Session Packet Flags=0x0 Length=2951 (0xb87) WARNING: Short packet. Try increasing the snap length (1448) SMB PACKET: SMBtrans2 (REPLY) SMB Command = 0x32 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x88 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 10 (0xa) TRANSACT2_FINDNEXT param_length=8 data_length=2887 TotParam=8 (0x8) TotData=2887 (0xb47) Res1=0x0 ParamCnt=8 (0x8) ParamOff=55 (0x37) ParamDisp0 (0x0) DataCnt=2887 (0xb47) DataOff=64 (0x40) DataDisp=0 (0x0) SetupCnt=0 (0x0) Parameters= Data: (8 bytes) [000] 4B 00 00 00 00 00 3A 0B K\000\000\000\000\000:\013 Data= Data: (2887 bytes) [000] 00 00 00 00 74 26 74 07 83 31 00 00 27 27 B5 BB \000\000\000\000t&t\007 \2031\000\000''\265\273 [010] A4 0D 00 00 A4 0D 00 00 00 00 0C 53 63 68 65 64 \244\015\000\000\244\015\000\000 \000\000\014Sched [020] 4C 6F 67 2E 54 78 74 00 1D 01 00 00 54 2A 74 99 Log.Txt\000 \035\001\000\000T*t\231 [030] 63 32 00 00 54 2A 75 99 DB 17 00 00 DB 17 00 00 c2\000\000T*u\231 \333\027\000\000\333\027\000\000 [040] 00 00 08 53 65 72 76 69 63 65 73 00 1F 01 00 00 \000\000\010Servi ces\000\037\001\000\000 [050] 54 2A 4B 8C 83 31 00 00 54 2A 4C 8C 77 17 00 00 T*K\214\2031\000\000 T*L\214w\027\000\000 [060] 77 17 00 00 00 00 0C 53 65 72 76 69 63 65 73 2E w\027\000\000\000\000\014S ervices. [070] 62 61 6B 00 21 01 00 00 7D 27 D4 96 83 31 00 00 bak\000!\001\000\000 }'\324\226\2031\000\000 [080] 97 26 C0 B2 38 B4 04 00 38 B4 04 00 00 00 09 53 \227&\300\2628\264\004\000 8\264\004\000\000\000\011S [090] 65 74 75 70 2E 62 6D 70 00 23 01 00 00 00 00 00 etup.bmp \000#\001\000\000\000\000\000 [0A0] 00 75 32 00 00 75 32 85 9E 20 50 07 00 20 50 07 \000u2\000\000u2\205 \236 P\007\000 P\007 [0B0] 00 03 00 08 55 53 45 52 2E 44 41 54 00 24 01 00 \000\003\000\010USER .DAT\000$\001\000 [0C0] 00 CA 2C 57 68 83 31 00 00 CA 2C 58 68 00 00 00 \000\312,Wh\2031\000 \000\312,Xh\000\000\000 [0D0] 00 00 00 00 00 00 00 09 74 72 61 63 65 2E 74 78 \000\000\000\000\000\000\000\011 trace.tx [0E0] 74 00 26 01 00 00 73 26 46 BB 58 32 00 00 73 26 t\000&\001\000\000s& F\273X2\000\000s& [0F0] 47 BB 00 00 00 00 00 00 00 00 00 00 0D 53 74 69 G\273\000\000\000\000\000\000 \000\000\000\000\015Sti [100] 5F 54 72 61 63 65 2E 6C 6F 67 00 28 01 00 00 27 _Trace.l og\000(\001\000\000' [110] 27 6F B8 83 31 00 00 97 26 C0 B2 4E 02 00 00 4E 'o\270\2031\000\000\227 &\300\262N\002\000\000N [120] 02 00 00 00 00 0D 53 74 72 61 77 20 4D 61 74 2E \002\000\000\000\000\015St raw Mat. [130] 62 6D 70 00 2A 01 00 00 27 27 A4 B8 83 31 00 00 bmp\000*\001\000\000 ''\244\270\2031\000\000 [140] 97 26 C0 B2 00 C0 00 00 00 C0 00 00 00 00 0B 54 \227&\300\262\000\300\000\000 \000\300\000\000\000\000\013T [150] 41 53 4B 4D 41 4E 2E 45 58 45 00 2B 01 00 00 27 ASKMAN.E XE\000+\001\000\000' [160] 27 A4 B8 75 32 00 00 97 26 C0 B2 00 70 00 00 00 '\244\270u2\000\000\227 &\300\262\000p\000\000\000 [170] 70 00 00 00 00 0B 54 41 53 4B 4D 4F 4E 2E 45 58 p\000\000\000\000\013TA SKMON.EX [180] 45 00 2C 01 00 00 74 26 41 07 58 32 00 00 37 30 E\000,\001\000\000t& A\007X2\000\00070 [190] 56 95 E1 00 00 00 E1 00 00 00 00 00 0C 54 45 4C V\225\341\000\000\000\341\000 \000\000\000\000\014TEL [1A0] 45 50 48 4F 4E 2E 49 4E 49 00 2D 01 00 00 8E 29 EPHON.IN I\000-\001\000\000\216) [1B0] AC AE 23 32 00 00 97 26 C0 B2 00 30 01 00 00 30 \254\256#2\000\000\227& \300\262\0000\001\000\0000 [1C0] 01 00 00 00 0A 54 45 4C 4E 45 54 2E 45 58 45 00 \001\000\000\000\012TEL NET.EXE\000 [1D0] 2E 01 00 00 73 26 D0 8A 83 31 00 00 73 26 D1 8A .\001\000\000s&\320\212 \2031\000\000s&\321\212 [1E0] 00 00 00 00 00 00 00 00 00 00 0C 54 48 49 4E 4B \000\000\000\000\000\000\000\000 \000\000\014THINK [1F0] 50 41 44 2E 49 4E 49 00 2F 01 00 00 27 27 30 B8 PAD.INI\000 /\001\000\000''0\270 [200] 83 31 00 00 97 26 C0 B2 7C 31 00 00 7C 31 00 00 \2031\000\000\227&\300\262 |1\000\000|1\000\000 [210] 00 00 08 54 49 50 53 2E 54 58 54 00 30 01 00 00 \000\000\010TIPS. TXT\0000\001\000\000 [220] 27 27 CE B8 83 31 00 00 97 26 C0 B2 00 E0 02 00 ''\316\270\2031\000\000 \227&\300\262\000\340\002\000 [230] 00 E0 02 00 00 00 0A 54 4F 55 52 39 38 2E 45 58 \000\340\002\000\000\000\012T OUR98.EX [240] 45 00 31 01 00 00 8E 29 AC AE 83 31 00 00 97 26 E\0001\001\000\000\216) \254\256\2031\000\000\227& [250] C0 B2 00 50 00 00 00 50 00 00 00 00 0B 54 52 41 \300\262\000P\000\000\000P \000\000\000\000\013TRA [260] 43 45 52 54 2E 45 58 45 00 32 01 00 00 86 27 10 CERT.EXE \0002\001\000\000\206'\020 [270] 86 83 31 00 00 86 27 22 86 ED 16 00 00 ED 16 00 \206\2031\000\000\206'" \206\355\026\000\000\355\026\000 [280] 00 00 00 07 54 54 59 2E 44 41 54 00 33 01 00 00 \000\000\000\007TTY. DAT\0003\001\000\000 [290] 27 27 06 B8 83 31 00 00 97 26 C0 B2 00 B0 01 00 ''\006\270\2031\000\000 \227&\300\262\000\260\001\000 [2A0] 00 B0 01 00 00 00 0A 54 55 4E 45 55 50 2E 45 58 \000\260\001\000\000\000\012T UNEUP.EX [2B0] 45 00 34 01 00 00 4B 2A 72 56 83 31 00 00 36 25 E\0004\001\000\000K* rV\2031\000\0006% [2C0] 13 74 60 55 01 00 60 55 01 00 00 00 09 54 57 41 \023t`U\001\000`U \001\000\000\000\011TWA [2D0] 49 4E 2E 44 4C 4C 00 35 01 00 00 4B 2A 72 56 9C IN.DLL\0005 \001\000\000K*rV\234 [2E0] 31 00 00 36 25 13 74 00 2E 01 00 00 2E 01 00 00 1\000\0006%\023t\000 .\001\000\000.\001\000\000 [2F0] 00 0C 54 57 41 49 4E 5F 33 32 2E 44 4C 4C 00 36 \000\014TWAIN_ 32.DLL\0006 [300] 01 00 00 27 27 CE B8 83 31 00 00 97 26 C0 B2 B0 \001\000\000''\316\270\203 1\000\000\227&\300\262\260 [310] BD 00 00 B0 BD 00 00 00 00 0C 54 57 55 4E 4B 5F \275\000\000\260\275\000\000\000 \000\014TWUNK_ [320] 31 36 2E 45 58 45 00 37 01 00 00 27 27 CE B8 83 16.EXE\0007 \001\000\000''\316\270\203 [330] 31 00 00 97 26 C0 B2 00 60 01 00 00 60 01 00 00 1\000\000\227&\300\262\000 `\001\000\000`\001\000\000 [340] 00 0C 54 57 55 4E 4B 5F 33 32 2E 45 58 45 00 38 \000\014TWUNK_ 32.EXE\0008 [350] 01 00 00 27 27 70 B8 83 31 00 00 97 26 C0 B2 42 \001\000\000''p\270\203 1\000\000\227&\300\262B [360] 02 00 00 42 02 00 00 00 00 09 54 69 6C 65 73 2E \002\000\000B\002\000\000\000 \000\011Tiles. [370] 62 6D 70 00 3A 01 00 00 27 27 70 B8 83 31 00 00 bmp\000:\001\000\000 ''p\270\2031\000\000 [380] 97 26 C0 B2 C6 00 00 00 C6 00 00 00 00 00 0D 54 \227&\300\262\306\000\000\000 \306\000\000\000\000\000\015T [390] 72 69 61 6E 67 6C 65 73 2E 62 6D 70 00 3C 01 00 riangles .bmp\000<\001\000 [3A0] 00 27 27 07 B8 83 31 00 00 97 26 C0 B2 00 E0 00 \000''\007\270\2031\000 \000\227&\300\262\000\340\000 [3B0] 00 00 E0 00 00 00 00 0B 55 50 57 49 5A 55 4E 2E \000\000\340\000\000\000\000\013 UPWIZUN. [3C0] 45 58 45 00 3D 01 00 00 27 27 73 B8 83 31 00 00 EXE\000=\001\000\000 ''s\270\2031\000\000 [3D0] 97 26 C0 B2 F9 10 00 00 F9 10 00 00 00 00 0A 55 \227&\300\262\371\020\000\000 \371\020\000\000\000\000\012U [3E0] 52 47 45 4E 54 2E 43 50 45 00 3E 01 00 00 13 2F RGENT.CP E\000>\001\000\000\023/ [3F0] A6 02 83 31 00 00 5C 2E 4F 93 10 A1 02 00 10 A1 \246\002\2031\000\000\. O\223\020\241\002\000\020\241 [400] 02 00 00 00 09 4A 56 49 45 57 2E 45 58 45 00 3F \002\000\000\000\011JVI EW.EXE\000? [410] 01 00 00 4B 2A 5C 56 83 31 00 00 4C 25 1A 91 00 \001\000\000K*\V\203 1\000\000L%\032\221\000 [420] 92 04 00 00 92 04 00 00 00 0C 55 6E 69 6E 73 6F \222\004\000\000\222\004\000\000 \000\014Uninso [430] 70 39 2E 65 78 65 00 41 01 00 00 27 27 A5 B8 83 p9.exe\000A \001\000\000''\245\270\203 [440] 31 00 00 97 26 C0 B2 00 B0 00 00 00 B0 00 00 00 1\000\000\227&\300\262\000 \260\000\000\000\260\000\000\000 [450] 00 09 56 43 4D 55 49 2E 45 58 45 00 42 01 00 00 \000\011VCMUI. EXE\000B\001\000\000 [460] 13 2F A8 02 83 31 00 00 5C 2E 50 93 10 9F 02 00 \023/\250\002\2031\000\000 \.P\223\020\237\002\000 [470] 10 9F 02 00 00 00 0A 57 4A 56 49 45 57 2E 45 58 \020\237\002\000\000\000\012W JVIEW.EX [480] 45 00 43 01 00 00 27 27 A5 B8 83 31 00 00 97 26 E\000C\001\000\000'' \245\270\2031\000\000\227& [490] C0 B2 00 40 04 00 00 40 04 00 00 00 0B 57 45 4C \300\262\000@\004\000\000@ \004\000\000\000\013WEL [4A0] 43 4F 4D 45 2E 45 58 45 00 44 01 00 00 74 26 23 COME.EXE \000D\001\000\000t&# [4B0] 1D 83 31 00 00 74 26 10 1E 90 67 00 00 90 67 00 \035\2031\000\000t&\020 \036\220g\000\000\220g\000 [4C0] 00 00 00 0B 57 46 58 49 4E 53 54 2E 4C 4F 47 00 \000\000\000\013WFXI NST.LOG\000 [4D0] 45 01 00 00 2B 27 5B B8 83 31 00 00 2B 27 65 B8 E\001\000\000+'[\270 \2031\000\000+'e\270 [4E0] 38 07 00 00 38 07 00 00 00 00 0C 57 46 58 50 41 8\007\000\0008\007\000\000 \000\000\014WFXPA [4F0] 54 43 48 2E 4C 4F 47 00 46 01 00 00 27 27 71 B8 TCH.LOG\000 F\001\000\000''q\270 [500] 75 32 00 00 97 26 C0 B2 D7 60 00 00 D7 60 00 00 u2\000\000\227&\300\262 \327`\000\000\327`\000\000 [510] 00 00 07 57 49 4E 2E 43 4F 4D 00 47 01 00 00 69 \000\000\007WIN.C OM\000G\001\000\000i [520] 32 F8 4C 69 32 00 00 69 32 F9 4C AC 02 00 00 AC 2\370Li2\000\000i 2\371L\254\002\000\000\254 [530] 02 00 00 20 00 0B 57 49 4E 49 4E 49 54 2E 42 41 \002\000\000 \000\013WI NINIT.BA [540] 4B 00 48 01 00 00 74 26 4B 1D 58 32 00 00 5B 20 K\000H\001\000\000t& K\035X2\000\000[ [550] 72 5D FA 00 00 00 FA 00 00 00 00 00 0A 57 49 4E r]\372\000\000\000\372\000 \000\000\000\000\012WIN [560] 46 41 58 2E 49 4E 49 00 00 00 00 00 00 00 00 00 FAX.INI\000 \000\000\000\000\000\000\000\000 [570] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [580] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [590] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [600] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [610] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [620] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [630] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [640] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [650] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [660] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [670] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [680] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [690] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [700] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [710] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [720] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [730] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [740] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [750] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [760] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [770] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [780] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [790] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [800] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [810] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [820] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [830] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [840] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [850] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [860] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [870] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [880] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [890] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [900] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [910] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [920] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [930] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [940] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [950] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [960] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [970] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [980] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [990] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A00] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A10] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A20] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A30] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A40] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A50] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A60] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A70] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A80] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A90] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AA0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AB0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AC0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AD0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AE0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AF0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B00] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B10] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B20] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B30] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B40] 00 00 00 00 00 00 00 \000\000\000\000\000\000\000 (DF) (ttl 128, id 6112, len 1492) 0x0000 4500 05d4 17e0 4000 8006 59d4 c0a8 010d E.....@...Y..... 0x0010 c0a8 0112 008b 83fd 0494 26da 2163 2a44 ..........&.!c*D 0x0020 5010 f743 b11c 0000 0000 0b87 ff53 4d42 P..C.........SMB 0x0030 3200 0000 0088 0100 0000 0000 0000 0000 2............... 0x0040 0000 0000 03f8 3d45 0000 0100 0a08 0047 ......=E.......G 0x0050 0b00 0008 0037 0000 0047 0b40 0000 0000 .....7...G.@.... 0x0060 0050 0b4b 0000 0000 003a 0b1a 0000 0000 .P.K.....:...... 0x0070 7426 7407 8331 0000 2727 b5bb a40d 0000 t&t..1..''...... 0x0080 a40d 0000 0000 0c53 6368 6564 4c6f 672e .......SchedLog. 0x0090 5478 7400 1d01 0000 542a 7499 6332 0000 Txt.....T*t.c2.. 0x00a0 542a 7599 db17 0000 db17 0000 0000 0853 T*u............S 0x00b0 6572 7669 6365 7300 1f01 0000 542a 4b8c ervices.....T*K. 0x00c0 8331 0000 542a 4c8c 7717 0000 7717 0000 .1..T*L.w...w... 0x00d0 0000 0c53 6572 7669 6365 732e 6261 6b00 ...Services.bak. 0x00e0 2101 0000 7d27 d496 8331 0000 9726 c0b2 !...}'...1...&.. 0x00f0 38b4 0400 38b4 0400 0000 0953 6574 7570 8...8......Setup 0x0100 2e62 6d70 0023 0100 0000 0000 0075 3200 .bmp.#.......u2. 0x0110 0075 3285 9e20 5007 0020 5007 0003 0008 .u2...P...P..... 0x0120 5553 4552 2e44 4154 0024 0100 00ca 2c57 USER.DAT.$....,W 0x0130 6883 3100 00ca 2c58 6800 0000 0000 0000 h.1...,Xh....... 0x0140 0000 0009 7472 6163 652e 7478 7400 2601 ....trace.txt.&. 0x0150 0000 7326 46bb 5832 0000 7326 47bb 0000 ..s&F.X2..s&G... 0x0160 0000 0000 0000 0000 0d53 7469 5f54 7261 .........Sti_Tra 0x0170 6365 2e6c 6f67 0028 0100 0027 276f b883 ce.log.(...''o.. 0x0180 3100 0097 26c0 b24e 0200 004e 0200 0000 1...&..N...N.... 0x0190 000d 5374 7261 7720 4d61 742e 626d 7000 ..Straw.Mat.bmp. 0x01a0 2a01 0000 2727 a4b8 8331 0000 9726 c0b2 *...''...1...&.. 0x01b0 00c0 0000 00c0 0000 0000 0b54 4153 4b4d ...........TASKM 0x01c0 414e 2e45 5845 002b 0100 0027 27a4 b875 AN.EXE.+...''..u 0x01d0 3200 0097 26c0 b200 7000 0000 7000 0000 2...&...p...p... 0x01e0 000b 5441 534b 4d4f 4e2e 4558 4500 2c01 ..TASKMON.EXE.,. 0x01f0 0000 7426 4107 5832 0000 3730 5695 e100 ..t&A.X2..70V... 0x0200 0000 e100 0000 0000 0c54 454c 4550 484f .........TELEPHO 0x0210 4e2e 494e 4900 2d01 0000 8e29 acae 2332 N.INI.-....)..#2 0x0220 0000 9726 c0b2 0030 0100 0030 0100 0000 ...&...0...0.... 0x0230 0a54 454c 4e45 542e 4558 4500 2e01 0000 .TELNET.EXE..... 0x0240 7326 d08a 8331 0000 7326 d18a 0000 0000 s&...1..s&...... 0x0250 0000 0000 0000 0c54 4849 4e4b 5041 442e .......THINKPAD. 0x0260 494e 4900 2f01 0000 2727 30b8 8331 0000 INI./...''0..1.. 0x0270 9726 c0b2 7c31 0000 7c31 0000 0000 0854 .&..|1..|1.....T 0x0280 4950 532e 5458 5400 3001 0000 2727 ceb8 IPS.TXT.0...''.. 0x0290 8331 0000 9726 c0b2 00e0 0200 00e0 0200 .1...&.......... 0x02a0 0000 0a54 4f55 5239 382e 4558 4500 3101 ...TOUR98.EXE.1. 0x02b0 0000 8e29 acae 8331 0000 9726 c0b2 0050 ...)...1...&...P 0x02c0 0000 0050 0000 0000 0b54 5241 4345 5254 ...P.....TRACERT 0x02d0 2e45 5845 0032 0100 0086 2710 8683 3100 .EXE.2....'...1. 0x02e0 0086 2722 86ed 1600 00ed 1600 0000 0007 ..'"............ 0x02f0 5454 592e 4441 5400 3301 0000 2727 06b8 TTY.DAT.3...''.. 0x0300 8331 0000 9726 c0b2 00b0 0100 00b0 0100 .1...&.......... 0x0310 0000 0a54 554e 4555 502e 4558 4500 3401 ...TUNEUP.EXE.4. 0x0320 0000 4b2a 7256 8331 0000 3625 1374 6055 ..K*rV.1..6%.t`U 0x0330 0100 6055 0100 0000 0954 5741 494e 2e44 ..`U.....TWAIN.D 0x0340 4c4c 0035 0100 004b 2a72 569c 3100 0036 LL.5...K*rV.1..6 0x0350 2513 7400 2e01 0000 2e01 0000 000c 5457 %.t...........TW 0x0360 4149 4e5f 3332 2e44 4c4c 0036 0100 0027 AIN_32.DLL.6...' 0x0370 27ce b883 3100 0097 26c0 b2b0 bd00 00b0 '...1...&....... 0x0380 bd00 0000 000c 5457 554e 4b5f 3136 2e45 ......TWUNK_16.E 0x0390 5845 0037 0100 0027 27ce b883 3100 0097 XE.7...''...1... 0x03a0 26c0 b200 6001 0000 6001 0000 000c 5457 &...`...`.....TW 0x03b0 554e 4b5f 3332 2e45 5845 0038 0100 0027 UNK_32.EXE.8...' 0x03c0 2770 b883 3100 0097 26c0 b242 0200 0042 'p..1...&..B...B 0x03d0 0200 0000 0009 5469 6c65 732e 626d 7000 ......Tiles.bmp. 0x03e0 3a01 0000 2727 70b8 8331 0000 9726 c0b2 :...''p..1...&.. 0x03f0 c600 0000 c600 0000 0000 0d54 7269 616e ...........Trian 0x0400 676c 6573 2e62 6d70 003c 0100 0027 2707 gles.bmp.<...''. 0x0410 b883 3100 0097 26c0 b200 e000 0000 e000 ..1...&......... 0x0420 0000 000b 5550 5749 5a55 4e2e 4558 4500 ....UPWIZUN.EXE. 0x0430 3d01 0000 2727 73b8 8331 0000 9726 c0b2 =...''s..1...&.. 0x0440 f910 0000 f910 0000 0000 0a55 5247 454e ...........URGEN 0x0450 542e 4350 4500 3e01 0000 132f a602 8331 T.CPE.>..../...1 0x0460 0000 5c2e 4f93 10a1 0200 10a1 0200 0000 ..\.O........... 0x0470 094a 5649 4557 2e45 5845 003f 0100 004b .JVIEW.EXE.?...K 0x0480 2a5c 5683 3100 004c 251a 9100 9204 0000 *\V.1..L%....... 0x0490 9204 0000 000c 556e 696e 736f 7039 2e65 ......Uninsop9.e 0x04a0 7865 0041 0100 0027 27a5 b883 3100 0097 xe.A...''...1... 0x04b0 26c0 b200 b000 0000 b000 0000 0009 5643 &.............VC 0x04c0 4d55 492e 4558 4500 4201 0000 132f a802 MUI.EXE.B..../.. 0x04d0 8331 0000 5c2e 5093 109f 0200 109f 0200 .1..\.P......... 0x04e0 0000 0a57 4a56 4945 572e 4558 4500 4301 ...WJVIEW.EXE.C. 0x04f0 0000 2727 a5b8 8331 0000 9726 c0b2 0040 ..''...1...&...@ 0x0500 0400 0040 0400 0000 0b57 454c 434f 4d45 ...@.....WELCOME 0x0510 2e45 5845 0044 0100 0074 2623 1d83 3100 .EXE.D...t&#..1. 0x0520 0074 2610 1e90 6700 0090 6700 0000 000b .t&...g...g..... 0x0530 5746 5849 4e53 542e 4c4f 4700 4501 0000 WFXINST.LOG.E... 0x0540 2b27 5bb8 8331 0000 2b27 65b8 3807 0000 +'[..1..+'e.8... 0x0550 3807 0000 0000 0c57 4658 5041 5443 482e 8......WFXPATCH. 0x0560 4c4f 4700 4601 0000 2727 71b8 7532 0000 LOG.F...''q.u2.. 0x0570 9726 c0b2 d760 0000 d760 0000 0000 0757 .&...`...`.....W 0x0580 494e 2e43 4f4d 0047 0100 0069 32f8 4c69 IN.COM.G...i2.Li 0x0590 3200 0069 32f9 4cac 0200 00ac 0200 0020 2..i2.L......... 0x05a0 000b 5749 4e49 4e49 542e 4241 4b00 4801 ..WININIT.BAK.H. 0x05b0 0000 7426 4b1d 5832 0000 5b20 725d fa00 ..t&K.X2..[.r].. 0x05c0 0000 fa00 0000 0000 0a57 494e 4641 582e .........WINFAX. 0x05d0 494e 4900 INI. 17:11:59.567629 192.168.1.13.netbios-ssn > 192.168.1.18.33789: . [tcp sum ok] 10358:11810(1452) ack 429 win 63299 >>> NBT Packet flags=0x49 NBT - Unknown packet type Type=0x49010000 Data: (1448 bytes) [000] 27 27 A5 B8 83 31 00 00 97 26 C0 B2 20 5F 02 00 ''\245\270\2031\000\000 \227&\300\262 _\002\000 [010] 20 5F 02 00 00 00 0B 57 49 4E 46 49 4C 45 2E 45 _\002\000\000\000\013W INFILE.E [020] 58 45 00 4A 01 00 00 27 27 A6 B8 83 31 00 00 97 XE\000J\001\000\000' '\246\270\2031\000\000\227 [030] 26 C0 B2 70 09 00 00 70 09 00 00 00 00 0B 57 49 &\300\262p\011\000\000p \011\000\000\000\000\013WI [040] 4E 48 45 4C 50 2E 45 58 45 00 4B 01 00 00 27 27 NHELP.EX E\000K\001\000\000'' [050] A6 B8 4F 32 00 00 97 26 C0 B2 00 E0 04 00 00 E0 \246\270O2\000\000\227& \300\262\000\340\004\000\000\340 [060] 04 00 00 00 0C 57 49 4E 48 4C 50 33 32 2E 45 58 \004\000\000\000\014WIN HLP32.EX [070] 45 00 4C 01 00 00 A5 2C 0A BE 9C 31 00 00 A5 2C E\000L\001\000\000\245, \012\276\2341\000\000\245, [080] 0B BE 00 00 00 00 00 00 00 00 00 00 09 54 57 41 \013\276\000\000\000\000\000\000 \000\000\000\000\011TWA [090] 49 4E 2E 4C 4F 47 00 4D 01 00 00 27 27 A6 B8 69 IN.LOG\000M \001\000\000''\246\270i [0A0] 32 00 00 97 26 C0 B2 F5 A3 00 00 F5 A3 00 00 00 2\000\000\227&\300\262\365 \243\000\000\365\243\000\000\000 [0B0] 00 0B 57 49 4E 49 4E 49 54 2E 45 58 45 00 4E 01 \000\013WININI T.EXE\000N\001 [0C0] 00 00 8E 29 AC AE 83 31 00 00 97 26 C0 B2 00 D0 \000\000\216)\254\256\2031 \000\000\227&\300\262\000\320 [0D0] 00 00 00 D0 00 00 00 00 0C 57 49 4E 49 50 43 46 \000\000\000\320\000\000\000\000 \014WINIPCF [0E0] 47 2E 45 58 45 00 4F 01 00 00 27 27 0F B8 83 31 G.EXE\000O\001 \000\000''\017\270\2031 [0F0] 00 00 97 26 C0 B2 15 07 00 00 15 07 00 00 00 00 \000\000\227&\300\262\025\007 \000\000\025\007\000\000\000\000 [100] 0B 57 49 4E 4C 4F 47 4F 2E 47 49 46 00 50 01 00 \013WINLOGO .GIF\000P\001\000 [110] 00 27 27 63 B8 83 31 00 00 97 26 C0 B2 D0 6B 00 \000''c\270\2031\000 \000\227&\300\262\320k\000 [120] 00 D0 6B 00 00 00 00 0C 57 49 4E 50 4F 50 55 50 \000\320k\000\000\000\000\014 WINPOPUP [130] 2E 45 58 45 00 51 01 00 00 27 27 07 B8 83 31 00 .EXE\000Q\001\000 \000''\007\270\2031\000 [140] 00 97 26 C0 B2 00 B0 06 00 00 B0 06 00 00 00 0A \000\227&\300\262\000\260\006 \000\000\260\006\000\000\000\012 [150] 57 49 4E 52 45 50 2E 45 58 45 00 52 01 00 00 7D WINREP.E XE\000R\001\000\000} [160] 27 D8 96 83 31 00 00 27 27 04 B7 00 54 00 00 00 '\330\226\2031\000\000' '\004\267\000T\000\000\000 [170] 54 00 00 00 00 0B 57 49 4E 53 4F 43 4B 2E 44 4C T\000\000\000\000\013WI NSOCK.DL [180] 4C 00 53 01 00 00 27 27 AC B8 83 31 00 00 97 26 L\000S\001\000\000'' \254\270\2031\000\000\227& [190] C0 B2 96 27 00 00 96 27 00 00 00 00 0A 57 49 4E \300\262\226'\000\000\226' \000\000\000\000\012WIN [1A0] 55 50 44 2E 49 43 4F 00 54 01 00 00 27 27 A6 B8 UPD.ICO\000 T\001\000\000''\246\270 [1B0] 83 31 00 00 97 26 C0 B2 40 0E 00 00 40 0E 00 00 \2031\000\000\227&\300\262 @\016\000\000@\016\000\000 [1C0] 00 00 0A 57 49 4E 56 45 52 2E 45 58 45 00 55 01 \000\000\012WINVE R.EXE\000U\001 [1D0] 00 00 71 2D 7D 6B 83 31 00 00 91 2C E4 88 10 3F \000\000q-}k\2031 \000\000\221,\344\210\020? [1E0] 00 00 10 3F 00 00 00 00 08 53 4E 4D 50 2E 45 58 \000\000\020?\000\000\000\000 \010SNMP.EX [1F0] 45 00 56 01 00 00 7D 2B 34 1D 83 31 00 00 7D 2B E\000V\001\000\000}+ 4\035\2031\000\000}+ [200] 35 1D 70 68 04 00 70 68 04 00 00 00 0C 57 4D 53 5\035ph\004\000ph \004\000\000\000\014WMS [210] 79 73 50 72 78 2E 70 72 78 00 58 01 00 00 4D 2B ysPrx.pr x\000X\001\000\000M+ [220] 11 97 83 31 00 00 4D 2B 1C 97 EB 02 00 00 EB 02 \021\227\2031\000\000M+ \034\227\353\002\000\000\353\002 [230] 00 00 00 00 0B 57 4F 52 44 50 41 44 2E 49 4E 49 \000\000\000\000\013WOR DPAD.INI [240] 00 59 01 00 00 74 26 CC 02 83 31 00 00 05 31 CD \000Y\001\000\000t&\314 \002\2031\000\000\0051\315 [250] AD 63 00 00 00 63 00 00 00 00 00 0C 57 50 58 45 \255c\000\000\000c\000\000 \000\000\000\014WPXE [260] 52 52 4F 52 2E 4C 4F 47 00 5A 01 00 00 27 27 A7 RROR.LOG \000Z\001\000\000''\247 [270] B8 25 32 00 00 97 26 C0 B2 00 50 00 00 00 50 00 \270%2\000\000\227&\300 \262\000P\000\000\000P\000 [280] 00 00 00 09 57 52 49 54 45 2E 45 58 45 00 5B 01 \000\000\000\011WRIT E.EXE\000[\001 [290] 00 00 74 26 10 1E 83 31 00 00 74 26 11 1E 00 00 \000\000t&\020\036\2031 \000\000t&\021\036\000\000 [2A0] 00 00 00 00 00 00 00 00 0C 57 54 4E 53 45 54 55 \000\000\000\000\000\000\000\000 \014WTNSETU [2B0] 50 2E 49 4E 49 00 5C 01 00 00 28 2F F4 2C 9B 31 P.INI\000\\001 \000\000(/\364,\2331 [2C0] 00 00 69 24 6B 9E 00 56 00 00 00 56 00 00 00 00 \000\000i$k\236\000V \000\000\000V\000\000\000\000 [2D0] 0B 50 57 4C 45 44 49 54 2E 45 58 45 00 5D 01 00 \013PWLEDIT .EXE\000]\001\000 [2E0] 00 27 27 6F B8 83 31 00 00 97 26 C0 B2 BE 00 00 \000''o\270\2031\000 \000\227&\300\262\276\000\000 [2F0] 00 BE 00 00 00 00 00 09 57 61 76 65 73 2E 62 6D \000\276\000\000\000\000\000\011 Waves.bm [300] 70 00 5F 01 00 00 1C 27 52 04 83 31 00 00 84 25 p\000_\001\000\000\034' R\004\2031\000\000\204% [310] 00 A0 00 3F 00 00 00 3F 00 00 00 00 0B 59 32 4B \000\240\000?\000\000\000? \000\000\000\000\013Y2K [320] 49 4E 46 4F 2E 54 58 54 00 60 01 00 00 EE 2C 23 INFO.TXT \000`\001\000\000\356,# [330] 08 83 31 00 00 EE 2C 24 08 0A 00 00 00 0A 00 00 \010\2031\000\000\356,$ \010\012\000\000\000\012\000\000 [340] 00 00 00 09 5F 4C 50 54 31 2E 66 73 66 00 62 01 \000\000\000\011_LPT 1.fsf\000b\001 [350] 00 00 EE 2C 40 08 58 32 00 00 50 2E D4 AA F2 18 \000\000\356,@\010X2 \000\000P.\324\252\362\030 [360] 00 00 F2 18 00 00 00 00 0C 5F 46 4C 41 54 4C 49 \000\000\362\030\000\000\000\000 \014_FLATLI [370] 4E 2E 66 73 66 00 64 01 00 00 54 2A 13 8C 83 31 N.fsf\000d\001 \000\000T*\023\214\2031 [380] 00 00 54 2A B7 85 73 7D 00 00 73 7D 00 00 00 00 \000\000T*\267\205s} \000\000s}\000\000\000\000 [390] 08 5F 64 65 74 6D 70 2E 31 00 66 01 00 00 54 2A \010_detmp. 1\000f\001\000\000T* [3A0] 13 8C 83 31 00 00 BB 26 1B 84 00 A0 00 00 00 A0 \023\214\2031\000\000\273& \033\204\000\240\000\000\000\240 [3B0] 00 00 00 00 08 5F 64 65 74 6D 70 2E 32 00 68 01 \000\000\000\000\010_de tmp.2\000h\001 [3C0] 00 00 1C 27 50 0D 83 31 00 00 05 31 8E 65 8D 00 \000\000\034'P\015\2031 \000\000\0051\216e\215\000 [3D0] 00 00 8D 00 00 00 00 00 0B 62 72 6E 64 6C 6F 67 \000\000\215\000\000\000\000\000 \013brndlog [3E0] 2E 74 78 74 00 6A 01 00 00 74 26 36 05 58 32 00 .txt\000j\001\000 \000t&6\005X2\000 [3F0] 00 74 26 37 05 56 00 00 00 56 00 00 00 00 00 0A \000t&7\005V\000\000 \000V\000\000\000\000\000\012 [400] 63 61 70 5F 70 69 2E 69 6E 69 00 6C 01 00 00 67 cap_pi.i ni\000l\001\000\000g [410] 29 C8 A6 83 31 00 00 46 29 E3 32 D1 AC 09 00 D1 )\310\246\2031\000\000F )\3432\321\254\011\000\321 [420] AC 09 00 00 00 08 63 64 33 32 2E 65 78 65 00 6E \254\011\000\000\000\010cd 32.exe\000n [430] 01 00 00 3E 29 8C 9D 83 31 00 00 3E 29 F4 9D 83 \001\000\000>)\214\235\203 1\000\000>)\364\235\203 [440] D2 00 00 83 D2 00 00 00 00 0B 64 61 73 65 74 75 \322\000\000\203\322\000\000\000 \000\013dasetu [450] 70 2E 6C 6F 67 00 70 01 00 00 74 26 15 07 83 31 p.log\000p\001 \000\000t&\025\007\2031 [460] 00 00 27 27 04 BB 0A 01 00 00 0A 01 00 00 02 00 \000\000''\004\273\012\001 \000\000\012\001\000\000\002\000 [470] 0B 64 65 73 6B 74 6F 70 2E 69 6E 69 00 72 01 00 \013desktop .ini\000r\001\000 [480] 00 4B 2D E6 7D 44 32 00 00 4B 2D E7 7D 0A 00 00 \000K-\346}D2\000 \000K-\347}\012\000\000 [490] 00 0A 00 00 00 00 00 09 5F 46 49 4C 45 2E 66 73 \000\012\000\000\000\000\000\011 _FILE.fs [4A0] 66 00 74 01 00 00 B6 2C C3 60 83 31 00 00 71 2D f\000t\001\000\000\266, \303`\2031\000\000q- [4B0] 0A 68 32 D0 01 00 32 D0 01 00 00 00 0B 77 73 63 \012h2\320\001\0002\320 \001\000\000\000\013wsc [4C0] 72 69 70 74 2E 65 78 65 00 76 01 00 00 5B 2D 58 ript.exe \000v\001\000\000[-X [4D0] 9C 83 31 00 00 5B 2D 67 9C 0D 06 00 00 0D 06 00 \234\2031\000\000[-g \234\015\006\000\000\015\006\000 [4E0] 00 00 00 0F 45 6E 76 43 68 65 63 6B 6C 6F 67 2E \000\000\000\017EnvC hecklog. [4F0] 74 78 74 00 79 01 00 00 B6 2C 48 61 83 31 00 00 txt\000y\001\000\000 \266,Ha\2031\000\000 [500] 05 31 8E 65 0A 55 00 00 0A 55 00 00 00 00 11 52 \0051\216e\012U\000\000 \012U\000\000\000\000\021R [510] 75 6E 4F 6E 63 65 45 78 20 4C 6F 67 2E 74 78 74 unOnceEx Log.txt [520] 00 7C 01 00 00 74 26 15 07 83 31 00 00 27 27 04 \000|\001\000\000t&\025 \007\2031\000\000''\004 [530] BB 42 33 00 00 42 33 00 00 02 00 0A 66 6F 6C 64 \273B3\000\000B3\000 \000\002\000\012fold [540] 65 72 2E 68 74 74 00 7E 01 00 00 74 26 76 30 83 er.htt\000~ \001\000\000t&v0\203 [550] 31 00 00 1A 29 64 AE 4C 22 00 00 4C 22 00 00 00 1\000\000\032)d\256L "\000\000L"\000\000\000 [560] 00 06 68 68 2E 64 61 74 00 80 01 00 00 CA 2C 0A \000\006hh.dat \000\200\001\000\000\312,\012 [570] 6F 83 31 00 00 CA 2C 0A 6F 00 2A 00 00 00 2A 00 o\2031\000\000\312,\012 o\000*\000\000\000*\000 [580] 00 00 00 06 68 68 2E 65 78 65 00 82 01 00 00 E7 \000\000\000\006hh.e xe\000\202\001\000\000\347 [590] 2E 24 6D 83 31 00 00 E7 2E 24 6D 00 84 00 00 00 .$m\2031\000\000\347 .$m\000\204\000\000\000 [5A0] 84 00 00 00 00 0C 6F 65 \204\000\000\000\000\014oe (DF) (ttl 128, id 6368, len 1492) 0x0000 4500 05d4 18e0 4000 8006 58d4 c0a8 010d E.....@...X..... 0x0010 c0a8 0112 008b 83fd 0494 2c86 2163 2a44 ..........,.!c*D 0x0020 5010 f743 8bd2 0000 4901 0000 2727 a5b8 P..C....I...''.. 0x0030 8331 0000 9726 c0b2 205f 0200 205f 0200 .1...&..._..._.. 0x0040 0000 0b57 494e 4649 4c45 2e45 5845 004a ...WINFILE.EXE.J 0x0050 0100 0027 27a6 b883 3100 0097 26c0 b270 ...''...1...&..p 0x0060 0900 0070 0900 0000 000b 5749 4e48 454c ...p......WINHEL 0x0070 502e 4558 4500 4b01 0000 2727 a6b8 4f32 P.EXE.K...''..O2 0x0080 0000 9726 c0b2 00e0 0400 00e0 0400 0000 ...&............ 0x0090 0c57 494e 484c 5033 322e 4558 4500 4c01 .WINHLP32.EXE.L. 0x00a0 0000 a52c 0abe 9c31 0000 a52c 0bbe 0000 ...,...1...,.... 0x00b0 0000 0000 0000 0000 0954 5741 494e 2e4c .........TWAIN.L 0x00c0 4f47 004d 0100 0027 27a6 b869 3200 0097 OG.M...''..i2... 0x00d0 26c0 b2f5 a300 00f5 a300 0000 000b 5749 &.............WI 0x00e0 4e49 4e49 542e 4558 4500 4e01 0000 8e29 NINIT.EXE.N....) 0x00f0 acae 8331 0000 9726 c0b2 00d0 0000 00d0 ...1...&........ 0x0100 0000 0000 0c57 494e 4950 4346 472e 4558 .....WINIPCFG.EX 0x0110 4500 4f01 0000 2727 0fb8 8331 0000 9726 E.O...''...1...& 0x0120 c0b2 1507 0000 1507 0000 0000 0b57 494e .............WIN 0x0130 4c4f 474f 2e47 4946 0050 0100 0027 2763 LOGO.GIF.P...''c 0x0140 b883 3100 0097 26c0 b2d0 6b00 00d0 6b00 ..1...&...k...k. 0x0150 0000 000c 5749 4e50 4f50 5550 2e45 5845 ....WINPOPUP.EXE 0x0160 0051 0100 0027 2707 b883 3100 0097 26c0 .Q...''...1...&. 0x0170 b200 b006 0000 b006 0000 000a 5749 4e52 ............WINR 0x0180 4550 2e45 5845 0052 0100 007d 27d8 9683 EP.EXE.R...}'... 0x0190 3100 0027 2704 b700 5400 0000 5400 0000 1..''...T...T... 0x01a0 000b 5749 4e53 4f43 4b2e 444c 4c00 5301 ..WINSOCK.DLL.S. 0x01b0 0000 2727 acb8 8331 0000 9726 c0b2 9627 ..''...1...&...' 0x01c0 0000 9627 0000 0000 0a57 494e 5550 442e ...'.....WINUPD. 0x01d0 4943 4f00 5401 0000 2727 a6b8 8331 0000 ICO.T...''...1.. 0x01e0 9726 c0b2 400e 0000 400e 0000 0000 0a57 .&..@...@......W 0x01f0 494e 5645 522e 4558 4500 5501 0000 712d INVER.EXE.U...q- 0x0200 7d6b 8331 0000 912c e488 103f 0000 103f }k.1...,...?...? 0x0210 0000 0000 0853 4e4d 502e 4558 4500 5601 .....SNMP.EXE.V. 0x0220 0000 7d2b 341d 8331 0000 7d2b 351d 7068 ..}+4..1..}+5.ph 0x0230 0400 7068 0400 0000 0c57 4d53 7973 5072 ..ph.....WMSysPr 0x0240 782e 7072 7800 5801 0000 4d2b 1197 8331 x.prx.X...M+...1 0x0250 0000 4d2b 1c97 eb02 0000 eb02 0000 0000 ..M+............ 0x0260 0b57 4f52 4450 4144 2e49 4e49 0059 0100 .WORDPAD.INI.Y.. 0x0270 0074 26cc 0283 3100 0005 31cd ad63 0000 .t&...1...1..c.. 0x0280 0063 0000 0000 000c 5750 5845 5252 4f52 .c......WPXERROR 0x0290 2e4c 4f47 005a 0100 0027 27a7 b825 3200 .LOG.Z...''..%2. 0x02a0 0097 26c0 b200 5000 0000 5000 0000 0009 ..&...P...P..... 0x02b0 5752 4954 452e 4558 4500 5b01 0000 7426 WRITE.EXE.[...t& 0x02c0 101e 8331 0000 7426 111e 0000 0000 0000 ...1..t&........ 0x02d0 0000 0000 0c57 544e 5345 5455 502e 494e .....WTNSETUP.IN 0x02e0 4900 5c01 0000 282f f42c 9b31 0000 6924 I.\...(/.,.1..i$ 0x02f0 6b9e 0056 0000 0056 0000 0000 0b50 574c k..V...V.....PWL 0x0300 4544 4954 2e45 5845 005d 0100 0027 276f EDIT.EXE.]...''o 0x0310 b883 3100 0097 26c0 b2be 0000 00be 0000 ..1...&......... 0x0320 0000 0009 5761 7665 732e 626d 7000 5f01 ....Waves.bmp._. 0x0330 0000 1c27 5204 8331 0000 8425 00a0 003f ...'R..1...%...? 0x0340 0000 003f 0000 0000 0b59 324b 494e 464f ...?.....Y2KINFO 0x0350 2e54 5854 0060 0100 00ee 2c23 0883 3100 .TXT.`....,#..1. 0x0360 00ee 2c24 080a 0000 000a 0000 0000 0009 ..,$............ 0x0370 5f4c 5054 312e 6673 6600 6201 0000 ee2c _LPT1.fsf.b...., 0x0380 4008 5832 0000 502e d4aa f218 0000 f218 @.X2..P......... 0x0390 0000 0000 0c5f 464c 4154 4c49 4e2e 6673 ....._FLATLIN.fs 0x03a0 6600 6401 0000 542a 138c 8331 0000 542a f.d...T*...1..T* 0x03b0 b785 737d 0000 737d 0000 0000 085f 6465 ..s}..s}....._de 0x03c0 746d 702e 3100 6601 0000 542a 138c 8331 tmp.1.f...T*...1 0x03d0 0000 bb26 1b84 00a0 0000 00a0 0000 0000 ...&............ 0x03e0 085f 6465 746d 702e 3200 6801 0000 1c27 ._detmp.2.h....' 0x03f0 500d 8331 0000 0531 8e65 8d00 0000 8d00 P..1...1.e...... 0x0400 0000 0000 0b62 726e 646c 6f67 2e74 7874 .....brndlog.txt 0x0410 006a 0100 0074 2636 0558 3200 0074 2637 .j...t&6.X2..t&7 0x0420 0556 0000 0056 0000 0000 000a 6361 705f .V...V......cap_ 0x0430 7069 2e69 6e69 006c 0100 0067 29c8 a683 pi.ini.l...g)... 0x0440 3100 0046 29e3 32d1 ac09 00d1 ac09 0000 1..F).2......... 0x0450 0008 6364 3332 2e65 7865 006e 0100 003e ..cd32.exe.n...> 0x0460 298c 9d83 3100 003e 29f4 9d83 d200 0083 )...1..>)....... 0x0470 d200 0000 000b 6461 7365 7475 702e 6c6f ......dasetup.lo 0x0480 6700 7001 0000 7426 1507 8331 0000 2727 g.p...t&...1..'' 0x0490 04bb 0a01 0000 0a01 0000 0200 0b64 6573 .............des 0x04a0 6b74 6f70 2e69 6e69 0072 0100 004b 2de6 ktop.ini.r...K-. 0x04b0 7d44 3200 004b 2de7 7d0a 0000 000a 0000 }D2..K-.}....... 0x04c0 0000 0009 5f46 494c 452e 6673 6600 7401 ...._FILE.fsf.t. 0x04d0 0000 b62c c360 8331 0000 712d 0a68 32d0 ...,.`.1..q-.h2. 0x04e0 0100 32d0 0100 0000 0b77 7363 7269 7074 ..2......wscript 0x04f0 2e65 7865 0076 0100 005b 2d58 9c83 3100 .exe.v...[-X..1. 0x0500 005b 2d67 9c0d 0600 000d 0600 0000 000f .[-g............ 0x0510 456e 7643 6865 636b 6c6f 672e 7478 7400 EnvChecklog.txt. 0x0520 7901 0000 b62c 4861 8331 0000 0531 8e65 y....,Ha.1...1.e 0x0530 0a55 0000 0a55 0000 0000 1152 756e 4f6e .U...U.....RunOn 0x0540 6365 4578 204c 6f67 2e74 7874 007c 0100 ceEx.Log.txt.|.. 0x0550 0074 2615 0783 3100 0027 2704 bb42 3300 .t&...1..''..B3. 0x0560 0042 3300 0002 000a 666f 6c64 6572 2e68 .B3.....folder.h 0x0570 7474 007e 0100 0074 2676 3083 3100 001a tt.~...t&v0.1... 0x0580 2964 ae4c 2200 004c 2200 0000 0006 6868 )d.L"..L".....hh 0x0590 2e64 6174 0080 0100 00ca 2c0a 6f83 3100 .dat......,.o.1. 0x05a0 00ca 2c0a 6f00 2a00 0000 2a00 0000 0006 ..,.o.*...*..... 0x05b0 6868 2e65 7865 0082 0100 00e7 2e24 6d83 hh.exe.......$m. 0x05c0 3100 00e7 2e24 6d00 8400 0000 8400 0000 1....$m......... 0x05d0 000c 6f65 ..oe 17:11:59.567633 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: . [tcp sum ok] 429:429(0) ack 11810 win 29040 (DF) (ttl 64, id 36138, len 40) 0x0000 4500 0028 8d2a 4000 4006 2a36 c0a8 0112 E..(.*@.@.*6.... 0x0010 c0a8 010d 83fd 008b 2163 2a44 0494 3232 ........!c*D..22 0x0020 5010 7170 b3fe 0000 P.qp.... 17:11:59.567649 192.168.1.13.netbios-ssn > 192.168.1.18.33789: P [tcp sum ok] 11810:11861(51) ack 429 win 63299 >>> NBT Packet flags=0x75 NBT - Unknown packet type Type=0x756E696E Data: (47 bytes) [000] 73 74 2E 65 78 65 00 84 01 00 00 86 27 62 AC 83 st.exe\000\204 \001\000\000\206'b\254\203 [010] 31 00 00 87 27 14 A4 54 00 00 00 54 00 00 00 00 1\000\000\207'\024\244T \000\000\000T\000\000\000\000 [020] 00 0C 69 6E 66 6F 76 69 65 77 2E 69 6E 69 00 \000\014infovi ew.ini\000 (DF) (ttl 128, id 6624, len 91) 0x0000 4500 005b 19e0 4000 8006 5d4d c0a8 010d E..[..@...]M.... 0x0010 c0a8 0112 008b 83fd 0494 3232 2163 2a44 ..........22!c*D 0x0020 5018 f743 1903 0000 756e 696e 7374 2e65 P..C....uninst.e 0x0030 7865 0084 0100 0086 2762 ac83 3100 0087 xe......'b..1... 0x0040 2714 a454 0000 0054 0000 0000 000c 696e '..T...T......in 0x0050 666f 7669 6577 2e69 6e69 00 foview.ini. 17:11:59.568070 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: P [tcp sum ok] 429:525(96) ack 11861 win 29040 >>> NBT Packet NBT Session Packet Flags=0x0 Length=92 (0x5c) SMB PACKET: SMBtrans2 (REQUEST) SMB Command = 0x32 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x8 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 15 (0xf) TRANSACT2_FINDNEXT param_length=24 data_length=0 TotParam=24 (0x18) TotData=0 (0x0) MaxParam=10 (0xa) MaxData=2920 (0xb68) MaxSetup=0 (0x0) Flags=0x0 TimeOut=0 (0x0) Res1=0x0 ParamCnt=24 (0x18) ParamOff=68 (0x44) DataCnt=0 (0x0) DataOff=92 (0x5c) SetupCnt=1 (0x1) TransactionName=Parameters= Data: (24 bytes) [000] 68 81 00 02 01 00 00 00 00 00 0E 00 6E 66 6F 76 h\201\000\002\001\000\000\000 \000\000\016\000nfov [010] 69 65 77 2E 69 6E 69 00 iew.ini\000 Data= (DF) (ttl 64, id 36139, len 136) 0x0000 4500 0088 8d2b 4000 4006 29d5 c0a8 0112 E....+@.@.)..... 0x0010 c0a8 010d 83fd 008b 2163 2a44 0494 3265 ........!c*D..2e 0x0020 5018 7170 8948 0000 0000 005c ff53 4d42 P.qp.H.....\.SMB 0x0030 3200 0000 0008 0100 0000 0000 0000 0000 2............... 0x0040 0000 0000 03f8 3d45 0000 0100 0f18 0000 ......=E........ 0x0050 000a 0068 0b00 0000 0000 0000 0000 0018 ...h............ 0x0060 0044 0000 005c 0001 0002 001b 0000 4420 .D...\........D. 0x0070 6881 0002 0100 0000 0000 0e00 6e66 6f76 h...........nfov 0x0080 6965 772e 696e 6900 iew.ini. 17:11:59.570542 192.168.1.13.netbios-ssn > 192.168.1.18.33789: . [tcp sum ok] 11861:13313(1452) ack 525 win 63203 >>> NBT Packet NBT Session Packet Flags=0x0 Length=2959 (0xb8f) WARNING: Short packet. Try increasing the snap length (1448) SMB PACKET: SMBtrans2 (REPLY) SMB Command = 0x32 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x88 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 10 (0xa) TRANSACT2_FINDNEXT param_length=8 data_length=2895 TotParam=8 (0x8) TotData=2895 (0xb4f) Res1=0x0 ParamCnt=8 (0x8) ParamOff=55 (0x37) ParamDisp0 (0x0) DataCnt=2895 (0xb4f) DataOff=64 (0x40) DataDisp=0 (0x0) SetupCnt=0 (0x0) Parameters= Data: (8 bytes) [000] 4E 00 00 00 00 00 44 0B N\000\000\000\000\000D\013 Data= Data: (2895 bytes) [000] 00 00 00 00 FB 26 D7 74 83 31 00 00 FB 26 D7 74 \000\000\000\000\373&\327t \2031\000\000\373&\327t [010] 35 00 00 00 35 00 00 00 00 00 0C 69 6E 74 75 70 5\000\000\0005\000\000\000 \000\000\014intup [020] 72 6F 66 2E 69 6E 69 00 88 01 00 00 95 2F D0 48 rof.ini\000 \210\001\000\000\225/\320H [030] 95 2F 00 00 95 2F D1 48 00 00 00 00 00 00 00 00 \225/\000\000\225/\321H \000\000\000\000\000\000\000\000 [040] 10 00 08 41 70 70 50 61 74 63 68 00 8A 01 00 00 \020\000\010AppPa tch\000\212\001\000\000 [050] 36 31 81 B2 83 31 00 00 56 30 95 B6 69 60 00 00 61\201\262\2031\000\000 V0\225\266i`\000\000 [060] 69 60 00 00 00 00 08 6A 61 76 61 2E 65 78 65 00 i`\000\000\000\000\010j ava.exe\000 [070] 8C 01 00 00 74 26 C4 12 97 31 00 00 B7 2A 8A 90 \214\001\000\000t&\304\022 \2271\000\000\267*\212\220 [080] 46 8A 00 00 46 8A 00 00 00 00 0B 6C 61 77 6C 65 F\212\000\000F\212\000\000 \000\000\013lawle [090] 73 73 2E 61 63 6C 00 8E 01 00 00 74 26 6F 16 9B ss.acl\000\216 \001\000\000t&o\026\233 [0A0] 31 00 00 9B 31 30 A3 00 20 00 00 00 20 00 00 00 1\000\000\23310\243\000 \000\000\000 \000\000\000 [0B0] 00 0B 6C 61 77 6C 65 73 73 2E 70 63 62 00 90 01 \000\013lawles s.pcb\000\220\001 [0C0] 00 00 74 26 62 16 3B 32 00 00 3B 32 44 97 93 2D \000\000t&b\026;2 \000\000;2D\227\223- [0D0] 00 00 93 2D 00 00 20 00 0C 6C 61 77 6C 65 73 73 \000\000\223-\000\000 \000 \014lawless [0E0] 38 2E 78 6C 62 00 92 01 00 00 73 26 4F BA 9C 31 8.xlb\000\222\001 \000\000s&O\272\2341 [0F0] 00 00 ED 2C F9 BE BE 25 00 00 BE 25 00 00 00 00 \000\000\355,\371\276\276% \000\000\276%\000\000\000\000 [100] 0B 6C 6D 70 63 6C 35 63 2E 69 6E 69 00 94 01 00 \013lmpcl5c .ini\000\224\001\000 [110] 00 74 26 36 05 83 31 00 00 4B 2A 86 56 88 03 00 \000t&6\005\2031\000 \000K*\206V\210\003\000 [120] 00 88 03 00 00 00 00 0B 6D 61 78 6C 69 6E 6B 2E \000\210\003\000\000\000\000\013 maxlink. [130] 69 6E 69 00 96 01 00 00 77 2A 92 83 83 31 00 00 ini\000\226\001\000\000 w*\222\203\2031\000\000 [140] A7 2C 6A 0F 7C 00 00 00 7C 00 00 00 00 00 07 6D \247,j\017|\000\000\000 |\000\000\000\000\000\007m [150] 64 6D 2E 69 6E 69 00 98 01 00 00 64 31 10 AA 83 dm.ini\000\230 \001\000\000d1\020\252\203 [160] 31 00 00 64 31 12 AA 0E 90 00 00 0E 90 00 00 00 1\000\000d1\022\252\016 \220\000\000\016\220\000\000\000 [170] 00 09 6E 73 72 65 67 2E 64 61 74 00 9A 01 00 00 \000\011nsreg. dat\000\232\001\000\000 [180] 8E 29 90 AE 83 31 00 00 95 30 2B 95 11 00 00 00 \216)\220\256\2031\000\000 \2250+\225\021\000\000\000 [190] 11 00 00 00 00 00 0F 6E 74 73 61 75 74 6F 64 69 \021\000\000\000\000\000\017n tsautodi [1A0] 61 6C 2E 69 6E 69 00 9D 01 00 00 67 29 D4 A6 83 al.ini\000\235 \001\000\000g)\324\246\203 [1B0] 31 00 00 B9 28 D3 52 15 88 07 00 15 88 07 00 00 1\000\000\271(\323R\025 \210\007\000\025\210\007\000\000 [1C0] 00 0B 70 61 74 63 68 65 73 2E 68 73 62 00 9F 01 \000\013patche s.hsb\000\237\001 [1D0] 00 00 27 27 CA BA 69 32 00 00 27 27 CB BA 00 00 \000\000''\312\272i2 \000\000''\313\272\000\000 [1E0] 00 00 00 00 00 00 00 00 0B 70 72 6F 67 6D 61 6E \000\000\000\000\000\000\000\000 \013progman [1F0] 2E 69 6E 69 00 A1 01 00 00 27 27 DA B8 83 31 00 .ini\000\241\001\000 \000''\332\270\2031\000 [200] 00 27 27 DB B8 7A 00 00 00 7A 00 00 00 00 00 0C \000''\333\270z\000\000 \000z\000\000\000\000\000\014 [210] 70 72 6F 74 6F 63 6F 6C 2E 69 6E 69 00 A3 01 00 protocol .ini\000\243\001\000 [220] 00 24 27 21 22 83 31 00 00 24 27 22 22 1C 00 00 \000$'!"\2031\000 \000$'""\034\000\000 [230] 00 1C 00 00 00 00 00 0A 71 66 6E 6F 6E 6C 2E 69 \000\034\000\000\000\000\000\012 qfnonl.i [240] 6E 69 00 A5 01 00 00 52 29 93 A0 83 31 00 00 52 ni\000\245\001\000\000R )\223\240\2031\000\000R [250] 29 AD A0 00 02 00 00 00 02 00 00 00 00 0C 72 61 )\255\240\000\002\000\000\000 \002\000\000\000\000\014ra [260] 6E 64 73 65 65 64 2E 72 6E 64 00 A7 01 00 00 4B ndseed.r nd\000\247\001\000\000K [270] 2A 71 56 83 31 00 00 37 25 18 58 00 CC 00 00 00 *qV\2031\000\0007 %\030X\000\314\000\000\000 [280] CC 00 00 00 00 0C 73 63 6E 6C 69 62 33 32 2E 64 \314\000\000\000\000\014sc nlib32.d [290] 6C 6C 00 A9 01 00 00 F8 26 AB 79 83 31 00 00 F8 ll\000\251\001\000\000\370 &\253y\2031\000\000\370 [2A0] 26 AC 79 3C 00 00 00 3C 00 00 00 00 00 09 73 65 &\254y<\000\000\000< \000\000\000\000\000\011se [2B0] 74 75 70 2E 6F 6C 64 00 AB 01 00 00 84 27 55 04 tup.old\000 \253\001\000\000\204'U\004 [2C0] 83 31 00 00 86 27 AA 8C B6 07 00 00 B6 07 00 00 \2031\000\000\206'\252\214 \266\007\000\000\266\007\000\000 [2D0] 00 00 0F 73 79 73 74 65 6D 2E 69 6E 69 2E 6F 6D \000\000\017syste m.ini.om [2E0] 61 70 00 AE 01 00 00 12 2B 9A A1 83 31 00 00 12 ap\000\256\001\000\000\022 +\232\241\2031\000\000\022 [2F0] 2B 9B A1 5B 00 00 00 5B 00 00 00 00 00 0E 74 65 +\233\241[\000\000\000[ \000\000\000\000\000\016te [300] 6C 6E 65 74 32 30 30 30 2E 69 6E 69 00 B1 01 00 lnet2000 .ini\000\261\001\000 [310] 00 2C 27 15 0C 83 31 00 00 2C 27 16 0C 7A 00 00 \000,'\025\014\2031\000 \000,'\026\014z\000\000 [320] 00 7A 00 00 00 00 00 0C 74 6D 70 64 65 6C 69 73 \000z\000\000\000\000\000\014 tmpdelis [330] 2E 62 61 74 00 B3 01 00 00 77 2A B0 A8 75 32 00 .bat\000\263\001\000 \000w*\260\250u2\000 [340] 00 9B 31 9B A8 E1 28 00 00 E1 28 00 00 02 00 08 \000\2331\233\250\341(\000 \000\341(\000\000\002\000\010 [350] 74 74 66 43 61 63 68 65 00 B5 01 00 00 54 2A 7C ttfCache \000\265\001\000\000T*| [360] 98 83 31 00 00 88 22 05 A9 00 92 04 00 00 92 04 \230\2031\000\000\210"\005 \251\000\222\004\000\000\222\004 [370] 00 00 00 0A 75 6E 69 6E 73 74 2E 65 78 65 00 B7 \000\000\000\012unin st.exe\000\267 [380] 01 00 00 4B 2A 70 56 83 31 00 00 37 25 41 58 00 \001\000\000K*pV\203 1\000\0007%AX\000 [390] B8 00 00 00 B8 00 00 00 00 0C 75 6E 73 63 61 6E \270\000\000\000\270\000\000\000 \000\014unscan [3A0] 34 30 2E 65 78 65 00 B9 01 00 00 3B 2B 2D B7 83 40.exe\000\271 \001\000\000;+-\267\203 [3B0] 31 00 00 91 27 A2 49 00 50 01 00 00 50 01 00 00 1\000\000\221'\242I\000 P\001\000\000P\001\000\000 [3C0] 00 0C 75 6E 76 69 73 65 33 32 2E 65 78 65 00 BB \000\014unvise 32.exe\000\273 [3D0] 01 00 00 9F 29 85 AE 83 31 00 00 77 2A 85 83 3C \001\000\000\237)\205\256\203 1\000\000w*\205\203< [3E0] 00 00 00 3C 00 00 00 00 00 0B 76 62 61 64 64 69 \000\000\000<\000\000\000\000 \000\013vbaddi [3F0] 6E 2E 69 6E 69 00 BD 01 00 00 8D 26 FA 03 83 31 n.ini\000\275\001 \000\000\215&\372\003\2031 [400] 00 00 13 2F B1 02 64 08 00 00 64 08 00 00 00 00 \000\000\023/\261\002d\010 \000\000d\010\000\000\000\000 [410] 0A 76 6D 69 6E 73 74 2E 6C 6F 67 00 BF 01 00 00 \012vminst. log\000\277\001\000\000 [420] 7D 2B 46 1D 83 31 00 00 A3 30 0A 6E 00 90 0B 00 }+F\035\2031\000\000 \2430\012n\000\220\013\000 [430] 00 90 0B 00 00 00 14 77 6D 70 6C 69 62 72 61 72 \000\220\013\000\000\000\024w mplibrar [440] 79 5F 76 5F 30 5F 31 32 2E 64 62 00 C2 01 00 00 y_v_0_12 .db\000\302\001\000\000 [450] 7D 2B 48 1D 69 32 00 00 69 32 D7 4D A0 5B 02 00 }+H\035i2\000\000 i2\327M\240[\002\000 [460] A0 5B 02 00 20 00 0B 77 6D 73 65 74 75 70 2E 6C \240[\002\000 \000\013w msetup.l [470] 6F 67 00 C4 01 00 00 77 2A B5 83 83 31 00 00 77 og\000\304\001\000\000w *\265\203\2031\000\000w [480] 2A B6 83 00 00 00 00 00 00 00 00 00 00 09 77 70 *\266\203\000\000\000\000\000 \000\000\000\000\000\011wp [490] 6C 6F 67 2E 74 78 74 00 C6 01 00 00 71 2D 83 6B log.txt\000 \306\001\000\000q-\203k [4A0] 83 31 00 00 13 2F B1 02 71 10 00 00 71 10 00 00 \2031\000\000\023/\261\002 q\020\000\000q\020\000\000 [4B0] 00 00 0C 64 61 68 6F 74 66 69 78 2E 6C 6F 67 00 \000\000\014dahot fix.log\000 [4C0] C8 01 00 00 92 2C 82 6C 92 2C 00 00 92 2C 83 6C \310\001\000\000\222,\202l \222,\000\000\222,\203l [4D0] 00 00 00 00 00 00 00 00 10 00 07 41 45 43 53 6F \000\000\000\000\000\000\000\000 \020\000\007AECSo [4E0] 66 74 00 CA 01 00 00 92 2C 82 6C 92 2C 00 00 92 ft\000\312\001\000\000\222 ,\202l\222,\000\000\222 [4F0] 2C 83 6C 00 00 00 00 00 00 00 00 10 00 09 41 6C ,\203l\000\000\000\000\000 \000\000\000\020\000\011Al [500] 6C 20 55 73 65 72 73 00 CC 01 00 00 92 2C 82 6C l Users\000 \314\001\000\000\222,\202l [510] 92 2C 00 00 92 2C 83 6C 00 00 00 00 00 00 00 00 \222,\000\000\222,\203l \000\000\000\000\000\000\000\000 [520] 10 00 10 41 70 70 6C 69 63 61 74 69 6F 6E 20 44 \020\000\020Appli cation D [530] 61 74 61 00 CF 01 00 00 92 2C 82 6C 92 2C 00 00 ata\000\317\001\000\000 \222,\202l\222,\000\000 [540] 92 2C 83 6C 00 00 00 00 00 00 00 00 10 00 07 43 \222,\203l\000\000\000\000 \000\000\000\000\020\000\007C [550] 41 54 52 4F 4F 54 00 D0 01 00 00 92 2C 82 6C 92 ATROOT\000\320 \001\000\000\222,\202l\222 [560] 2C 00 00 92 2C 83 6C 00 00 00 00 00 00 00 00 00 ,\000\000\222,\203l\000 \000\000\000\000\000\000\000\000 [570] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [580] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [590] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [600] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [610] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [620] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [630] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [640] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [650] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [660] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [670] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [680] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [690] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [6F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [700] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [710] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [720] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [730] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [740] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [750] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [760] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [770] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [780] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [790] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [7F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [800] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [810] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [820] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [830] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [840] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [850] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [860] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [870] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [880] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [890] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [8F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [900] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [910] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [920] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [930] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [940] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [950] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [960] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [970] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [980] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [990] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [9F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A00] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A10] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A20] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A30] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A40] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A50] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A60] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A70] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A80] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [A90] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AA0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AB0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AC0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AD0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AE0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [AF0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B00] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B10] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B20] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B30] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [B40] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000 (DF) (ttl 128, id 6880, len 1492) 0x0000 4500 05d4 1ae0 4000 8006 56d4 c0a8 010d E.....@...V..... 0x0010 c0a8 0112 008b 83fd 0494 3265 2163 2aa4 ..........2e!c*. 0x0020 5010 f6e3 563c 0000 0000 0b8f ff53 4d42 P...V<.......SMB 0x0030 3200 0000 0088 0100 0000 0000 0000 0000 2............... 0x0040 0000 0000 03f8 3d45 0000 0100 0a08 004f ......=E.......O 0x0050 0b00 0008 0037 0000 004f 0b40 0000 0000 .....7...O.@.... 0x0060 0058 0b4e 0000 0000 0044 0b1b 0000 0000 .X.N.....D...... 0x0070 fb26 d774 8331 0000 fb26 d774 3500 0000 .&.t.1...&.t5... 0x0080 3500 0000 0000 0c69 6e74 7570 726f 662e 5......intuprof. 0x0090 696e 6900 8801 0000 952f d048 952f 0000 ini....../.H./.. 0x00a0 952f d148 0000 0000 0000 0000 1000 0841 ./.H...........A 0x00b0 7070 5061 7463 6800 8a01 0000 3631 81b2 ppPatch.....61.. 0x00c0 8331 0000 5630 95b6 6960 0000 6960 0000 .1..V0..i`..i`.. 0x00d0 0000 086a 6176 612e 6578 6500 8c01 0000 ...java.exe..... 0x00e0 7426 c412 9731 0000 b72a 8a90 468a 0000 t&...1...*..F... 0x00f0 468a 0000 0000 0b6c 6177 6c65 7373 2e61 F......lawless.a 0x0100 636c 008e 0100 0074 266f 169b 3100 009b cl.....t&o..1... 0x0110 3130 a300 2000 0000 2000 0000 000b 6c61 10............la 0x0120 776c 6573 732e 7063 6200 9001 0000 7426 wless.pcb.....t& 0x0130 6216 3b32 0000 3b32 4497 932d 0000 932d b.;2..;2D..-...- 0x0140 0000 2000 0c6c 6177 6c65 7373 382e 786c .....lawless8.xl 0x0150 6200 9201 0000 7326 4fba 9c31 0000 ed2c b.....s&O..1..., 0x0160 f9be be25 0000 be25 0000 0000 0b6c 6d70 ...%...%.....lmp 0x0170 636c 3563 2e69 6e69 0094 0100 0074 2636 cl5c.ini.....t&6 0x0180 0583 3100 004b 2a86 5688 0300 0088 0300 ..1..K*.V....... 0x0190 0000 000b 6d61 786c 696e 6b2e 696e 6900 ....maxlink.ini. 0x01a0 9601 0000 772a 9283 8331 0000 a72c 6a0f ....w*...1...,j. 0x01b0 7c00 0000 7c00 0000 0000 076d 646d 2e69 |...|......mdm.i 0x01c0 6e69 0098 0100 0064 3110 aa83 3100 0064 ni.....d1...1..d 0x01d0 3112 aa0e 9000 000e 9000 0000 0009 6e73 1.............ns 0x01e0 7265 672e 6461 7400 9a01 0000 8e29 90ae reg.dat......).. 0x01f0 8331 0000 9530 2b95 1100 0000 1100 0000 .1...0+......... 0x0200 0000 0f6e 7473 6175 746f 6469 616c 2e69 ...ntsautodial.i 0x0210 6e69 009d 0100 0067 29d4 a683 3100 00b9 ni.....g)...1... 0x0220 28d3 5215 8807 0015 8807 0000 000b 7061 (.R...........pa 0x0230 7463 6865 732e 6873 6200 9f01 0000 2727 tches.hsb.....'' 0x0240 caba 6932 0000 2727 cbba 0000 0000 0000 ..i2..''........ 0x0250 0000 0000 0b70 726f 676d 616e 2e69 6e69 .....progman.ini 0x0260 00a1 0100 0027 27da b883 3100 0027 27db .....''...1..''. 0x0270 b87a 0000 007a 0000 0000 000c 7072 6f74 .z...z......prot 0x0280 6f63 6f6c 2e69 6e69 00a3 0100 0024 2721 ocol.ini.....$'! 0x0290 2283 3100 0024 2722 221c 0000 001c 0000 ".1..$'""....... 0x02a0 0000 000a 7166 6e6f 6e6c 2e69 6e69 00a5 ....qfnonl.ini.. 0x02b0 0100 0052 2993 a083 3100 0052 29ad a000 ...R)...1..R)... 0x02c0 0200 0000 0200 0000 000c 7261 6e64 7365 ..........randse 0x02d0 6564 2e72 6e64 00a7 0100 004b 2a71 5683 ed.rnd.....K*qV. 0x02e0 3100 0037 2518 5800 cc00 0000 cc00 0000 1..7%.X......... 0x02f0 000c 7363 6e6c 6962 3332 2e64 6c6c 00a9 ..scnlib32.dll.. 0x0300 0100 00f8 26ab 7983 3100 00f8 26ac 793c ....&.y.1...&.y< 0x0310 0000 003c 0000 0000 0009 7365 7475 702e ...<......setup. 0x0320 6f6c 6400 ab01 0000 8427 5504 8331 0000 old......'U..1.. 0x0330 8627 aa8c b607 0000 b607 0000 0000 0f73 .'.............s 0x0340 7973 7465 6d2e 696e 692e 6f6d 6170 00ae ystem.ini.omap.. 0x0350 0100 0012 2b9a a183 3100 0012 2b9b a15b ....+...1...+..[ 0x0360 0000 005b 0000 0000 000e 7465 6c6e 6574 ...[......telnet 0x0370 3230 3030 2e69 6e69 00b1 0100 002c 2715 2000.ini.....,'. 0x0380 0c83 3100 002c 2716 0c7a 0000 007a 0000 ..1..,'..z...z.. 0x0390 0000 000c 746d 7064 656c 6973 2e62 6174 ....tmpdelis.bat 0x03a0 00b3 0100 0077 2ab0 a875 3200 009b 319b .....w*..u2...1. 0x03b0 a8e1 2800 00e1 2800 0002 0008 7474 6643 ..(...(.....ttfC 0x03c0 6163 6865 00b5 0100 0054 2a7c 9883 3100 ache.....T*|..1. 0x03d0 0088 2205 a900 9204 0000 9204 0000 000a .."............. 0x03e0 756e 696e 7374 2e65 7865 00b7 0100 004b uninst.exe.....K 0x03f0 2a70 5683 3100 0037 2541 5800 b800 0000 *pV.1..7%AX..... 0x0400 b800 0000 000c 756e 7363 616e 3430 2e65 ......unscan40.e 0x0410 7865 00b9 0100 003b 2b2d b783 3100 0091 xe.....;+-..1... 0x0420 27a2 4900 5001 0000 5001 0000 000c 756e '.I.P...P.....un 0x0430 7669 7365 3332 2e65 7865 00bb 0100 009f vise32.exe...... 0x0440 2985 ae83 3100 0077 2a85 833c 0000 003c )...1..w*..<...< 0x0450 0000 0000 000b 7662 6164 6469 6e2e 696e ......vbaddin.in 0x0460 6900 bd01 0000 8d26 fa03 8331 0000 132f i......&...1.../ 0x0470 b102 6408 0000 6408 0000 0000 0a76 6d69 ..d...d......vmi 0x0480 6e73 742e 6c6f 6700 bf01 0000 7d2b 461d nst.log.....}+F. 0x0490 8331 0000 a330 0a6e 0090 0b00 0090 0b00 .1...0.n........ 0x04a0 0000 1477 6d70 6c69 6272 6172 795f 765f ...wmplibrary_v_ 0x04b0 305f 3132 2e64 6200 c201 0000 7d2b 481d 0_12.db.....}+H. 0x04c0 6932 0000 6932 d74d a05b 0200 a05b 0200 i2..i2.M.[...[.. 0x04d0 2000 0b77 6d73 6574 7570 2e6c 6f67 00c4 ...wmsetup.log.. 0x04e0 0100 0077 2ab5 8383 3100 0077 2ab6 8300 ...w*...1..w*... 0x04f0 0000 0000 0000 0000 0009 7770 6c6f 672e ..........wplog. 0x0500 7478 7400 c601 0000 712d 836b 8331 0000 txt.....q-.k.1.. 0x0510 132f b102 7110 0000 7110 0000 0000 0c64 ./..q...q......d 0x0520 6168 6f74 6669 782e 6c6f 6700 c801 0000 ahotfix.log..... 0x0530 922c 826c 922c 0000 922c 836c 0000 0000 .,.l.,...,.l.... 0x0540 0000 0000 1000 0741 4543 536f 6674 00ca .......AECSoft.. 0x0550 0100 0092 2c82 6c92 2c00 0092 2c83 6c00 ....,.l.,...,.l. 0x0560 0000 0000 0000 0010 0009 416c 6c20 5573 ..........All.Us 0x0570 6572 7300 cc01 0000 922c 826c 922c 0000 ers......,.l.,.. 0x0580 922c 836c 0000 0000 0000 0000 1000 1041 .,.l...........A 0x0590 7070 6c69 6361 7469 6f6e 2044 6174 6100 pplication.Data. 0x05a0 cf01 0000 922c 826c 922c 0000 922c 836c .....,.l.,...,.l 0x05b0 0000 0000 0000 0000 1000 0743 4154 524f ...........CATRO 0x05c0 4f54 00d0 0100 0092 2c82 6c92 2c00 0092 OT......,.l.,... 0x05d0 2c83 6c00 ,.l. 17:11:59.570671 192.168.1.13.netbios-ssn > 192.168.1.18.33789: . [tcp sum ok] 13313:14765(1452) ack 525 win 63203 >>> NBT Packet NBT Session Packet Flags=0x0 Length=0 (0x0) Session packet:(raw data?) (DF) (ttl 128, id 7136, len 1492) 0x0000 4500 05d4 1be0 4000 8006 55d4 c0a8 010d E.....@...U..... 0x0010 c0a8 0112 008b 83fd 0494 3811 2163 2aa4 ..........8.!c*. 0x0020 5010 f6e3 0b91 0000 0000 0000 0000 0010 P............... 0x0030 0007 434f 4d4d 414e 4400 d101 0000 922c ..COMMAND......, 0x0040 826c 922c 0000 922c 836c 0000 0000 0000 .l.,...,.l...... 0x0050 0000 1000 0643 4f4e 4649 4700 d201 0000 .....CONFIG..... 0x0060 922c 826c 922c 0000 922c 836c 0000 0000 .,.l.,...,.l.... 0x0070 0000 0000 1000 0743 5552 534f 5253 00d3 .......CURSORS.. 0x0080 0100 0092 2c82 6c92 2c00 0092 2c83 6c00 ....,.l.,...,.l. 0x0090 0000 0000 0000 0014 0007 436f 6f6b 6965 ..........Cookie 0x00a0 7300 d501 0000 922c 826c 922c 0000 922c s......,.l.,..., 0x00b0 836c 0000 0000 0000 0000 1000 0743 7279 .l...........Cry 0x00c0 7374 616c 00d7 0100 0092 2c82 6c92 2c00 stal......,.l.,. 0x00d0 0092 2c83 6c00 0000 0000 0000 0010 0008 ..,.l........... 0x00e0 4452 5741 5453 4f4e 00d8 0100 0092 2c82 DRWATSON......,. 0x00f0 6c92 2c00 0092 2c83 6c00 0000 0000 0000 l.,...,.l....... 0x0100 0010 0007 4465 736b 746f 7000 da01 0000 ....Desktop..... 0x0110 922c 826c 922c 0000 922c 836c 0000 0000 .,.l.,...,.l.... 0x0120 0000 0000 1400 1844 6f77 6e6c 6f61 6465 .......Downloade 0x0130 6420 5072 6f67 7261 6d20 4669 6c65 7300 d.Program.Files. 0x0140 dd01 0000 922c 826c 922c 0000 922c 836c .....,.l.,...,.l 0x0150 0000 0000 0000 0000 1000 0645 534c 6f67 ...........ESLog 0x0160 7300 df01 0000 922c 826c 922c 0000 922c s......,.l.,..., 0x0170 836c 0000 0000 0000 0000 1400 0546 4f4e .l...........FON 0x0180 5453 00e0 0100 0092 2c82 6c92 2c00 0092 TS......,.l.,... 0x0190 2c83 6c00 0000 0000 0000 0010 0009 4661 ,.l...........Fa 0x01a0 766f 7269 7465 7300 e201 0000 922c 826c vorites......,.l 0x01b0 922c 0000 922c 836c 0000 0000 0000 0000 .,...,.l........ 0x01c0 1000 0448 454c 5000 e301 0000 922c 826c ...HELP......,.l 0x01d0 922c 0000 922c 836c 0000 0000 0000 0000 .,...,.l........ 0x01e0 1400 0748 6973 746f 7279 00e5 0100 0092 ...History...... 0x01f0 2c82 6c92 2c00 0092 2c83 6c00 0000 0000 ,.l.,...,.l..... 0x0200 0000 0012 0003 494e 4600 e601 0000 922c ......INF......, 0x0210 826c 922c 0000 922c 836c 0000 0000 0000 .l.,...,.l...... 0x0220 0000 1600 0949 6e73 7461 6c6c 6572 00e8 .....Installer.. 0x0230 0100 0092 2c82 6c92 2c00 0092 2c83 6c00 ....,.l.,...,.l. 0x0240 0000 0000 0000 0010 0006 496e 7475 6974 ..........Intuit 0x0250 00ea 0100 0092 2c82 6c92 2c00 0092 2c83 ......,.l.,...,. 0x0260 6c00 0000 0000 0000 0010 0004 4a41 5641 l...........JAVA 0x0270 00eb 0100 0092 2c82 6c92 2c00 0092 2c83 ......,.l.,...,. 0x0280 6c00 0000 0000 0000 0010 000e 4c6f 6361 l...........Loca 0x0290 6c20 5365 7474 696e 6773 00ee 0100 0092 l.Settings...... 0x02a0 2c82 6c92 2c00 0092 2c83 6c00 0000 0000 ,.l.,...,.l..... 0x02b0 0000 0010 0005 4d45 4449 4100 ef01 0000 ......MEDIA..... 0x02c0 922c 826c 922c 0000 922c 836c 0000 0000 .,.l.,...,.l.... 0x02d0 0000 0000 1000 064d 5341 7070 7300 f101 .......MSApps... 0x02e0 0000 922c 826c 922c 0000 922c 836c 0000 ...,.l.,...,.l.. 0x02f0 0000 0000 0000 1200 074e 6574 486f 6f64 .........NetHood 0x0300 00f3 0100 0092 2c82 6c92 2c00 0092 2c83 ......,.l.,...,. 0x0310 6c00 0000 0000 0000 0011 0011 4f66 666c l...........Offl 0x0320 696e 6520 5765 6220 5061 6765 7300 f601 ine.Web.Pages... 0x0330 0000 922c 826c 922c 0000 922c 836c 0000 ...,.l.,...,.l.. 0x0340 0000 0000 0000 1000 0350 4946 00f7 0100 .........PIF.... 0x0350 0092 2c82 6c92 2c00 0092 2c83 6c00 0000 ..,.l.,...,.l... 0x0360 0000 0000 0010 0007 5069 7874 7261 6e00 ........Pixtran. 0x0370 f901 0000 922c 826c 922c 0000 922c 836c .....,.l.,...,.l 0x0380 0000 0000 0000 0000 1200 0950 7269 6e74 ...........Print 0x0390 486f 6f64 00fb 0100 0092 2c82 6c92 2c00 Hood......,.l.,. 0x03a0 0092 2c83 6c00 0000 0000 0000 0010 0008 ..,.l........... 0x03b0 5072 6f66 696c 6573 00fd 0100 0092 2c82 Profiles......,. 0x03c0 6c92 2c00 0092 2c83 6c00 0000 0000 0000 l.,...,.l....... 0x03d0 0012 0006 5265 6365 6e74 00ff 0100 0092 ....Recent...... 0x03e0 2c82 6c92 2c00 0092 2c83 6c00 0000 0000 ,.l.,...,.l..... 0x03f0 0000 0010 0007 5341 4d50 4c45 5300 0002 ......SAMPLES... 0x0400 0000 922c 826c 922c 0000 922c 836c 0000 ...,.l.,...,.l.. 0x0410 0000 0000 0000 1200 0853 5953 4243 4b55 .........SYSBCKU 0x0420 5000 0102 0000 922c 826c 922c 0000 922c P......,.l.,..., 0x0430 836c 0000 0000 0000 0000 1000 0653 5953 .l...........SYS 0x0440 5445 4d00 0202 0000 922c 826c 922c 0000 TEM......,.l.,.. 0x0450 922c 836c 0000 0000 0000 0000 1000 0853 .,.l...........S 0x0460 5953 5445 4d33 3200 0302 0000 922c 826c YSTEM32......,.l 0x0470 922c 0000 922c 836c 0000 0000 0000 0000 .,...,.l........ 0x0480 1000 0653 656e 6454 6f00 0502 0000 922c ...SendTo......, 0x0490 836c 922c 0000 922c 846c 0000 0000 0000 .l.,...,.l...... 0x04a0 0000 1200 0853 6865 6c6c 4e65 7700 0702 .....ShellNew... 0x04b0 0000 922c 836c 922c 0000 922c 846c 0000 ...,.l.,...,.l.. 0x04c0 0000 0000 0000 1000 0a53 7461 7274 204d .........Start.M 0x04d0 656e 7500 0902 0000 922c 836c 922c 0000 enu......,.l.,.. 0x04e0 922c 846c 0000 0000 0000 0000 1000 0454 .,.l...........T 0x04f0 454d 5000 0a02 0000 922c 836c 922c 0000 EMP......,.l.,.. 0x0500 922c 846c 0000 0000 0000 0000 1400 0554 .,.l...........T 0x0510 6173 6b73 000c 0200 0092 2c83 6c92 2c00 asks......,.l.,. 0x0520 0092 2c84 6c00 0000 0000 0000 0014 0018 ..,.l........... 0x0530 5465 6d70 6f72 6172 7920 496e 7465 726e Temporary.Intern 0x0540 6574 2046 696c 6573 000f 0200 0092 2c83 et.Files......,. 0x0550 6c92 2c00 0092 2c84 6c00 0000 0000 0000 l.,...,.l....... 0x0560 0010 0003 5643 4d00 1002 0000 922c 836c ....VCM......,.l 0x0570 922c 0000 922c 846c 0000 0000 0000 0000 .,...,.l........ 0x0580 1400 0357 4542 0011 0200 0092 2c83 6c92 ...WEB......,.l. 0x0590 2c00 0092 2c84 6c00 0000 0000 0000 0010 ,...,.l......... 0x05a0 0005 6169 6d39 3500 1302 0000 922c 836c ..aim95......,.l 0x05b0 922c 0000 922c 846c 0000 0000 0000 0000 .,...,.l........ 0x05c0 1000 046f 7269 6700 1502 0000 922c 836c ...orig......,.l 0x05d0 922c 0000 .,.. 17:11:59.570676 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: . [tcp sum ok] 525:525(0) ack 14765 win 34848 (DF) (ttl 64, id 36140, len 40) 0x0000 4500 0028 8d2c 4000 4006 2a34 c0a8 0112 E..(.,@.@.*4.... 0x0010 c0a8 010d 83fd 008b 2163 2aa4 0494 3dbd ........!c*...=. 0x0020 5010 8820 9163 0000 P....c.. 17:11:59.570693 192.168.1.13.netbios-ssn > 192.168.1.18.33789: P [tcp sum ok] 14765:14824(59) ack 525 win 63203 >>> NBT Packet flags=0x92 NBT - Unknown packet type Type=0x922C846C Data: (55 bytes) [000] 00 00 00 00 00 00 00 00 12 00 05 73 70 6F 6F 6C \000\000\000\000\000\000\000\000 \022\000\005spool [010] 00 18 02 00 00 00 00 00 00 00 00 00 00 76 32 49 \000\030\002\000\000\000\000\000 \000\000\000\000\000v2I [020] 56 00 00 C0 04 00 00 C0 04 20 00 0A 57 49 4E 33 V\000\000\300\004\000\000\300 \004 \000\012WIN3 [030] 38 36 2E 53 57 50 00 86.SWP\000 (DF) (ttl 128, id 7392, len 99) 0x0000 4500 0063 1ce0 4000 8006 5a45 c0a8 010d E..c..@...ZE.... 0x0010 c0a8 0112 008b 83fd 0494 3dbd 2163 2aa4 ..........=.!c*. 0x0020 5018 f6e3 1c9d 0000 922c 846c 0000 0000 P........,.l.... 0x0030 0000 0000 1200 0573 706f 6f6c 0018 0200 .......spool.... 0x0040 0000 0000 0000 0000 0076 3249 5600 00c0 .........v2IV... 0x0050 0400 00c0 0420 000a 5749 4e33 3836 2e53 ........WIN386.S 0x0060 5750 00 WP. 17:11:59.571051 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: P [tcp sum ok] 525:619(94) ack 14824 win 34848 >>> NBT Packet NBT Session Packet Flags=0x0 Length=90 (0x5a) SMB PACKET: SMBtrans2 (REQUEST) SMB Command = 0x32 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x8 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 15 (0xf) TRANSACT2_FINDNEXT param_length=22 data_length=0 TotParam=22 (0x16) TotData=0 (0x0) MaxParam=10 (0xa) MaxData=2920 (0xb68) MaxSetup=0 (0x0) Flags=0x0 TimeOut=0 (0x0) Res1=0x0 ParamCnt=22 (0x16) ParamOff=68 (0x44) DataCnt=0 (0x0) DataOff=90 (0x5a) SetupCnt=1 (0x1) TransactionName=Parameters= Data: (22 bytes) [000] 68 81 00 02 01 00 00 00 00 00 0E 00 49 4E 33 38 h\201\000\002\001\000\000\000 \000\000\016\000IN38 [010] 36 2E 53 57 50 00 6.SWP\000 Data= (DF) (ttl 64, id 36141, len 134) 0x0000 4500 0086 8d2d 4000 4006 29d5 c0a8 0112 E....-@.@.)..... 0x0010 c0a8 010d 83fd 008b 2163 2aa4 0494 3df8 ........!c*...=. 0x0020 5018 8820 a184 0000 0000 005a ff53 4d42 P..........Z.SMB 0x0030 3200 0000 0008 0100 0000 0000 0000 0000 2............... 0x0040 0000 0000 03f8 3d45 0000 0100 0f16 0000 ......=E........ 0x0050 000a 0068 0b00 0000 0000 0000 0000 0016 ...h............ 0x0060 0044 0000 005a 0001 0002 0019 0000 4420 .D...Z........D. 0x0070 6881 0002 0100 0000 0000 0e00 494e 3338 h...........IN38 0x0080 362e 5357 5000 6.SWP. 17:11:59.572708 192.168.1.13.netbios-ssn > 192.168.1.18.33789: . [tcp sum ok] 14824:16276(1452) ack 619 win 63109 >>> NBT Packet NBT Session Packet Flags=0x0 Length=1750 (0x6d6) WARNING: Short packet. Try increasing the snap length (1448) SMB PACKET: SMBtrans2 (REPLY) SMB Command = 0x32 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x88 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 10 (0xa) TRANSACT2_FINDNEXT param_length=8 data_length=1686 TotParam=8 (0x8) TotData=1686 (0x696) Res1=0x0 ParamCnt=8 (0x8) ParamOff=55 (0x37) ParamDisp0 (0x0) DataCnt=1686 (0x696) DataOff=64 (0x40) DataDisp=0 (0x0) SetupCnt=0 (0x0) Parameters= Data: (8 bytes) [000] 29 00 01 00 00 00 02 00 )\000\001\000\000\000\002\000 Data= Data: (1686 bytes) [000] 00 00 00 00 58 2B 92 8D 83 31 00 00 58 2B 92 8D \000\000\000\000X+\222\215 \2031\000\000X+\222\215 [010] 00 16 01 00 00 16 01 00 00 00 0B 77 75 70 64 6D \000\026\001\000\000\026\001\000 \000\000\013wupdm [020] 67 72 2E 65 78 65 00 1B 02 00 00 A5 2C 3B B9 83 gr.exe\000\033 \002\000\000\245,;\271\203 [030] 31 00 00 A5 2C 82 B9 85 03 07 00 85 03 07 00 00 1\000\000\245,\202\271\205 \003\007\000\205\003\007\000\000 [040] 00 0D 48 6F 6D 65 53 69 74 65 35 2E 6C 6F 67 00 \000\015HomeSi te5.log\000 [050] 1D 02 00 00 71 2D F5 65 71 2D 00 00 71 2D F6 65 \035\002\000\000q-\365e q-\000\000q-\366e [060] 00 00 00 00 00 00 00 00 12 00 0C 6D 73 64 6F 77 \000\000\000\000\000\000\000\000 \022\000\014msdow [070] 6E 6C 64 2E 74 6D 70 00 1F 02 00 00 A5 2C 0A BE nld.tmp\000 \037\002\000\000\245,\012\276 [080] 9C 31 00 00 9C 31 F1 A9 03 00 00 00 03 00 00 00 \2341\000\000\2341\361\251 \003\000\000\000\003\000\000\000 [090] 00 00 0C 54 77 61 69 6E 30 30 31 2E 4D 74 78 00 \000\000\014Twain 001.Mtx\000 [0A0] 21 02 00 00 A5 2C 42 B8 83 31 00 00 A5 2C 42 B8 !\002\000\000\245,B\270 \2031\000\000\245,B\270 [0B0] 92 96 04 00 92 96 04 00 00 00 0D 48 6F 6D 65 53 \222\226\004\000\222\226\004\000 \000\000\015HomeS [0C0] 69 74 65 35 2E 30 30 30 00 23 02 00 00 A5 2C 3B ite5.000 \000#\002\000\000\245,; [0D0] B9 83 31 00 00 A5 2C 3B B9 0A 89 04 00 0A 89 04 \271\2031\000\000\245,; \271\012\211\004\000\012\211\004 [0E0] 00 00 00 0D 48 6F 6D 65 53 69 74 65 35 2E 30 30 \000\000\000\015Home Site5.00 [0F0] 31 00 25 02 00 00 A5 2C 71 B9 83 31 00 00 AA 2A 1\000%\002\000\000\245, q\271\2031\000\000\252* [100] 61 AF 00 08 01 00 00 08 01 00 00 00 0B 75 6E 6C a\257\000\010\001\000\000\010 \001\000\000\000\013unl [110] 69 74 65 32 2E 65 78 65 00 27 02 00 00 5B 2D DA ite2.exe \000'\002\000\000[-\332 [120] B5 83 31 00 00 5B 2D DC B5 8B 04 00 00 8B 04 00 \265\2031\000\000[-\334 \265\213\004\000\000\213\004\000 [130] 00 00 00 0D 4C 55 49 4E 53 54 41 4C 4C 2E 4C 4F \000\000\000\015LUIN STALL.LO [140] 47 00 29 02 00 00 69 32 FC 4C 69 32 00 00 69 32 G\000)\002\000\000i2 \374Li2\000\000i2 [150] FD 4C C1 08 00 00 C1 08 00 00 20 00 10 52 65 67 \375L\301\010\000\000\301\010 \000\000 \000\020Reg [160] 20 53 61 76 65 20 4C 6F 67 2E 74 78 74 00 2C 02 Save Lo g.txt\000,\002 [170] 00 00 62 31 53 63 83 31 00 00 62 31 54 63 00 1E \000\000b1Sc\2031 \000\000b1Tc\000\036 [180] 01 00 00 1E 01 00 00 00 0B 53 54 36 55 4E 53 54 \001\000\000\036\001\000\000\000 \013ST6UNST [190] 2E 45 58 45 00 2D 02 00 00 05 31 29 79 76 32 00 .EXE\000-\002\000 \000\0051)yv2\000 [1A0] 00 58 32 37 B2 97 31 00 00 97 31 00 00 20 00 07 \000X27\262\2271\000 \000\2271\000\000 \000\007 [1B0] 57 49 4E 2E 49 4E 49 00 2E 02 00 00 63 2E 10 4B WIN.INI\000 .\002\000\000c.\020K [1C0] 69 32 00 00 63 2E 10 4B 00 84 00 00 00 84 00 00 i2\000\000c.\020K \000\204\000\000\000\204\000\000 [1D0] 20 00 0C 69 65 75 6E 69 6E 73 74 2E 65 78 65 00 \000\014ieuni nst.exe\000 [1E0] 31 02 00 00 71 2D 8B 65 69 32 00 00 69 32 0C 4D 1\002\000\000q-\213e i2\000\000i2\014M [1F0] 0B 6C 01 00 0B 6C 01 00 20 00 12 57 69 6E 64 6F \013l\001\000\013l\001\000 \000\022Windo [200] 77 73 20 55 70 64 61 74 65 2E 6C 6F 67 00 34 02 ws Updat e.log\0004\002 [210] 00 00 13 2F 98 03 83 31 00 00 13 2F AC 04 56 70 \000\000\023/\230\003\2031 \000\000\023/\254\004Vp [220] 01 00 56 70 01 00 00 00 0B 44 69 72 65 63 74 58 \001\000Vp\001\000\000\000 \013DirectX [230] 2E 6C 6F 67 00 36 02 00 00 98 2D CE 06 94 31 00 .log\0006\002\000 \000\230-\316\006\2241\000 [240] 00 98 2D 69 03 00 C8 02 00 00 C8 02 00 00 00 0C \000\230-i\003\000\310\002 \000\000\310\002\000\000\000\014 [250] 70 61 74 63 68 77 33 32 2E 64 6C 6C 00 38 02 00 patchw32 .dll\0008\002\000 [260] 00 05 31 25 79 83 31 00 00 AA 2A 85 69 00 36 00 \000\0051%y\2031\000 \000\252*\205i\0006\000 [270] 00 00 36 00 00 00 00 1B 4D 53 44 55 4E 20 31 2E \000\0006\000\000\000\000\033 MSDUN 1. [280] 34 20 52 65 6C 65 61 73 65 20 4E 6F 74 65 73 2E 4 Releas e Notes. [290] 64 6F 63 00 3C 02 00 00 05 31 25 79 83 31 00 00 doc\000<\002\000\000 \0051%y\2031\000\000 [2A0] AA 2A 85 69 90 2E 00 00 90 2E 00 00 00 00 1F 4D \252*\205i\220.\000\000 \220.\000\000\000\000\037M [2B0] 53 44 55 4E 20 31 2E 34 20 4C 69 63 65 6E 73 65 SDUN 1.4 License [2C0] 20 41 67 72 65 65 6D 65 6E 74 2E 74 78 74 00 40 Agreeme nt.txt\000@ [2D0] 02 00 00 C7 30 49 5F 83 31 00 00 C7 30 4A 5F 37 \002\000\000\3070I_\203 1\000\000\3070J_7 [2E0] 00 00 00 37 00 00 00 00 00 07 76 69 77 2E 69 6E \000\000\0007\000\000\000\000 \000\007viw.in [2F0] 69 00 42 02 00 00 62 31 56 63 83 31 00 00 62 31 i\000B\002\000\000b1 Vc\2031\000\000b1 [300] 57 63 00 60 04 00 00 60 04 00 00 00 0A 53 65 74 Wc\000`\004\000\000` \004\000\000\000\012Set [310] 75 70 31 2E 65 78 65 00 44 02 00 00 0E 2F F9 B2 up1.exe\000 D\002\000\000\016/\371\262 [320] 0E 2F 00 00 0E 2F FA B2 00 00 00 00 00 00 00 00 \016/\000\000\016/\372\262 \000\000\000\000\000\000\000\000 [330] 10 00 08 54 77 61 69 6E 5F 33 32 00 46 02 00 00 \020\000\010Twain _32\000F\002\000\000 [340] 1D 2D F3 38 83 31 00 00 1D 2D F3 38 F7 44 00 00 \035-\3638\2031\000\000 \035-\3638\367D\000\000 [350] F7 44 00 00 00 00 0C 69 65 78 74 72 61 63 74 2E \367D\000\000\000\000\014i extract. [360] 65 78 65 00 48 02 00 00 36 31 81 B2 83 31 00 00 exe\000H\002\000\000 61\201\262\2031\000\000 [370] 56 30 96 B6 6B 70 00 00 6B 70 00 00 00 00 09 6A V0\226\266kp\000\000 kp\000\000\000\000\011j [380] 61 76 61 77 2E 65 78 65 00 4B 02 00 00 E5 30 72 avaw.exe \000K\002\000\000\3450r [390] 81 83 31 00 00 E5 30 73 81 E0 D4 04 00 E0 D4 04 \201\2031\000\000\3450s \201\340\324\004\000\340\324\004 [3A0] 00 00 00 0C 57 4D 53 79 73 50 72 39 2E 70 72 78 \000\000\000\014WMSy sPr9.prx [3B0] 00 4D 02 00 00 63 2E 10 4B 83 31 00 00 63 2E 10 \000M\002\000\000c.\020 K\2031\000\000c.\020 [3C0] 4B 00 84 00 00 00 84 00 00 00 00 0B 51 33 33 30 K\000\204\000\000\000\204\000 \000\000\000\013Q330 [3D0] 39 39 34 2E 65 78 65 00 4F 02 00 00 95 30 D7 94 994.exe\000 O\002\000\000\2250\327\224 [3E0] 83 31 00 00 8E 29 99 AE 9A 84 01 00 9A 84 01 00 \2031\000\000\216)\231\256 \232\204\001\000\232\204\001\000 [3F0] 00 00 08 5F 64 65 74 6D 70 2E 33 00 51 02 00 00 \000\000\010_detm p.3\000Q\002\000\000 [400] 95 30 D7 94 83 31 00 00 F2 28 1D 57 00 A0 00 00 \2250\327\224\2031\000\000 \362(\035W\000\240\000\000 [410] 00 A0 00 00 00 00 08 5F 64 65 74 6D 70 2E 34 00 \000\240\000\000\000\000\010_ detmp.4\000 [420] 53 02 00 00 8C 31 E8 98 8C 31 00 00 8C 31 20 9D S\002\000\000\2141\350\230 \2141\000\000\2141 \235 [430] 1E 00 00 00 1E 00 00 00 00 00 0A 64 6C 6D 67 72 \036\000\000\000\036\000\000\000 \000\000\012dlmgr [440] 5F 2E 70 72 6F 00 57 02 00 00 E5 30 91 81 83 31 _.pro\000W\002 \000\000\3450\221\201\2031 [450] 00 00 E5 30 92 81 00 E0 00 00 00 E0 00 00 00 00 \000\000\3450\222\201\000\340 \000\000\000\340\000\000\000\000 [460] 09 75 6E 65 6E 67 2E 65 78 65 00 59 02 00 00 D2 \011uneng.e xe\000Y\002\000\000\322 [470] 30 19 75 83 31 00 00 D2 30 19 75 00 82 00 00 00 0\031u\2031\000\000\322 0\031u\000\202\000\000\000 [480] 82 00 00 00 00 0B 6D 75 6E 69 6E 73 74 2E 65 78 \202\000\000\000\000\013mu ninst.ex [490] 65 00 5B 02 00 00 E5 30 78 81 83 31 00 00 E5 30 e\000[\002\000\000\3450 x\201\2031\000\000\3450 [4A0] 78 81 00 00 0B 00 00 00 0B 00 03 00 14 44 65 66 x\201\000\000\013\000\000\000 \013\000\003\000\024Def [4B0] 61 75 6C 74 53 74 6F 72 65 5F 35 39 52 2E 62 69 aultStor e_59R.bi [4C0] 6E 00 5E 02 00 00 E5 30 7A 81 83 31 00 00 E5 30 n\000^\002\000\000\3450 z\201\2031\000\000\3450 [4D0] 7A 81 00 00 10 00 00 00 10 00 03 00 19 55 73 65 z\201\000\000\020\000\000\000 \020\000\003\000\031Use [4E0] 72 4D 69 67 72 61 74 65 64 53 74 6F 72 65 5F 35 rMigrate dStore_5 [4F0] 39 52 2E 62 69 6E 00 61 02 00 00 05 31 57 5E 05 9R.bin\000a \002\000\000\0051W^\005 [500] 31 00 00 05 31 58 5E 00 00 00 00 00 00 00 00 10 1\000\000\0051X^\000 \000\000\000\000\000\000\000\020 [510] 00 1A 57 69 6E 64 6F 77 73 20 55 70 64 61 74 65 \000\032Window s Update [520] 20 53 65 74 75 70 20 46 69 6C 65 73 00 64 02 00 Setup F iles\000d\002\000 [530] 00 1D 2D F3 38 83 31 00 00 1D 2D F3 38 00 36 01 \000\035-\3638\2031\000 \000\035-\3638\0006\001 [540] 00 00 36 01 00 00 00 0B 65 78 74 72 61 63 74 2E \000\0006\001\000\000\000\013 extract. [550] 65 78 65 00 66 02 00 00 66 2F D6 89 83 31 00 00 exe\000f\002\000\000 f/\326\211\2031\000\000 [560] 66 2F D6 89 00 84 00 00 00 00 00 00 00 00 00 00 f/\326\211\000\204\000\000 \000\000\000\000\000\000\000\000 [570] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [580] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [590] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [5F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [600] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [610] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [620] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [630] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [640] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [650] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [660] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [670] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [680] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000 [690] 00 00 00 00 00 00 \000\000\000\000\000\000 (DF) (ttl 128, id 7648, len 1492) 0x0000 4500 05d4 1de0 4000 8006 53d4 c0a8 010d E.....@...S..... 0x0010 c0a8 0112 008b 83fd 0494 3df8 2163 2b02 ..........=.!c+. 0x0020 5010 f685 1aa4 0000 0000 06d6 ff53 4d42 P............SMB 0x0030 3200 0000 0088 0100 0000 0000 0000 0000 2............... 0x0040 0000 0000 03f8 3d45 0000 0100 0a08 0096 ......=E........ 0x0050 0600 0008 0037 0000 0096 0640 0000 0000 .....7.....@.... 0x0060 009f 0629 0001 0000 0002 0019 0000 0000 ...)............ 0x0070 582b 928d 8331 0000 582b 928d 0016 0100 X+...1..X+...... 0x0080 0016 0100 0000 0b77 7570 646d 6772 2e65 .......wupdmgr.e 0x0090 7865 001b 0200 00a5 2c3b b983 3100 00a5 xe......,;..1... 0x00a0 2c82 b985 0307 0085 0307 0000 000d 486f ,.............Ho 0x00b0 6d65 5369 7465 352e 6c6f 6700 1d02 0000 meSite5.log..... 0x00c0 712d f565 712d 0000 712d f665 0000 0000 q-.eq-..q-.e.... 0x00d0 0000 0000 1200 0c6d 7364 6f77 6e6c 642e .......msdownld. 0x00e0 746d 7000 1f02 0000 a52c 0abe 9c31 0000 tmp......,...1.. 0x00f0 9c31 f1a9 0300 0000 0300 0000 0000 0c54 .1.............T 0x0100 7761 696e 3030 312e 4d74 7800 2102 0000 wain001.Mtx.!... 0x0110 a52c 42b8 8331 0000 a52c 42b8 9296 0400 .,B..1...,B..... 0x0120 9296 0400 0000 0d48 6f6d 6553 6974 6535 .......HomeSite5 0x0130 2e30 3030 0023 0200 00a5 2c3b b983 3100 .000.#....,;..1. 0x0140 00a5 2c3b b90a 8904 000a 8904 0000 000d ..,;............ 0x0150 486f 6d65 5369 7465 352e 3030 3100 2502 HomeSite5.001.%. 0x0160 0000 a52c 71b9 8331 0000 aa2a 61af 0008 ...,q..1...*a... 0x0170 0100 0008 0100 0000 0b75 6e6c 6974 6532 .........unlite2 0x0180 2e65 7865 0027 0200 005b 2dda b583 3100 .exe.'...[-...1. 0x0190 005b 2ddc b58b 0400 008b 0400 0000 000d .[-............. 0x01a0 4c55 494e 5354 414c 4c2e 4c4f 4700 2902 LUINSTALL.LOG.). 0x01b0 0000 6932 fc4c 6932 0000 6932 fd4c c108 ..i2.Li2..i2.L.. 0x01c0 0000 c108 0000 2000 1052 6567 2053 6176 .........Reg.Sav 0x01d0 6520 4c6f 672e 7478 7400 2c02 0000 6231 e.Log.txt.,...b1 0x01e0 5363 8331 0000 6231 5463 001e 0100 001e Sc.1..b1Tc...... 0x01f0 0100 0000 0b53 5436 554e 5354 2e45 5845 .....ST6UNST.EXE 0x0200 002d 0200 0005 3129 7976 3200 0058 3237 .-....1)yv2..X27 0x0210 b297 3100 0097 3100 0020 0007 5749 4e2e ..1...1.....WIN. 0x0220 494e 4900 2e02 0000 632e 104b 6932 0000 INI.....c..Ki2.. 0x0230 632e 104b 0084 0000 0084 0000 2000 0c69 c..K...........i 0x0240 6575 6e69 6e73 742e 6578 6500 3102 0000 euninst.exe.1... 0x0250 712d 8b65 6932 0000 6932 0c4d 0b6c 0100 q-.ei2..i2.M.l.. 0x0260 0b6c 0100 2000 1257 696e 646f 7773 2055 .l.....Windows.U 0x0270 7064 6174 652e 6c6f 6700 3402 0000 132f pdate.log.4..../ 0x0280 9803 8331 0000 132f ac04 5670 0100 5670 ...1.../..Vp..Vp 0x0290 0100 0000 0b44 6972 6563 7458 2e6c 6f67 .....DirectX.log 0x02a0 0036 0200 0098 2dce 0694 3100 0098 2d69 .6....-...1...-i 0x02b0 0300 c802 0000 c802 0000 000c 7061 7463 ............patc 0x02c0 6877 3332 2e64 6c6c 0038 0200 0005 3125 hw32.dll.8....1% 0x02d0 7983 3100 00aa 2a85 6900 3600 0000 3600 y.1...*.i.6...6. 0x02e0 0000 001b 4d53 4455 4e20 312e 3420 5265 ....MSDUN.1.4.Re 0x02f0 6c65 6173 6520 4e6f 7465 732e 646f 6300 lease.Notes.doc. 0x0300 3c02 0000 0531 2579 8331 0000 aa2a 8569 <....1%y.1...*.i 0x0310 902e 0000 902e 0000 0000 1f4d 5344 554e ...........MSDUN 0x0320 2031 2e34 204c 6963 656e 7365 2041 6772 .1.4.License.Agr 0x0330 6565 6d65 6e74 2e74 7874 0040 0200 00c7 eement.txt.@.... 0x0340 3049 5f83 3100 00c7 304a 5f37 0000 0037 0I_.1...0J_7...7 0x0350 0000 0000 0007 7669 772e 696e 6900 4202 ......viw.ini.B. 0x0360 0000 6231 5663 8331 0000 6231 5763 0060 ..b1Vc.1..b1Wc.` 0x0370 0400 0060 0400 0000 0a53 6574 7570 312e ...`.....Setup1. 0x0380 6578 6500 4402 0000 0e2f f9b2 0e2f 0000 exe.D..../.../.. 0x0390 0e2f fab2 0000 0000 0000 0000 1000 0854 ./.............T 0x03a0 7761 696e 5f33 3200 4602 0000 1d2d f338 wain_32.F....-.8 0x03b0 8331 0000 1d2d f338 f744 0000 f744 0000 .1...-.8.D...D.. 0x03c0 0000 0c69 6578 7472 6163 742e 6578 6500 ...iextract.exe. 0x03d0 4802 0000 3631 81b2 8331 0000 5630 96b6 H...61...1..V0.. 0x03e0 6b70 0000 6b70 0000 0000 096a 6176 6177 kp..kp.....javaw 0x03f0 2e65 7865 004b 0200 00e5 3072 8183 3100 .exe.K....0r..1. 0x0400 00e5 3073 81e0 d404 00e0 d404 0000 000c ..0s............ 0x0410 574d 5379 7350 7239 2e70 7278 004d 0200 WMSysPr9.prx.M.. 0x0420 0063 2e10 4b83 3100 0063 2e10 4b00 8400 .c..K.1..c..K... 0x0430 0000 8400 0000 000b 5133 3330 3939 342e ........Q330994. 0x0440 6578 6500 4f02 0000 9530 d794 8331 0000 exe.O....0...1.. 0x0450 8e29 99ae 9a84 0100 9a84 0100 0000 085f .)............._ 0x0460 6465 746d 702e 3300 5102 0000 9530 d794 detmp.3.Q....0.. 0x0470 8331 0000 f228 1d57 00a0 0000 00a0 0000 .1...(.W........ 0x0480 0000 085f 6465 746d 702e 3400 5302 0000 ..._detmp.4.S... 0x0490 8c31 e898 8c31 0000 8c31 209d 1e00 0000 .1...1...1...... 0x04a0 1e00 0000 0000 0a64 6c6d 6772 5f2e 7072 .......dlmgr_.pr 0x04b0 6f00 5702 0000 e530 9181 8331 0000 e530 o.W....0...1...0 0x04c0 9281 00e0 0000 00e0 0000 0000 0975 6e65 .............une 0x04d0 6e67 2e65 7865 0059 0200 00d2 3019 7583 ng.exe.Y....0.u. 0x04e0 3100 00d2 3019 7500 8200 0000 8200 0000 1...0.u......... 0x04f0 000b 6d75 6e69 6e73 742e 6578 6500 5b02 ..muninst.exe.[. 0x0500 0000 e530 7881 8331 0000 e530 7881 0000 ...0x..1...0x... 0x0510 0b00 0000 0b00 0300 1444 6566 6175 6c74 .........Default 0x0520 5374 6f72 655f 3539 522e 6269 6e00 5e02 Store_59R.bin.^. 0x0530 0000 e530 7a81 8331 0000 e530 7a81 0000 ...0z..1...0z... 0x0540 1000 0000 1000 0300 1955 7365 724d 6967 .........UserMig 0x0550 7261 7465 6453 746f 7265 5f35 3952 2e62 ratedStore_59R.b 0x0560 696e 0061 0200 0005 3157 5e05 3100 0005 in.a....1W^.1... 0x0570 3158 5e00 0000 0000 0000 0010 001a 5769 1X^...........Wi 0x0580 6e64 6f77 7320 5570 6461 7465 2053 6574 ndows.Update.Set 0x0590 7570 2046 696c 6573 0064 0200 001d 2df3 up.Files.d....-. 0x05a0 3883 3100 001d 2df3 3800 3601 0000 3601 8.1...-.8.6...6. 0x05b0 0000 000b 6578 7472 6163 742e 6578 6500 ....extract.exe. 0x05c0 6602 0000 662f d689 8331 0000 662f d689 f...f/...1..f/.. 0x05d0 0084 0000 .... 17:11:59.572822 192.168.1.13.netbios-ssn > 192.168.1.18.33789: P [tcp sum ok] 16276:16578(302) ack 619 win 63109 >>> NBT Packet NBT Session Packet Flags=0x84 Length=0 (0x0) Session packet:(raw data?) (DF) (ttl 128, id 7904, len 342) 0x0000 4500 0156 1ee0 4000 8006 5752 c0a8 010d E..V..@...WR.... 0x0010 c0a8 0112 008b 83fd 0494 43a4 2163 2b02 ..........C.!c+. 0x0020 5018 f685 ddfd 0000 0084 0000 0000 0d76 P..............v 0x0030 6778 756e 696e 7374 2e65 7865 0068 0200 gxuninst.exe.h.. 0x0040 0005 3179 7a83 3100 0005 3166 81d8 a600 ..1yz.1...1f.... 0x0050 00d8 a600 0000 000a 7070 706c 6f67 2e74 ........ppplog.t 0x0060 7874 006a 0200 0005 3113 8775 3200 002e xt.j....1..u2... 0x0070 3101 58a7 d814 00a7 d814 0002 000e 5368 1.X...........Sh 0x0080 656c 6c49 636f 6e43 6163 6865 006d 0200 ellIconCache.m.. 0x0090 0036 31ce 9336 3100 0036 31cf 9300 0000 .61..61..61..... 0x00a0 0000 0000 0010 0003 5375 6e00 6f02 0000 ........Sun.o... 0x00b0 4d31 017e 8331 0000 6a31 b4bb 760f 0000 M1.~.1..j1..v... 0x00c0 760f 0000 0000 0a6d 6f7a 7665 722e 6461 v......mozver.da 0x00d0 7400 7102 0000 6a31 bcbb 8331 0000 6a31 t.q...j1...1..j1 0x00e0 bdbb 7b88 0100 7b88 0100 0000 1455 6e69 ..{...{......Uni 0x00f0 6e73 7461 6c6c 4669 7265 666f 782e 6578 nstallFirefox.ex 0x0100 6500 7402 0000 6631 a0b2 8331 0000 6631 e.t...f1...1..f1 0x0110 a1b2 0000 0000 0000 0000 0000 1051 5549 .............QUI 0x0120 434b 494e 5354 414c 4c2e 494e 4900 7702 CKINSTALL.INI.w. 0x0130 0000 6f31 4d64 5832 0000 6f31 5164 4006 ..o1MdX2..o1Qd@. 0x0140 0000 4006 0000 0000 0c77 6678 6472 7630 ..@......wfxdrv0 0x0150 302e 746d 7000 0.tmp. 17:11:59.572825 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: . [tcp sum ok] 619:619(0) ack 16578 win 37752 (DF) (ttl 64, id 36142, len 40) 0x0000 4500 0028 8d2e 4000 4006 2a32 c0a8 0112 E..(..@.@.*2.... 0x0010 c0a8 010d 83fd 008b 2163 2b02 0494 44d2 ........!c+...D. 0x0020 5010 9378 7e98 0000 P..x~... 17:11:59.580668 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: P [tcp sum ok] 619:658(39) ack 16578 win 37752 >>> NBT Packet NBT Session Packet Flags=0x0 Length=35 (0x23) SMB PACKET: SMBdskattr (REQUEST) SMB Command = 0x80 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x8 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 0 (0x0) smb_bcc=0 (DF) (ttl 64, id 36143, len 79) 0x0000 4500 004f 8d2f 4000 4006 2a0a c0a8 0112 E..O./@.@.*..... 0x0010 c0a8 010d 83fd 008b 2163 2b02 0494 44d2 ........!c+...D. 0x0020 5018 9378 6e6a 0000 0000 0023 ff53 4d42 P..xnj.....#.SMB 0x0030 8000 0000 0008 0100 0000 0000 0000 0000 ................ 0x0040 0000 0000 03f8 3d45 0000 0100 0000 00 ......=E....... 17:11:59.580956 192.168.1.13.netbios-ssn > 192.168.1.18.33789: P [tcp sum ok] 16578:16627(49) ack 658 win 63070 >>> NBT Packet NBT Session Packet Flags=0x0 Length=45 (0x2d) SMB PACKET: SMBdskattr (REPLY) SMB Command = 0x80 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x88 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 5 (0x5) smbvwv[]= TotalUnits=38117 (0x94e5) BlocksPerUnit=2048 (0x800) BlockSize=512 (0x200) FreeUnits=25964 (0x656c) Media=0x0 smb_bcc=0 (DF) (ttl 128, id 8160, len 89) 0x0000 4500 0059 1fe0 4000 8006 574f c0a8 010d E..Y..@...WO.... 0x0010 c0a8 0112 008b 83fd 0494 44d2 2163 2b29 ..........D.!c+) 0x0020 5018 f65e 0177 0000 0000 002d ff53 4d42 P..^.w.....-.SMB 0x0030 8000 0000 0088 0100 0000 0000 0000 0000 ................ 0x0040 0000 0000 03f8 3d45 0000 0100 05e5 9400 ......=E........ 0x0050 0800 026c 6500 0000 00 ...le.... 17:11:59.618982 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: . [tcp sum ok] 658:658(0) ack 16627 win 37752 (DF) (ttl 64, id 36144, len 40) 0x0000 4500 0028 8d30 4000 4006 2a30 c0a8 0112 E..(.0@.@.*0.... 0x0010 c0a8 010d 83fd 008b 2163 2b29 0494 4503 ........!c+)..E. 0x0020 5010 9378 7e40 0000 P..x~@.. 17:12:01.078962 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: P [tcp sum ok] 658:700(42) ack 16627 win 37752 >>> NBT Packet NBT Session Packet Flags=0x0 Length=38 (0x26) SMB PACKET: SMBchkpth (REQUEST) SMB Command = 0x10 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x8 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 0 (0x0) smbbuf[]= Path=\ (DF) (ttl 64, id 36145, len 82) 0x0000 4500 0052 8d31 4000 4006 2a05 c0a8 0112 E..R.1@.@.*..... 0x0010 c0a8 010d 83fd 008b 2163 2b29 0494 4503 ........!c+)..E. 0x0020 5018 9378 8205 0000 0000 0026 ff53 4d42 P..x.......&.SMB 0x0030 1000 0000 0008 0100 0000 0000 0000 0000 ................ 0x0040 0000 0000 03f8 3d45 0000 0100 0003 0004 ......=E........ 0x0050 5c00 \. 17:12:01.079270 192.168.1.13.netbios-ssn > 192.168.1.18.33789: P [tcp sum ok] 16627:16666(39) ack 700 win 63028 >>> NBT Packet NBT Session Packet Flags=0x0 Length=35 (0x23) SMB PACKET: SMBchkpth (REPLY) SMB Command = 0x10 Error class = 0x0 Error code = 0 (0x0) Flags1 = 0x88 Flags2 = 0x1 Tree ID = 63491 (0xf803) Proc ID = 17725 (0x453d) UID = 0 (0x0) MID = 1 (0x1) Word Count = 0 (0x0) smb_bcc=0 (DF) (ttl 128, id 8416, len 79) 0x0000 4500 004f 20e0 4000 8006 5659 c0a8 010d E..O..@...VY.... 0x0010 c0a8 0112 008b 83fd 0494 4503 2163 2b53 ..........E.!c+S 0x0020 5018 f634 7aac 0000 0000 0023 ff53 4d42 P..4z......#.SMB 0x0030 1000 0000 0088 0100 0000 0000 0000 0000 ................ 0x0040 0000 0000 03f8 3d45 0000 0100 0000 00 ......=E....... 17:12:01.079277 192.168.1.18.33789 > 192.168.1.13.netbios-ssn: . [tcp sum ok] 700:700(0) ack 16666 win 37752 (DF) (ttl 64, id 36146, len 40) 0x0000 4500 0028 8d32 4000 4006 2a2e c0a8 0112 E..(.2@.@.*..... 0x0010 c0a8 010d 83fd 008b 2163 2b53 0494 452a ........!c+S..E* 0x0020 5010 9378 7def 0000 P..x}...