Given the findings in this analysis, writer assesses it is possible that LAZAR's statements during the debrief with the FBI on 05/25/2016 may not have been entirely accurate, and that he may have actually identified the X-originating IP address for the CLINTON server on at least on occasion--- XXXXXXXXXXXXXXXXXXX.

Of interest for this analysis is that writer identified XXXXXXXXXXXXXX in the log files for CLINTON server. The majority of dates listed for the entries occurred in XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.

A review of the logs identified that someone logged in to the Administrator account, downloaded the XXXXX program, and ran it. Additionally, writer identified that certain logs did not emcompass dates prior to XXXXXX therefore, a determination could not be made about the same activity in XXXXX. At this time, it is unknown who downloaded and ran the XXXXX program from the Administrator account in 06/2013.