Edit tour

Windows Analysis Report
https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip

Overview

General Information

Sample URL:	https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip
Analysis ID:	597349
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

DLL side loading technique detected

Sigma detected: Suspicious Call by Ordinal

Queries the volume information (name, serial number etc) of a device

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

AV process strings found (often used to terminate AV products)

Extensive use of GetProcAddress (often used to hide API calls)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Checks if the current process is being debugged

Found large amount of non-executed APIs

Sigma detected: Windows Suspicious Use Of Web Request in CommandLine

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64native

cmd.exe (PID: 4880 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip" > cmdline.out 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

wget.exe (PID: 3076 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)

7za.exe (PID: 2648 cmdline: 7za x -y -pinfected -o"C:\Users\user\Desktop\extract" "C:\Users\user\Desktop\download\ComparePlugin_v2.0.2_X64.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

loaddll64.exe (PID: 7556 cmdline: loaddll64.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll" MD5: 4E8A40CAD6CCC047914E3A7830A2D8AA)

cmd.exe (PID: 1604 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 1224 cmdline: rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 3148 cmdline: C:\Windows\system32\WerFault.exe -u -p 1224 -s 432 MD5: 5C06542FED8EE68994D43938E7326D75)

rundll32.exe (PID: 3196 cmdline: rundll32.exe C:\Users\user\Desktop\extract\ComparePlugin.dll,beNotified MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 4104 cmdline: C:\Windows\system32\WerFault.exe -u -p 3196 -s 436 MD5: 5C06542FED8EE68994D43938E7326D75)

rundll32.exe (PID: 3404 cmdline: rundll32.exe C:\Users\user\Desktop\extract\ComparePlugin.dll,getFuncsArray MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7720 cmdline: C:\Windows\system32\WerFault.exe -u -p 3404 -s 432 MD5: 5C06542FED8EE68994D43938E7326D75)

rundll32.exe (PID: 4776 cmdline: rundll32.exe C:\Users\user\Desktop\extract\ComparePlugin.dll,getName MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 372 cmdline: rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",beNotified MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 3148 cmdline: C:\Windows\system32\WerFault.exe -u -p 372 -s 428 MD5: 5C06542FED8EE68994D43938E7326D75)

rundll32.exe (PID: 428 cmdline: rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",getFuncsArray MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 3344 cmdline: C:\Windows\system32\WerFault.exe -u -p 428 -s 424 MD5: 5C06542FED8EE68994D43938E7326D75)

rundll32.exe (PID: 6664 cmdline: rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",getName MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3644 cmdline: rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",isUnicode MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6640 cmdline: rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",messageProc MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Call by Ordinal

Source: Process started

Author: Florian Roth: Data: Command: rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",#1, CommandLine: rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",#1, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1604, ParentProcessName: cmd.exe, ProcessCommandLine: rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",#1, ProcessId: 1224, ProcessName: rundll32.exe

Source: Process started

Author: James Pemberton / @4A616D6573: Data: Command: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip" , CommandLine: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wget.exe, NewProcessName: C:\Windows\SysWOW64\wget.exe, OriginalFileName: C:\Windows\SysWOW64\wget.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip" > cmdline.out 2>&1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4880, ParentProcessName: cmd.exe, ProcessCommandLine: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip" , ProcessId: 3076, ProcessName: wget.exe

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.11.20:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.11.20:49751 version: TLS 1.2

Source:	Binary string: C:\projects\compare-plugin\Notepad++\plugins\ComparePlugin.pdb source: rundll32.exe, 00000008.00000002.53133614574.00007FFBBDCAC000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000009.00000000.53107375345.00007FFBBDCAC000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000010.00000002.53160095731.00007FFBBDCAC000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000015.00000000.53198315997.00007FFBBDCAC000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000016.00000000.53197555059.00007FFBBDCAC000.00000002.00000001.01000000.00000004.sdmp, ComparePlugin.dll.4.dr
Source:	Binary string: c:\dev\sqlite\core\sqlite3.pdb source: sqlite3.dll.4.dr

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFBBDCA3784 FindFirstFileExA,

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: wget.exe, 00000002.00000002.53072409006.0000000002DED000.00000004.00000800.00020000.00000000.sdmp, wget.exe, 00000002.00000002.53071734243.0000000000A67000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.53070031005.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: wget.exe, wget.exe, 00000002.00000002.53072409006.0000000002DED000.00000004.00000800.00020000.00000000.sdmp, wget.exe, 00000002.00000003.53070031005.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: wget.exe, 00000002.00000002.53072409006.0000000002DED000.00000004.00000800.00020000.00000000.sdmp, wget.exe, 00000002.00000002.53071734243.0000000000A67000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.53070031005.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: wget.exe, 00000002.00000002.53072409006.0000000002DED000.00000004.00000800.00020000.00000000.sdmp, wget.exe, 00000002.00000003.53070031005.0000000002DEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crlJ
Source: git2.dll.4.dr	String found in binary or memory: http://libgit2.github.com/D
Source: Amcache.hve.LOG1.18.dr, Amcache.hve.18.dr	String found in binary or memory: http://upx.sf.net
Source: 7za.exe, 00000004.00000003.53082213532.0000000003240000.00000004.00000800.00020000.00000000.sdmp, sqlite3.dll.4.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: rundll32.exe, 00000008.00000002.53133927537.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000009.00000002.53134812123.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000010.00000000.53134991199.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000015.00000002.53225101572.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000016.00000000.53197852442.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, ComparePlugin.dll.4.dr	String found in binary or memory: https://github.com/jsleroy/compare-plugin
Source: rundll32.exe, 00000008.00000002.53133927537.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000009.00000002.53134812123.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000010.00000000.53134991199.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000015.00000002.53225101572.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000016.00000000.53197852442.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, ComparePlugin.dll.4.dr	String found in binary or memory: https://github.com/pnedev/compare-plugin
Source: wget.exe, wget.exe, 00000002.00000002.53071734243.0000000000A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugi
Source: wget.exe, 00000002.00000002.53071396618.0000000000190000.00000004.00000020.00020000.00000000.sdmp, cmdline.out.0.dr	String found in binary or memory: https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip
Source: wget.exe, 00000002.00000002.53072228538.0000000001410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip_5
Source: wget.exe, 00000002.00000002.53072228538.0000000001410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zipneDriv
Source: cmdline.out.0.dr	String found in binary or memory: https://objects.githubusercontent.com/github-production-release-asset-2e65be/50095301/f0aad92b-ebf9-

Source: unknown

DNS traffic detected: queries for: github.com

Source: global traffic	HTTP traffic detected: GET /pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: /Accept-Encoding: identityHost: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/50095301/f0aad92b-ebf9-49d7-8eb8-da1dde346952?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20220325%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220325T191320Z&X-Amz-Expires=300&X-Amz-Signature=5053414ddd70e50734eacb002da0a5ed0adb35bb4bd3c967d01196cf1c48f106&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=50095301&response-content-disposition=attachment%3B%20filename%3DComparePlugin_v2.0.2_X64.zip&response-content-type=application%2Foctet-stream HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: /Accept-Encoding: identityHost: objects.githubusercontent.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.11.20:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.11.20:49751 version: TLS 1.2

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3196 -s 436

Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC94E30
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC825E0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC8FE10
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC945B0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC9FDA4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC905A0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDCA3578
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC91580
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDCAB4D3
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC83CC0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC894C0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC82890
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDCAA098
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDCAA890
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC90880
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC88800
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC81FA0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDCA5760
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC8DF80
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC89720
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDCAAEFC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC94280
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC861F0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC8A9D0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDCAB170
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC9D910
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC860C0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC920C0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDCA5C30
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC89C30
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC823D0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC87B90
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC9DB8C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC88330
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC8F350
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC8AB00
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC8FAA0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC90AD0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC8E2D0

Source: ComparePlugin.dll.4.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ComparePlugin.dll.4.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ComparePlugin.dll.4.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ComparePlugin.dll.4.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ComparePlugin.dll.4.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ComparePlugin.dll.4.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ComparePlugin.dll.4.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ComparePlugin.dll.4.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ComparePlugin.dll.4.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ComparePlugin.dll.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\SysWOW64\wget.exe	Section loaded: edgegdi.dll
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\loaddll64.exe	Section loaded: edgegdi.dll

Source: C:\Windows\SysWOW64\wget.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip"
Source: unknown	Process created: C:\Windows\SysWOW64\7za.exe 7za x -y -pinfected -o"C:\Users\user\Desktop\extract" "C:\Users\user\Desktop\download\ComparePlugin_v2.0.2_X64.zip"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\extract\ComparePlugin.dll,beNotified
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3196 -s 436
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1224 -s 432
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\extract\ComparePlugin.dll,getFuncsArray
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3404 -s 432
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\extract\ComparePlugin.dll,getName
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",beNotified
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",getFuncsArray
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",getName
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",isUnicode
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",messageProc
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 428 -s 424
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\extract\ComparePlugin.dll,beNotified
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\extract\ComparePlugin.dll,getFuncsArray
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\extract\ComparePlugin.dll,getName
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",beNotified
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",getFuncsArray
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",getName
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",isUnicode
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",messageProc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",#1

Source: C:\Windows\SysWOW64\wget.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\Desktop\cmdline.out

Jump to behavior

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\8cc57867-0d7d-43e4-a6c6-6997b62c56f9

Jump to behavior

Source: classification engine

Classification label: mal48.evad.win@31/28@2/2

Source: sqlite3.dll.4.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: sqlite3.dll.4.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: sqlite3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: rundll32.exe	Binary or memory string: SELECT checksum FROM nodes_current WHERE local_relpath='%s';
Source: sqlite3.dll.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sqlite3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: sqlite3.dll.4.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: sqlite3.dll.4.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: sqlite3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: sqlite3.dll.4.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: sqlite3.dll.4.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\extract\ComparePlugin.dll,beNotified

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3196
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6164:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess372
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3404
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess428
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4152:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6164:304:WilStaging_02
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1224

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFBBDC961D0 FindResourceW,LoadResource,LockResource,SizeofResource,GlobalAlloc,GlobalLock,

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: C:\projects\compare-plugin\Notepad++\plugins\ComparePlugin.pdb source: rundll32.exe, 00000008.00000002.53133614574.00007FFBBDCAC000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000009.00000000.53107375345.00007FFBBDCAC000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000010.00000002.53160095731.00007FFBBDCAC000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000015.00000000.53198315997.00007FFBBDCAC000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000016.00000000.53197555059.00007FFBBDCAC000.00000002.00000001.01000000.00000004.sdmp, ComparePlugin.dll.4.dr
Source:	Binary string: c:\dev\sqlite\core\sqlite3.pdb source: sqlite3.dll.4.dr

Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DF38E0 pushad ; ret
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DECA48 pushad ; retn 0078h
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DECE00 pushfd ; retn 0000h
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_3_02DECC31 pushad ; retn 0078h
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_2_00A68000 push ebx; retf
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_2_00A68E4A push eax; retf
Source: C:\Windows\SysWOW64\wget.exe	Code function: 2_2_02DF38E0 pushad ; ret

Source: sqlite3.dll.4.dr

Static PE information: section name: text

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFBBDC91870 GetModuleHandleW,GetModuleFileNameW,PathRemoveExtensionW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\Desktop\extract\ComparePlugin\sqlite3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\Desktop\extract\ComparePlugin\git2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\Desktop\extract\ComparePlugin.dll	Jump to dropped file

Source: C:\Windows\System32\rundll32.exe

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\loaddll64.exe TID: 6528

Thread sleep time: -120000s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\extract\ComparePlugin\sqlite3.dll			Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\extract\ComparePlugin\git2.dll			Jump to dropped file

Source: C:\Windows\System32\rundll32.exe

API coverage: 0.5 %

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFBBDCA3784 FindFirstFileExA,

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Source: wget.exe, 00000002.00000002.53071734243.0000000000A67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll-
Source: wget.exe	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.18.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFBBDC98F40 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFBBDCA47F4 GetProcessHeap,

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC98F40 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC98270 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00007FFBBDC9C2DC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion

DLL side loading technique detected

Source: C:\Windows\System32\loaddll64.exe	Section loaded: C:\Users\user\Desktop\extract\ComparePlugin.dll
Source: C:\Windows\System32\loaddll64.exe	Section loaded: C:\Users\user\Desktop\extract\ComparePlugin.dll

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",#1

Source: C:\Windows\SysWOW64\wget.exe

Queries volume information: C:\Users\user\Desktop\download VolumeInformation

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFBBDCA9C70 cpuid

Source: C:\Windows\SysWOW64\wget.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\System32\rundll32.exe

Code function: 8_2_00007FFBBDC99090 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Source: Amcache.hve.18.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.18.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.18.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.2107.4-0\msmpeng.exe
Source: Amcache.hve.18.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	11 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	23 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	11 DLL Side-Loading	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip	0%	Virustotal		Browse
https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\Desktop\extract\ComparePlugin.dll	0%	Metadefender	Browse
C:\Users\user\Desktop\extract\ComparePlugin.dll	0%	ReversingLabs
C:\Users\user\Desktop\extract\ComparePlugin\git2.dll	0%	Metadefender	Browse
C:\Users\user\Desktop\extract\ComparePlugin\git2.dll	0%	ReversingLabs
C:\Users\user\Desktop\extract\ComparePlugin\sqlite3.dll	0%	Metadefender	Browse
C:\Users\user\Desktop\extract\ComparePlugin\sqlite3.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://objects.githubusercontent.com/github-production-release-asset-2e65be/50095301/f0aad92b-ebf9-	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
github.com	140.82.121.4	true	false		high
objects.githubusercontent.com	185.199.110.133	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip_5	wget.exe, 00000002.00000002.53072228538.0000000001410000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pnedev/compare-plugin	rundll32.exe, 00000008.00000002.53133927537.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000009.00000002.53134812123.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000010.00000000.53134991199.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000015.00000002.53225101572.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000016.00000000.53197852442.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, ComparePlugin.dll.4.dr	false		high
https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugi	wget.exe, wget.exe, 00000002.00000002.53071734243.0000000000A67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zipneDriv	wget.exe, 00000002.00000002.53072228538.0000000001410000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.LOG1.18.dr, Amcache.hve.18.dr	false		high
https://objects.githubusercontent.com/github-production-release-asset-2e65be/50095301/f0aad92b-ebf9-	cmdline.out.0.dr	false	Avira URL Cloud: safe	unknown
http://libgit2.github.com/D	git2.dll.4.dr	false		high
http://www.sqlite.org/copyright.html.	7za.exe, 00000004.00000003.53082213532.0000000003240000.00000004.00000800.00020000.00000000.sdmp, sqlite3.dll.4.dr	false		high
https://github.com/jsleroy/compare-plugin	rundll32.exe, 00000008.00000002.53133927537.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000009.00000002.53134812123.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000010.00000000.53134991199.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000015.00000002.53225101572.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, rundll32.exe, 00000016.00000000.53197852442.00007FFBBDCC8000.00000002.00000001.01000000.00000004.sdmp, ComparePlugin.dll.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
140.82.121.4	github.com	United States		36459	GITHUBUS	false
185.199.110.133	objects.githubusercontent.com	Netherlands		54113	FASTLYUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	597349
Start date and time:	2022-03-25 19:13:21 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 53s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	urldownload.jbs
Sample URL:	https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.evad.win@31/28@2/2
EGA Information:	Successful, ratio: 50%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WerFault.exe, backgroundTaskHost.exe, svchost.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 20.93.58.141, 20.42.65.92, 20.189.173.21, 20.82.209.183, 20.40.129.122
Excluded domains from analysis (whitelisted): wd-prod-cp-eu-north-3-fe.northeurope.cloudapp.azure.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, wdcp.microsoft.com, wd-prod-cp.trafficmanager.net, arc.msn.com, wdcpalt.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, arc.trafficmanager.net, umwatson.events.data.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, iris-de-prod-azsc-frc.francecentral.cloudapp.azure.com
Execution Graph export aborted for target wget.exe, PID 3076 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
20:15:20	API Interceptor	5x Sleep call for process: WerFault.exe modified
20:15:26	API Interceptor	1x Sleep call for process: loaddll64.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Com_a390959f1f8b5ca1582bdff61f9451e7944f2ec_71036408_399256d0-1930-45f7-b8f8-e5db712531dc\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8276584589052882
Encrypted:	false
SSDEEP:	192:IDDoiSyIV8xmjiqFj0AfuDu76+fAlx8ii:+DoiPIV8gjiqFj0xDu76+fAlx8P
MD5:	FE4DDCAE09649257CF9B34AE2582F0B4
SHA1:	7436C928550783032D4384CA9DCC49B3F668CC94
SHA-256:	FC4DD2EA5DAF30AA344D508367B42D7E13F1D2CDB972A45418D329A0D4A9C288
SHA-512:	D70EA830DCD2AA1960124EFD5D52D6512FDAE3E2860734BEDFAE92072B248FFBABDD84C4000768E7E622CAFD9E4340F301DD5F6E45987A7E9F89DC86850A3B3D
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.9.2.7.1.2.9.2.1.0.6.0.7.5.8.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.9.2.7.1.2.9.2.1.9.0.4.3.1.5.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.9.9.2.5.6.d.0.-.1.9.3.0.-.4.5.f.7.-.b.8.f.8.-.e.5.d.b.7.1.2.5.3.1.d.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.b.0.c.a.3.6.6.-.b.c.4.0.-.4.b.2.7.-.a.1.f.1.-.8.7.e.1.b.7.3.1.2.d.c.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.C.o.m.p.a.r.e.P.l.u.g.i.n...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.4.c.-.0.0.0.1.-.0.0.1.5.-.8.2.7.2.-.0.d.0.d.8.5.4.0.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Com_a390959f1f8b5ca1582bdff61f9451e7944f2ec_71036408_7b33abf3-139a-4117-9db1-e0552caf4048\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8277202917788117
Encrypted:	false
SSDEEP:	192:ETDoiryiV8xmjiqFj0AfuDu76+fAlx8ii:6DoiOiV8gjiqFj0xDu76+fAlx8P
MD5:	30D619F2AD8835534CE7908E0E8067EA
SHA1:	30B230C68A6896EC4E78673CEDAAEC9DA351204F
SHA-256:	C2898E50AB7578CC9431F46289C6FA9C8085E684ED6309913C9573248D1291A5
SHA-512:	285E1E54E790704FB7EC3FF22FB8F3D3D72FD6EA93133FEA3EC6C33B68C5F2D49441BE7F35F292968CB908887628283DC54E7BC435300B5D34A9C4B4D8A75343
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.9.2.7.1.2.9.2.7.3.0.5.0.5.9.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.9.2.7.1.2.9.2.8.5.0.7.8.7.6.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.b.3.3.a.b.f.3.-.1.3.9.a.-.4.1.1.7.-.9.d.b.1.-.e.0.5.5.2.c.a.f.4.0.4.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.9.c.c.c.2.c.3.-.3.d.3.6.-.4.6.9.d.-.8.1.0.f.-.1.0.6.2.a.9.a.a.6.6.3.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.C.o.m.p.a.r.e.P.l.u.g.i.n...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.1.a.c.-.0.0.0.1.-.0.0.1.5.-.b.5.5.8.-.d.a.1.0.8.5.4.0.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Com_cf6dae3a8bcb14daf052b4753019709517e7_71036408_8d113b16-a122-48e1-973a-0e9340f5e74b\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8296528251481353
Encrypted:	false
SSDEEP:	192:ChtoigyXV8wjmKeeakj0AfuDu76+fAlx8ii:gtoitXV8XKeeakj0xDu76+fAlx8P
MD5:	094D80CFB31CE1EDCAF0166BBC542F8C
SHA1:	833C55B863EA2B0F93EBA74D37D270BE1A488085
SHA-256:	66B63B2D2649C10D758D947436CBCDA1A49FF42FB764E2D8B243BF9856AE09F6
SHA-512:	1051887FB2B776E13E65EF8B1290E248510CD9A4E49B71A629B07AE07E4F76D85F4D7660E1F84FAD35ADA8E11A2777276BDD5EC27A5A18A7C132C55E069BE304
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.9.2.7.1.2.9.1.8.3.3.9.5.8.1.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.9.2.7.1.2.9.1.9.6.3.6.2.1.7.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.d.1.1.3.b.1.6.-.a.1.2.2.-.4.8.e.1.-.9.7.3.a.-.0.e.9.3.4.0.f.5.e.7.4.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.f.a.7.b.d.6.e.-.f.7.a.6.-.4.d.f.e.-.b.9.d.e.-.7.d.6.e.0.c.5.e.a.6.f.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.C.o.m.p.a.r.e.P.l.u.g.i.n...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.c.8.-.0.0.0.1.-.0.0.1.5.-.4.e.0.a.-.3.0.0.b.8.5.4.0.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Com_cf6dae3a8bcb14daf052b4753019709517e7_71036408_9c2fb87e-0516-41f9-ad98-9e013c83d1cb\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8309105274717505
Encrypted:	false
SSDEEP:	192:14/TdoimyAV8wjmKeeakj0AfuDu76+fAlx8ii:EoibAV8XKeeakj0xDu76+fAlx8P
MD5:	9F855C2C92D422F01AEB9781081C42C6
SHA1:	CC5C98D63231309DEC9E4C8514B067AD22D177E3
SHA-256:	D622B20390CCBA07E239CEDC2B66C67F6534D41A851A71F65937F981AE303736
SHA-512:	5EFF52510E5F47F1E5F881FD4110B1F9BC4AF765F99B0E581DBD56A8EA5EB82C43AC114A56B4D47DEB4C5E4802315BD96B3B5F1948CA36246703B71CACED7BE7
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.9.2.7.1.2.9.1.8.2.7.1.4.8.4.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.9.2.7.1.2.9.1.9.5.2.1.1.8.0.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.c.2.f.b.8.7.e.-.0.5.1.6.-.4.1.f.9.-.a.d.9.8.-.9.e.0.1.3.c.8.3.d.1.c.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.5.6.5.2.c.3.4.-.c.9.7.b.-.4.f.9.6.-.8.9.e.0.-.4.1.5.0.f.b.3.8.d.b.0.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.C.o.m.p.a.r.e.P.l.u.g.i.n...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.7.c.-.0.0.0.1.-.0.0.1.5.-.7.4.d.4.-.2.d.0.b.8.5.4.0.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Com_cf6dae3a8bcb14daf052b4753019709517e7_71036408_bc772a15-5856-4b2d-aa65-5a0d4f57349d\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8273807072317486
Encrypted:	false
SSDEEP:	192:Tcoi1y1V8wjmKeeakj0APuDu76+fAlx8iiM:ooiQ1V8XKeeakj0xDu76+fAlx8PM
MD5:	7830F95BE67E55793A0D5BE3946A7CC4
SHA1:	D02B8ABCB7B2A8E304272C51B0F6BC38B3645D95
SHA-256:	88060590C363F629EAEF2DFE7B6D8A07BF36FF09D1F96235F767B5BA222558B2
SHA-512:	CBEE56608DA6DE22015DBCC9F78F1649E9F027E7ECD9C6CD3632DDA09533527E3AA68BD382E8E8B7F91F3E93547D0BB9F8760C7DDCDA68A5F516203B69B527F4
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.9.2.7.1.2.9.2.7.2.7.4.2.4.2.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.9.2.7.1.2.9.2.8.4.3.0.2.1.6.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.c.7.7.2.a.1.5.-.5.8.5.6.-.4.b.2.d.-.a.a.6.5.-.5.a.0.d.4.f.5.7.3.4.9.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.c.f.8.5.c.d.9.-.7.d.8.f.-.4.b.2.f.-.8.d.a.b.-.a.8.d.d.5.c.2.a.3.0.0.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.C.o.m.p.a.r.e.P.l.u.g.i.n...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.1.7.4.-.0.0.0.1.-.0.0.1.5.-.f.6.4.9.-.c.6.1.0.8.5.4.0.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER399E.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 25 20:15:18 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	69122
Entropy (8bit):	1.4868531021630391
Encrypted:	false
SSDEEP:	192:G0xRETFZnrOMqF3XjHdvH94ep7WUCaz2hLWeuUd+P:xIFZny/FLdvH94a7WUCaoLWeuUUP
MD5:	F06441147B7A0E93899AF7D051D96D25
SHA1:	6FB11749DE88D20E1CEA9618E5B31219D2A63440
SHA-256:	BD95CE7B8F9666C9F8186DFDB23250E694535E4AA2C6266178D799A0BFCB1017
SHA-512:	B742AFCFA076AEB014ACDAFD0625026828A14B818ED95F66359903966488FAE51E43A1CD4BA9DFB330D7E15FC599E5210EA41A4D5985EC966B3DBAE476DF72E5
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........">b........................h...........$....0..........T.......8...........T...........................4........... ...............................................................................bJ..............Lw......................T.......\|....">b.............................0..................G.M.T. .S.t.a.n.d.a.r.d. .T.i.m.e...................................................G.M.T. .D.a.y.l.i.g.h.t. .T.i.m.e...................................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER39AD.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 25 20:15:18 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	67070
Entropy (8bit):	1.5229715412163212
Encrypted:	false
SSDEEP:	192:GgjK3uTFTr+OMqMkFf54PGD2RUOjL8J4Y:XK3MFTr5/f5WGMUOX8J
MD5:	32BF35CBF51A597150512EB455E89052
SHA1:	18E297B72D1D20373A43445CF951B91C978F44DC
SHA-256:	A82674763BB9F028345F3704FC121A6DA8F8E73F1EC273235E32D16399F54E93
SHA-512:	353CE521039CAF34D501F2A7207F2DA1769291A225404CE70CEFA0B124F0708FD64D1A39320B4C98548CC470409CCA5A6B7798E6C0625326D618EED284243D59
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........">b........................h...........$....0..........T.......8...........T...........h...............4........... ...............................................................................bJ..............Lw......................T............">b.............................0..................G.M.T. .S.t.a.n.d.a.r.d. .T.i.m.e...................................................G.M.T. .D.a.y.l.i.g.h.t. .T.i.m.e...................................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B06.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8956
Entropy (8bit):	3.698858363333661
Encrypted:	false
SSDEEP:	192:R9l7lZNioqrDNb6Yw2cygmfLipQyKRgpr/89broxfuA5m:R9lnNi9J6YJJgmfLipRKzr+fY
MD5:	442C2ED9F9C483A5A123380FC3AB3C05
SHA1:	336383435A348ECF78D9519B41F8BA312FACF897
SHA-256:	80BCEFDDDE9552914D8DBF697E9481932F9CACC0FE2B689C6BC82135B6EB65C6
SHA-512:	BF49F39E511DD22C7B1DAEB1AB795CA1ED1F3104C7D5F61537EE3A35B94141803029077C7767CA95159D0574DFBD4CB2DDA114E03FC8F96DD8E92B61F33CAB95
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B45.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8774
Entropy (8bit):	3.6955738591210756
Encrypted:	false
SSDEEP:	192:R9l7lZNioBAb6Yda/vgmfLipQyKRgprI89brPTfe05m:R9lnNiGU6YgvgmfLipRKGr7fen
MD5:	780BAC9032E8EDC352FCEB069078392B
SHA1:	048275FB0C6D9DDC8667350CE6DE2770766A7473
SHA-256:	BCEA6AD49F1BED16BD21A10A7FD246A637B288D6EB665D68ABD28452581A9336
SHA-512:	CE2F5A6082A88E167AD6E31AC2BA6B6CE091A99BCBDD547BA919C956CE9C8D2806B36CC3EB38695ADA9D52F333F8C1AEC5A1F19250BF8951C624480E09B638A8
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.2.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B94.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4964
Entropy (8bit):	4.514970872828352
Encrypted:	false
SSDEEP:	48:cvIwwtl8zsxe70xzI7VFJ5WS2Cfjkc3s3rm8M4JC+OC+ctbNFkoyq85m+G3Ytptf:uILf47y8ySPf8JfCawooGIpoOhd
MD5:	0969BA986206A40FA49C1DAA6AB5F197
SHA1:	F35B4F67A72BE46A1E18051334B060DA8C58C2D3
SHA-256:	E87770D85AC98A114C9B4AD4D268AF79BFE1AB7AAEA735E243E43CDB2A96A8B5
SHA-512:	79A91CCC299EEA5F4C20FCDB4A6D16F7E66AD2EC9D25874C95179D77340FAA8A1E6E602C7AD88AAF71599EA7FC30FFF3171A3E0F485B52258933DC7090B7636D
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="221542497" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3BD2.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4964
Entropy (8bit):	4.512073844279563
Encrypted:	false
SSDEEP:	48:cvIwwtl8zsxe70xzI7VFJ5WS2CfjkcSs3rm8M4JC+OC+ctbNF5/yq85m+G3YGKpm:uILf47y8ySPfnJfCat/oGtKpoOUDd
MD5:	567DD472D8FE3E649C5E2D813D12E96C
SHA1:	E6ABA1BF2B724202804234BCB73D43B27D2B2D7A
SHA-256:	254954BF6C8573C9EF9CF2A77CCBA6C46120CB1ADA03EA2B14AD49BA5F3461EE
SHA-512:	BDB7901CD83F03845CBC1219386FA75BB62BBA3C4DFDD918BB7558AE1F06693F77001F8C02CBEA72EC67CAF6C0C664E0552C267DAC84D6844755AF288B08157F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="221542497" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

C:\ProgramData\Microsoft\Windows\WER\Temp\WER445C.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 25 20:15:21 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	66770
Entropy (8bit):	1.5207445596543092
Encrypted:	false
SSDEEP:	192:JoWXvTFh/rYOMqoxg/7uZkiphI0/WhhLk:BLFh/rf/oxgDuZkEI0/Whm
MD5:	E1D0BF018A4C0D9E722AF9690C19A2CD
SHA1:	E4AD2C116C9532EA1095D5A39430D3D86CD3FFA5
SHA-256:	F48C471688EC3914B26F75718BAD04DAE89FED387AC6FBEC30BC12E0C95416F9
SHA-512:	8D3AE48A2449D80DC95E156FC1CD8034830A14F64A82FFB89ACCB9C5E50D934DB34F787A44D23049CD621668CEA438FCE07D1DA8F165A98A8AA8DF4B887B9793
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........">b........................h...........$....0..........T.......8...........T...........................4........... ...............................................................................bJ..............Lw......................T.......L....">b.............................0..................G.M.T. .S.t.a.n.d.a.r.d. .T.i.m.e...................................................G.M.T. .D.a.y.l.i.g.h.t. .T.i.m.e...................................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4586.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8514
Entropy (8bit):	3.6932293598297115
Encrypted:	false
SSDEEP:	192:R9l7lZNiFMRE6YwOcygmfLip8zgpr389bZR1fGvTm:R9lnNiQE6YBJgmfLip8xZzfb
MD5:	2C802FA65EBBCD1BF5242AEA12057ED2
SHA1:	45B7C0A9B38E4E8807890EAB3C3B5D24C92D1805
SHA-256:	4C13438D380D6DD4C29E9E2AC050DA8B7219385647CADFC14E73FC90B0984D70
SHA-512:	17A4B14674E6C739DC8C8E36CF3A6C5047FCAC901910FBF65615D61A0FC7BF66B6F3605D601E2D57F0E93ADAB370101A7B2500E2E3DC1D1064931CE442B8948F
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER45B5.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4963
Entropy (8bit):	4.511782705155914
Encrypted:	false
SSDEEP:	48:cvIwwtl8zsxe70xzI7VFJ5WS2CfjkcHs3rm8M4JC+OC+ctbyFTNFGyq85m+G3YYp:uILf47y8ySPf8JfCaaFGoGBpoO7d
MD5:	FE661ACEDDC58AA45593C3331CE0AE67
SHA1:	B93A60C6166B835A8D3E852D0810D82F2ACEEF04
SHA-256:	41D6D80C8E8B9123DCD32AF6B5372F384567828008DF48C3038572BD4D119FC9
SHA-512:	F1C414E730CA95D881024A8F3BC1E3AE02B2A2B85E7B04E385CA3987726FDB7C99C4B193192892EA2085F3FACAA5893A863A8E3D507EA73B0B36A94A8DF1A1C4
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="221542497" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C97.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 25 20:15:27 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	68962
Entropy (8bit):	1.4892611525441077
Encrypted:	false
SSDEEP:	192:7UlNyT+y52OMqfeY4Ucw58tkwCK2mW8SJ:cNw+yv/WYbcw5kkwCWWb
MD5:	84C639597298F69E8BF0041608597184
SHA1:	883F83F0B41D39588B1934F1BC6CED56430E5059
SHA-256:	161166D91DCD90D705C4FBF8557CD4E5F10C5775DA7C256504271AB67BFCC49F
SHA-512:	3AE2ECF1F8844AE4DF01C1D8F1AEAC7678B37039B543201E73A9E9DA1B673314F2DD0EEE1C4241359E49F0DBE67697E3E73A202D0408A615E9894584E79C7D49
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........">b........................h...........$....0..........T.......8...........T...............J...........4........... ...............................................................................bJ..............Lw......................T.......t....">b.............................0..................G.M.T. .S.t.a.n.d.a.r.d. .T.i.m.e...................................................G.M.T. .D.a.y.l.i.g.h.t. .T.i.m.e...................................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CE5.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Mar 25 20:15:27 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	67890
Entropy (8bit):	1.508302227012987
Encrypted:	false
SSDEEP:	192:7IutTFte2s6OMqKMQQWj4o+xyR3CwPdJ:nxFtIF/KMQQWcoL3CwD
MD5:	47F2FD224A929EEBF7B45BE58AE1452C
SHA1:	E8EA6E58BEE6B7BA65426AD955D0798D62BAED17
SHA-256:	57F22B0A243847EA32838A0AE9357BAD8F6B579CB68CA9A4F812232AE2B2B5A7
SHA-512:	2E10AB87D49517893338060A415CBE720CAAADB845B9F6F905CE1D54339F23589494FEAE6FE94A4883CE01A21EB1B01F9789374E5C1EF24CAED6E14543AECEE0
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........">b........................h...........$....0..........T.......8...........T...........................4........... ...............................................................................bJ..............Lw......................T............">b.............................0..................G.M.T. .S.t.a.n.d.a.r.d. .T.i.m.e...................................................G.M.T. .D.a.y.l.i.g.h.t. .T.i.m.e...................................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5DF0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8502
Entropy (8bit):	3.6921949711975635
Encrypted:	false
SSDEEP:	192:R9l7lZNibUuye6YDQ0H9WgmfLipQyKRgprD89bvx1foFm:R9lnNiIq6Yc0HsgmfLipRK3vTfn
MD5:	2E2EFCFA7F42DFF687128FDD6AC41444
SHA1:	55685C4F19ABD5343E85EE77FF6E402908235741
SHA-256:	8372EE5CD70DAE52A3316CF1E74A90D4727131F45EB021F4A75B61729C1CBEE6
SHA-512:	9614A02BD826A314A567F97BF894160798FEB47240DD2065363AF4C873AD04A325E32C3DD70767E1CEBBFF5F9D432A39E2417FE3DAD1C12E438CA6F9B7162CFE
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.7.2.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E3E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8502
Entropy (8bit):	3.6915526245198786
Encrypted:	false
SSDEEP:	192:R9l7lZNiL+N6YDFH9WgmfLip8zgprY89bvG1fCFm:R9lnNiCN6YhHsgmfLip8MvcfZ
MD5:	8912DACF57223A3F4A2835A19831E5FF
SHA1:	A07CF3B376E07FBE65FAC7FA2B95C66CED3153E0
SHA-256:	E0E055AE133724E2AA757110339D8B4A2172434E2DA9FEE167F6C1D17711220A
SHA-512:	FA67ABAAF7C5C0A8AB5F364856EC94573162B5108BE7B9B8355CF4C6FBE39488B1CBA0AE545354980DDD41FCA45E5DA6B093D6F2CFB91BC346A021BA18659511
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.2.8.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E8D.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4963
Entropy (8bit):	4.5135851316176
Encrypted:	false
SSDEEP:	48:cvIwwtl8zsxe70xzI7VFJ5WS2Cfjkcos3rm8M4JC+OC+ctbNFxvyq85m+G3Y+ptg:uILf47y8ySPf9JfCaFoG7poOid
MD5:	70960C3E3E62B504B0F975325976DBDD
SHA1:	850B4BA465D2F2DA3C095DFC42F7B5171810B4F6
SHA-256:	AEA22B2092A05E07B4A50B50403BE10E73A1190934A345114E9455295620ED11
SHA-512:	3A5A89EBB0E0489AD2D730F950CC4B432FD4E2733499C3CFD1CB7C7A0F9633D8468775984FCF98936728673D719026CACE97A4EDCEF632C6797A92CB01753762
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="221542497" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5EAC.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4963
Entropy (8bit):	4.510118284109059
Encrypted:	false
SSDEEP:	48:cvIwwtl8zsxe70xzI7VFJ5WS2Cfjkcjs3rm8M4JC+OC+ctbyFAyq85m+G3Y1ptSm:uILf47y8ySPf8JfCa7oGkpoOrd
MD5:	DDFF3A82AC345550ECA63450D1E06EE3
SHA1:	CFBA3B87608ACF0C0593F7812443B2552CFEA55C
SHA-256:	483E9C61021D07900A31EB8148665069A053CC3A98BACB174E70F84958A26014
SHA-512:	FBA6A4F67D1FE1E675A836E631CEB6BC9AB3D2B461CC64F22ED48D6B75BDDAF4F0A6D15480138F94F964F273AF5D92DE3065B741B3E0DE1451180DAE0089F53C
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="221542497" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

C:\Users\user\Desktop\cmdline.out

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	modified
Size (bytes):	4168
Entropy (8bit):	4.373738299569115
Encrypted:	false
SSDEEP:	48:RmXf4rou93Prou93vD0D56+0QlcAkdTyapS2APBQ0yNr:RwEhyapPR
MD5:	8ED3CC43EAA9DEA8835351A33940FC98
SHA1:	0A0FBF7FBC3FA92A42B27F54AD7010012D383573
SHA-256:	4148A083CCFE9BA5D9E2348B4D2BCBDF77453F2C36134C9A25471EB74D520E1D
SHA-512:	30B53EAFE3F0B2B435CA2B3107A3CA1BBBF4AB22ED4EB58C05EF3F05087ADD24F3C3F38580FF5679F59E110BD1A936BC1A9D07C1180F8C6B92F904300CCA5207
Malicious:	false
Reputation:	low
Preview:	--2022-03-25 20:15:12-- https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip..Resolving github.com (github.com)... 140.82.121.4..Connecting to github.com (github.com)\|140.82.121.4\|:443... connected...HTTP request sent, awaiting response... 302 Found..Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/50095301/f0aad92b-ebf9-49d7-8eb8-da1dde346952?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20220325%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220325T191320Z&X-Amz-Expires=300&X-Amz-Signature=5053414ddd70e50734eacb002da0a5ed0adb35bb4bd3c967d01196cf1c48f106&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=50095301&response-content-disposition=attachment%3B%20filename%3DComparePlugin_v2.0.2_X64.zip&response-content-type=application%2Foctet-stream [following]..--2022-03-25 20:15:12-- https://objects.githubusercontent.com/github-production-release-asset-2e65be/50095301/f0aad92b-ebf

C:\Users\user\Desktop\download\ComparePlugin_v2.0.2_X64.zip

Download File

Process:	C:\Windows\SysWOW64\wget.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	1388181
Entropy (8bit):	7.997956887940178
Encrypted:	true
SSDEEP:	24576:6fxvnjZQ0clHZk5XyurCaIGi2r97lgEFl963UD9TXKlApp5IZm5:Wxvq0clHZwiurC9Y7lgW96K9TXKl4
MD5:	DA0CC28CDEC8749872F8C51E79CB68B2
SHA1:	A9D5A3930538642E171622ACB62291F011FAB003
SHA-256:	4151FBC9778047991CF4B900363D846BDA5B0D1783E5FED9EB77E4C8253BA315
SHA-512:	3B01251BDBC2ED627D71C155067EB2D48155A9638CB0B96FD925221625A6029CEB08A633D5A24C1AD332B2AD517AAFC85AFADB964822B483461F3312A01B50F3
Malicious:	false
Reputation:	low
Preview:	PK........p~BT................ComparePlugin/PK........p~BT...xe....b......ComparePlugin.dll.]{@TU......T.3sJ.si......;:.f...i.Y...)4.Lwg....Y.n.Y..z...V....n.."..C.....;...k.c.X.........s...s..w..I.$3.PH.6K..)... I.G6...Ky.....'\.`..G..k.X\|.U...^}.5^.e...}W;.^.(=o..k..76==5[+.`....~.?I.=.M.N...{......^Nibws...nIy..5._g}..h].....})..p.7L....G..W8...s..>...2I....t..#..q........(I..8._.\;{k..~$'qT.:...\.g.;..q...@.n..c,f)...yf....l..HR...tA?m..k.r..H_...l.....c..y....$h7..8$.j.../..SO.4P......?'...`..x.AO....S<\..j..4...X..)..+./.\|........D8.%.O.W...eN.x.....ki<.c.)o.E..pL....2.n....'....7...o>1Ir..O8_.Q7.%I.......[.f>I.....F..H).Ws.......\..@.~g.\..S.}~..}.1...\.e.Q..&.H..R/..0 .f.?.1...............4!.2...1.g<....-.......-...p>...p....d..,.[.F............g.E.H...l...?...8D8...*.C.p.........C.H...#}ZC..WC...%...E.V9....j.+C8.yh.....R....%5rp....+...@..Xbu6,I..K.r....7.v..E.y.....:.V.o..W.9\|..."...H.....p.~...T.,.d..[.......J..t.2.

C:\Users\user\Desktop\extract\ComparePlugin.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	287232
Entropy (8bit):	6.183705147240815
Encrypted:	false
SSDEEP:	6144:0IfvPfxEsrL2fN7pYUMv3T0j22qZR/kUV8vFiFebnCBiloC1Os31+:bhZL0NdYUMv3p2qZR/kUqvFF2B4oIOX
MD5:	913E79C2C839355E296425CDB6DBF920
SHA1:	960566EAAA109C21A93FBD44A594FE20549F2B69
SHA-256:	D7F501E35C8B92CCE2D9B8FC18CFB8770426FBE362406F2EE73DB2C8F7D6ADF3
SHA-512:	3548B3C2C9F7DE8BB3A4F36884A7FCC73A78169FD0EDF989CBAA68359923387D85F010607F1C1FAB4E4494861A86E62CFC34374A03FAA5183DF129AB30D581EA
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E.[.$...$...$....L..$....N..$....O..$...z...$...z...$...z...$..o.v..$...$..i$...z...$...z...$.. zB..$...$*..$...z...$..Rich.$..........PE..d......a.........." .....................................................................`.................................................H...........0<...0...-..............,...ps..T...................ht..(....s...............................................text...R........................... ..`.rdata........... ..................@..@.data...,B..........................@....pdata...-...0......................@..@.gfids.......`......................@..@.tls.........p......................@....rsrc...0<.......>..................@..@.reloc..,............X..............@..B........................................................................................................................................................

C:\Users\user\Desktop\extract\ComparePlugin\git2.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1078784
Entropy (8bit):	6.52071386992817
Encrypted:	false
SSDEEP:	24576:mu0mJ+S0TzbTS/zcfEZyLQvhDbJBbcZiEw2SaEBSdy:nT0v3ozcEZyLQvhDbJ1Ovy
MD5:	4C3C723290A6BFCE2B3BB70531373D86
SHA1:	B1DFA1394E7F887C7C606ADC8140D4DBAE4F9334
SHA-256:	B87C99AF51FB8325FB77DB3C4F022E08FDE604051FEEEC7816FE2ED7370143C3
SHA-512:	ED5B3D48E5993F3692372CB451601C205E84C396E10748C02D87DC2E2767C2C0DF0A09490E8D0357E3173A8D75A69E7E9EF0B239200E90167FD3E99A80CFF928
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._..,_..,_..,.:.,Z..,..=,r..,..<,...,...,T..,.e.,]..,.e.,P..,_..,...,..8,..,...,^..,R..,^..,_.K,^..,...,^..,Rich_..,................PE..d....L+X.........." ......................................................................`..............................................[...t..........................................................................p............................................text............................... ..`.rdata..............................@..@.data...zQ.......(...r..............@....pdata..............................@..@.rsrc................f..............@..@.reloc...............l..............@..B........................................................................................................................................................................................................................................

C:\Users\user\Desktop\extract\ComparePlugin\sqlite3.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1701376
Entropy (8bit):	5.907260777160115
Encrypted:	false
SSDEEP:	24576:QH2A+z8EGx/omYKlQRRAPQrDcc0k3eI0dq14JRaPND+:a2x8MKl8KPQn3ee4JUPND
MD5:	3E88E14D939CD2026F7C5556D21331B7
SHA1:	5DCB19632C9ABBE99204392159BF45AD670F21A7
SHA-256:	5654B13635CD0BE290FE5AAEBC55E56B606009921D37F2829F2A8BA25BECEDE1
SHA-512:	68485F06CAD7FFCCB144293F90F065284F8885D3F367E95A4BACB937A1FFB4DEFD9E57EB5DB7272F464CBE22A34C62E8D55A64A6229F07EDF43F57E2A4585D5A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y...=.f.=.f.=.f..w..>.f.=.g.C.f.4...&.f.4...6.f.4...f.f.4...<.f.#...<.f.4...<.f.Rich=.f.........................PE..d......X.........." ................h,.......................................`.......................................................*...$......(.... .......................@.......9..............................................8................................text............................... ..`.rdata.......0... ..................@..@.data....\...P...D...>..............@....pdata..............................@..@.idata..D...........................@...text....J...........................@.. data....F ......."..................@..@.rsrc........ ......................@..@.reloc.......@... ..................@..B........................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	2097152
Entropy (8bit):	4.512520917705985
Encrypted:	false
SSDEEP:	12288:OgEUY6/eee9WwB84iTd+vXlnFbSwv+JnxQ7SLj732qlCGzz4DragmcnYJe:OH9WwB84iTd+vXlnFGnB4DragmcnYJe
MD5:	8844846383370A8E25495DA4F967A5D2
SHA1:	75C92796AEAC60F34BD30DA5E6C2A74E4C413551
SHA-256:	0A929BA428335767EF26ED4B95057E75B8CBA57421EDAFBB5238F0AB07CB9755
SHA-512:	C6F2A285846B0D7641BBFFC1016D1C311DAA23E2005A1A7FF5224C352CDC96985142ABF3964F3BF5C5DD89732E05CE4D2B525956FECCCC51A5C3D1C1753821A5
Malicious:	false
Reputation:	low
Preview:	regf........5.#.^................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e......Q......P..#....Q......P..#........Q......P..#.rmtm._u.x@.................................................................................................................................................................................................................................................................................................................................................2........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	376832
Entropy (8bit):	2.5484156376419898
Encrypted:	false
SSDEEP:	3072:E1DuecejetINqlWjai5sTBG2nDgebeOeF8DgebeOeDe3TKeme:E1aJesPnc6ns8c6nie3TKz
MD5:	D6159F3F2B31291D81BC62FE9B4C51F1
SHA1:	DB682CAE492A70E6EA000CBAC14DCCE1651ABF24
SHA-256:	C3CFA9892B06C077494201082B4C58A9A12E08D2E424CA9FBA784D193B360092
SHA-512:	2A3130517795B3D61F4E8033530A4A05FE33E4A21114F86278D8C26AC9CB85675CE9CB512F4CBB910FA65F4A2176FD88FC2AF67555F543DFD69B7BD014C916B7
Malicious:	false
Reputation:	low
Preview:	regf........5.#.^................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e......Q......P..#....Q......P..#........Q......P..#.rmtm._u.x@.................................................................................................................................................................................................................................................................................................................................................2HvLE.^.....................P..&.@.....o.........................`... ..hbin................5.#.^...........nk,....S...............................................................&...{11517B7C-E79D-4e20-961B-75A811715ADD}......nk ..."..(......(...........@...............................*...N.......)...InventoryMiscellaneousMemorySlotArrayInfo....................mG.....nk .$4./T....... ...................................Z.......................Root........lh..(.....A.....nk ......(..

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	536
Entropy (8bit):	5.130335913661143
Encrypted:	false
SSDEEP:	12:pMd1DiIiRw38ufTDdmFybdcZvIhAI9DgNIzvn:piWI4w3/fTDkUqZvIhAIGevn
MD5:	3672C2459C32C114227239A0EEFCFFB9
SHA1:	A967DB7354F0A4F59308F56F27A7D36B9B1E86AF
SHA-256:	A047AEA3CEDB3B19B99CFA687645CE65088DA895C71EE5293B648C10FB40CBEC
SHA-512:	36E07CFA5230A1EB931135F60EC24188318BE40A087952006DC472F0AC61763E3739B64D25E286B0FE481DA7846E69BFF14A3A5C24DB1A241421E75421738E01
Malicious:	false
Reputation:	low
Preview:	..7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30....Scanning the drive for archives:.. 0M Scan C:\Users\user\Desktop\download\. .1 file, 1388181 bytes (1356 KiB)....Extracting archive: C:\Users\user\Desktop\download\ComparePlugin_v2.0.2_X64.zip..--..Path = C:\Users\user\Desktop\download\ComparePlugin_v2.0.2_X64.zip..Type = zip..Physical Size = 1388181.... 0%. . 44% 3. .Everything is Ok....Folders: 1..Files: 3..Size: 3067392..Compressed: 1388181..

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2022 20:15:13.316870928 CET	49750	443	192.168.11.20	140.82.121.4
Mar 25, 2022 20:15:13.316950083 CET	443	49750	140.82.121.4	192.168.11.20
Mar 25, 2022 20:15:13.317168951 CET	49750	443	192.168.11.20	140.82.121.4
Mar 25, 2022 20:15:13.318430901 CET	49750	443	192.168.11.20	140.82.121.4
Mar 25, 2022 20:15:13.318487883 CET	443	49750	140.82.121.4	192.168.11.20
Mar 25, 2022 20:15:13.363451958 CET	443	49750	140.82.121.4	192.168.11.20
Mar 25, 2022 20:15:13.363778114 CET	49750	443	192.168.11.20	140.82.121.4
Mar 25, 2022 20:15:13.365273952 CET	49750	443	192.168.11.20	140.82.121.4
Mar 25, 2022 20:15:13.365304947 CET	443	49750	140.82.121.4	192.168.11.20
Mar 25, 2022 20:15:13.365747929 CET	443	49750	140.82.121.4	192.168.11.20
Mar 25, 2022 20:15:13.367796898 CET	49750	443	192.168.11.20	140.82.121.4
Mar 25, 2022 20:15:13.381901026 CET	443	49750	140.82.121.4	192.168.11.20
Mar 25, 2022 20:15:13.381998062 CET	443	49750	140.82.121.4	192.168.11.20
Mar 25, 2022 20:15:13.382117987 CET	443	49750	140.82.121.4	192.168.11.20
Mar 25, 2022 20:15:13.382226944 CET	49750	443	192.168.11.20	140.82.121.4
Mar 25, 2022 20:15:13.382392883 CET	49750	443	192.168.11.20	140.82.121.4
Mar 25, 2022 20:15:13.388314009 CET	49750	443	192.168.11.20	140.82.121.4
Mar 25, 2022 20:15:13.388336897 CET	443	49750	140.82.121.4	192.168.11.20
Mar 25, 2022 20:15:13.420128107 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:13.420211077 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:13.420381069 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:13.421432972 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:13.421483994 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:13.464063883 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:13.464518070 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:13.465609074 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:13.465645075 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:13.466335058 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:13.467444897 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:13.507993937 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.024856091 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.025118113 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.025247097 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.025374889 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.025518894 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.025602102 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.025650978 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.025831938 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.025866985 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.026084900 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.026316881 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.026333094 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.026372910 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.026571035 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.026614904 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.026793003 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.026971102 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.027038097 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.027069092 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.027162075 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.027276993 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.027410984 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.027486086 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.027513981 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.027623892 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.027692080 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.027719975 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.027882099 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.027911901 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.027945995 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.028070927 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.028103113 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.028275013 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.028470993 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.028497934 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.028562069 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.028775930 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.032788992 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.033109903 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.033227921 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.033325911 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.033339977 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.033370972 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.033552885 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.033595085 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.033631086 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.033823013 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.033857107 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.034065008 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.034096003 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.034276009 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.034492970 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.034523010 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.034573078 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.034687042 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.034713984 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.034780025 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.035343885 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.035402060 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.035504103 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.035537004 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.035547972 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.035574913 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.035598040 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.035628080 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.035643101 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.040728092 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.040770054 CET	443	49751	185.199.110.133	192.168.11.20
Mar 25, 2022 20:15:14.040910959 CET	49751	443	192.168.11.20	185.199.110.133
Mar 25, 2022 20:15:14.040941000 CET	443	49751	185.199.110.133	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2022 20:15:13.301995039 CET	62930	53	192.168.11.20	1.1.1.1
Mar 25, 2022 20:15:13.311404943 CET	53	62930	1.1.1.1	192.168.11.20
Mar 25, 2022 20:15:13.409169912 CET	58485	53	192.168.11.20	1.1.1.1
Mar 25, 2022 20:15:13.417960882 CET	53	58485	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Mar 25, 2022 20:15:13.301995039 CET	192.168.11.20	1.1.1.1	0xfc2c	Standard query (0)	github.com	A (IP address)	IN (0x0001)
Mar 25, 2022 20:15:13.409169912 CET	192.168.11.20	1.1.1.1	0xe756	Standard query (0)	objects.githubusercontent.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Mar 25, 2022 20:15:13.311404943 CET	1.1.1.1	192.168.11.20	0xfc2c	No error (0)	github.com	140.82.121.4	A (IP address)	IN (0x0001)
Mar 25, 2022 20:15:13.417960882 CET	1.1.1.1	192.168.11.20	0xe756	No error (0)	objects.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)
Mar 25, 2022 20:15:13.417960882 CET	1.1.1.1	192.168.11.20	0xe756	No error (0)	objects.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)
Mar 25, 2022 20:15:13.417960882 CET	1.1.1.1	192.168.11.20	0xe756	No error (0)	objects.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)
Mar 25, 2022 20:15:13.417960882 CET	1.1.1.1	192.168.11.20	0xe756	No error (0)	objects.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

github.com

objects.githubusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49750	140.82.121.4	443	C:\Windows\SysWOW64\wget.exe

Timestamp	kBytes transferred	Direction	Data
2022-03-25 19:15:13 UTC	0	OUT	GET /pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko Accept: / Accept-Encoding: identity Host: github.com Connection: Keep-Alive
2022-03-25 19:15:13 UTC	0	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Fri, 25 Mar 2022 19:13:20 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Accept-Encoding, Accept, X-Requested-With permissions-policy: interest-cohort=() Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/50095301/f0aad92b-ebf9-49d7-8eb8-da1dde346952?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20220325%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220325T191320Z&X-Amz-Expires=300&X-Amz-Signature=5053414ddd70e50734eacb002da0a5ed0adb35bb4bd3c967d01196cf1c48f106&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=50095301&response-content-disposition=attachment%3B%20filename%3DComparePlugin_v2.0.2_X64.zip&response-content-type=application%2Foctet-stream Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade Expect-CT: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
2022-03-25 19:15:13 UTC	1	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 62 6c 6f 63 6b 2d 61 6c 6c 2d 6d 69 78 65 64 2d 63 6f 6e 74 65 6e 74 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 6f 62 6a 65 63 74 73 2d 6f 72 69 67 69 6e 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.
2022-03-25 19:15:13 UTC	2	IN	Data Raw: 58 2d 47 69 74 48 75 62 2d 52 65 71 75 65 73 74 2d 49 64 3a 20 43 46 44 45 3a 45 34 39 41 3a 31 46 36 33 36 41 45 3a 32 30 45 36 41 33 42 3a 36 32 33 45 31 34 43 31 0d 0a 63 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a Data Ascii: X-GitHub-Request-Id: CFDE:E49A:1F636AE:20E6A3B:623E14C1connection: close
2022-03-25 19:15:13 UTC	2	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 59 6f 75 20 61 72 65 20 62 65 69 6e 67 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6f 62 6a 65 63 74 73 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 67 69 74 68 75 62 2d 70 72 6f 64 75 63 74 69 6f 6e 2d 72 65 6c 65 61 73 65 2d 61 73 73 65 74 2d 32 65 36 35 62 65 2f 35 30 30 39 35 33 30 31 2f 66 30 61 61 64 39 32 62 2d 65 62 66 39 2d 34 39 64 37 2d 38 65 62 38 2d 64 61 31 64 64 65 33 34 36 39 35 32 3f 58 2d 41 6d 7a 2d 41 6c 67 6f 72 69 74 68 6d 3d 41 57 53 34 2d 48 4d 41 43 2d 53 48 41 32 35 36 26 61 6d 70 3b 58 2d 41 6d 7a 2d 43 72 65 64 65 6e 74 69 61 6c 3d 41 4b 49 41 49 57 4e 4a 59 41 58 34 43 53 56 45 48 35 33 41 25 32 46 32 30 32 32 30 33 32 35 25 32 46 75 73 2d 65 61 73 74 2d 31 Data Ascii: <html><body>You are being <a href="https://objects.githubusercontent.com/github-production-release-asset-2e65be/50095301/f0aad92b-ebf9-49d7-8eb8-da1dde346952?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20220325%2Fus-east-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49751	185.199.110.133	443	C:\Windows\SysWOW64\wget.exe

Timestamp	kBytes transferred	Direction	Data
2022-03-25 19:15:13 UTC	3	OUT	GET /github-production-release-asset-2e65be/50095301/f0aad92b-ebf9-49d7-8eb8-da1dde346952?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20220325%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20220325T191320Z&X-Amz-Expires=300&X-Amz-Signature=5053414ddd70e50734eacb002da0a5ed0adb35bb4bd3c967d01196cf1c48f106&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=50095301&response-content-disposition=attachment%3B%20filename%3DComparePlugin_v2.0.2_X64.zip&response-content-type=application%2Foctet-stream HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko Accept: / Accept-Encoding: identity Host: objects.githubusercontent.com Connection: Keep-Alive
2022-03-25 19:15:14 UTC	4	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1388181 Content-Type: application/octet-stream Content-MD5: 2gzCjN7IdJhy+MUeectosg== Last-Modified: Wed, 02 Feb 2022 15:55:28 GMT ETag: "0x8D9E6646EE13410" Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 9436cebd-901e-0009-7c7c-4067b6000000 x-ms-version: 2020-04-08 x-ms-creation-time: Wed, 02 Feb 2022 15:55:28 GMT x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob Content-Disposition: attachment; filename=ComparePlugin_v2.0.2_X64.zip x-ms-server-encrypted: true Fastly-Restarts: 1 Accept-Ranges: bytes Date: Fri, 25 Mar 2022 19:15:14 GMT Via: 1.1 varnish Age: 0 X-Served-By: cache-mxp6920-MXP X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1648235713.470343,VS0,VE549
2022-03-25 19:15:14 UTC	5	IN	Data Raw: 50 4b 03 04 14 00 00 00 00 00 70 7e 42 54 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 43 6f 6d 70 61 72 65 50 6c 75 67 69 6e 2f 50 4b 03 04 14 00 00 00 08 00 70 7e 42 54 14 80 8c 78 65 0a 02 00 00 62 04 00 11 00 00 00 43 6f 6d 70 61 72 65 50 6c 75 67 69 6e 2e 64 6c 6c d4 5d 7b 40 54 55 1a bf f3 82 01 c1 19 54 0c 33 73 2a 4a 12 73 69 b1 82 08 9b 11 d0 3b 3a 18 66 2a ad 95 94 69 ba 59 91 ce a4 95 29 34 90 4c 77 67 97 ca da de 59 ed 6e 96 59 d6 96 0f 7a 81 14 a0 56 92 b5 1b d6 6e d9 fb 22 96 d8 43 d1 1e b3 bf ef 3b f7 ce 13 6b fb 63 ff 58 f4 de f3 fa ce f9 ce f7 9d 73 be f3 9d ef 9c 73 a7 fc 77 8d 92 49 92 24 33 9e 50 48 92 36 4b e2 cf 29 fd f2 9f d5 20 49 03 47 36 0d 94 9e 4b 79 e3 84 cd 06 cf 1b 27 5c b0 60 e1 12 47 f5 e2 6b ae 58 7c e9 55 8e b9 97 5e Data Ascii: PKp~BTComparePlugin/PKp~BTxebComparePlugin.dll]{@TUT3sJsi;:fiY)4LwgYnYzVn"C;kcXsswI$3PH6K) IG6Ky'\`GkX\|U^
2022-03-25 19:15:14 UTC	6	IN	Data Raw: 89 02 9c 68 7b 07 48 0a 09 00 2d df 3c aa bf f2 36 fb a7 ad 8b a3 25 0f 89 f9 cd dd 17 33 70 5d 76 b5 49 02 8e 34 4e 0d 70 13 06 4a b3 1d a1 cc 53 01 56 96 df 9c bf 4b 47 d9 bb 81 0a 6d ed ce a6 8c fe 2d 79 4c 63 59 fe b6 50 e6 c1 f5 94 d2 d1 64 e1 d1 67 39 b4 dd c4 85 e4 c1 7f a5 e6 cf 29 0d 4e 1e de 8e 82 1d 80 c1 58 fc 31 94 59 b5 81 69 ce 63 62 15 72 42 99 5e c4 89 56 7c 19 2f a5 ed 34 03 37 fb 2a 04 fc 7d 06 5b 7d 3d 4d 6b 5b 64 42 ed 5d ae d4 a2 43 52 1d 03 b5 d4 32 f9 bb da 6a 91 a2 51 39 01 25 b1 67 1a 3c f3 fd 37 3a c0 ae 12 87 6f 64 34 3b 35 50 db 06 e2 65 1d 47 80 9e 76 d4 d6 c0 94 64 16 13 97 03 9e 6c 07 51 e9 04 95 3d c9 02 87 41 e7 9c 47 79 03 95 27 b6 f1 a8 7d 57 63 de be a7 09 fb 1f b8 57 cb f9 af ab 7f 99 07 c1 53 fb 2a 75 fb 39 97 5c 3c Data Ascii: h{H-<6%3p]vI4NpJSVKGm-yLcYPdg9)NX1YicbrB^V\|/47}[}=Mk[dB]CR2jQ9%g<7:od4;5PeGvdlQ=AGy'}WcWSu9\<
2022-03-25 19:15:14 UTC	7	IN	Data Raw: b2 03 8a bc f2 2e 90 aa 41 d4 a8 67 11 84 85 3b 40 63 fc 20 ea 22 92 9b 28 1b 2a a0 5e 49 10 65 2e 65 9a 39 94 d9 2e aa aa 09 b3 4b 11 02 57 c7 6c 5e f7 c4 13 a3 73 3d d9 d9 87 ba 95 ad 2d ea 48 53 a7 2e e2 02 d3 ed f7 f8 3f 4e 36 6d 6d e9 33 05 4a d2 a8 21 22 d3 ca b3 17 89 69 a5 92 18 57 45 72 94 18 e7 9c 31 7d 96 1c 5c 94 bd 05 6b 00 a1 90 5a 4e ed d0 08 2c 1b e5 a6 01 bd db bf 37 c9 56 f7 4f 13 29 a2 cf 65 77 91 e6 b7 f7 64 5b 5d 33 0d c6 bd 9f 49 a4 0e e6 1a 28 d2 e0 1d e9 3f 72 92 ad be 1d a1 e0 e4 7d a1 cc df a0 c6 a4 5c 93 42 d2 ad d2 48 b0 6d ea f0 77 1b bc b3 6a 0f 77 9b 68 ac de 0f 50 77 8b 6a 9f ef 62 6d 32 28 14 3e 12 af 0d ba 32 d8 f4 57 5e 27 21 ba e9 1e 3d ee 6f 7f 65 19 6b 47 64 a0 e4 9c 26 1a 03 a5 4a 73 cf 4d f9 cd 6d 25 05 06 d4 bc 3d Data Ascii: .Ag;@c "(*^Ie.e9.KWl^s=-HS.?N6mm3J!"iWEr1}\kZN,7VO)ewd[]3I(?r}\BHmwjwhPwjbm2(>2W^'!=oekGd&JsMm%=
2022-03-25 19:15:14 UTC	9	IN	Data Raw: 51 af 11 cd 62 54 dd 3c 83 10 68 75 f7 69 f3 84 96 b9 b6 a5 02 21 70 e4 c6 af 22 45 ba 6b 55 2b 38 e6 3d 47 63 20 eb 7c 0b 51 26 c0 3b 8d 0c ee 89 02 a7 58 51 c8 99 71 b1 12 c7 3a a2 63 03 5e f4 10 28 48 05 d8 2f 31 d0 34 93 a7 89 b3 4c 2b db 31 ef 13 da 38 cb df a6 24 1a 24 9d ec fd 81 fb de c5 48 46 17 fa 1c bd 4a 13 e3 25 06 1e 47 88 8f 02 3b 53 80 bd 1b 0f 36 54 07 fb 91 c1 6c 02 ac 23 1e 6c ff bd 31 60 ea bd 0c b6 25 1e ac 43 07 fb 89 c1 5a 04 d8 b3 f1 60 0f c7 82 dd 2b c0 1e 8d 07 bb 41 07 4b 62 19 b3 04 66 ad 6b 08 94 74 e0 20 d9 9f a6 5b 3d 98 7e 66 56 31 50 0a 03 fd bd 93 b3 4e 0a c3 29 14 11 07 6a d5 40 59 e0 1c 17 05 2a 25 80 26 0b d0 0a 2e f5 c0 3d 02 14 e9 04 86 1c 14 af 83 a6 6a a5 b2 fc 68 bb 27 52 aa 31 a1 d4 34 9e a8 1e b9 87 ec 88 e8 be Data Ascii: QbT<hui!p"EkU+8=Gc \|Q&;XQq:c^(H/14L+18$$HFJ%G;S6Tl#l1`%CZ`+AKbfkt [=~fV1PN)j@Y*%&.=jh'R14
2022-03-25 19:15:14 UTC	10	IN	Data Raw: 03 12 fb bb e5 fa 5d de cb 69 27 fb 94 46 52 56 32 77 be 6c c2 80 d8 4a a5 31 e6 51 32 66 77 b9 50 76 2c 49 a2 4e d9 93 04 23 8e 2e 1d 54 4f d1 56 74 e5 22 24 9a 90 87 42 19 3c 82 21 ef 57 a1 1c f5 76 ea ad ed 25 56 29 66 e5 ee 9c 15 6e 6f 7d bc 3a a9 79 64 de bb 41 db 55 a3 62 1f d4 ac 00 f6 53 48 7e 8a f6 d9 a9 8e 03 74 23 37 d0 9b ea 0f 13 b9 27 7c 43 8d e4 fd 40 56 92 65 f0 82 1d 89 df 60 5f 3b ba 73 e4 b4 0c 8a d7 0d f5 b4 f5 92 e5 9a e9 a2 6a 14 90 3c 04 c1 47 a8 02 39 1e e5 00 6c e9 be 4b c2 7c 1f 15 a1 d6 37 44 5f 0f 45 71 e0 5b 2a ab aa e7 b4 b0 90 1c 6e 1b 89 79 c5 69 f7 0d 92 29 05 a0 e1 51 aa 22 c0 91 b2 32 90 37 d4 59 ee 09 71 20 2b 2b ec 3d 90 02 13 19 2d c9 9c c3 3d e9 6e 65 99 dd 53 d4 66 ab 7f 90 d4 89 95 d4 1b 2f b1 52 57 98 63 75 d3 40 Data Ascii: ]i'FRV2wlJ1Q2fwPv,IN#.TOVt"$B<!Wv%V)fno}:ydAUbSH~t#7'\|C@Ve`_;sj<G9lK\|7D_Eq[*nyi)Q"27Yq ++=-=neSf/RWcu@
2022-03-25 19:15:14 UTC	11	IN	Data Raw: 9f e5 fa 1e 91 7e 8e 3c 03 91 94 c3 c5 3b 8a 51 79 2e e0 e4 f1 9c a7 2b 68 2e 62 53 25 ed 7c c6 76 f9 d3 18 ec 98 55 e2 1c d3 4d ae 2d a7 ae 11 c5 64 89 f4 74 4e 3f 74 8b 51 8a ed 25 df 3d 47 f1 1f de c2 c5 13 25 ab 8d 06 58 b1 32 46 c5 e4 de c9 50 5b 6e 11 96 ac 6b 19 24 37 16 c1 93 0c 72 17 40 30 4e ce 7d 9e e4 16 8d 55 65 36 b6 75 af c4 6a 6e 49 81 5b f9 84 64 f2 9c d6 5f 1c 1f 5d 7f 10 e3 a3 f2 bb f0 f8 b0 6b e3 e3 1f e7 1c 65 7c f0 a9 32 c8 42 5d c0 6c 95 a4 a3 9c 0f 62 2c ea 8b c3 0d 12 15 9d de 94 a7 15 7d 03 8a 16 25 47 8e 06 25 da d3 d0 43 02 b4 a7 c0 eb 8c 50 66 79 0d ef 4e e5 69 31 69 ac e0 62 5b 60 7d 9d 51 53 76 13 f0 83 c0 55 90 fb a8 46 a0 56 18 13 0f c3 47 fd 92 22 0c ec 54 08 a7 53 22 c7 55 a1 0e 0c d7 b6 d2 24 6a fb 7a 51 62 6d fb ad af Data Ascii: ~<;Qy.+h.bS%\|vUM-dtN?tQ%=G%X2FP[nk$7r@0N}Ue6ujnI[d_]ke\|2B]lb,}%G%CPfyNi1ib[`}QSvUFVG"TS"U$jzQbm
2022-03-25 19:15:14 UTC	13	IN	Data Raw: 20 55 16 40 15 c2 a9 14 ce 82 14 76 aa 85 b3 4c 38 35 29 54 4e 43 0a 97 53 05 c0 70 b7 c1 6e 9b b2 1d 9d 41 69 b1 6d 9c 60 6e 70 99 61 91 40 c7 c0 81 fa 80 2b 0d b6 69 ee 20 74 58 dc 95 a5 4c 80 20 9a 96 0d e6 bb 83 ae ec 2d 20 82 d7 77 b7 93 94 b3 d9 d1 43 6b d8 97 31 a1 c6 66 97 1b 6d 19 93 1b 6d 76 e7 1a 84 d7 20 bc 01 e1 0d 08 37 23 dc 8c 70 27 c2 9d 08 ef 41 78 0f c2 bd 08 f7 ca 38 4b eb 5b cf 5b 35 a9 f9 db 5c 4a 6d 1e cd 9a 81 1a 72 10 1a 27 42 e4 b8 03 0d 05 c2 71 0a 47 26 47 a9 15 91 35 05 22 e4 14 21 a7 08 c9 22 24 20 b1 5b 1d 10 c0 01 a7 70 28 5e 3f 4f 43 5c d9 4a 96 ff dd bf 8a 2b 4e c1 95 ff 19 4f e4 20 af 10 68 10 e7 b9 83 8d 05 cc 16 e6 4e c0 00 cf 38 f2 b8 cc 98 76 ad ea b7 18 49 fd e9 e8 f9 cd 24 a6 98 b1 70 0a 84 e3 64 87 19 14 91 87 61 Data Ascii: U@vL85)TNCSpnAim`npa@+i tXL - wCk1fmmv 7#p'Ax8K[[5\Jmr'BqG&G5"!"$ [p(^?OC\J+NO hN8vI$pda
2022-03-25 19:15:14 UTC	14	IN	Data Raw: 22 27 b0 8a e2 74 ed 6b 15 bd 85 35 ab e8 03 5b dd 16 6e f0 01 f9 5f ca b4 31 72 2b 42 b1 83 ef f8 7d b4 59 67 8a 8c 3d 1a 89 ee dc 0e 8c 3f 1a 7c 38 79 22 d6 5f 9d d1 4b ae ce a5 37 61 35 78 bb dc b2 c7 a4 59 bf 4e 70 1d 6c 1e e9 bb 0a 07 07 fa dc 45 cd 4b 7e ef c9 6d c6 59 64 eb e2 2b f0 1e b5 f4 0a 0f b4 5d 2c 23 33 4f 21 0b 58 ae 1c b8 d2 8a 07 1c 48 62 d6 4f d4 58 3f 51 63 fd 58 39 70 b5 15 8f 5d b3 8a b5 47 cc 99 9a 61 4c ba 9a cc 60 47 ae a2 f7 b7 fc fe 8a df 2a bd 8f 62 0f 1e e1 a7 3d af 76 cb 32 38 f4 47 4b e4 4c 1a 0b 3b be c7 f0 c8 b1 88 81 31 fe 64 43 64 4c 2a e9 ef be 6c d2 47 66 5a 87 62 4e 2d b4 5c 88 ec 2b c7 d5 14 7b a8 18 ef c9 18 f9 37 de 6f 8a de 8b c0 bd dc ab f9 a2 81 f8 9e 41 f9 31 e1 13 dc c1 f4 e3 90 49 dd 3f 96 f4 44 fb 66 1a cc Data Ascii: "'tk5[n_1r+B}Yg=?\|8y"_K7a5xYNplEK~mYd+],#3O!XHbOX?QcX9p]GaL`Gb=v28GKL;1dCdLlGfZbN-\+{7oA1I?Df
2022-03-25 19:15:14 UTC	15	IN	Data Raw: 63 63 7c fb bd fb b4 68 bf ed 4f 47 da 6f d5 37 91 f6 db 84 78 f5 d6 53 a8 fd d6 3d ad b7 df 23 4f 53 fb fd 99 b2 a8 03 4f 89 6b 3f 61 76 b3 dc bc 2a dc 6c 79 1c 93 be e6 0e 13 b7 9e 43 6f 3d 71 ff 69 9e 76 e5 5a a6 24 f5 fb 63 59 f8 59 d4 f3 f9 44 f6 1f 90 59 70 e6 f6 e1 cc 19 61 d6 14 7f 89 f4 f9 9e 8f a7 ef d0 53 a0 cf 51 53 bc f7 29 a2 6f 90 6d 63 e6 eb a8 c6 33 06 26 74 7c 14 a1 6f 02 40 7d f8 64 22 74 eb 53 44 e8 0e 44 6e 79 8a 08 7d 8a f2 aa 27 23 ad 67 e3 eb b1 7f 80 e9 fe 8b 49 ea be fc f9 50 48 af 0f 44 d1 c5 c0 81 a4 4b 1e 46 99 87 db 42 21 3a 7d e2 43 44 19 e2 59 86 a8 83 cb a8 92 23 ce 79 8a a7 93 d3 9f 8a 53 b8 ea 0e 44 4d 5e 87 8e 35 10 47 ab ff 02 d8 42 cb a5 e4 28 28 c3 7b 12 7d b7 f1 76 a0 b8 ab 8f bf be f5 c5 ed 8c b5 ef 41 ed f3 7f 7f Data Ascii: cc\|hOGo7xS=#OSOk?av*lyCo=qivZ$cYYDYpaSQS)omc3&t\|o@}d"tSDDny}'#gIPHDKFB!:}CDY#ySDM^5GB(({}vA
2022-03-25 19:15:14 UTC	17	IN	Data Raw: 1e 7b d8 d4 7d 49 6b cc 79 5f c5 f2 d0 3d 26 3e e6 5b 68 09 c2 e7 4b 57 bf ca 12 d6 8c 5b 0a c9 cd 1c f9 28 eb b3 d5 48 54 f3 f3 59 5f 4e 7b 94 d5 43 c3 a3 71 fa f2 05 9f 47 e9 cb ed 36 d6 97 9d c8 27 cc 46 16 b2 d3 51 a3 28 ed 62 00 c5 8c 17 88 67 fa 92 16 f7 e5 e8 53 4e 9d 4b 27 61 d2 b8 93 f1 d4 1e e6 fe 3a 1a 46 f5 51 e8 aa d7 e5 53 35 4f 62 3c 1d b4 b9 73 2a 4e 9d 8d 92 fd 7b f6 e0 d2 50 1f 97 a4 5a 90 8a 24 df 63 3d 83 d4 69 a7 50 0f 9d c2 ef db 66 d1 5b c1 bb 5f fc ba 64 24 fc 13 e5 85 db d7 9a 8f 86 fe 2f 03 7f 0e fd 2d 03 05 fa b5 40 bf eb 64 42 f9 3a bf 07 31 fa 34 7a f7 8b 5f 97 64 3a fd 30 cc 7f 64 3a 0a fd 03 7f 96 fe 81 51 f4 33 ea 29 fc be 6d 26 d3 8f 77 b8 ff 8b ef e9 ee 26 7b 5f 3d eb a9 4d 27 b0 92 7a c9 2c 56 52 97 22 92 b6 ee 85 96 7a Data Ascii: {}Iky_=&>[hKW[(HTY_N{CqG6'FQ(bgSNK'a:FQS5Ob<s*N{PZ$c=iPf[_d$/-@dB:14z_d:0d:Q3)m&w&{_=M'z,VR"z
2022-03-25 19:15:14 UTC	18	IN	Data Raw: b0 fc 3e 01 4b da 4a c6 72 46 04 8b 71 25 63 f9 26 16 cb a7 11 2c bb 05 96 12 75 8c c0 f2 d1 87 11 2c 65 84 c5 9c 80 65 bc c0 12 9a 1b c6 32 4e 60 39 79 65 0c 96 a1 2b c3 58 06 b0 d7 54 a9 b6 4d 66 2c 45 7b 22 58 96 12 96 07 cd f1 58 aa 05 96 96 08 96 9f 04 96 59 b1 58 64 81 85 bc c5 3a 96 2a 81 e5 0c 35 82 c5 55 03 2c 05 09 58 ce ae 11 ed 12 c1 92 57 c3 58 4e a8 89 c1 32 a8 26 4c 4b 32 7b 4d a5 ea 11 37 63 39 6f 6f 04 cb 12 c2 b2 cb 14 8f 65 91 c0 52 1c c1 72 99 c0 32 3d 16 4b 69 04 4b a1 c0 32 53 5d 2d b0 3c fe 59 04 cb 5f 09 cb a2 04 2c 0f 0a 2c fb 2f 0b 63 19 53 cb 58 ea 63 b1 5c 17 c1 72 a5 c0 32 49 1d 2b b0 4c c7 02 84 20 a9 9c 76 94 83 52 17 a0 0c ea ef 70 54 ab 80 ba ea d3 08 54 8b 80 7a 4f 40 f5 10 d4 c7 32 43 b5 77 47 a0 66 9f c7 50 9e 9b 19 ea Data Ascii: >KJrFq%c&,u,ee2N`9ye+XTMf,E{"XXYXd:*5U,XWXN2&LK2{M7c9ooeRr2=KiK2S]-<Y_,,/cSXc\r2I+L vRpTTzO@2CwGfP
2022-03-25 19:15:14 UTC	19	IN	Data Raw: ff 0e 9f b2 5c 9c 0f 8e fb a2 a2 93 ae 5d cf 10 bf 02 54 fc 6e b5 89 0f 47 57 ca 45 3b 3d 81 cb b3 ab 6c 1b f7 62 7d 55 dc 8e f8 a6 ae 64 71 e3 6a 81 20 93 ae 5b d3 d7 68 98 0e 36 71 5e 27 64 31 57 d9 37 21 6c 36 5a 80 68 c4 79 14 15 f6 4f ae 58 2f 9d 8c 9b 5c 3e f7 35 ca f5 24 92 39 cb 04 4e eb 2a 6a 5b 3e 06 f1 9e b9 9f 53 e6 09 29 5a 6a 36 52 dd a6 57 e5 b9 3b e4 a2 8e 95 a9 2e e5 df ce e7 0d f8 a0 64 0e 8e 5a 32 ec b6 72 e5 d5 a6 f5 7a 61 df b9 b8 30 42 64 06 94 31 84 29 a2 39 06 dd db 2e 9a 85 6e aa e6 c9 25 b7 0d e6 9a 72 a5 9d 0f e9 36 35 59 b5 3b 09 4f 03 06 45 f8 8c a1 56 cf dc 56 ce ae 27 ad 66 04 bd b9 b8 85 0f 08 e2 73 a5 4f f6 cc 6d 23 a0 f5 3a d0 35 00 f2 14 f5 f9 86 71 f5 da 23 c8 67 72 c2 1e df 50 3d 41 cf 51 8c 84 f0 67 8e ba 92 b5 d8 51 Data Ascii: \]TnGWE;=lb}Udqj [h6q^'d1W7!l6ZhyOX/\>5$9N*j[>S)Zj6RW;.dZ2rza0Bd1)9.n%r65Y;OEVV'fsOm#:5q#grP=AQgQ
2022-03-25 19:15:14 UTC	21	IN	Data Raw: 40 18 14 70 19 17 73 1e 88 be 03 d1 18 b9 95 25 36 f8 6b 6a 57 6a ac 5e d7 68 a5 96 74 87 bc 7d 7c 66 f6 68 66 a3 f4 cc 7a e0 1c d9 51 66 27 00 00 b8 4c 3d b3 d3 70 ce fe 49 5c 66 68 bf 96 59 eb 28 2d b3 d4 48 e6 1b 00 6a 97 d9 21 91 59 c3 28 2d b3 34 f8 fd 15 99 e1 93 a1 57 96 f4 8c f6 ef 01 01 7d 2f a0 71 8f 18 cb 0f fe 36 e2 f3 6b d2 2b 67 8f 64 4e 8c c1 91 ef 0d 00 bd 83 58 2c a3 c4 4f e2 8e bd 20 06 01 5f 1d 04 d1 c0 10 19 80 58 cd 10 e9 31 08 78 ec 20 88 17 19 22 0b 10 d7 33 c4 c1 1f c7 4a 09 76 23 88 47 18 a2 3f 20 c6 30 c4 1b 31 88 6b 45 73 ee 65 88 5c 40 e4 32 c4 9f 7e 4c df c3 ea 4a f2 4c 46 31 68 e5 20 cf 77 9a b2 b4 b2 74 70 df 50 38 c3 62 8a ad da 67 62 5e b2 9e a4 b3 01 52 ab 6f 3e cf 58 d7 67 46 c2 12 fb f7 0b f9 d0 de 73 86 be fc 0d 38 7e Data Ascii: @ps%6kjWj^ht}\|fhfzQf'L=pI\fhY(-Hj!Y(-4W}/q6k+gdNX,O _X1x "3Jv#G? 01kEse\@2~LJLF1h wtpP8bgb^Ro>XgFs8~
2022-03-25 19:15:14 UTC	22	IN	Data Raw: 47 d9 b6 4c 37 ac 8d 4a f7 bf 98 9b bf 85 ae 82 40 a5 f8 f3 fd a6 69 18 76 62 18 f1 c1 20 d6 ff bf fb 61 f4 9e 28 4f 9d 7d 88 97 db 3f de 64 90 a3 cb 13 36 ab 23 c9 e7 88 6e a3 f3 1f f2 d2 bb 9b 77 31 f0 7f 38 9b b4 9b 10 b3 6e 74 6c d3 9d 8c 6f 7d d3 cd 17 20 23 a3 41 52 79 93 46 00 64 89 a8 21 88 82 fc 1d d2 ae f3 20 0f ca e0 2c 01 0d fa e7 7c 62 d4 3c 80 cf d8 6e 18 6f 2f fc c3 a9 28 fb 73 f6 15 de 0a 60 a2 4b a8 36 0b 50 f9 1a b5 0f a1 d6 74 f4 54 8e 39 90 bc 6e 3e c2 f2 df 15 b5 10 f5 7f e6 3c 4e 71 21 52 84 27 dc 8a 18 1d 1e 10 58 f1 1e 40 de 02 b0 52 00 f6 64 c0 85 ed 00 6f 8b 02 4e 15 80 1f 4f 25 c0 45 ed 00 6f 88 02 e6 0b c0 57 19 70 71 3b c0 89 51 c0 1e 02 f0 57 0c b8 a4 1d a0 33 0a 78 60 18 03 fe 82 01 2b da 01 0e 8a 02 ae 15 80 2e 04 88 ce d0 Data Ascii: GL7J@ivb a(O}?d6#nw18ntlo} #ARyFd! ,\|b<no/(s`K6PtT9n><Nq!R'X@RdoNO%EoWpq;QW3x`+.
2022-03-25 19:15:14 UTC	23	IN	Data Raw: 81 75 ab 6c 6c 9b 3a 6a d5 37 a3 81 be 25 b2 4b 3d 48 49 72 85 4c 64 78 cb b5 b2 88 4c a6 ba c8 8f 56 70 43 ba 1c c6 b1 eb 61 d4 be aa c5 93 90 e9 53 dc 44 d2 32 c5 90 d1 43 22 ce c2 40 25 25 84 8b 8e 52 36 bd 5a 4a b6 bb e8 d8 c7 96 f9 af a0 6c a4 60 89 2d 97 d7 59 ed b0 da 5e 1f 03 fe 77 72 78 9e 95 30 9d cd 9b 1c 30 45 5b 09 b6 82 6f 99 13 25 b5 0b 54 cf 47 4c 6a 5f 74 2d 9d bf 11 e0 4f 8b de fa ac 83 de 0a bf b5 b7 af d9 de 47 60 ab c4 57 66 dc d7 50 70 63 75 46 a1 7d 5a 7b 4b 1a 71 64 c2 d6 7b 48 d3 ad 65 fe dc 5b 24 e7 e1 b9 e7 48 ce 5d f3 ce 92 1c 5f d2 a6 49 c7 7b 47 23 ad 74 3f d9 44 d5 49 91 c2 c3 9f 6b b1 c7 82 07 22 b8 0a cb 94 8d 33 4e e1 8c 39 92 34 89 cb 84 12 f1 36 60 af 3a e3 61 02 44 cf 69 50 cc 0b fa 30 49 32 5f 65 4b d4 a1 e8 50 5f 15 Data Ascii: ull:j7%K=HIrLdxLVpCaSD2C"@%%R6ZJl`-Y^wrx00E[o%TGLj_t-OG`WfPpcuF}Z{Kqd{He[$H]_I{G#t?DIk"3N946`:aDiP0I2_eKP_
2022-03-25 19:15:14 UTC	25	IN	Data Raw: cb 36 1c 16 e9 43 7d 14 6f c2 f0 32 7a aa 37 b8 58 75 30 d1 f8 37 f6 8d f4 a0 76 e9 36 e0 3d 70 da 90 dd 2e fc 44 b3 1b 62 cc ee 7e 64 22 c4 62 8a d0 6e cd 77 a4 20 c2 0d f4 f7 52 a2 1f e1 5e 71 3d e9 7f 98 f9 5c 8f fb 6c be 2b 86 fe 6f 56 54 54 78 31 42 d5 e6 39 dc ee bf 8c e6 79 61 d8 29 ab b2 12 90 ad 0d 72 c6 7d 93 4c bc 17 8e 28 11 f8 b6 70 74 7b 7c 9b 9c 65 c4 b7 6d a0 33 90 8a af 97 b5 a4 49 9c b4 68 74 7b bc eb 9f 65 10 f8 3a 64 8e 57 7e 8f d9 2b 7b 1a 49 51 ff d7 2f 45 fd 7f 8a fa e3 fd 2f f4 1e f6 73 8a dc 66 3f 0e de a2 3f 62 d7 66 0f 16 26 5c 9b ed 11 68 b3 d6 63 44 9b 7b b9 ae 69 cf 7b e2 2f cc ef f3 c4 30 7c 1e 40 82 4e 48 3b e0 a6 78 98 60 e8 f9 a3 d1 ba 62 8a 96 dd 58 c0 62 88 bf 7a 58 bf f4 b2 af 60 1d 64 08 be 81 af 97 69 bc a9 a2 7b 8e Data Ascii: 6C}o2z7Xu07v6=p.Db~d"bnw R^q=\l+oVTTx1B9ya)r}L(pt{\|em3Iht{e:dW~+{IQ/E/sf??bf&\hcD{i{/0\|@NH;x`bXbzX`di{
2022-03-25 19:15:14 UTC	26	IN	Data Raw: 33 45 b2 52 47 63 0e 4e ab 3a f1 6f 7a 4b 47 fe 4d af d0 4d 72 78 75 93 1c a3 d8 24 c7 8f a8 66 29 9b 4c 09 fe 40 b3 c8 6e cd 03 92 c2 a5 73 d1 53 75 92 5e 4d 4b 63 ff 9f fc 34 f3 f3 78 2a 3d ff 4e 4f fe 8b b5 c7 ef 88 31 81 c4 0a 4a 84 73 c9 fd 06 0b 61 71 07 ab 7f dd 9f 26 33 a5 db fb d3 d4 99 d1 88 9d 42 d4 7c 0e 2d 8d b9 b4 f2 a5 b2 98 d4 36 b5 e7 9d c4 27 8e 00 8d ea 99 d4 29 6b d9 1d ef 7e fc 8d 44 ff 99 89 65 b4 79 b9 85 04 31 9d e8 43 19 26 82 a6 52 56 33 a9 9c 12 f2 db a9 94 58 43 ba db 4e 1a 36 b6 f2 16 9e c0 de 46 d4 eb 93 c9 70 4e 78 5e 1e 8d 76 2e 82 d1 f7 6f a9 2f 02 c7 01 2a b1 7f 2a d8 4a a1 0c 67 53 ef b5 3c a0 f9 f6 d4 7d 68 7e 1f 7f a2 8e a8 3f d1 d3 a9 5e 28 cc 86 3a d8 d4 27 a8 0e 28 26 5b 77 21 9a dd d2 88 62 e2 7b a2 5d 7f 74 ec 18 Data Ascii: 3ERGcN:ozKGMMrxu$f)L@nsSu^MKc4x=NO1Jsaq&3B\|-6')k~Dey1C&RV3XCN6FpNx^v.o/*JgS<}h~?^(:'(&[w!b{]t
2022-03-25 19:15:14 UTC	27	IN	Data Raw: 43 12 3e 32 c2 6e 6d 13 1d 3a 5b a6 d5 f5 fa 38 af 88 45 ed 4c f0 f3 7a ea ba ac 13 81 1c 3e 88 f8 94 d6 4e a8 a1 29 ed a9 a1 8f c0 2a 56 8f bc 49 d4 50 af c7 63 d4 10 53 41 6b 89 0a c2 5d 95 41 da 66 ab 8f 46 7d 37 9d 59 be 5c 0c 70 e1 58 c1 28 64 a3 a0 06 82 21 56 fb 9f a8 ef 70 aa 6f 09 d7 f7 ea c7 be 57 7d ef 3a dc e5 fa f2 c1 af 5d 95 67 52 95 67 fb 94 b6 4e 6a 7b ad b4 f6 4f e2 af 87 5e db db 32 51 db bb df a0 da 9e e3 30 52 38 4b bc e1 e1 9b 34 7a 53 0e a7 76 33 d4 7c 7a b4 e6 f5 5a cd 6d a8 b9 1c b6 fe 44 af b9 40 39 7d 7a c4 56 bc f8 f5 9d fa 36 8b dd 30 83 65 f8 39 ed c0 2e 7b 3a ca fb d2 07 44 0a 4f 6a 95 71 61 35 c4 d3 0a 36 bf 7a a1 99 d8 9f 17 49 c1 2d 68 68 05 82 1a 60 50 96 05 7c ed b9 80 08 5b b3 66 d8 97 d0 cb e5 df d2 fa 79 ae 0c 80 63 Data Ascii: C>2nm:[8ELz>N)*VIPcSAk]AfF}7Y\pX(d!VpoW}:]gRgNj{O^2Q0R8K4zSv3\|zZmD@9}zV60e9.{:DOjqa56zI-hh`P\|[fyc
2022-03-25 19:15:14 UTC	29	IN	Data Raw: 78 b6 54 bf 82 0f a3 c2 17 1d a2 f2 77 08 77 b6 e7 e0 4a 9e 22 57 6a 91 20 81 8b d0 81 6e 66 c6 0b 03 1d db d4 83 a3 78 ed 9d 88 7c b0 e4 9e e1 55 44 66 3a d9 c2 19 8d 79 92 69 6c be b2 d3 fc b9 65 53 49 53 28 dd 74 5a 9a d7 de 48 93 c0 0d ab 7c 0e 46 0f 70 2b 85 3f e2 07 c0 2b 6b 49 a1 46 99 a7 ac 85 a0 13 ba 40 08 3a dd f6 38 0b 3a 51 67 09 b1 0c f1 d7 85 fe fc fc f4 ff 51 7f ee 6c ed 42 7f fe 7e e4 77 f7 e7 37 7f fc ae fe 9c 79 43 27 fd 39 fe 8f 9d f4 e7 4f 1e eb ac 3f 3b e7 77 79 71 ce 31 32 13 e5 74 0f 8c 78 96 7f 90 ff 05 16 68 be ac dd 13 bf e8 7a cb bf c1 e5 da ea df b1 4e c3 51 dd ff 21 08 47 9f e5 2d 57 b0 30 29 30 06 9a 0e 50 1d 5c 5c 3c 26 3c f2 51 8a 84 0c 04 13 20 bd dc 4a 46 5f 0f 31 0b 5d 8a 6c b5 34 b0 ea ed 58 1b 22 46 3b 33 96 07 7a f8 Data Ascii: xTwwJ"Wj nfx\|UDf:yileSIS(tZH\|Fp+?+kIF@:8:QgQlB~w7yC'9O?;wyq12txhzNQ!G-W0)0P\\<&<Q JF_1]l4X"F;3z
2022-03-25 19:15:14 UTC	30	IN	Data Raw: ac f6 29 b5 a1 24 0e 57 c6 02 d9 6a 13 a2 43 49 9e ca 88 7d e5 46 a2 a7 94 dd 6e c7 2e 8f 65 67 95 07 1d b5 f2 cf 4c 58 fd 2c cf 57 7e 4c 16 ad 92 c3 19 2b 5c 7a ab 94 24 6e 94 02 28 ce b9 fc 33 49 d9 a4 67 8e b6 6f 8a 41 cd f9 39 a4 ff 94 f1 56 17 f8 06 e5 0d 2e cb 36 59 f1 d8 a4 f2 ed 5e c5 84 37 24 b7 95 28 d6 95 85 d6 5f 06 8a 50 92 2b b2 85 b2 71 e1 68 88 4b a0 15 d8 99 57 a0 a2 ad 21 33 f2 a7 92 82 1f 1b 9b 68 7f 52 75 c1 c2 7e 28 c9 1e 1a 8d d9 e3 a2 1b 4b 3a 1e 4c 77 62 84 c2 35 82 1e 76 3b af c0 c7 b3 dc 20 5c a2 97 1f 44 56 5a 83 6e 8b ab 2a 1a 14 12 0d 42 b3 77 e2 34 af 97 84 66 6f 30 34 e8 67 7a 83 6a d1 20 cb 5b 9d b6 e7 62 14 14 e1 be 43 ad d1 9a db 50 3f c5 8c 3a 87 cc c8 9c 8a 01 5f 3e 61 c4 1a 43 49 54 f7 55 a5 68 0e b7 24 52 c7 df bf fd Data Ascii: )$WjCI}Fn.egLX,W~L+\z$n(3IgoA9V.6Y^7$(_P+qhKW!3hRu~(K:Lwb5v; \DVZn*Bw4fo04gzj [bCP?:_>aCITUh$R
2022-03-25 19:15:14 UTC	31	IN	Data Raw: 74 a1 3e df 78 bc 68 e6 5a ed b1 19 87 b1 39 68 9c f0 f5 62 c2 a3 3e 0a 0a 10 f3 7d 21 ea e2 72 d6 da c3 ef e0 45 c6 4d 86 d9 57 7e 18 49 ee e2 09 5f 8f 09 7f 82 e6 1d 02 78 c2 ef b7 52 d9 98 f1 f5 54 fc 0f 3d 8a 2d 36 e3 b7 cd a8 72 3b bb c7 15 7f c8 38 e1 eb 69 c2 1f c2 a8 7d 80 39 72 c8 1a 41 1d 30 e3 7d ce b7 ec e1 89 54 0b 2c 19 63 c3 fd 43 2e 4b 11 e6 4f a3 5c 0e 6e 3d 16 e0 f1 e1 fe 77 11 8f 46 12 fc d2 46 7b 78 30 80 c7 94 5f 7f c8 2a 04 e1 9f 16 13 0b 74 fc 9b 0a f8 35 85 ee 3b d2 ed 95 16 b3 98 6c 08 97 cb 8b ac 54 c9 e2 58 ec c7 b4 93 78 34 7c 40 3e e0 ed b8 22 45 c0 0b 10 6b 28 52 c6 37 aa b5 e8 97 cd af 02 90 2b 4d 35 e6 59 ed ac b3 87 9f e4 25 00 a4 21 e4 a7 78 7a f3 fc 8e e2 cb 44 aa 19 84 42 52 ef 42 d2 1e 5c 64 60 21 cf f1 62 33 09 b0 72 Data Ascii: t>xhZ9hb>}!rEMW~I_xRT=-6r;8i}9rA0}T,cC.KO\n=wFF{x0_*t5;lTXx4\|@>"Ek(R7+M5Y%!xzDBRB\d`!b3r
2022-03-25 19:15:14 UTC	33	IN	Data Raw: 94 2f 93 1c 6f c5 a4 b5 84 8c 6b 52 ec 04 17 af 23 d1 4d 7d 84 94 23 40 c1 5d 6a f0 18 5c 58 74 b4 6e a0 bf 9b ba 92 e3 94 d1 38 78 d6 cd e9 a6 2e e0 4f 47 ab 14 3c 69 9b db 4d fd 05 7d e2 7d 30 72 b9 52 40 b6 52 45 ce 5a 41 5c 56 6a c6 14 1f 26 f7 8a 3b 31 6e d4 f0 e9 44 de af 28 63 22 74 49 91 1c 35 b1 60 7f 71 2a d1 24 e3 5b 49 fc ac 1c cb b9 66 66 41 c6 49 e8 76 3a 28 25 98 5a c8 83 a9 05 7b 25 1f 91 84 b9 05 7b 70 2b 3e 34 93 0b f6 e5 6b f1 81 b7 c1 f6 db 9f 60 18 f8 3c 0a b2 b2 5c 2b fe db a4 d0 85 28 ab 89 ca 9a 8f 6e dc ea 0d 97 e2 3c 30 79 bf ba 53 8e 44 38 46 29 55 45 0d 92 a5 75 b1 bd 77 83 fd 76 32 5f 84 5e 4a 36 9a 7c 98 af 9b 7c f8 b9 56 fe 9c cb a9 ec 79 e3 a8 dc 0c 2a b7 be b4 09 e9 d0 23 28 7d 3f fe d5 96 24 bc 93 fa 7d b8 b4 1a 47 46 bf Data Ascii: /okR#M}#@]j\Xtn8x.OG<iM}}0rR@REZA\Vj&;1nD(c"tI5`q$[IffAIv:(%Z{%{p+>4k`<\+(n<0ySD8F)UEuwv2_^J6\|\|Vy#(}?$}GF
2022-03-25 19:15:14 UTC	34	IN	Data Raw: 02 a2 0a 2c 5f 4e 9b 6c 64 83 17 9d ca 0c d6 1a 68 2f 90 7a 2a 74 57 2d ec 22 da b9 19 fa 1d d5 c0 26 d9 5e 82 a9 36 5e 55 97 6e a5 e6 1b a8 c3 00 33 ef 5a 66 d1 b1 e8 46 6e cd a4 a5 f1 8d f1 ac fc 8e b6 4c 5a 05 89 80 6c 2c 24 6d 30 d1 d7 aa 75 36 97 76 cd 5b 09 a5 d1 f9 60 a5 84 ae 0e 96 b6 da 64 5c ff 06 eb c0 a2 3e c2 03 62 5f f5 07 2c b6 f9 47 99 c2 ed 85 3c 98 b8 dd 69 12 c4 ad 9e c3 0d d8 15 3b c6 cf 7b cc 9d e0 e7 ad 66 03 7e fe cc 6c c0 cf 89 66 1d 3f dd 66 81 9f 7f 9d df 21 5d 3b 2a 8e ae 3d 8e 3b 75 bc 34 79 41 d7 6a aa 60 68 6e 93 fa e1 ad 91 c8 77 12 a7 f6 ca 1f a1 ca df 13 35 f7 2c 6c 8f 9a 8c 58 f7 42 21 a5 0b e8 f9 47 cc 14 e3 ca de 7c 0d d2 61 a3 f2 ec 47 d7 6b c2 69 58 81 34 65 e0 48 35 ed 5f ce 62 6b c5 b8 e6 f1 5f 83 90 de b1 9e 08 e3 Data Ascii: ,_Nldh/ztW-"&^6^Un3ZfFnLZl,$m0u6v[`d\>b_,G<i;{f~lf?f!];=;u4yAj`hnw5,lXB!G\|aGkiX4eH5_bk_
2022-03-25 19:15:14 UTC	35	IN	Data Raw: 8b bd 29 7a 9d 15 bb 2b ba 53 cf 35 1f 46 07 24 b4 f2 fe 84 56 5e 6b 68 e5 94 ae b7 32 2d 5a dd 01 a8 6e 42 0b 7f 92 d0 c2 1f 24 24 f9 ac 06 49 3a 69 9d 5b a9 78 c9 ab 04 d6 eb 33 32 56 95 f6 73 13 5b a1 32 1a 94 6a c5 36 cc 51 9a 4b 44 db 0d 47 83 fb 62 bd 32 f2 20 bd 3a 0f 72 94 ce 83 3c 9f 79 90 83 88 46 ac ba 91 44 9e ea 09 41 c8 bd 1d 21 86 db b9 d8 8a 8d 70 2f a8 2a f5 d1 17 f9 fe 8f 9f f7 f0 f3 57 f4 44 71 03 69 13 7c fd 06 6a 13 61 24 d3 40 55 a6 78 36 e0 a9 ed 4b 65 fb ca b1 05 7c 06 84 f5 29 1b a1 5e 0c 44 62 e4 8a 64 0e 7e c9 6c 22 1b 50 64 8b ab 8d ec d7 d3 35 1d 59 ca 6c 96 1c 2d 52 70 53 0a 54 7f 71 df ba 47 b2 97 1e 92 2a bf f0 0f 33 de bf e3 ec d0 d3 ab 54 83 68 cc 2e 0e 67 14 a8 43 4b 11 0a ea 3c 7c 85 0d ee 00 03 ef 23 da f5 72 12 40 51 Data Ascii: )z+S5F$V^kh2-ZnB$$I:i[x32Vs[2j6QKDGb2 :r<yFDA!p/WDqi\|ja$@Ux6Ke\|)^Dbd~l"Pd5Yl-RpSTqG3Th.gCK<\|#r@Q
2022-03-25 19:15:14 UTC	37	IN	Data Raw: 46 ce 41 10 81 28 88 50 10 e4 a3 20 4f 10 35 d1 04 26 fe 41 83 e0 3d 1f 64 6f 39 ac 02 0e e8 23 1a f4 11 21 41 50 4a e0 22 a0 24 9b e4 04 74 ce 0a db 63 af 23 7d be 69 0f 6e 41 41 f3 94 3e 15 d3 4f 2d c1 fa bb 38 9b 4d 16 05 70 0c b5 0c af df 2b a9 28 d0 d7 ee a2 3a 98 88 ec ef 1f e5 72 d4 c1 13 0f 2b 9b 8f a5 83 23 1e ca a5 eb 1c 74 ca 03 d8 38 64 f6 75 ee df ea 6b 9d 34 d7 a6 a2 cd 3b 3c 46 46 42 d7 f8 a7 db 58 62 a2 7e d1 a1 5e d8 c1 e1 b8 75 9f a3 f4 77 45 eb a2 0d 28 3b e9 0f dd f2 94 44 46 9a ac 6b 6f c2 70 23 a6 8c 5c f3 04 de f5 81 4d 03 af 87 0c 50 da 9c 59 f4 ff b3 a0 e8 08 25 3c 47 03 25 ee 0d 6e 2f 8b e0 fc 42 64 03 39 e2 ac 72 76 38 af 94 09 f5 7c e4 4b 3b 06 b5 e9 c7 81 a3 7d 74 1c e8 3f 1f 94 88 86 af e8 9f ab 06 73 bb e7 ef ec d2 f2 6d 64 Data Ascii: FA(P O5&A=do9#!APJ"$tc#}inAA>O-8Mp+(:r+#t8duk4;<FFBXb~^uwE(;DFkop#\MPY%<G%n/Bd9rv8\|K;}t?smd
2022-03-25 19:15:14 UTC	38	IN	Data Raw: 3a 8f 43 b7 3f d9 2d 6e 59 3c f4 29 0a 0d 73 68 68 dd a3 54 1b 17 db a8 36 98 1a cc 68 8c 88 7f 15 35 ae 49 d3 50 55 9b 06 e6 68 d9 02 f5 3b 2b 70 5a 6b 09 56 43 48 56 f7 2e d1 23 c2 a6 42 f6 55 1f 5a 57 27 51 9a 8b 91 26 1d de 3b 48 e5 53 e1 e8 41 b5 f7 46 47 c3 9e ce d0 ba 0c 7c 21 70 24 02 87 07 eb 4e 86 d6 91 ac 77 a3 ab 03 41 59 78 83 d2 fc 39 4c b5 89 3f 25 ad e7 53 89 22 f9 28 26 41 6a 49 92 84 a3 e5 29 0d 22 8e cb fa 42 9d a0 13 d7 ad 2b 4b 89 da 57 3c 2e 71 e4 e0 00 96 96 d0 a2 54 b6 4c bc 88 f6 b4 51 b6 99 a3 22 7f e0 4f 48 f1 6e b6 f9 6a 44 39 a3 e5 6e fe f7 c3 fe 2c d5 c9 e9 54 15 9d c8 82 57 f4 77 48 d9 d4 50 3f 03 7d 72 15 af a2 77 65 32 06 53 e4 31 4a b9 45 c7 43 55 bf 98 49 cf 7d 3a ea e3 99 02 15 a0 a8 fd 01 22 89 61 51 8a dd 30 8e fc fe Data Ascii: :C?-nY<)shhT6h5IPUh;+pZkVCHV.#BUZW'Q&;HSAFG\|!p$NwAYx9L?%S"(&AjI)"B+KW<.qTLQ"OHnjD9n,TWwHP?}rwe2S1JECUI}:"aQ0
2022-03-25 19:15:14 UTC	39	IN	Data Raw: 52 3c 63 5d ca e4 2c 92 03 32 09 8e b7 55 c4 b3 74 89 f7 92 1e ef cf 1c ea 29 c8 3f ee 0d 79 9c 1e 05 d7 be 16 64 11 43 82 bf 5c 57 61 60 ac f5 9e 49 bc 8b 65 23 68 44 88 16 42 18 11 aa fd 9e 0f 98 76 81 10 66 a6 5e a4 74 50 d5 0b 98 9b 24 7f aa 0b d7 cc 23 63 37 59 c8 b3 e7 65 11 c7 26 13 83 2c 91 61 9b 52 f8 2d 23 d2 7f 93 8d df 4c 91 4c 8e f9 36 68 e3 33 8b 3f 36 33 3b 32 21 5a 84 83 79 4f 93 5b e9 0c 58 c8 61 ee 9f 38 7d 8f 93 05 26 c8 a9 f2 b5 0c 9f 4e 6e 64 a9 80 b5 f9 31 89 2d bd 04 82 73 bc 39 da d8 ad 52 91 47 0e f4 d1 15 5c 0b d4 bf 5e 4a 0b e6 74 27 8d e6 5e 54 68 25 63 53 a8 b7 f2 75 64 68 32 e6 fd c0 e4 a4 30 1f a7 84 f2 a0 f2 ea 34 c1 d5 12 5d e5 ca df 4b 95 89 3d 12 fc 9c df 07 76 a8 89 78 ae c8 59 02 f8 36 34 33 f2 f7 46 ed 7f a7 90 1d 5c Data Ascii: R<c],2Ut)?ydC\Wa`Ie#hDBvf^tP$#c7Ye&,aR-#LL6h3?63;2!ZyO[Xa8}&Nnd1-s9RG\^Jt'^Th%cSudh204]K=vxY643F\
2022-03-25 19:15:14 UTC	41	IN	Data Raw: 3a b6 bb 8c 1f a2 be dc 4a 23 6c 03 87 dc 54 8e b9 77 49 06 bd 5a dc b0 db 04 52 2d 7c 96 a1 13 73 39 a2 73 51 f2 03 74 13 54 54 ed 5c f8 26 78 0f cf 5c 83 22 00 24 2f ca af d3 fb 56 ac 0a dd a2 3f 7a 15 37 b6 9c dc 17 57 52 8a 6e 1e 34 68 bc 64 75 f6 24 16 27 71 bd 74 91 37 7c 3a d7 c8 8f b2 82 0d 46 76 ef a8 fd be 10 28 c1 65 10 2d f1 1a 68 8d 00 d9 b8 5f 0b d0 61 01 ca 06 28 47 03 1d 10 a0 9c 2e 92 f6 e0 c9 c9 c4 30 b9 70 71 4a 0a 0c 77 59 5f b9 d2 56 f9 c5 20 13 a4 e4 e9 f9 75 c1 93 52 e0 ac ea 2b c7 36 02 ee 3a 0b 87 2c 38 67 42 25 fd c0 f9 0a 76 d5 42 00 53 79 d2 4e f2 84 75 ed f4 5b 65 c2 6f 78 fc e9 a7 d1 bd 71 5f e7 2d ea c0 27 ad d6 aa e7 f9 65 b2 7f 48 e5 49 1b e1 ad 3d c2 36 0e 92 37 62 5e 45 62 35 c0 a2 7a d8 4a c2 a0 af 1d 68 42 7b b8 0a af Data Ascii: :J#lTwIZR-\|s9sQtTT\&x\"$/V?z7WRn4hdu$'qt7\|:Fv(e-h_a(G.0pqJwY_V uR+6:,8gB%vBSyNu[eoxq_-'eHI=67b^Eb5zJhB{
2022-03-25 19:15:14 UTC	42	IN	Data Raw: bb 6e d9 69 29 cd d6 e6 cc f1 16 99 2e 76 f4 a6 6e 07 67 cb 5e 9c 1b f2 ec 48 c5 25 5d 6d 9a 4d ca db 49 6c 96 78 7f 26 0d 1b 67 a8 91 b6 9a 94 ac 56 75 30 81 a2 60 57 3f 5a f9 79 c2 1c a4 dc ac 1b 0a f6 90 62 ae d1 48 19 fc 80 f6 97 94 f4 42 d2 7f fe 43 4c 94 23 93 4d 7e ec 35 21 09 38 88 72 42 18 d0 4a ca cf e5 e4 f8 b5 34 74 53 4b ed 57 58 6d 20 1a 80 90 6a 54 50 4a 3c b5 55 5a 79 b7 98 0d a8 a6 7e 7e 61 f6 73 92 c1 fa ba ef 3a 8c 3b 17 84 1c ac 1f 12 bf 76 1c ad 87 ef 03 b6 51 ad ee 3b a5 1d ce c2 37 17 ee 4b c0 14 fe ea 6b c1 a5 5e 7b 9d 01 d7 44 af 91 c3 83 1b 9e c5 5e 31 9c 31 00 ea d9 7d d1 64 55 7b fd 63 5d d6 d7 1b 49 2f 02 f7 36 a0 1b ec 68 94 61 f0 dd 58 df c5 7e 6d 35 fa 98 57 42 14 39 ec 94 aa f6 06 be 86 6c d1 03 3b a7 35 ac 42 a0 e5 fd 53 Data Ascii: ni).vng^H%]mMIlx&gVu0`W?ZybHBCL#M~5!8rBJ4tSKWXm jTPJ<UZy~~as:;vQ;7Kk^{D^11}dU{c]I/6haX~m5WB9l;5BS
2022-03-25 19:15:14 UTC	43	IN	Data Raw: 62 e7 35 6d 59 99 89 f6 4e f4 3e c6 f6 4e b0 19 20 3f 08 ff f5 99 fb da 8b 20 a6 d9 b2 94 3a d3 f3 fc bb 89 7f 1f e7 df df e1 37 79 3f 77 c2 55 73 36 b3 cc 99 f7 fc 91 af f1 ca e5 ef d5 76 b2 e8 64 ce 32 66 df 97 30 7c 37 82 6a 4f 32 bc 54 c0 af 07 5c b3 1b 71 82 e1 17 0b f8 64 c0 05 51 04 69 a4 06 88 a0 fc 64 52 29 02 3e 30 91 54 d2 ae f1 e3 a5 dd ce f3 9c cc 7d f0 84 c8 1c 01 a2 22 d7 7c 19 11 5c 15 b3 e2 b4 20 cf 03 6f 1e b5 3f 82 f8 d8 bc 3c f9 58 17 ae 1c 92 c1 91 2e 5e e6 d6 20 1c 1c 9b b8 b8 2f 58 de f0 32 f0 85 37 02 9e ff a5 30 64 a7 b4 bb 95 6f 5d 45 1f 5b d7 93 bd dd 7b 61 8b 48 bb 4e ff bd be 02 17 02 1b 3a 28 e5 80 77 e1 3a 87 01 ae c1 46 f5 d2 60 99 71 d8 14 91 22 4f ce c7 97 48 06 a4 b1 2a 7d 7c 38 23 b7 e8 c8 9a fe f8 08 98 e0 67 b1 0f f8 Data Ascii: b5mYN>N ? :7y?wUs6vd2f0\|7jO2T\qdQidR)>0T}"\|\ o?<X.^ /X270do]E[{aHN:(w:F`q"OH*}\|8#g
2022-03-25 19:15:14 UTC	45	IN	Data Raw: ec e4 bd 08 4f c8 5f a8 2f 67 31 33 84 b4 60 a5 93 f3 85 a8 51 fb bc 5b 38 6b 95 80 f3 61 5f 3c 5b 73 63 d9 e2 69 e0 f2 5b f4 21 cf 93 06 a6 79 ce 47 2e c0 9c 70 08 45 e2 9e d0 f3 79 ca 7b 82 55 66 3e 19 34 98 65 3d 7c 33 ca c0 e4 99 4d e6 91 d0 1a 87 9d 10 b0 2e c5 aa 41 70 0f f4 c5 16 07 3a 88 b5 39 5c 6b 27 d0 ab a1 04 a8 10 b1 f2 49 d9 b5 e7 5a 88 85 b0 ea 13 c4 62 01 1f 54 fb 7e 2f 01 ef 9e 50 19 50 c4 79 52 ed 1b 3c bb 1c 94 08 d5 04 54 66 40 f2 6e 96 00 b4 51 91 1a 44 43 21 c9 63 90 7f df 2c 06 d8 1f 7b e9 c0 59 fa 55 a4 d3 37 25 71 f8 82 3e 8f 2f 0b 93 05 b6 29 6a 7f 07 78 00 26 d0 05 b0 4e 03 fe 91 73 6c 90 38 48 a7 fc 04 02 93 fb a3 e8 84 1b 37 a6 b0 40 ae 84 fb e1 0a e0 29 2d a1 09 c3 eb 4f 5a 5c 5b 3f c1 c0 c4 1a b1 ab 76 88 70 43 d1 52 df 69 Data Ascii: O_/g13`Q[8ka_<[sci[!yG.pEy{Uf>4e=\|3M.Ap:9\k'IZbT~/PPyR<Tf@nQDC!c,{YU7%q>/)jx&Nsl8H7@)-OZ\[?vpCRi
2022-03-25 19:15:14 UTC	46	IN	Data Raw: ab 1c 66 83 98 6f 71 9f fb 7a dd ec 51 a0 9f 50 cf 2b 48 bc 3f c9 b6 f4 94 77 81 37 4b e2 2e f4 3e 5a 8f 75 e4 a2 f6 bb 6f 60 be 97 a0 c3 63 78 b7 82 9e d2 52 43 d9 a7 c9 62 1e 93 6f 25 f2 26 88 35 8a 84 1c 17 40 12 71 b2 ca 0f 8c 8b ab 7b a7 b0 f5 ec 9a 68 14 ba aa 85 72 4a a0 57 a5 8c c5 d1 69 88 a4 55 ca 26 7a 61 ae 17 a9 76 cb 60 cf f6 33 e2 53 74 da da 58 5b 2e a3 8b f0 2e b7 55 f0 48 9a 32 0b 6e 8f 5d bc 18 d7 2f 42 7c 57 11 e1 3e 11 be 3f e4 9a 16 96 cd 58 17 ae 63 4d c7 30 56 a5 9a 32 e2 a7 0c 38 86 3d fa 0c 96 d5 c3 e0 6b 69 53 40 50 de 73 11 4b 63 c4 1b 6b 96 0f 17 bb ac a7 66 61 20 59 35 0c 19 f2 71 7c f3 2e 8d 87 2b 80 24 9e a8 9d a5 a7 b1 10 4c 01 93 07 ca 42 50 01 4f cd 89 f8 73 9c 7c 1f e1 5a 89 ab 82 fc 55 53 db 87 b2 c5 ed f7 0a 71 fb 3d Data Ascii: foqzQP+H?w7K.>Zuo`cxRCbo%&5@q{hrJWiU&zav`3StX[..UH2n]/B\|W>?XcM0V28=kiS@PsKckfa Y5q\|.+$LBPOs\|ZUSq=
2022-03-25 19:15:14 UTC	47	IN	Data Raw: bd c4 5b bb 66 18 01 82 d1 a6 3e 33 45 a3 d5 4a 22 d5 02 dc 23 bc 5a 80 a2 76 17 62 ea ea 72 da b6 05 7c 0a cd 06 51 2b ef a7 a8 33 93 b7 86 1e d7 eb 12 62 39 59 48 47 f9 c3 f0 f8 84 07 c5 24 1a 35 72 13 64 40 5c d3 b7 4c 13 40 dc ff 99 d6 75 4b 5e 34 2d 3e 1d 9c 61 bf 26 cc 34 2b 6d 6b 77 2e c3 e0 2d be 80 ce 0a b1 ea 8c c5 7e 0d e5 82 1f a6 bc 40 ae dc b1 83 c6 43 60 a8 1c 3c 95 e9 4f c5 ef c0 40 3f cc fd df e1 b4 4c 9d 00 5d 4f 2e 59 c4 06 1d 45 54 99 f2 0e b5 83 fa 53 e9 df 6e d1 98 ff 9c a1 ed 21 d6 df 1e 77 c4 43 c6 e0 ac 18 39 34 13 28 b4 9f 9a 4a 27 ae cc 10 8f 47 75 30 3b a8 dd 71 3a 88 74 c8 e7 2b 29 ae 05 3b a3 fe 73 39 10 f2 35 c0 93 50 ff c2 a8 81 03 31 37 32 2b fb 88 b5 74 19 ed 06 90 b3 b6 9b a2 5d e4 47 8a ab 2c 7f af f5 05 97 1b 66 83 3b Data Ascii: [f>3EJ"#Zvbr\|Q+3b9YHG$5rd@\L@uK^4->a&4+mkw.-~@C`<O@?L]O.YETSn!wC94(J'Gu0;q:t+);s95P172+t]G,f;
2022-03-25 19:15:14 UTC	49	IN	Data Raw: 97 5c 67 54 5f 73 83 e3 5c 86 c0 71 14 ca f5 d7 8b d8 45 60 f3 b2 2c 18 e9 f2 a1 e2 52 e7 c2 81 8a 0f 86 05 db a4 e5 87 f5 9a 4b d1 6b 6e 1f 2c c5 e8 10 26 e7 ec 4a 8f 28 0d 98 1b 7c d5 07 04 54 60 2f 10 db c2 ef 4c ef 1f 5c 83 29 5c 83 88 33 13 71 f4 2a 4c 49 a8 c2 ab 96 73 15 9e 3b d7 5d e8 5f 99 d3 43 1d 96 c2 ff 9d 2a 4f d2 2a d1 24 2a d1 64 e6 4a a4 4a 4a d0 93 63 7e 49 46 1d 41 1f 35 76 ab 28 8f b9 7c aa ac d0 34 62 f0 69 de fb 83 97 b9 5a b9 91 ef bf e9 e6 b1 0b 74 bd 84 85 54 af 9a 0f 47 8a c5 2a d1 a6 fc f7 23 3e b9 32 ca 5a a9 17 0a fd eb b7 97 a6 aa df 0e 24 05 d3 07 4d 42 22 94 aa 8e 2e c5 37 26 51 68 a8 7e 0a f5 e7 92 ce c8 d9 74 f2 b4 84 db b3 55 e0 64 12 0e 0b a9 7c b4 1f 52 ce 86 ea 30 0d b6 e2 4b 85 ef 70 9f b2 c4 e2 73 1c 21 fe d0 87 4b Data Ascii: \gT_s\qE`,RKkn,&J(\|T`/L\)\3qLIs;]_CO$dJJJc~IFA5v(\|4biZtTG*#>2Z$MB".7&Qh~tUd\|R0Kps!K
2022-03-25 19:15:14 UTC	50	IN	Data Raw: 50 34 87 c0 a9 28 9e 02 88 e1 ae 03 7e 13 ee 2d f7 b9 0b 36 80 50 ed 78 3c 7c 09 77 56 46 8d 8d 75 7b f0 c6 14 1a a7 58 a1 f3 ed ff 5c 8f bd df a1 cb e5 7d bb b0 74 47 03 bd d9 bf 27 4e 54 d9 17 1a 1a ac 09 e1 ea 6a 00 f2 77 b2 9e df 6e 2c 48 82 9e e8 97 4f d1 f0 26 af af 1d ad d1 66 31 2a 20 27 8a 09 82 42 65 18 18 b2 65 86 ae e2 e9 25 8f 90 9d 3e 61 c3 e0 7d a0 1d ac 9e d9 ea 2d fa d8 3f 94 36 3a f7 59 85 c6 dd 7e f8 79 a2 83 f2 32 ba 9f 4e 27 ee 91 0f 76 90 b6 67 cc fa f5 3c 5d d1 12 ab 1d a5 e7 0b 39 91 9e 0c 9b dc b1 94 4a 85 91 e5 78 4a 2d d5 33 9b 29 a5 b1 ba b9 72 f5 3c 4e 6e 3f a5 78 3f 43 b4 64 67 b1 c7 29 a4 12 4b be 89 93 d7 13 65 8b b2 5a ba 72 0e a7 8d 72 c6 ec 81 a3 8c 5e 3e fc da e1 6c 26 45 10 af f5 85 4e d9 08 73 1d cb 2c bc c7 d8 2d d8 Data Ascii: P4(~-6Px<\|wVFu{X\}tG'NTjwn,HO&f1* 'Bee%>a}-?6:Y~y2N'vg<]9JxJ-3)r<Nn?x?Cdg)KeZrr^>l&ENs,-
2022-03-25 19:15:14 UTC	51	IN	Data Raw: 0c cf 15 99 d0 ea 89 75 cf 75 15 df 62 38 ef 3a a2 98 73 11 27 ff 7d 5c d9 a3 83 cb 32 78 6e 31 9f 0d 88 fa d8 37 c8 cb 5d 9d a8 a9 82 60 71 c7 5a 64 53 af a6 88 09 3f cf a3 54 a1 c1 07 01 57 f7 1d 25 cc b7 d5 0d c8 5e fe 5e e7 5d 6f a9 cf 71 46 71 67 51 37 4b 96 78 b0 2a fa 1f f3 3b 1a 5b a7 0b c8 68 bb 73 12 cd 06 ae d6 5a 68 bf 17 ba 1e 6b a8 dd fe 8c 44 e1 24 06 7e 45 97 fe 58 7d 99 35 59 49 e6 46 f3 72 d8 c0 55 a0 bc 4b 5a 0c 4f 40 d8 a1 07 f9 97 c4 c0 83 46 e8 e0 60 54 0a 38 d0 26 23 78 e7 44 61 06 84 c5 3e ca 4f 27 7c 90 66 11 a6 6c 73 30 6a 0c fc 38 46 cb 99 98 44 bf 18 78 58 2c 53 91 d4 fc f7 49 d3 40 14 7c 99 2e f4 3a d3 1e 0f f3 c0 1f a0 a9 ef 15 fa 56 6d 32 b6 3c 66 c8 27 23 67 51 fb ee 36 b1 0c 93 47 55 74 5f 8f c7 d4 dd 7d 5b d0 7e f1 08 06 Data Ascii: uub8:s'}\2xn17]`qZdS?TW%^^]oqFqgQ7Kx*;[hsZhkD$~EX}5YIFrUKZO@F`T8&#xDa>O'\|fls0j8FDxX,SI@\|.:Vm2<f'#gQ6GUt_}[~
2022-03-25 19:15:14 UTC	53	IN	Data Raw: cf 14 3f 57 c4 3f 52 fe 1f 94 25 eb 87 cb f2 e1 05 4c ea 5f d4 5d 79 7c 14 d5 1d df 33 d9 5c cc 06 39 82 80 06 88 18 0c d4 48 10 36 6e 80 9d 64 17 66 c9 46 c2 a5 a1 6a c5 a6 46 ac 56 91 ec 72 08 c6 c4 4d 6a 36 e3 5a ac bd ef bb b6 f6 c0 56 05 d1 62 42 24 09 a0 05 c4 03 b5 96 a8 6d 9d 38 52 41 6c 08 8a 6c bf bf df db d9 dd 84 c3 1e ff b4 f9 64 76 de bc fb f8 bd f7 7e ef f7 7e c7 cf 6a 87 b6 25 29 17 89 e0 bd cc 90 0f e2 8d 59 7d 95 b6 1c 6d 26 6a 20 ac 88 e6 c5 6d 31 7e 00 7d db 43 ad 88 26 f7 a4 2f 0f f0 9e 74 7b 89 b1 27 5d 6e 31 f6 2c 75 bf f0 a9 3f c5 51 3e 37 c3 88 32 9c a2 0c 8e 33 56 6c 6d 0f 25 e2 fc dd 9c b4 d9 59 f2 bc 20 97 8f 7c 04 6c 27 40 4d 7e b4 44 1c 51 0e 8a e3 09 31 de 32 61 6f fa 49 e4 72 40 5b 7b 1b 92 9e 7e 5f 10 80 62 e6 c7 9f f7 3f Data Ascii: ?W?R%L_]y\|3\9H6ndfFjFVrMj6ZVbB$m8RAlldv~~j%)Y}m&j m1~}C&/t{']n1,u?Q>723Vlm%Y \|l'@M~DQ12aoIr@[{~_b?
2022-03-25 19:15:14 UTC	69	IN	Data Raw: dc a1 c5 a6 e8 f7 50 51 2d 64 01 65 10 92 8c d0 34 08 d1 fa 66 e0 ab db ee 3a 26 c7 48 0d b0 6a a7 6f 78 e1 40 df 19 ea b9 69 f1 21 ec 5a 1f 8b a1 30 16 f1 a4 72 bb ba 5c 4a 7d e8 ca b6 ca 63 69 0b cf 42 8d ad 81 70 5b d4 59 5c 5b 54 97 8d 34 28 ce 45 bb 7d 48 42 1d e6 e8 56 bd a5 9c 4e b4 34 11 e7 96 6e 95 9c 5b 7d 13 24 67 6b c5 78 77 c6 51 09 76 dd 32 fd 16 e7 e6 05 34 42 96 28 3c 25 be d4 65 3e 9a 3c 42 d1 7b e4 18 8f 6c 55 cc 97 53 5c 58 e8 cb 56 97 d8 e2 cd 95 a9 b9 9d 4d 36 ff a8 ca 65 dd d0 76 76 d8 ab 4e b0 ad 2a 77 7b e0 49 d6 73 8e 44 11 57 de 25 06 ce 42 84 aa c0 c8 55 27 db f4 77 02 e4 35 92 ac d3 3f a2 d7 23 68 f2 9d 43 c5 60 26 13 f9 fb e0 53 1d 61 6d 74 d6 bf 4c 46 08 1d 3d 97 cb 34 75 7d a0 27 2f 69 d7 b4 af 59 ba 88 1f 01 c8 9f 95 4d 69 Data Ascii: PQ-de4f:&Hjox@i!Z0r\J}ciBp[Y\[T4(E}HBVN4n[}$gkxwQv24B(<%e><B{lUS\XVM6evvN*w{IsDW%BU'w5?#hC`&SamtLF=4u}'/iYMi
2022-03-25 19:15:14 UTC	85	IN	Data Raw: 39 1b a9 84 53 f2 70 e7 4d 9c e6 8f 3e 7b d6 6e b1 44 b8 e6 38 5a ee b0 a4 7a f1 30 de 8c 91 3c c1 e2 1e 87 1c f9 99 b4 e3 ae 21 b8 ab 64 44 98 5b c5 e8 bd 59 07 ee 7b 20 37 1c 2d c5 b0 8c 0e e7 67 b4 3f 3d e4 6b 19 7f 01 65 0b 8a 73 c7 c5 ae 03 3b a0 b7 c7 09 da 7d 8a 57 7b d4 67 bd 67 1e 62 30 39 37 6e 06 c5 60 82 a3 82 5e c1 ce 40 0c 1c d8 0a 7f 52 24 71 92 da e5 f6 b3 f6 78 c4 00 15 8b 3d 3e b5 67 a4 96 2b 4e cd f7 87 c4 3c 17 f9 06 e1 e8 f7 0c 52 d6 5f 20 a3 49 bb a9 80 be 88 0d 38 b6 df 9c 52 f3 15 e8 e4 f4 7d f3 37 0b 41 a4 ed 38 dc 5b 5c d1 56 e4 e9 a0 1d fb f3 3c b1 99 45 69 e7 f2 f0 76 8c a9 75 2e 1e 90 3b 77 e5 aa e8 6a dc 7e 8f f7 32 07 b5 da a0 d1 cb 1a 78 ac 80 6f 00 ec c1 91 5c 7a 80 30 a6 1a 17 51 60 2f 79 bb e9 d7 fb d3 3a 5c 89 b8 5a 76 Data Ascii: 9SpM>{nD8Zz0<!dD[Y{ 7-g?=kes;}W{ggb097n`^@R$qx=>g+N<R_ I8R}7A8[\V<Eivu.;wj~2xo\z0Q`/y:\Zv
2022-03-25 19:15:14 UTC	101	IN	Data Raw: f9 7d fa f6 c3 fb c1 25 bb c0 05 0c 72 0a 0c 0a c6 4b 1b 61 e1 11 91 51 d1 31 b1 53 85 d3 e2 e2 13 12 93 92 53 52 a7 4f 98 f8 db a4 c9 01 3f b7 cf 98 39 6b f6 9c ff 74 fb ff d3 e5 ff d3 fe 77 16 6f dd c5 3b ee dd 3d f0 36 fb 91 5e de 78 33 fd 98 b1 be e3 fc fc c7 4b fc ff 73 fb 7f 85 ff ff 2b 66 40 6e eb ed ef 3d a4 66 40 6e eb 4d e6 ef bc 41 da b6 2d f9 3b db cb be 29 b5 d3 66 4d 92 3f bf 85 3b e1 1b 09 05 22 8f e0 c6 fd 87 0e 56 fc bf d9 ce bf 6e 37 3b 84 2b 7d 79 ba 5c 75 8c 0c 79 c0 0b b6 9e 74 39 4a 5e 12 ea f4 fe 53 c2 d0 e2 0d 56 9b d5 c4 14 58 7b 6c cf 99 ed 13 cf 57 5a 04 77 97 bc 4b 3d f2 dd 56 fe c2 ed 85 53 56 36 74 76 8c 86 17 2f bc d2 cc d0 2c 2b 97 a0 07 dc 21 46 eb b4 4d cd bc 36 8b 33 92 59 a5 78 76 91 af b1 de ce 6f 17 c3 62 8a e2 9f c4 Data Ascii: }%rKaQ1SSRO?9ktwo;=6^x3Ks+f@n=f@nMA-;)fM?;"Vn7;+}y\uyt9J^SVX{lWZwK=VSV6tv/,+!FM63Yxvob
2022-03-25 19:15:14 UTC	117	IN	Data Raw: 76 15 39 b5 82 0c 51 80 f5 5c 81 4f c5 4c 73 e7 dc b4 18 e6 4e 75 8f 6c 1f e6 b9 dd 78 66 63 47 3a e6 7e b9 f7 99 49 d7 b2 f6 3f 08 f1 10 44 dc 4f f3 60 92 ae 65 a1 bf f6 a6 47 2a 86 0e 10 43 b1 8f 59 ba 0f f7 8b 71 8f ad 10 f7 d8 06 b8 71 2d 8d bd c6 34 ec dd 47 de 86 3d 7f 23 44 2d c7 91 a8 6b 36 d4 1b fa 8e ad a1 38 36 30 5a 10 c9 0f 73 fe 86 e6 8a a1 fe 7c 8c b9 88 bb 09 63 6f 15 74 5f 69 ac 24 3a 28 1c bf c7 99 41 f7 6a 52 d9 cc 49 36 e3 3d 6c 1e 97 1c 60 e0 55 e5 f7 21 28 7f df da ad ec 37 96 ed ca 6b 8a 30 d9 a5 3c 57 94 1f 40 db dd a7 89 22 ec 07 e4 fb cd 28 53 1a ec 92 23 5c ef 09 f1 0c a4 64 15 95 29 49 d7 4a 73 44 29 6c 50 8a fb 28 a5 4d e9 58 c3 c3 36 94 73 21 fe 9a ad 02 6f 61 0d fb 56 bf ad 92 74 f9 1c 4f 05 ec 51 86 fd 9b 01 be ec 98 25 aa Data Ascii: v9Q\OLsNulxfcG:~I?DO`eG*CYqq-4G=#D-k6860Zs\|cot_i$:(AjRI6=l`U!(7k0<W@"(S#\d)IJsD)lP(MX6s!oaVtOQ%
2022-03-25 19:15:14 UTC	133	IN	Data Raw: d9 ef 33 32 fa ed af fa 29 fa d4 b3 62 ee c5 29 23 7f b5 fe 20 5d c9 2b f6 98 87 95 df 06 c6 ab ad bb 28 66 67 4e 27 c6 ce 91 71 0f 3b bf 31 5f f6 9c 49 bc 13 eb c8 53 65 2e 33 e6 a9 23 45 f7 17 f3 04 a0 1f 62 f7 ff 3c f1 1f cd 13 7f 35 f0 25 ed 53 12 23 6f 9c 37 52 e2 fb a9 62 e2 fd 04 89 7d c9 01 f7 91 0b 24 9f 71 76 f9 b9 be 9c 41 24 a6 ec 3d 54 62 a4 ff 5c 61 3f 8e bd 6d cd c4 b6 e8 67 ee 83 c4 01 b9 cc d2 b5 f5 fa f3 c5 53 25 23 a5 fd 5f 1c 07 6d 10 0f 96 8d 98 6e 5f 72 a5 9c 71 18 c3 b0 e2 83 79 b0 e2 ea 7e 6b 1c cc 09 fd 1e 9e 6e 3f 38 b3 2d 3c 97 bd 38 61 b3 c5 d2 ed 07 71 3e ac b3 d0 7f 19 ff e7 89 bf 1e d6 b9 60 f1 e2 23 6d 7f 3c 6f 2f bd 8f 93 73 16 2f 4e c8 4b 9c 21 f6 22 be 17 ff 79 87 fd bc 47 72 c3 7b f6 fe 29 39 23 52 f1 ab e7 81 fb f6 19 Data Ascii: 32)b)# ]+(fgN'q;1_ISe.3#Eb<5%S#o7Rb}$qvA$=Tb\a?mgS%#_mn_rqy~kn?8-<8aq>`#m<o/s/NK!"yGr{)9#R
2022-03-25 19:15:14 UTC	149	IN	Data Raw: e4 b0 6d 34 51 71 22 95 b3 21 1b 4f 9b ec f8 69 45 2c 69 e2 31 94 26 ed 47 7c bb c6 c6 e7 18 70 76 21 ce 13 59 62 c5 57 db 61 26 1c 05 0d 47 5a 0a e5 39 86 54 0e ce 29 20 0b 1f 99 ca ae 8a 27 50 dc 9a be dc 8d cc 2a 18 e7 b9 70 9e e2 cf 94 a1 44 f3 fb db 6e 41 1a a2 dc d6 33 62 e0 94 be 55 da f8 8e ca eb de f6 03 85 e6 61 a0 54 7f bb 5b 6d fb 3a 5e f9 b4 13 39 5a 10 7b 81 b3 44 d1 6c ba d5 46 9a fa db 9d 51 ef b0 46 02 79 d4 48 f3 02 ae 91 6e c5 85 98 6f c1 63 e9 f7 e3 e0 bb 07 2d d1 f7 b2 be 4d 35 e4 87 03 ae 3a 13 c7 1f 3d 19 ef 63 c1 d0 4c b3 57 b6 13 db ec 8e f3 43 5f ac 8d 32 81 ac 12 d9 e8 bb ad 7f ee 51 68 7a 79 e9 71 6c 3e cb 4e 61 6e 40 48 2f 11 96 04 d1 1a e2 7e 3f be 84 15 38 af 93 b8 1e 3b 2b 07 3f 84 30 54 bf 05 0b 69 1e 54 66 3f 4d 83 c5 f5 Data Ascii: m4Qq"!OiE,i1&G\|pv!YbWa&GZ9T) 'P*pDnA3bUaT[m:^9Z{DlFQFyHnoc-M5:=cLWC_2Qhzyql>Nan@H/~?8;+?0TiTf?M
2022-03-25 19:15:14 UTC	165	IN	Data Raw: f6 7c 36 ee 07 3a 20 ba a2 25 8b d7 39 ea a3 89 b3 9f cc f9 98 36 66 cd 93 df 42 41 a4 63 37 bb 80 9f ae f5 01 4a d8 ba 51 15 81 a1 f8 ee 60 35 9f 83 ea ea 2c fe 1a 44 58 13 91 4c 3d 24 01 27 7d 01 37 71 8e 10 aa b1 e1 dd 68 23 9d a3 7b d0 fc cc 5c f0 ba 38 ed 5a 48 55 a5 1e 75 89 f3 6a 4a 2e 1c df 55 62 14 77 eb a7 b0 af c8 a5 46 5c 8f 87 cb ac 6a 33 4e 6a 5f a6 76 bb 64 94 e2 13 2c 6a f3 36 b2 1e 0a 98 7b 54 d7 fb 5c fe 73 1f 87 c6 11 ef c8 14 bc 64 2f 5c 68 61 87 49 be 33 e0 fa 73 57 17 1b 46 78 31 7b 8f e5 6c 88 86 70 74 51 3c 77 ec 4d be 08 4c c5 11 25 57 bf 2f f1 80 b8 e3 2b f9 74 c3 48 82 0a 5b 8e bd c5 57 cd ef b2 7d 32 4e 9d e0 0b c8 2b ee fe 22 43 13 e3 90 ab ed 86 e8 d8 f0 7e a7 6e 8f 5d 6b 2f 1c 66 f0 b5 af 2e b6 e2 12 e9 1a 82 ca 71 16 b9 9a Data Ascii: \|6: %96fBAc7JQ`5,DXL=$'}7qh#{\8ZHUujJ.UbwF\j3Nj_vd,j6{T\sd/\haI3sWFx1{lptQ<wML%W/+tH[W}2N+"C~n]k/f.q
2022-03-25 19:15:14 UTC	181	IN	Data Raw: 7c 18 48 a9 99 90 5e 75 1b b2 17 f6 ad 71 a4 57 59 95 5b f2 af b0 d0 b7 cc 05 6b ed df f9 fe 36 fa fe 36 d8 76 07 5b fa d0 6a c9 db 4f 3b d5 a9 99 ac 62 55 41 e4 c4 ad a8 73 a1 15 0d 04 92 a8 01 ed 5b 5a 2f ab ab e9 34 ca 8b 02 6d 21 d6 e5 67 c0 a0 15 4f 98 5e b9 d4 8b c5 ea 49 da ed 71 bc b1 b8 af 27 ef 10 29 ef b4 a0 08 7c 4f d4 e0 c6 1c 64 0a 62 d4 7d 20 da 1a c9 22 fb f0 f3 0c 2c 7c 4b 1d 6f 89 bc 83 d3 26 d4 79 49 ba c9 d0 a6 70 42 80 10 77 10 3c 27 ee cf 4c 73 95 f3 ef f8 f3 fc 5e cf d5 bd 9e 2b 7a 3e af a2 9e 37 25 be 4f 3e 1d 9a 12 9e e1 90 36 96 af b9 0a 7b ea a7 87 5d 9e de ed 21 46 07 45 50 e5 f3 ac e6 08 1f 68 1e b3 8a 07 d8 e3 65 d1 07 b9 9c 36 52 96 09 33 53 aa e0 8e 7e 14 fa df 47 db a6 b3 41 38 82 d5 db a0 fd d1 ea 29 5a 4f fb 33 e4 e8 00 Data Ascii: \|H^uqWY[k66v[jO;bUAs[Z/4m!gO^Iq')\|Odb} ",\|Ko&yIpBw<'Ls^+z>7%O>6{]!FEPhe6R3S~GA8)ZO3
2022-03-25 19:15:14 UTC	197	IN	Data Raw: 82 b2 1e 24 11 4a 12 1a 6e 3f 79 b8 33 ae 33 bc be 74 e3 5f e5 1f c2 4e f3 29 87 64 c8 2f 25 b1 70 02 59 23 9d 84 ce 20 46 92 ec 68 e0 20 49 98 4a a1 24 9e e0 1b e7 34 7f 1f fc 4d f1 a7 e1 af 39 b0 22 b8 a2 c0 14 08 c0 8f 4d 59 47 5e 97 74 ee 50 cf 27 82 2c a1 b4 92 e8 b2 04 e4 38 a8 be 56 9f ca 3b 63 ba 9e 41 be 9a ee 14 d0 59 9b b4 43 c4 33 65 b8 a3 a0 02 97 82 36 43 a8 4f 1a 0c 58 48 b6 3c 10 37 cb 76 04 32 a9 41 eb da 2c fc c2 95 39 f0 65 6e fa 98 34 3d 9a 9a ae bc b8 e9 29 7a d3 87 4d 71 4d 8f 76 6e c9 20 58 59 fb 8a b4 ce 31 f1 51 47 88 6b 3b 5d 31 da ec cf 24 cd 92 6b 07 d5 cc b9 0b d5 0f 9b e3 04 56 bb 02 2c b0 4a 79 8b 05 56 90 23 13 56 ba 9b b3 85 20 23 86 4d 3d df c1 5c 07 1d bd d4 2f ab 07 0c c4 fb b1 32 0f 19 73 ad 3b 47 bf db f0 1b be fe 4c Data Ascii: $Jn?y33t_N)d/%pY# Fh IJ$4M9"MYG^tP',8V;cAYC3e6COXH<7v2A,9en4=)zMqMvn XY1QGk;]1$kV,JyV#V #M=\/2s;GL
2022-03-25 19:15:14 UTC	213	IN	Data Raw: 39 90 aa 65 96 77 b0 65 86 26 26 65 09 e1 93 b1 cc 1e 3e 47 96 d9 df cf b0 97 99 fe 4b 59 66 80 0b f6 37 1b 00 b5 2f 51 7c 80 25 17 95 25 17 d5 57 82 f8 cd 92 60 0a ce 8c a9 ce 3c 92 5b 1d 32 55 f5 16 71 f2 12 18 80 a4 94 47 39 85 52 7e 49 5e 1e 2d b4 31 46 ea 92 88 58 96 20 03 67 f3 b4 af 39 cf 69 37 5f 70 e9 fd e8 1c a0 5f e0 8d 71 3c 2d 86 85 b8 0d 93 b8 3d 13 e9 18 ab 68 72 4e 2d 2e 1f ae aa 30 e9 db 63 91 1e 26 7d 7b f8 39 39 98 19 a0 78 f8 de 22 f9 75 22 5d 86 d9 5e 1b 07 22 9d df 6f 84 a8 16 55 e3 f2 e1 52 a4 73 47 a3 45 3a bf d8 d8 9b 74 7e f1 bb 22 f9 7d 14 e9 b0 90 3f 06 b8 66 46 f7 42 92 a8 79 f1 62 7f 77 b3 dc 11 ef 97 80 5c 39 66 23 3e 70 95 8d ef fb 4e 80 05 66 96 56 6e fb 7f 8a ef 13 d2 9f 5d 6e 73 f3 bb 82 fa 46 3f fe 53 b0 66 e6 cd 1a 15 Data Ascii: 9ewe&&e>GKYf7/Q\|%%W`<[2UqG9R~I^-1FX g9i7_p_q<-=hrN-.0c&}{99x"u"]^"oURsGE:t~"}?fFBybw\9f#>pNfVn]nsF?Sf
2022-03-25 19:15:14 UTC	229	IN	Data Raw: f4 d7 ef b7 eb 3b a1 5f 35 c2 5e b1 3a 70 6b ec 5d dc e3 1e bb b2 59 6b b8 0f b8 64 ec 80 bd e2 ca 6d 5a 83 8e 77 e8 04 6e 52 82 b4 22 ca fc 94 4b b6 44 b2 1c 67 7c 2b 99 a4 ff 6f 60 5f 7b f0 bb 0f cf 6e 62 1e b8 dd bf d4 1a 78 9f 03 c0 e3 fc 02 f2 f7 76 04 3b 3f 16 23 41 fd 8c ec 7b 04 f8 7c c7 04 f8 3a 7a 3b 18 ec f7 36 87 0b c6 ac 3f 79 0b 70 ca 5b dc d1 0c a5 4e 80 6e a4 98 ad 81 67 78 37 d5 33 bf 79 4e 3e dd e7 0b 5a c3 5b 6a 6b 80 a8 24 b9 b2 72 f4 71 89 ea 99 35 fd f2 f9 46 f7 e7 87 92 fd f7 5e 9c 6b e3 1d 3d f3 9b 88 8e 35 ed 89 67 0e 44 21 c0 89 e2 01 b8 76 03 a3 e6 59 b1 57 7b af 0c 98 fe 3c d8 f5 0b fb fb 81 26 79 1b d4 f6 77 2e 2a 40 24 8d be ac 54 a2 cc 43 f7 27 32 80 18 92 27 da a8 d2 c4 64 2f 6d 50 9f cb 8e 71 45 d7 70 04 6e a8 bf eb 31 f1 Data Ascii: ;_5^:pk]YkdmZwnR"KDg\|+o`_{nbxv;?#A{\|:z;6?yp[Nngx73yN>Z[jk$rq5F^k=5gD!vYW{<&yw.*@$TC'2'd/mPqEpn1
2022-03-25 19:15:14 UTC	245	IN	Data Raw: 55 b6 ee 60 90 10 f9 fa 79 22 9a a1 14 9b 6f 51 25 df 50 25 7d e1 3c ea d6 ac f5 87 af 77 96 84 af 71 31 82 99 1f 4c 62 8a 9b 18 91 7e 11 59 cc c5 ed c1 84 02 06 13 84 35 40 ae b1 43 05 35 7b e4 29 61 f4 1a b7 f4 4a e6 3e 7f 12 b7 c4 71 d7 01 44 c6 7b 2c e5 03 f5 7d f1 2b 74 a7 9e f4 67 e4 7f c1 1e 2c f6 eb 99 bf c7 23 87 7d b0 4f cf be 1e cf e2 68 02 86 78 99 93 f0 02 d4 98 9c 9c 8c f8 c6 09 c9 36 3d e9 62 a4 30 4c 5c d2 58 3c 80 b2 c8 46 5d ff db 7f 55 d2 bb cc 4d 28 df 79 12 67 e0 5e e1 d0 46 5b 23 c9 d1 ec 97 96 a7 da d6 da 95 15 c3 3d 07 71 81 dd 58 37 69 b8 2f 3c 6c 13 32 e2 e7 53 f9 49 da 80 9f f0 79 db 54 5a 3d 7e 8c f1 d7 a9 ad 5f 04 d1 6b e4 ae 9e f4 57 7c c0 41 c3 02 8f b1 9d 9d c6 ed 2f 30 d8 87 c1 f6 e6 a0 f5 1e 57 a4 d9 84 30 6c 35 26 2a 0a Data Ascii: U`y"oQ%P%}<wq1Lb~Y5@C5{)aJ>qD{,}+tg,#}Ohx6=b0L\X<F]UM(yg^F[#=qX7i/<l2SIyTZ=~_kW\|A/0W0l5&*
2022-03-25 19:15:14 UTC	261	IN	Data Raw: 9a a9 97 09 c5 9d 14 ae 1d 2e 7f bf 5c ba 42 b9 ba 2d 4c c7 d0 ba b5 2f 86 16 98 73 e3 67 3d 59 b6 28 a5 c0 98 fc 90 c8 be 16 8f b2 91 eb 07 8f 03 6f 59 5e 2e aa 51 26 75 b2 16 34 85 8c f3 cc 2c ba e1 55 08 09 86 13 17 62 17 7d cc 78 ee d7 a6 a3 65 28 dc 93 2e dc 2a 2d 8d 2f ca d5 a8 45 c1 7b fd ae 37 bd 1a a9 53 ce 51 ca 8d e1 75 46 d1 3d c1 1a b9 64 da ac c7 d4 5c 7b 27 9b 3c 43 b1 1e 84 77 96 05 40 fb a3 db 58 73 42 ec 3c ff c5 4d 49 10 9a c8 7e fc 98 bd 2b 8b 4a 91 85 d7 aa a7 8e a9 e5 41 56 a3 33 06 39 72 97 7e 80 0d b4 3d 75 a9 3f b0 56 f2 4b 61 02 13 be 56 d8 19 a4 09 ea 77 71 22 48 e8 f9 9e 9d da aa fd 6e e3 7a 11 58 8e e0 cc fc 2a 5f 46 56 97 a7 ff 9d c5 55 85 6f 6b 01 58 3a b4 14 78 03 d1 50 f4 8a 4f 46 a9 c4 48 33 ef 5f ba 12 a3 b8 d8 1e c5 fa Data Ascii: .\B-L/sg=Y(oY^.Q&u4,Ub}xe(.-/E{7SQuF=d\{'<Cw@XsB<MI~+JAV39r~=u?VKaVwq"HnzX_FVUokX:xPOFH3_
2022-03-25 19:15:14 UTC	277	IN	Data Raw: f7 2a 10 b4 d8 ff 47 44 c6 cb e9 00 b7 da ae e7 41 fa cb 60 b2 70 89 66 fc 8f fb 3a 9c fd 81 e0 45 ca 25 bd 93 27 68 a1 08 b6 88 14 21 c1 3f 62 2f d9 67 e2 cc f5 8a 6a ab 9d 2a 30 70 a3 e4 a1 27 a4 ad 4b 50 d4 3b 43 e1 c2 48 1c 9d 1a f8 3c 8b cc b4 f8 39 ea cf bc f7 1d 16 9b 1c 8c 12 ed 00 e7 18 2c 42 81 ff 7a 67 af 67 7e 46 2d aa f0 91 e2 0a 38 58 d4 3c 28 79 a8 e2 98 f6 ed e6 3b 9b 65 6f 3c e6 14 8e 69 b9 53 45 b8 87 e6 c9 15 68 fa ca 8d 30 f7 64 97 ce 29 d3 a9 8e 2a 79 db 66 92 0e e5 a9 50 82 d0 79 c2 d4 d7 5c 89 05 2a cb 37 7b 5d fd 07 65 88 af b1 53 39 5f 61 30 7e 86 71 be 7b 0b 67 f6 93 5b 12 ac cc 78 49 78 98 09 76 e7 44 be 07 0b 70 8f 82 57 9a cb f8 85 01 7d 75 c8 75 08 76 1c e9 de d9 4f b1 46 73 55 40 07 ea 57 4c 3e 7c 56 0f c5 b6 54 fd c5 ee ce Data Ascii: GDA`pf:E%'h!?b/gj0p'KP;CH<9,Bzgg~F-8X<(y;eo<iSEh0d)yfPy\7{]eS9_a0~q{g[xIxvDpW}uuvOFsU@WL>\|VT
2022-03-25 19:15:14 UTC	293	IN	Data Raw: cc dd 56 0b 7e 5a f9 73 29 fe d2 b3 ec f2 85 e2 d1 d5 bf 30 14 af 14 33 24 3f dc 02 85 b4 06 84 b8 c7 9c 7b 4a 2c 5c 12 9b 30 c9 b2 24 8e e4 df 81 e0 f7 f5 89 1c 1f e6 1f ef bd a3 eb e0 45 cf 1f bf 9f 16 19 c2 b6 c7 88 37 a1 ac ac 8f 12 9b 51 b8 01 e5 a5 b0 8e 57 89 5c 14 1e c8 0c de d1 2d 74 e3 e0 a3 33 29 7e 0c eb cf 01 69 9c 2c 3f ae be 04 02 0a 9b 51 e7 1c b5 ca c9 6b c8 be de cf 6d f7 e6 2f ad 62 64 81 19 53 c2 12 b4 5c 3c 28 a4 46 07 55 8f 71 38 cb 2b 20 ee 71 38 a7 56 39 06 f8 9d 78 9c eb 18 e0 76 39 9c 1a 37 16 92 8a 3e 77 38 45 23 32 51 8c 1f 9c 59 c9 ae 91 23 a4 4a 88 cd 89 51 a8 25 ad 10 17 e6 e7 48 07 a1 44 cb 52 55 09 6d 4f f7 aa 76 82 54 9d e4 f6 a8 45 a0 1f 7d 26 93 69 d5 24 9f f6 e3 37 b4 c8 2f 16 dd d7 ee 4d ee 16 0f 72 46 d7 b1 ff 29 85 Data Ascii: V~Zs)03$?{J,\0$E7QW\-t3)~i,?Qkm/bdS\<(FUq8+ q8V9xv97>w8E#2QY#JQ%HDRUmOvTE}&i$7/MrF)
2022-03-25 19:15:14 UTC	309	IN	Data Raw: d2 e9 2f dd 8b c9 da a6 48 0e c7 8d 0c 15 34 a2 98 fe 25 b4 2e b8 38 13 cd 4a c0 43 df 8c 03 59 79 4f c5 17 6e 5c fb 1d e1 38 5f ed ba df c2 82 69 81 60 17 8a 91 1f d5 53 87 39 de 25 a0 5c 32 87 17 bb 79 a3 69 07 f5 be 48 ee 0f a0 3e d5 87 bf 0b 9f e1 8d fa c1 7c 6e 52 08 f8 28 71 26 4b 64 3e 22 e5 81 6b 48 4b c3 29 02 a3 75 4e 75 72 12 75 6a 95 22 f5 10 2e 58 50 7a df e6 6c a2 7d a8 76 98 5c a9 20 fd 0f de 01 53 92 c6 c4 5c 38 04 55 bc bd 04 6f d0 d7 7e 69 51 53 65 ee 58 2b 33 e9 88 e9 38 74 80 04 d5 32 e2 d5 6b fb a7 24 78 2b 4e a7 fa c0 65 22 4f 4a fa a0 18 d7 59 9f 77 ff 80 14 1b 9c dc 54 00 99 27 5d 66 ec d9 a2 b8 8f e3 ac 41 e6 2d b0 1a a0 c7 56 ab bf 07 c2 14 6f f5 b7 b1 25 23 71 33 40 74 48 af 86 b2 02 73 45 07 3b 58 f0 a2 fa 3f a2 58 31 3d 47 9d Data Ascii: /H4%.8JCYyOn\8_i`S9%\2yiH>\|nR(q&Kd>"kHK)uNuruj".XPzl}v\ S\8Uo~iQSeX+38t2k$x+Ne"OJYwT']fA-Vo%#q3@tHsE;X?X1=G
2022-03-25 19:15:14 UTC	325	IN	Data Raw: c8 9f 80 46 c2 d5 27 c5 ba bd d9 5d e8 97 42 ec 20 d0 11 5c ac b0 a4 8e 8d f5 24 21 e9 4f c3 27 7b d1 a7 a4 b8 6a 25 1d b5 f4 63 be 11 6a 59 21 ab 92 6e 50 8f b2 89 75 43 b5 2d a6 44 85 27 0f da 87 e4 b6 e9 57 ce 11 da 09 6f 75 bc f5 de cb 84 b4 5b ff 8f 60 2e fc be 16 2a ec 98 77 ef 11 c3 7e bf e3 51 dc 1f 8d a7 56 a8 f7 7f fc 48 b7 7c f9 b6 13 bf 0b 4f 8d 1e 06 32 bf 82 c9 90 13 f1 31 6f 29 67 03 bd ee 44 9b d3 cf fe ad 87 05 ff a6 3c 69 0f 39 2d a8 3d a8 8e 73 c1 c2 64 0c c9 a2 2a 41 30 94 a3 91 fe 9b 25 47 44 0a 47 71 6c c7 60 65 01 37 14 e7 aa b3 05 79 cc 0b d1 af 0b 77 c3 14 6c 9a 87 fe c5 ea 12 15 24 82 5a ef fe 4b 25 3e 05 72 50 60 c7 b7 79 4e 51 27 86 ad 55 6a 6f ef 73 d6 e9 3f ca 61 b0 c0 6e 18 cf 62 0e 7d 9c 6e 9a 43 57 a4 9f 70 2f d1 5f be c5 Data Ascii: F']B \$!O'{j%cjY!nPuC-D'Wou[`.w~QVH\|O21o)gD<i9-=sdA0%GDGql`e7ywl$ZK%>rP`yNQ'Ujos?anb}nCWp/_
2022-03-25 19:15:14 UTC	341	IN	Data Raw: ef 13 55 e7 25 b0 ba fd 8d 54 df c1 a0 9a 8c f6 83 5c 4b de e1 61 ab 3f 33 30 aa a6 bb 76 39 b2 b0 ac 48 09 10 64 50 d9 b2 f1 88 47 3a 39 ac 37 d0 4f 67 e2 bd 12 ec 95 81 2c bf 89 5d 9a f2 2d 70 3d b1 40 96 b1 e9 e3 13 66 14 d9 af 29 a7 d5 a5 50 3b 58 f1 81 af 4a ee e8 3f 46 36 9e 32 bf ac 4e 99 75 76 c4 08 86 04 bf 82 3e 1c 3e c0 cb d1 73 10 6b f0 f5 77 33 6d 52 e5 1e e3 92 6b c4 1a 5b 64 62 73 39 cf bd e3 59 7f 8e 7d 0c 84 0a 1d 2a b8 4c 98 90 f5 27 0b b5 db fd fa 15 d7 56 80 42 2c 80 59 2c bf af 0e e8 95 0b c9 cf 33 3e f4 8f 82 7a 03 8f 00 f0 94 f8 82 f8 d0 4f bc 2b bd be eb 2d ab 43 8d 1f a9 0e 5d 95 1a 7e b5 b1 c2 bb bb f2 21 d1 a4 93 8e 55 f3 14 2e d8 98 d7 2b 0f f1 f1 38 fd 26 94 ff 51 e5 61 49 11 88 9b 6a b7 47 94 30 d7 e0 9d c9 a4 12 c1 9d 33 cd Data Ascii: U%T\Ka?30v9HdPG:97Og,]-p=@f)P;XJ?F62Nuv>>skw3mRk[dbs9Y}*L'VB,Y,3>zO+-C]~!U.+8&QaIjG03
2022-03-25 19:15:14 UTC	357	IN	Data Raw: dd 56 dd 0f bc 15 0f 1a 86 42 e4 37 05 0a 95 bd 1f 95 27 7d 7c 45 9f 28 0d ca 4f 91 ec a3 9f 3f 0d 75 8c 13 4b a3 3a b1 2c c4 2d 94 78 d8 56 cd 9b 87 ba de bc 01 37 bd 9a b9 f6 d5 32 d7 1a e2 a9 03 1b 76 a4 85 1d 14 be a3 43 90 fd 6f 40 db c3 df 8d 46 65 74 c2 33 90 88 77 4e e5 b0 87 a7 e2 42 af 43 b9 b1 78 23 15 90 db 70 4c 2e 6f 15 54 c2 04 3f d4 c1 c1 58 a8 73 bd 26 41 c2 5a e4 9f 2e ac 0b c3 2e 41 e0 d6 2c 4a 08 c8 b5 ec 8c 00 7e 7d f8 7b db 3b 28 db e7 ef 06 ab 3f af 2f 38 2d 07 04 56 c1 1d fd 3d 7f 17 98 94 55 2b d2 6d f0 73 f5 04 a7 ed c7 a7 19 9f 7a 7c 76 82 4e 7a 42 d3 36 fb 42 93 72 81 4a 62 78 35 6f d6 77 ce e2 59 29 c0 fa 0c 41 f5 1e 4c c5 7e df 6b 17 05 7f 01 67 89 bf 9f 48 3c 8a 45 82 ae 5f 22 b3 90 56 b1 4e 5a f0 e4 a0 b6 6a 75 3e 84 7a 49 Data Ascii: VB7'}\|E(O?uK:,-xV72vCo@Fet3wNBCx#pL.oT?Xs&AZ..A,J~}{;(?/8-V=U+msz\|vNzB6BrJbx5owY)AL~kgH<E_"VNZju>zI
2022-03-25 19:15:14 UTC	373	IN	Data Raw: 90 cb 2c 5c ae ff 4a 2e 29 3d 7a 7d b7 5c e6 e0 b2 e7 fb 72 39 97 38 93 72 29 26 62 b8 bb f7 7b 79 41 48 e3 ae df c9 25 f1 fc d7 aa 9c c5 b8 ac 52 09 4a 70 79 ca cf 72 59 8a cb f1 07 e4 72 16 cb 3b 28 97 b3 95 0a 24 9b 83 d9 d9 e8 3c f4 a6 23 a6 6c 58 86 6b 72 d4 4b f1 17 b3 8e 0b da 04 df 62 cf 2a 7f 0a ab ba dc c4 bf db de 01 ff 2e 4d 8c 3e 85 4d ee dc b6 c1 f9 32 04 84 7b c4 20 34 b3 e2 1a 6e 2e 82 cf ec f3 e5 5d 9b 29 86 7e 28 e7 ac fd 8c c6 f2 b3 5f ab c8 8c 81 33 b7 be e1 30 c0 99 87 eb 5f ca f5 16 c8 88 71 5e c6 b5 8f d2 bf ad b8 20 c5 6a e0 5f 31 c6 cc 2c 5b e1 27 03 62 44 b2 19 97 a1 3f cb 77 d0 d6 e2 97 89 9f 5b 44 ed f7 e1 21 5b 7e 87 fc 65 c5 a9 fb 12 91 5b 67 f2 2a ac 6f a5 27 10 9f 91 8f 7d 74 9b bb c6 19 ba 40 58 1f bd 65 85 78 da 8f 10 2b Data Ascii: ,\J.)=z}\r98r)&b{yAH%RJpyrYr;($<#lXkrKb.M>M2{ 4n.])~(_30_q^ j_1,['bD?w[D![~e[go'}t@Xex+
2022-03-25 19:15:14 UTC	389	IN	Data Raw: 67 20 fe d7 e2 68 c4 b1 95 6d 79 06 5e c3 fb 7c c9 4d 73 9a 8f 7d 7c 92 3a 8f af af 17 e5 74 0b 24 4d aa b9 44 f8 5a 5f 2b c2 97 f2 a2 7f 3a 81 d3 a1 d2 f4 5c 4b a5 fe eb 27 86 fe eb 87 58 66 b8 91 9b 8f 32 68 cc ed 8c 09 88 e9 bf ba c9 ad 2b 13 94 1e cd 65 37 74 60 f4 c5 af 53 ce 1c 28 ef 7c 17 50 5a 66 08 1d 9d 3a b6 2b db 2b 9f 55 1f e1 ab 0d 69 fb 70 da 98 0b 4f 0f c9 63 40 50 90 46 53 37 d6 4f 5f d4 22 0b ef 9f 6f 52 a2 c4 46 7b 07 c5 d8 5c b6 af a4 cf b2 1b c0 45 73 9e a1 ae 5f 5c 47 42 88 f5 08 6d 77 df ff 12 df b8 d6 a2 17 a3 3e 6c 3f fc b9 9a e8 08 11 cc f9 67 d1 6d 56 9d 58 7f 7f ce 87 56 9d d8 40 e6 78 de 63 25 cb bd 72 be c5 bb 43 78 db 24 83 8e b3 95 72 63 8f 49 84 e6 fb 8a 34 c5 5f 7f 65 b5 63 1f 10 0d 82 d5 70 1e 28 3f 6e 5f 92 e4 a5 66 cc Data Ascii: g hmy^\|Ms}\|:t$MDZ_+:\K'Xf2h+e7t`S(\|PZf:++UipOc@PFS7O_"oRF{\Es_\GBmw>l?gmVXV@xc%rCx$rcI4_ecp(?n_f
2022-03-25 19:15:14 UTC	405	IN	Data Raw: e9 e2 6d 32 c9 42 3a 26 57 33 ae 56 5c 5b b4 83 c4 86 c7 15 c6 b5 4d 3f 34 40 4d b5 79 b2 5f 4f cc e1 e4 94 a0 2c 1f 5a 22 3c 8e cd 51 62 9d f4 9e 80 e5 ca 89 a6 64 79 f7 c9 a4 9c bc c5 f4 2e dc 05 7f 6e 3e 8f ee 92 e7 15 f3 88 0d da 2b 4c 7c ee 97 3a 8c 88 28 44 75 a8 cc 49 b4 11 9a 10 29 51 5d e5 3c 87 93 99 13 63 ac aa 75 18 72 44 99 18 53 1c 13 c3 37 54 a2 6f 85 f1 0a 26 46 b3 43 83 d9 31 c0 a1 c1 dc d6 e0 56 11 7c e8 54 5d 82 78 b0 a9 90 63 21 a3 e8 bb 76 e0 26 79 c2 fc b1 e1 d8 13 66 1b 27 4c d9 6b 1c 61 de f1 f3 9c 30 e5 78 25 79 a2 4c 93 62 88 20 c8 89 e2 92 62 2a 58 0c 5f e2 44 19 2a c5 f0 4e f0 2f 91 3d 48 e4 36 6b 6d 3f 2c 5b 37 47 5b 20 ec 49 55 24 be 85 d7 11 df 02 5b 5f 3e 5c e9 bc 4d 07 95 43 73 80 30 84 98 08 34 6e b5 4c 07 d0 1f df d0 13 Data Ascii: m2B:&W3V\[M?4@My_O,Z"<Qbdy.n>+L\|:(DuI)Q]<curDS7To&FC1V\|T]xc!v&yf'Lka0x%yLb bX_DN/=H6km?,[7G[ IU$[_>\MCs04nL
2022-03-25 19:15:14 UTC	421	IN	Data Raw: 40 62 37 7c 0a 5a 97 77 08 b2 58 4d d2 a2 9c f3 ee 40 39 db 15 70 32 0b 98 7f de b9 78 40 d3 af bd d0 37 fe 8a 4b 9e d8 8e 1e 79 0c 65 ef b8 1d 67 9b 34 7c 15 75 39 2c 7e 4a 50 ed 02 3e 7a 84 68 75 11 6d 97 7e 68 26 ea a8 18 26 f8 8f c0 41 26 e7 72 4c 7b 24 85 16 68 5a 18 61 38 e0 8c 78 3b 07 29 dc 45 40 45 26 15 89 44 e7 db c8 a1 81 ce 24 b8 bb 59 df 71 dc 30 8d ed 0f cb e0 53 fa 4f a2 c7 8b e1 2e 67 26 72 99 ee 95 80 ee 29 f5 59 f8 4b d4 c7 26 2d 9f 48 bc b8 eb 4b 96 c5 38 8b 61 cf 40 63 e3 28 75 5a e2 a7 a9 5d d0 8c 49 12 73 ed d4 c1 2e 38 c4 5e 63 08 77 25 25 30 f7 97 f5 10 bd 26 77 bb 92 eb 2e b8 a5 64 c9 36 13 3d 23 a3 3b 8b 43 8a c7 42 a4 7c ff c8 fd e4 a6 50 26 74 e7 30 52 b5 d3 1b cb 43 0e c3 2a d2 ca 5e 08 5f e7 8e 0b 6c ff 26 50 db d5 47 e1 39 Data Ascii: @b7\|ZwXM@9p2x@7Kyeg4\|u9,~JP>zhum~h&&A&rL{$hZa8x;)E@E&D$Yq0SO.g&r)YK&-HK8a@c(uZ]Is.8^cw%%0&w.d6=#;CB\|P&t0RC*^_l&PG9
2022-03-25 19:15:14 UTC	437	IN	Data Raw: 0b db 9f 85 65 00 9c 65 6f b4 1a 2c a5 4c ca a5 14 7f f3 ee 86 7e 02 f9 30 44 9f 9a d3 42 39 6f e1 38 55 ec c0 66 d9 51 54 7f d5 c4 68 2a 7e 0a c0 31 c4 76 8e cd 10 5b 06 33 d1 d3 90 40 ec 55 aa aa 12 87 28 f4 0f a0 44 76 d4 90 93 4a 38 73 f2 8d 34 07 ab 0d 33 a1 ec 76 35 5d cb 85 6e ce 73 ac 28 bb fa a5 7f b2 76 25 e0 51 55 57 78 26 93 49 86 10 78 03 04 8c 2b a9 82 8d 46 25 36 58 13 26 da 19 48 60 06 26 12 c4 25 b5 08 58 2b 52 ad 8a 49 86 45 59 02 49 8a d3 e7 28 56 6d ed e6 52 ad 75 6b d5 56 01 b5 62 42 84 04 10 09 6e 2c 56 c1 fd c5 71 41 ad 24 61 c9 f4 ff cf 7d ef 65 b2 a0 6d bf f2 7d 61 66 ee bb ef ee f7 dc 73 cf f2 9f 67 45 18 d4 e0 e8 5d c0 3f 58 80 32 42 c0 30 86 2d d8 14 35 33 f6 84 75 53 88 be d0 34 fe 52 21 13 37 9f 94 ee 78 de 69 db 34 eb e3 83 Data Ascii: eeo,L~0DB9o8UfQTh*~1v[3@U(DvJ8s43v5]ns(v%QUWx&Ix+F%6X&H`&%X+RIEYI(VmRukVbBn,VqA$a}em}afsgE]?X2B0-53uS4R!7xi4
2022-03-25 19:15:14 UTC	453	IN	Data Raw: d9 9b c7 03 c0 15 75 06 9e e1 fd fc b4 8a 87 f6 44 ce 64 ec 88 c0 33 5e 3e 1b 1d a8 ed f4 46 86 23 7b e4 18 66 93 0c 5e 66 88 67 e0 d1 28 6d 65 2d 39 c9 75 a8 aa b5 b6 63 c0 fc ec 58 e0 9e da 8e a3 17 b8 63 81 87 e3 03 63 81 17 f8 63 42 2c b0 29 e0 6b 5c e2 2b c5 e5 36 a5 7d 67 e8 f2 4d c1 bb 42 da e3 9b 83 ae 16 24 45 b4 10 98 58 0d ad c4 a1 09 3e f8 49 fc 5c ea 16 3c 51 3b ed 0f 78 f3 38 80 28 50 9c ee ad 4f c8 cd fb dd 66 dc bc 07 97 45 89 0a 94 45 ff b7 66 db ff ed cf 72 89 f9 76 e3 4f fc 83 59 23 83 5c 94 00 97 b7 14 5f 86 05 c6 89 4d 63 c0 a9 2c 20 a1 80 78 df b2 7c 6c 32 f3 87 f5 4d c8 e9 57 eb 1f 4f 60 34 59 50 02 90 45 b8 e4 49 7f 53 a1 be c8 d1 d6 6d 32 bb ef aa 6d cc 29 f1 35 46 b4 00 8b 0d 59 c5 6e 2c d5 d6 39 7b bd 92 91 f4 0a 60 8e f0 42 03 Data Ascii: uDd3^>F#{f^fg(me-9ucXcccB,)k\+6}gMB$EX>I\<Q;x8(POfEEfrvOY#\_Mc, x\|l2MWO`4YPEISm2m)5FYn,9{`B
2022-03-25 19:15:14 UTC	469	IN	Data Raw: c3 ed 67 e0 77 0a fb 4e 75 4b fc 2e ad 15 14 e9 6c 33 31 b3 64 7e 53 7a 49 23 32 43 9f 0b bc ab 3a e0 5d 9d 00 f5 fc a4 28 b4 68 3f c6 07 8b 73 13 dc 4d 40 8d dd 0a 5d 02 f7 3d f8 38 f1 d9 8e 4f 95 4f 69 4b 95 56 77 91 ae ec 2f fc 86 7e 12 7a 94 0b 8c b1 f8 b9 50 4a bd e4 7d 51 51 06 38 14 e5 a4 d4 c2 f7 78 84 a7 f4 04 2a b1 1c 13 52 cd e5 f8 78 06 f8 7c 70 d5 86 0a 47 ed b5 c2 ea 28 1b ea 52 03 d4 73 41 37 ca 32 d3 28 b2 68 4f 1c 14 3a 87 e4 54 21 e4 fe fb 9f 99 02 cd 32 2a 7f 45 c3 b9 8e 52 00 cc 60 f4 76 41 9c 14 60 eb 97 4a 89 87 bb 22 05 10 0d e7 1f d7 81 55 43 ef 99 32 18 2f 00 34 08 ea d0 83 9b ac 2b 58 ed 2c 1d 1b 45 18 70 7c 5c 58 12 1c b8 f9 67 84 6b f5 fb 62 38 43 a8 72 b9 6c ad 93 31 79 c7 63 6b c5 f3 7e 62 b8 6b bc 73 e8 ac bc 83 fd 6a b4 93 Data Ascii: gwNuK.l31d~SzI#2C:](h?sM@]=8OOiKVw/~zPJ}QQ8xRx\|pG(RsA72(hO:T!2ER`vA`J"UC2/4+X,Ep\|\Xgkb8Crl1yck~bksj
2022-03-25 19:15:14 UTC	485	IN	Data Raw: a2 d1 27 69 21 ec e4 7c 60 80 11 3a 1a c9 a3 c9 26 56 8b 6d 2a a6 05 37 36 20 09 de f2 39 c4 27 a3 69 a3 07 e7 15 c0 58 15 d2 cb 70 f3 fb 4c b6 c4 c3 90 4a 7f 34 21 39 ea 2b 85 df 0a 44 88 85 e9 00 cd 6f c6 99 d7 94 75 9a e1 3c ad 65 cf 6c 2f de c0 99 f9 0b 49 4f 7f 90 60 36 d5 7b bc 59 75 33 f9 05 7c 90 59 1e 45 a3 78 11 d3 c6 63 ef be c0 9b 5e 0d 23 83 8d 8c 62 71 0a 0a 95 8b 51 c1 94 80 29 26 05 ca 7b b4 ca 67 99 43 b2 24 d8 eb 28 20 54 b4 0d a1 d9 de 7a 2f b5 2f 6c 10 3d 70 9b 8a df 47 3f e7 d6 f7 72 22 f0 3f 91 6c 73 46 e2 06 2f da 4c 20 f6 28 d0 18 60 ee 1c 8a 5c 81 a1 49 98 c3 63 f2 d3 1a 1e e7 eb 50 0f 40 1c ce 2e 37 33 9f 28 47 80 0b 82 e0 a0 af 47 e1 e0 01 17 07 5d fb 65 0f 7c 88 cb f0 b7 40 89 7f 21 59 08 9b 5e bf 0d 76 4e 3c 32 76 ae 1d 2c 2a Data Ascii: 'i!\|`:&Vm76 9'iXpLJ4!9+Dou<el/IO`6{Yu3\|YExc^#bqQ)&{gC$( Tz//l=pG?r"?lsF/L (`\IcP@.73(GG]e\|@!Y^vN<2v,
2022-03-25 19:15:14 UTC	501	IN	Data Raw: e5 e9 d8 f9 a2 3a fa 7b 22 20 e6 0c ec 1b 10 45 4b 4e 98 00 83 f9 22 74 d8 d7 9e c8 82 20 c7 d3 0a a8 9c 2c 54 80 b9 56 52 92 9e 5d e6 6b e9 2e a2 7a 06 18 00 d4 f3 81 1f df ca b7 c7 04 9b a6 0f 1d b4 ac 1e 7d 4d 0f 20 a3 28 77 04 ce 1c 8a 23 30 70 81 b9 0f 69 6f e5 8c 9d e8 7f e4 a4 ff b9 36 06 df 85 99 80 9a bd c7 f2 fb ee b4 07 9d de 75 e8 a4 b5 0f 14 18 75 7b cd 5d b1 e3 9e c8 12 ab 35 f2 2e fc 5d 0d 45 89 8f 02 1e 03 a3 9e ac e4 49 77 ac b9 2b 03 2a 6d 8f 03 60 48 c5 ab 0f af f8 d8 f6 1d a4 20 fb 4c 48 42 f8 41 0c d1 01 c8 aa db 90 98 6c 76 67 71 5b a2 5e 2e 8a 5c ae 8a e0 e3 fc b6 3a 14 43 12 e0 6a b7 d2 76 07 89 d1 3e 8c c4 ff dc 91 93 04 fe b5 c2 6f 0a fc 8f e5 5d 1a fe bb e0 51 b7 03 8a ce 3e e0 db 15 68 74 51 a4 c7 44 b6 0d 40 bd 40 a0 90 f9 9a Data Ascii: :{" EKN"t ,TVR]k.z}M (w#0pio6uu{]5.]EIw+*m`H LHBAlvgq[^.\:Cjv>o]Q>htQD@@
2022-03-25 19:15:14 UTC	517	IN	Data Raw: 2e 4e 7e 86 3f c2 5e 0e c9 9d ea dd b3 91 60 9d 12 3c 2d f6 e0 f1 e3 19 2d 78 5a 5c 8e 07 82 a7 c5 43 82 27 ba c5 88 b1 4d 22 55 3a 00 e9 2d c1 11 a9 d2 f7 80 7b 4a 9d b6 51 a4 24 62 cd 91 d2 21 e5 c0 89 c3 71 09 77 9c 4a 3a 74 3c 3e 15 53 22 ea 8b 62 b4 c3 46 ac a5 c1 37 e4 d3 e9 42 41 58 98 d7 0d 4c 4b 0f 5f 3c 14 b6 3a c5 1d 32 cf 1d 2d f4 5d 4c d1 44 93 a7 c8 d7 ae ee 65 6e 63 87 a4 db a4 bc 41 fb dc 46 a7 9c 37 ee 36 ff d4 8f b9 05 de 9a d0 35 70 a3 fd dd c3 68 76 a2 86 0e 5d f3 60 3f 32 71 5e d8 d8 6d b7 5d 00 50 95 7a ed 4a 9f 48 8c 91 4a 77 70 22 73 d9 62 4b e2 49 ec ce 56 a8 6e 7b ff 7a eb 08 88 66 46 a8 b0 20 37 6f e6 2c a1 72 02 ff 6c 91 61 0c a2 44 e9 3e b0 89 c7 89 2c 63 ee 2e 76 5a 05 3a 6d a6 74 5a 0f 22 d8 a9 4b 94 34 b1 27 58 c6 6f fc 96 Data Ascii: .N~?^`<--xZ\C'M"U:-{JQ$b!qwJ:t<>S"bF7BAXLK_<:2-]LDencAF765phv]`?2q^m]PzJHJwp"sbKIVn{zfF 7o,rlaD>,c.vZ:mtZ"K4'Xo
2022-03-25 19:15:14 UTC	533	IN	Data Raw: b9 39 93 d2 69 66 83 95 38 aa 9b 70 e5 e6 55 7c 3d ae 2a 70 95 1f fb 07 20 9a ef 42 a0 9b 87 64 d7 c9 56 db 53 1a d7 b3 ff d1 f9 e5 dc 44 17 73 ab 28 ba 19 11 30 7a 7e e8 4c 2f 9a 8f 5c 18 67 eb a6 92 6b f4 d1 a3 bb ad 50 5f a5 2b dc a6 8e 23 f7 e2 1b 0e 7c 2b 29 c0 58 50 ce ac 21 2c 3b 04 31 40 20 f6 10 f5 e2 a0 be aa cc 7d cc 25 b2 68 81 9e 17 1b c8 2e d5 4e 4c a7 7b f4 5f 4f 2c 18 0d 63 56 be db 2d ef 8e d9 89 1e 8e 14 10 14 06 cd 4f 03 be 3f 2a a3 8e 6d 2a 9e 2c f7 7f 4a 21 0c 6a 5e 29 1a 00 81 d1 6b f6 4d 9e 07 43 e6 bd 62 fa 6a c2 0b a3 bc 3c e0 fb 5e 59 13 04 cf ff cb b1 df 47 50 10 7a ad 42 d0 65 2d 2c e1 83 6d d6 5c fc c2 f6 20 39 c7 ed ff 5e 59 c3 4b e8 e5 10 2b 2a ef 26 0a 6a 06 10 47 d6 a5 f6 13 4b 97 8b 2d e2 bf 0a a6 8a a7 94 a0 ff 9f 84 b1 Data Ascii: 9if8pU\|=p BdVSDs(0z~L/\gkP_+#\|+)XP!,;1@ }%h.NL{_O,cV-O?m,J!j^)kMCbj<^YGPzBe-,m\ 9^YK+&jGK-
2022-03-25 19:15:14 UTC	549	IN	Data Raw: f0 cf 82 7f 0e fc 73 a0 4d 17 41 0b 10 d4 01 5d de 5c 6e 4f 1f 0f 08 26 42 a9 9f b7 24 e6 03 8f 81 0a ba de 7c 3b 67 74 37 5f 50 8b 44 3d ee 58 2d 6f 07 6d f7 3b 71 d6 0f 88 14 5a 41 41 df 16 74 e9 93 bf 21 b5 81 ad 43 a4 b3 f3 36 8e 9b 43 59 e1 b6 d3 90 49 3e 30 4f 48 c7 f0 f4 58 c7 4e 05 f8 4f ca 30 70 fa 74 57 cc bd fb 05 50 32 60 df d1 bd 13 0e 1c d0 98 f4 24 89 ec 61 f0 2e 48 04 74 e7 7e 66 12 bf 8e 1e 71 2f 2b 02 f6 ad 3c 1d 98 99 0f 1d d3 0d 5a db b3 0a 66 5a ea 5d 7d 17 e3 eb 8f 70 77 5a 36 04 49 56 06 46 14 4f 6b 6c b0 cf ba 4b 24 78 87 37 4f f9 d8 b1 6c 18 c4 51 56 36 8c e0 0e c4 14 73 ee 46 8a d6 d4 5b c0 b9 bc 0f 39 c9 05 01 92 8a 1d a7 53 21 42 7a 30 6b 64 eb 5e fe b5 a0 a5 7c 8c 00 b4 8e 36 30 be ce a3 87 ec 4a a7 a0 4b fe 75 1f 13 be 25 f7 Data Ascii: sMA]\nO&B$\|;gt7_PD=X-om;qZAAt!C6CYI>0OHXNO0ptWP2`$a.Ht~fq/+<ZfZ]}pwZ6IVFOklK$x7OlQV6sF[9S!Bz0kd^\|60JKu%
2022-03-25 19:15:14 UTC	565	IN	Data Raw: b5 92 1e 41 fa 19 49 67 91 5e 2b e9 1c d2 f7 49 ba 80 f4 2a 49 bb 49 57 49 ba 98 74 b9 a4 67 92 9e 2d e9 b9 a4 4b 25 5d 4e fa 22 49 57 90 76 4b ba 9a 74 9e a4 57 91 ce 92 74 29 e9 0c 49 af 21 9d 26 e9 b5 a4 93 25 bd 8e b4 49 d2 1b 49 7f 7b b2 ec 67 d2 aa a4 9b 48 bf 2f e9 bb 48 37 4b ba 99 f4 4b 92 de 4d 7a a3 a4 f7 91 7e 4c d2 2a e9 35 92 de 4f 7a b5 a4 db 48 57 4b da 14 07 7a b1 a4 ad a4 e7 4a da 4e 7a 86 a4 d3 48 97 48 3a 9d b4 57 d2 23 48 17 48 3a 8b f4 99 92 ce 21 3d 42 d2 05 a4 07 49 da 4d da 2e e9 62 d2 f1 92 2e 21 dd 36 44 f6 1b e9 cf 25 3d 93 f4 3e 49 cf 25 fd 86 a4 cb 49 37 49 ba 82 f4 f3 92 ae 26 bd 4e d2 ab 48 3f 24 e9 bb 48 df 25 e9 35 a4 57 4a 7a 2d e9 0a 49 af 23 ed 93 f4 46 d2 33 41 cb 27 bf 0b f9 5f e6 4e ec cd ad f3 4e 6e a9 4b f4 f5 85 Data Ascii: AIg^+IIIWItg-K%]N"IWvKtWt)I!&%II{gH/H7KKMz~L5OzHWKzJNzHH:W#HH:!=BIM.b.!6D%=>I%I7I&NH?$H%5WJz-I#F3A'_NNnK
2022-03-25 19:15:14 UTC	581	IN	Data Raw: fa 25 13 14 66 e0 7b ae 8f 48 7f c4 05 4a 6d 01 cd 07 22 fd e2 59 e4 b7 93 bb cb 74 1f 62 e9 8e ef 74 81 cd c3 6f 36 cd b5 cd f9 dd 04 94 58 a4 8b 2c 07 49 83 28 2e c0 3f 7a 4f fc 5e 27 f7 47 c4 d7 22 68 46 7e b2 a8 c6 09 4a e5 54 5f 04 27 6f 21 3e 9b a3 ca 14 4b 32 be ce 73 52 9a 89 27 ac 88 3a ad 87 86 d3 aa 49 94 ed 55 72 9f 86 fe a2 68 1e 6d 8b b5 c4 5a 13 a3 5d 2e 57 0c 7d ae 4d 41 de 28 80 33 75 fa ec 38 bb e5 eb 29 29 b7 4e 8f c3 04 d6 69 a7 d7 f6 b9 f3 e7 e2 83 09 6a 69 05 3e f6 38 bc 8d b3 d8 ed 76 38 e1 4b a8 5c 2f 16 96 2b 85 85 25 39 96 76 fc fa b2 bc 3c 82 37 e4 79 6f c9 2e f4 e5 19 ef 67 44 e2 9e e2 02 6f 41 76 61 c1 5d 79 53 ca f0 84 8d 8a 19 79 39 de 82 92 62 57 05 39 f3 3e 85 6b 61 5e b1 d7 55 71 ab 81 cf c8 2b ca 2e 9d 5f 52 96 47 ef c4 Data Ascii: %f{HJm"Ytbto6X,I(.?zO^'G"hF~JT_'o!>K2sR':IUrhmZ].W}MA(3u8))Niji>8v8K\/+%9v<7yo.gDoAva]ySy9bW9>ka^Uq+._RG
2022-03-25 19:15:14 UTC	597	IN	Data Raw: a3 88 a5 29 b7 8f fd b3 cc 60 1f 5d 0e 01 62 30 b6 ea 1d 44 a9 45 21 39 e3 91 05 8f 12 e8 5c 51 a0 db 98 55 b4 00 3c e2 5c a9 a8 51 26 fd 33 51 16 ce aa 17 14 f5 29 8e fa 73 c1 71 9f 46 ac 96 ea f6 7f 28 fb dd ad a8 7d 65 a3 53 85 1d ed a9 8e eb 60 62 f7 ad dc fb 5e 2b d2 71 d6 ef 58 37 40 53 0d 66 80 08 6e ab 65 58 ee a5 f7 f8 78 83 0e eb 50 68 5a ca 9e 04 ee 46 50 ef b8 68 eb c2 67 ef 3d d7 d6 77 dc bc 61 6f dc 9f c5 4d cf 22 39 6e 46 0e 5a f7 d1 d6 d9 b8 1f 2e 38 3e 65 07 b9 e2 55 b7 4f 4c bf 86 65 46 0c ea 8a b4 b8 df 23 3d a6 83 73 31 4b ac d9 9d 15 4a f8 11 db d2 05 47 49 b4 74 fb 96 85 a3 c0 65 66 f1 13 a1 62 9e f2 9c 2b 5d 58 7b 1f 8a a2 28 3f ca 86 27 fe 96 99 1a 90 e3 5f 48 fa 26 0e f6 9b 74 f7 b3 44 64 32 46 35 87 22 12 21 70 69 eb 69 e8 76 d4 Data Ascii: )`]b0DE!9\QU<\Q&3Q)sqF(}eS`b^+qX7@SfneXxPhZFPhg=waoM"9nFZ.8>eUOLeF#=s1KJGItefb+]X{(?'_H&tDd2F5"!piiv
2022-03-25 19:15:14 UTC	613	IN	Data Raw: 1b 8d 9c 01 f9 42 5b d6 91 6e e5 9e f1 27 25 e4 ed 08 ef 65 5b 7d 38 6a 51 be 1f 5d 90 2f e1 4b 8d 3d 50 9b b7 be c2 6b 65 e1 69 09 e9 79 7a 42 96 91 cf e0 ea d0 f0 45 84 aa e3 1a 57 08 7b 65 a8 87 01 8f a0 9c 17 8f 75 8d 7d 87 73 8f 8e 12 74 e5 5c 12 eb 3b 01 59 46 cc 99 cb 45 ec 8f 23 69 39 72 1d 7e dc a5 06 75 df 4e cb d2 e3 cf c6 f8 22 3c ea 38 f1 22 5d 90 1e 8f 17 0f a6 5d f3 64 32 ef ce 44 ae c2 86 fd 9c 84 8c 3c 17 34 fe 38 d7 0c da a1 e0 19 84 6f a8 38 c5 fb d4 79 cf e5 3a d4 6d ee bb aa b4 47 21 fc 82 75 84 b0 2b 4f d8 ab c3 f0 20 d0 f9 fa 02 ef e6 aa 73 83 eb a6 4f 4d 2f 4c c8 1b 11 86 ef 63 ca f9 70 d7 66 94 83 af 04 25 61 2d 8b df 8c 3c 7a 0d 5e 87 0e 3c ba 51 c6 5f 9c 90 1f 20 3c 95 e5 3d 18 b2 30 ea 41 79 ac 96 61 d2 33 e3 c7 77 0d f2 31 e4 Data Ascii: B[n'%e[}8jQ]/K=PkeiyzBEW{eu}st\;YFE#i9r~uN"<8"]]d2D<48o8y:mG!u+O sOM/Lcpf%a-<z^<Q_ <=0Aya3w1
2022-03-25 19:15:14 UTC	629	IN	Data Raw: 6e 4d 1d f5 68 87 52 8f 76 08 d7 f0 02 ac 35 a4 5a 87 40 64 b3 83 31 7a 2f 65 ae ef 64 30 21 e7 72 b0 dc d7 58 1f b1 17 4a 8c b2 d4 7d 1a fd 01 bf c7 1f 52 97 31 2b 3c f1 36 b1 61 37 a2 93 73 49 27 ef 45 e7 90 b6 53 f1 3a 95 df de 49 73 fc f6 24 ce 40 ea 5b b4 83 3b 9e 71 5b 87 40 f9 2c 32 b7 d9 41 9c f7 f6 29 b5 f1 fb 5c c8 df d1 85 f2 4f 33 58 3a c5 f7 50 5f 03 62 d8 e6 2d 75 f3 ba 5b df a0 93 30 c3 7e 07 fd 8c f3 bb f0 ba d8 ea 5e fa e2 ba 97 e1 c7 e8 17 f5 38 db ff 1a ad 2f 29 8d 4f 21 f5 aa 36 c0 c7 71 1e 59 df 46 76 d1 2f 9d 24 75 72 1c 2c f3 10 7f 7f cf cc a2 e9 85 93 4e ae f5 7c ca f8 77 ee 35 d1 bb 26 8f 4b 1e 6e ed 83 51 5b 4f 89 be a8 4f f3 7b 25 dd fd d7 c8 6e b5 40 e3 0b fe c0 fd 88 5c 9b 87 1d 1e f9 3e c9 03 7f 2c d4 f8 6d 94 c3 39 67 5e e6 Data Ascii: nMhRv5Z@d1z/ed0!rXJ}R1+<6a7sI'ES:Is$@[;q[@,2A)\O3X:P_b-u[0~^8/)O!6qYFv/$ur,N\|w5&KnQ[OO{%n@\>,m9g^
2022-03-25 19:15:14 UTC	645	IN	Data Raw: fc 70 ad da 9c df 26 fb 17 6a b8 4e 6d de a5 61 3f e1 65 7e 78 84 da a8 da 60 24 a1 e1 8d 6a 73 2e 4b f6 37 68 f8 e1 16 fd f2 64 ff 9e 1a ce 55 5b 64 f9 2f d5 70 7d 8b 5e 9f ec 5f aa e1 fa fa d4 fb 7f d3 0a 3f dc a0 36 e7 8a 64 ff 1a 0d 37 a8 b5 fd eb af 49 3e 9f 76 3c f8 27 da af 05 3a df a5 e1 a6 b1 c6 0b e7 0e f7 ed 47 0d 3a 9f d6 32 8e ea dc ce 3f 3e 1d 7d fb 85 fa fb 07 07 48 bc 70 e3 02 f1 cb f9 0f 5a 4e 2d fd 41 53 a6 7f dc 5e c1 fe 8c fc c9 3d 3f ee cf fe 09 7f f4 2e ad 07 9a 8f 86 5a cd ef bb be 5d a5 e1 49 1a de f0 8e 6f 77 d3 70 59 8b 7d 5c cf ab b2 76 49 db ab 7f d3 d7 37 19 ab 5f b3 f4 20 fe ac d4 7a d1 b9 a9 f5 86 2d a4 f3 f0 16 f4 46 d5 6f 51 bd 49 c3 b9 6f 25 c7 cf d7 70 fe 8d c9 f1 b3 df fe f1 f2 bc 69 6e b2 3f bd a5 5e 37 25 eb 19 56 3b Data Ascii: p&jNma?e~x`$js.K7hdU[d/p}^_?6d7I>v<':G:2?>}HpZN-AS^=?.Z]IowpY}\vI7_ z-FoQIo%pin?^7%V;
2022-03-25 19:15:14 UTC	661	IN	Data Raw: f3 75 f8 25 b4 eb 12 5f fc 96 b5 f1 5a 26 f5 ef e8 a6 c3 6b bf ed fe a3 c3 03 3e b0 1e 74 f8 0a c4 78 0b 37 cf 33 6f dd ca 6d 18 a5 c3 8b d1 ac c3 7d 3f 72 ee 75 78 08 a6 ea f0 b9 98 a1 c3 57 42 a7 be 1e 73 74 0b af ff b1 6b 38 fe e6 96 bf 47 fa ef eb 79 c7 cf ec 8b 6d b2 fc f7 cf 1d 67 1d 5e a7 cd 1a 78 3d 93 7a 3b 74 d7 e1 ab be 70 9c 75 0b af b6 a0 b2 fc 79 eb bc 03 d2 bf 27 e7 03 16 56 96 ff 5b a9 7c ea 22 f7 19 db e7 79 83 2f ed e3 6e 8e 21 ef f1 b5 fb af f1 2c 6f b8 d8 b9 d0 e1 1e 98 a8 c3 ab 7d eb f8 eb f0 c5 28 ea f0 bf 51 d2 ad fc ca 52 f3 dc d9 f1 e7 a3 bf 73 ec 8c 37 f1 47 58 ae db a2 97 c5 7b 93 e6 ec f7 ce d7 b4 4c ea b7 50 f5 46 26 f5 af e8 a6 93 76 eb 1c 3d a3 7f 70 fd 21 ab c3 17 fd 64 2d e9 f0 12 8c d4 ed dc f2 73 65 7c 66 71 ea 7f fd 62 Data Ascii: u%_Z&k>tx73om}?ruxWBstk8Gymg^x=z;tpuy'V[\|"y/n!,o}(QRs7GX{LPF&v=p!d-se\|fqb
2022-03-25 19:15:14 UTC	677	IN	Data Raw: 63 89 4e 03 56 85 4d 01 c7 a9 04 be 89 a9 76 df dd e8 72 ef d9 65 c5 2e bf 2d d4 9c d2 78 12 ed be 12 4d b8 24 36 ea 3b e4 9d b1 31 7f ac 2a 1f 16 17 cc 31 7a 52 9d 5a bf a0 6d a5 a1 ff bd a2 0e 02 77 95 ef 17 f8 47 5f 70 7a 4f 68 bc 87 34 a5 da 03 2e ea c4 e9 af 07 15 a5 b4 68 cf 86 f9 03 c6 97 93 75 06 32 ee d0 b8 d3 9d e5 7e 00 02 62 fd db e1 c9 04 38 1e f1 34 c6 19 84 e7 69 ca 52 c7 7c 15 ca 29 1f 27 88 0c 0c bb f9 9e d4 78 4a 54 e0 25 67 79 1f c5 b9 9c 50 92 f3 3b 46 fb 8a 3b bd 7d c9 f7 4e 70 a0 8c 3e d7 ef 38 51 fb 86 93 ec 60 ee 5c d0 e9 d4 36 39 8b 82 eb f7 8b db 14 f5 a9 16 8b 7a ee 19 6d 3d e8 a8 27 4d 2c 76 e1 45 6d c0 29 25 86 d3 11 00 11 b3 f7 35 eb 41 a7 34 0b c9 23 29 37 3a 30 dd eb 9d 45 c7 dd 6b 1d 77 f8 47 3b 60 82 72 3b ba 89 67 15 5c Data Ascii: cNVMvre.-xM$6;1*1zRZmwG_pzOh4.hu2~b84iR\|)'xJT%gyP;F;}Np>8Q`\69zm='M,vEm)%5A4#)7:0EkwG;`r;g\
2022-03-25 19:15:14 UTC	693	IN	Data Raw: 8d c5 f2 ea 63 1e d9 fc aa 1c dd a9 f5 c2 30 97 cf db 4c c4 2f e6 f1 bf 10 b1 99 fd fd e9 c4 97 56 6a fd fd 5e ad bf e3 21 d9 df 3f 95 ec ef f7 6a 7d f3 5e bd bf 7f 77 01 eb ef 7a 64 ef f3 a4 8f 4e 50 a4 0f 7e 46 4b 69 ae 5f 8a d9 ef 0b ac 02 a4 5f d1 ba f8 04 71 8c 49 ff a5 ce df 52 0b c7 10 34 d4 0e 1e c1 a7 a7 fb cb 57 bb c3 0e da 07 13 38 9b 01 8e 5f 59 ed ae 53 56 5b 93 1f 41 9f 42 51 21 81 42 d9 4d f6 d0 6f 4e 7c 09 3c e3 45 9e 3a cf 83 78 3f 0f 44 bd 35 7a 60 10 dc f9 c6 c9 60 f6 c3 29 10 53 d6 66 63 dc 08 6a 7f 54 3f 21 65 6d 5d d2 9c 6f 4e 3a 7a 71 97 74 85 8a ab b3 99 38 38 a6 2e a9 94 06 45 67 f3 4e fc 57 15 c9 a3 48 15 8a 44 8a c4 35 28 28 bb bc 04 42 98 fb 89 6f 02 90 34 47 00 15 a9 d5 24 2f f1 97 db 80 bc b2 e4 5a 32 1b 0f 5a bb 8d b2 96 0c Data Ascii: c0L/Vj^!?j}^wzdNP~FKi__qIR4W8_YSV[ABQ!BMoN\|<E:x?D5z``)SfcjT?!em]oN:zqt88.EgNWHD5((Bo4G$/Z2Z
2022-03-25 19:15:14 UTC	709	IN	Data Raw: 5c 09 65 65 f0 b0 ce 80 12 22 92 4d 2e cd 58 7e 83 26 2f 8a 0c dc 8f ae 1c f0 be 4d b6 0f 4a 77 a4 bf 6b f2 4c bc a6 bf 57 44 06 ed 5f d3 71 88 c3 67 b3 39 1e ee 26 70 fc b3 92 07 29 8f d6 06 5c 3b 01 54 b2 f4 16 3d 52 20 64 68 dd f0 fc 72 20 df 6b d8 ab 72 74 25 15 4f 08 c2 c7 df d1 6c 81 4f 8b fd 0d b4 41 5d ae db 19 23 df 35 d6 06 19 96 36 05 24 e9 3b 27 a2 40 bd bd 89 22 d6 8d 73 d3 35 b5 61 8e 0b fb 66 ba a1 80 d9 e0 32 3f a3 ee c2 4e d6 67 6e 9c 8a 4f c3 98 8d 0d d8 ae 3c a1 eb 3a ad d8 db 24 38 9f 58 91 1b ab c2 5c 9d ef 09 dd 68 85 33 8d de c6 73 a4 87 b2 a1 a5 5f d2 10 ef 92 1e ea 81 93 04 d4 87 6b 70 3d d2 c2 dd e8 a6 cd 5d fe a4 7a b8 c1 85 98 e6 2e 24 ac c8 75 07 27 c3 65 06 5e b3 b8 34 99 84 4f 74 c9 28 cf 69 cd 67 70 ae e4 25 ef 8c b0 30 7e Data Ascii: \ee"M.X~&/MJwkLWD_qg9&p)\;T=R dhr krt%OlOA]#56$;'@"s5af2?NgnO<:$8X\h3s_kp=]z.$u'e^4Ot(igp%0~
2022-03-25 19:15:14 UTC	725	IN	Data Raw: 13 03 be ae e8 f2 91 ea 60 61 50 7f f6 bd 83 63 36 52 ef 57 e5 6a c4 a9 f2 5a 61 ed fa 84 d5 48 3e 90 e8 a0 61 1c a4 df 28 f9 51 26 d6 15 6a a7 41 fd 63 93 e0 eb 5f 86 9a 98 6b a5 ad 60 7d 5c 3a f7 cc a4 37 98 7f fe 9a ce 3c 69 ed 9c ad 0c bd 8e d7 3f f5 89 12 cf dc de 38 7f da b2 d8 8e 77 fc a4 c4 95 d0 73 c0 38 99 8b 00 20 77 3f 0f 24 e4 6e 7a 80 72 87 0f 28 e6 d2 fa ce 95 d0 f7 84 4f 41 7d e7 5a cb 26 7c 46 d6 d3 5a eb ed 89 89 14 ae c1 2b 5e 2d 99 04 85 d2 40 c2 5a 6b df 3a a2 80 0f e8 eb f7 bf db 49 21 5f c4 b7 15 3e 72 ad f5 ac 08 f3 d2 77 e3 6b ad 51 9d a2 ce 7e 6f 6e 5c dc 99 4a f5 fa 26 48 70 f2 59 56 dc eb b4 0b ba 8f 3f 5a 6f 6b ca 51 62 21 cf 6b 53 03 c5 c3 55 7b b3 37 79 53 b1 5e 17 31 6d 2a 36 e8 88 89 38 8b c4 43 bc fd 6b 56 1a 48 f1 0c 98 Data Ascii: `aPc6RWjZaH>a(Q&jAc_k`}\:7<i?8ws8 w?$nzr(OA}Z&\|FZ+^-@Zk:I!_>rwkQ~on\J&HpYV?ZokQb!kSU{7yS^1m*68CkVH
2022-03-25 19:15:14 UTC	741	IN	Data Raw: ad f9 dd 03 e4 45 f0 7d ce 29 d7 5c d5 1d df 08 f6 bd eb 2a 81 2f 09 50 ee 36 84 8f ab 1c 53 5a a4 3d 30 15 77 f1 08 dd 05 85 bf a5 76 9b d1 e4 1e 50 b4 f2 81 eb e0 69 1f 67 37 19 dc dc ab 86 d6 7a 77 85 48 31 ac 43 a0 8a af cc 45 4c 55 c4 3c 86 98 91 88 4e 19 d1 d8 23 a2 45 e6 b1 72 10 f2 df a3 3e 2a f5 fc 2d ce bc fa 4a 84 a2 3c a5 ef ec 96 a7 74 73 75 31 c2 20 f9 21 3b 39 f9 74 83 b9 aa 00 3e ed 63 f1 e0 a2 2c 2d 55 b4 87 f2 81 dc e1 5f 99 1f 53 22 5b 6a ba bb ff ca 69 6c a0 71 dc 8c 74 94 27 77 1b b2 b5 cd fb 56 08 fb e0 22 04 31 af 73 a6 87 3c 9d 0b 5d 89 9e 4e 97 b9 fa 39 3d 4f 59 da 4e 9a ac 9f 39 1a e2 dc 3f 01 cf 1e 7d fb 11 fe d4 be 42 1f 6e 9c a5 7a 6e 9c 0f 7b 34 ce 0f 74 e1 c2 dd 84 00 94 cb d1 dd b2 67 32 57 77 50 90 95 0f 8d 85 ff b8 19 26 Data Ascii: E})\/P6SZ=0wvPig7zwH1CELU<N#Er>-J<tsu1 !;9t>c,-U_S"[jilqt'wV"1s<]N9=OYN9?}Bnzn{4tg2WwP&
2022-03-25 19:15:14 UTC	757	IN	Data Raw: 3a a1 5f 37 eb 05 a8 ba 6e 10 2b d4 3f 8c de a4 cd e6 70 ab d1 aa a7 6b f5 c3 98 90 52 4c d7 c2 ab a9 29 62 a2 29 85 e0 f2 70 53 72 0c 7a 93 da 93 5e 38 cf 16 ea 85 75 9e 11 1a 1b 6b ce c7 3e f8 41 d3 bd 8b b6 7f 4e 4b ae eb e8 8c 40 4d 47 72 53 3d b5 5a 4a 08 c7 a3 ff 6c 8f 5e 61 db c9 a1 01 c7 ea 8f ce a4 0b 29 9a 8b 79 7a 9b cb 70 bf d8 a6 2c 70 42 33 d4 9b 55 bb 18 5d c2 b0 fe 72 19 76 e1 12 ec c2 e7 76 6d c5 f5 78 63 d0 ee d7 75 22 1e d8 f7 0f fb cf f0 29 37 39 7d f9 37 8d 8e 7c 27 19 69 18 af 35 b4 84 d2 29 70 f4 22 a7 ba 48 a1 99 2a 40 0d d9 09 5d 61 75 ce 36 74 d8 34 9e b6 4e e8 d7 c0 67 1b 8a 51 76 e7 bf 2c 4f 3b e2 90 7e 7b 29 3e a5 ba 95 96 53 42 ba 24 fb 93 aa c9 5b 5d 9e cb 44 45 65 83 88 11 0e d7 e4 90 73 b9 76 a0 38 6b 3d 86 3d ea 6f 1e 63 Data Ascii: :_7n+?pkRL)b)pSrz^8uk>ANK@MGrS=ZJl^a)yzp,pB3U]rvvmxcu")79}7\|'i5)p"H*@]au6t4NgQv,O;~{)>SB$[]DEesv8k==oc
2022-03-25 19:15:14 UTC	773	IN	Data Raw: 1f 20 83 48 5e 5b c0 5a c8 93 58 0c 24 d9 c4 12 3c 88 a8 48 c7 8d af 24 e2 80 a0 af fd eb 76 5d 1b 60 2e f1 43 ee ae 88 8f b1 a8 1f 4e d4 d9 21 b7 e3 11 8e ab 87 6f c5 2f 21 c3 37 67 91 d4 69 0b 33 43 02 48 63 57 1a a0 a9 78 0b c3 74 56 11 d9 57 c0 4c c4 24 86 32 9b ee 2a 12 be 26 9f 36 e4 75 2c 9f 22 04 26 3a df 62 15 1a 7f 65 65 11 55 81 72 ab 9d 71 c6 a0 32 d7 a5 7b dd 12 e1 20 20 a0 2c 70 53 8b 10 52 ca 86 4d cd e7 22 9f e6 c6 cc 19 87 6a ec 2f fc 84 72 96 60 e0 52 c8 a4 8b 58 cd 1c c3 5b 7f 3f 6a 31 cb f0 cb b8 16 b3 5e 7a ab d2 ca 8a d9 2c 93 e7 2a d0 81 6e af 50 5f 04 71 1d f0 7e 00 d7 73 1e 64 0c 5f c0 7e 9f 08 1d 90 a9 c6 32 75 fe 66 7a 25 a1 a4 0d 26 d1 0f 90 06 b4 e2 7c 83 5f 03 ec 82 6d b2 57 89 0f 3a 75 f4 62 a7 bf f8 79 3d de 9c 08 cb 18 9d Data Ascii: H^[ZX$<H$v]`.CN!o/!7gi3CHcWxtVWL$2&6u,"&:beeUrq2{ ,pSRM"j/r`RX[?j1^z,nP_q~sd_~2ufz%&\|_mW:uby=
2022-03-25 19:15:14 UTC	789	IN	Data Raw: 14 be ad 77 9f 8e a7 3e 69 66 9f 36 37 52 f6 91 a2 be 73 0e a8 ef 25 aa 6f 2c d5 b7 9e d0 c0 1a 9b 47 fd b0 d4 f6 01 2f 99 ca 2e 3f 7d 14 96 1a aa 23 e2 40 9f f9 46 8a e8 67 93 fa 16 d7 f8 fc 00 ee e7 f7 a8 be 72 d4 47 94 d6 54 ae f7 59 bc 21 fe 96 da bb de 3a aa f7 e5 77 b1 ec 2e a2 5c a7 18 b9 ce ba 6f 3f fd 53 e7 8e 69 14 b4 d1 e9 04 3b 28 e3 ba 10 6b 42 79 5c ad 00 24 00 ce eb 5a a0 4e 50 2a 9f 31 e4 44 92 a9 a0 9d b8 36 40 84 60 41 25 58 50 01 0b 3d 21 e6 bf 9f 6a e9 ee 4f 64 9b ba 47 4f 2f 8a 25 6e 62 23 f8 2c 2d 5d 36 1d ad 17 6e d3 f5 fe e8 cf 43 73 9e 0a d9 6f 27 1c 0d 27 32 a4 ab 4f 45 69 83 50 80 da 78 e8 68 b0 c4 ef 23 5e 5d f2 4b 45 b4 0e 63 9f 11 7f cf 8a bf e7 c4 df f3 e2 ef 05 f1 f7 fb 22 42 ee 2b 51 a5 f6 61 9d 58 9f 4b 0c cd c0 cc fc d8 Data Ascii: w>if67Rs%o,G/.?}#@FgrGTY!:w.\o?Si;(kBy\$ZNP*1D6@`A%XP=!jOdGO/%nb#,-]6nCso''2OEiPxh#^]KEc"B+QaXK
2022-03-25 19:15:14 UTC	805	IN	Data Raw: c0 94 47 36 79 85 a8 03 53 1b 3e 1e 8f a9 e1 7f 9e 32 f4 97 9d 8c 22 f6 09 08 62 8c 1e 06 9c 7b 0f a0 c4 1e 40 98 ad c9 14 83 06 a3 15 be ac b2 ee 50 55 61 65 fe d5 05 fe 02 69 f3 56 2c 70 07 48 85 26 e2 cb 35 7b 2c 97 db e4 f0 e4 31 98 75 03 e4 fa 22 33 8c da 18 80 14 57 72 37 d6 20 cc f6 03 a4 1f f5 ab df 62 dc a6 ca e1 25 63 a0 b7 64 76 01 6f ec 4b d3 c2 67 79 9c ee 43 01 04 cc c0 13 47 2b d1 81 37 dd 43 46 f6 2f 4b a1 77 79 74 4d c2 da 04 74 48 59 91 b3 60 d0 f2 35 6f e4 5b 4e e0 9d af 51 92 43 c7 87 d5 24 a2 59 a2 c2 1d ec 81 c3 29 07 01 ce 66 67 8f 75 47 4a 15 af 0d e9 02 2d 50 12 9b 4b 3e 0d 22 90 2c 93 29 ae ba f6 06 36 c4 15 06 9a e8 26 12 48 56 b1 65 d6 4d f1 eb 09 24 ee 34 ac 9b 85 00 8b 17 6d 56 57 57 2b 8e 6b 2c bf 62 5d e3 6c 98 c6 5c 8d 62 Data Ascii: G6yS>2"b{@PUaeiV,pH&5{,1u"3Wr7 b%cdvoKgyCG+7CF/KwytMtHY`5o[NQC$Y)fguGJ-PK>",)6&HVeM$4mVWW+k,b]l\b
2022-03-25 19:15:14 UTC	821	IN	Data Raw: e4 6b 95 d9 02 6b 42 ed dc 0b 82 7e d7 4d 4f 40 d0 7c d8 6b 7e cb 51 69 75 2a 54 ab 23 42 81 9b 28 0b c3 78 54 3b 8f 40 32 d9 0e 36 5c a4 64 58 42 55 28 3d 89 01 c9 28 63 6d 51 36 2c 1b 64 03 3c d9 79 04 25 12 b2 23 77 02 74 19 6b 40 17 2a 93 08 61 d0 1a ca a3 68 7f 9d 5e 37 8d 41 4e 3e 15 da 79 04 f3 f8 89 4e 21 8e 13 55 68 39 70 e7 91 7c 42 93 7b 0c 0f 89 d7 24 f9 60 a3 01 7f 76 fc a1 cb 66 0e 12 36 6e 31 03 50 22 bd 7d 36 c0 d7 e7 f0 27 85 bd 7a 21 aa 5f 5b e8 60 b9 94 f7 42 03 20 75 40 af c1 8f b0 91 40 c5 84 a2 e0 20 20 e3 24 9b 70 ab 6c 06 06 ae 35 43 6f fd 50 6b b1 83 a6 0d f2 20 8b 6f 24 1a ec 0e e5 05 e8 41 db df 21 26 41 cd 48 72 8a ab 6d 85 14 c0 30 84 92 a4 d5 5b 20 15 e2 2c b4 8e 0e a5 93 a0 ac b6 b1 7e d7 b2 d7 b4 ad 60 14 36 90 ec 8b c8 93 Data Ascii: kkB~MO@\|k~QiuT#B(xT;@26\dXBU(=(cmQ6,d<y%#wtk@ah^7AN>yN!Uh9p\|B{$`vf6n1P"}6'z!_[`B u@@ $pl5CoPk o$A!&AHrm0[ ,~`6
2022-03-25 19:15:14 UTC	837	IN	Data Raw: 70 9e 01 3f 26 70 18 05 b9 0e e5 12 b6 08 bf fe 8e a6 b9 99 5b b2 ee 87 a2 9a b8 ed e4 0b b7 51 75 00 2b 9b d4 d1 8c 98 cf ce 99 80 26 31 ec 0a 6c 02 c4 18 06 78 6c 6a f1 fe 13 86 0d d0 96 ee 19 5b 9b 2f ee a0 2f 68 d3 bf 60 3c ed df 10 d7 ea a4 4f 77 1e a9 5f f9 32 58 36 5f f5 d3 3e ef a6 75 51 bd cd 4c 30 6a 05 ce f0 93 95 cf 21 26 ee f5 fd 39 af d8 16 f8 a2 c1 72 3c e4 57 2c f8 0e 4b 28 80 35 36 c7 7a 02 e8 b5 e3 98 01 65 f0 49 83 17 53 10 9e 3f 80 03 25 f2 6e 00 d3 50 bd 18 79 04 4b 94 85 ff 6b 92 f0 db fd 30 0e b8 b1 25 22 7c 2e b3 93 73 75 cc eb 5d ca 09 69 56 da d8 d6 b2 27 aa c8 54 07 ae 0c 5c 99 b8 20 a2 99 84 30 87 36 1f 22 0f d0 e2 3b 17 87 1f 39 af 30 4b 56 36 55 8d 80 e4 44 f7 5d ee 00 a7 a0 81 7d 97 53 74 f6 f7 63 09 c8 c6 a9 65 db 7d ca f4 Data Ascii: p?&p[Qu+&1lxlj[//h`<Ow_2X6_>uQL0j!&9r<W,K(56zeIS?%nPyKk0%"\|.su]iV'T\ 06";90KV6UD]}Stce}
2022-03-25 19:15:14 UTC	853	IN	Data Raw: ac 36 0d 20 c4 bd 1c 71 69 40 1b c9 d5 1d c0 3b 69 ad b5 ac f1 b1 c0 8d 65 8d 3f 08 cc c9 53 ae ed 65 a3 13 ff 74 4f 64 1c a2 f4 fa 18 02 5c c2 73 f9 c1 23 e0 3f c0 79 76 a5 1f 91 55 fc a3 85 2a df e3 03 99 ed e4 62 00 62 40 b4 9e e1 51 40 c8 a2 d5 92 1f 00 18 e9 2e 04 52 46 bb a5 d7 e5 cc ac cd 59 bb e1 f6 b2 2f 8e 19 86 ca 91 71 f9 ee 1c 48 a7 01 58 a1 55 11 66 45 ee 8e 92 4f e5 b9 bb 31 90 dd c3 01 bb b6 79 e1 d9 1e 44 1a 45 77 67 01 2e 76 cf 73 dd 4d 51 c9 0b 7e c1 6b a8 3c 0c 05 53 03 11 ad 29 38 81 36 94 13 b8 16 54 d0 0f 1f 6a 66 66 20 7b da 64 a9 fc 7d 33 17 12 74 18 f6 c3 46 4d 94 95 aa 71 62 71 df f8 3e 8a bb 11 c1 49 2e 78 8d 5f a1 03 10 7f 01 e9 1a bf 41 a9 ae fc 4e b3 c1 62 a0 ee f7 c5 92 7d eb 07 27 4f f6 6e 4a f6 56 73 7c 77 9a 6a 6e dd 9d Data Ascii: 6 qi@;ie?SetOd\s#?yvU*bb@Q@.RFY/qHXUfEO1yDEwg.vsMQ~k<S)86Tjff {d}3tFMqbq>I.x_ANb}'OnJVs\|wjn
2022-03-25 19:15:14 UTC	869	IN	Data Raw: f8 91 a8 ab bd c0 96 5c 63 47 13 16 e4 e2 d0 f1 80 38 b8 6d 09 2f 4a 94 1f 4e 8b 5c ed b1 09 eb 52 03 a5 8b b2 56 ba f1 97 2f 34 c0 bc 7f e4 f3 f0 48 3c f0 79 38 5b ba af fe 5c 3c 40 50 1f 2f c3 dc 35 46 3e 7b e2 30 fe 55 38 64 ae bf 46 ae 9c 63 6b 65 b1 0d 1f d4 02 70 87 84 a0 83 16 31 e2 32 5d 62 03 8d 0e b7 76 68 19 81 56 d6 f1 71 fd b6 7f 76 1a a2 0f be 38 b6 04 e3 cf d4 dd 42 a3 0f f2 8e 4f 16 f0 20 a9 3b 55 98 84 c0 08 80 b1 88 60 6a 33 99 2d a4 68 8e 60 72 54 40 f1 3f 05 2a c6 a9 52 c3 4e 3b 62 1c c4 43 0b 1e 28 2d 7b 28 a6 c1 5b fc 20 59 2b 93 b3 2c a5 f4 d2 4c 38 cb ba 32 3b 7e 2c 9c 65 0d ab 69 dc 1e 4a c7 2f 47 59 7c 0c bd cc 93 1b b6 e3 e8 6c c4 b3 64 42 a2 f8 a5 64 18 24 e9 9a cb 55 49 4a 7f 69 72 7a e1 67 6b 0c be ac f4 6f 99 e9 2f a1 f4 3a Data Ascii: \cG8m/JN\RV/4H<y8[\<@P/5F>{0U8dFckep12]bvhVqv8BO ;U`j3-h`rT@?*RN;bC(-{([ Y+,L82;~,eiJ/GY\|ldBd$UIJirzgko/:
2022-03-25 19:15:14 UTC	885	IN	Data Raw: fd ad 96 74 da 62 ae 2e 08 0f 60 e7 f6 31 01 f7 9b 9c ae 42 d5 b9 a2 1a 5b f3 57 23 22 5b e5 08 04 bd 9d 82 bb 18 89 98 02 c9 2c 2e ce ad 0d c5 84 16 4f 54 dc cc 84 aa 65 59 0f e3 3a 76 4a 23 58 17 53 9f cc 6b 77 91 45 25 9c e0 1b df 1e 24 21 f8 21 ad 71 21 7c 1e 6a c8 87 5a 24 39 cc 0c a5 a0 eb db f5 ee 20 a0 53 8c 09 a8 78 1d ae 7b 46 fa ce 99 1e 91 a4 cd 5f e1 d7 85 48 72 36 1f 0f a2 a8 60 4b b8 1a d4 a5 45 89 1b 6a 5e 71 2c 4a 00 bb 91 1e 22 01 b9 f6 f2 d2 5c d1 be ec da 86 32 a7 19 59 54 a7 7a 1f 5e c7 d5 cc ce fb c8 74 35 41 fa 0b c8 0e 86 ed 58 1e 53 41 08 6c 86 b3 83 19 a8 13 d7 da 67 91 a3 b4 79 23 6e 38 29 04 9d bc 15 c0 c2 d0 65 90 19 dd 43 36 40 5c 20 63 61 83 e7 8b 42 f7 72 24 12 5b 2d e0 e0 1b d3 a4 cd 6b 50 d8 87 c1 fa 71 fb 61 85 3f 23 0d Data Ascii: tb.`1B[W#"[,.OTeY:vJ#XSkwE%$!!q!\|jZ$9 Sx{F_Hr6`KEj^q,J"\2YTz^t5AXSAlgy#n8)eC6@\ caBr$[-kPqa?#
2022-03-25 19:15:14 UTC	891	IN	Data Raw: 4a bb 8c 87 a8 df 5c 84 ca 08 49 f3 db 95 78 5d b9 1c ff b8 15 a3 f5 79 ed 9b e3 68 68 c1 15 67 2c fd 69 a0 8c 94 d2 43 25 3a f9 30 77 33 af e4 7d 6b 93 3d 9c f9 86 e4 80 2d e8 a6 f4 70 6e 48 3a da f4 86 22 5d 6c 4d 5e b1 69 10 54 a0 a1 b5 96 e3 45 4f 23 8d f2 37 a4 81 42 b3 18 c6 bb 7c d6 ee f4 77 e8 48 2b 34 fc 93 e9 21 c9 b5 53 d1 5b 10 2f 0b 5b f2 76 3f d4 21 36 ae 44 2f 90 5c dc 4c 3f 24 a1 2e bb aa c6 6e 25 20 9a 50 3f c4 79 7c f2 fa 93 a0 1c e2 cb 49 da c2 4b 08 81 13 c0 4e 6c e2 19 d5 88 c1 6e fe 1f 4d 91 9b af 5c 23 24 35 3b 29 a7 b6 62 68 33 fd 1a 57 bd 93 27 ee c6 1b f6 fe 67 7e fd e1 ff 8a d1 ff 0a 98 f9 6c e9 ae a5 69 bc 7e 7d 78 50 87 ee af 69 52 1b d6 bf 74 2c 0b 62 be 1d 3a 26 f3 07 8b ec 44 24 6f b4 b0 25 c6 4d 69 3d 97 7d cb 30 ea 1e e9 Data Ascii: J\Ix]yhhg,iC%:0w3}k=-pnH:"]lM^iTEO#7B\|wH+4!S[/[v?!6D/\L?$.n% P?y\|IKNlnM\#$5;)bh3W'g~li~}xPiRt,b:&D$o%Mi=}0
2022-03-25 19:15:14 UTC	907	IN	Data Raw: 49 bf c8 6d 50 23 22 e2 40 9e 17 f1 39 1d 11 57 8e ce d0 11 01 f1 da 10 21 4b 44 58 fb 0e 8a 1c 9b 23 3a a6 43 05 fc 96 a7 2b 34 59 52 67 5f c2 29 18 a9 81 fa ed 4c c9 6c 8e 15 1a 6b 34 a4 d1 80 8e c4 06 0c d9 d1 bc 16 a6 b8 54 bf fa 7c 4b 68 34 85 e0 8d 54 04 93 a3 17 a4 40 7b 70 54 27 a7 f4 22 50 b8 27 39 94 49 75 6c 32 dc bd b4 09 f3 95 58 36 77 87 47 f0 d4 ff ab 11 55 36 7c c2 c0 70 86 5c cb 70 17 a3 d1 b4 cc 21 3d 91 4c c1 ae 01 f8 43 52 cd 12 ea 41 5e e1 eb 59 bf e9 90 2e f1 2d cb 16 cf 1b fd 95 bf 4d c8 36 fa 6b 68 32 e2 d9 42 23 55 44 a3 e1 d8 8e 0f 7e 95 74 2e 71 22 88 aa 0d e7 aa d9 e3 55 4b 86 b9 20 6a c6 85 a3 35 d0 57 c2 93 ee 6a 27 9e ec 07 97 7d f5 a4 5e 79 77 8f cb c2 cb a3 96 76 66 cd a9 27 e2 93 58 2d 4e c8 7c 78 b8 1b 52 ef f7 f1 05 91 Data Ascii: ImP#"@9W!KDX#:C+4YRg_)Llk4T\|Kh4T@{pT'"P'9Iul2X6wGU6\|p\p!=LCRA^Y.-M6kh2B#UD~t.q"UK j5Wj'}^ywvf'X-N\|xR
2022-03-25 19:15:14 UTC	923	IN	Data Raw: fd a4 cd 44 4a fb ec 11 2c 22 1a 85 a3 d8 5b 50 6c f4 52 24 f9 32 92 00 90 14 77 29 e1 91 8b 38 e1 78 10 83 44 57 53 a2 d4 60 77 5a dd 88 87 29 1f 00 5f 88 33 de a4 69 08 e1 2b ca f9 04 92 78 94 ed 56 d3 30 40 7e 01 96 eb 23 f0 ae df 6e c7 55 8d a3 ca ea b7 cb b7 6d 1f 82 8b a9 55 a9 6c 52 90 74 51 53 f0 00 89 23 1f 41 30 c2 13 de 70 59 5a b8 d2 4c a7 cb 3f 82 1e 00 a5 1d ed ec 04 1b 8d de 89 12 bb b4 ac b8 12 4d f1 25 26 f4 2f 91 fb f9 4a 50 65 94 5a f8 0c 15 7a 85 28 f4 1b 5c 68 c7 74 3c 87 b8 39 94 76 0c ea e4 94 93 1a 25 99 80 ef c2 4e c8 a4 f1 3a 14 f8 04 f1 01 51 8e 40 97 d0 6d b0 8d 1b ff 6e 4e a9 de be f1 45 fb b9 3e 62 1f 22 43 e3 b7 31 d3 5b 7d 1d a4 a1 62 38 3e 79 2d 2a 38 33 f9 f5 85 00 62 e6 81 e7 49 f0 4d 96 25 3e 6b c3 78 f8 66 95 0d 83 ef Data Ascii: DJ,"[PlR$2w)8xDWS`wZ)_3i+xV0@~#nUmUlRtQS#A0pYZL?M%&/JPeZz(\ht<9v%N:Q@mnNE>b"C1[}b8>y-*83bIM%>kxf
2022-03-25 19:15:14 UTC	939	IN	Data Raw: 68 f4 d4 86 75 e8 c0 b1 9b b8 37 9b a6 f2 18 d7 b3 6b a9 ad 0d cd 43 9b aa 0d bb 33 c3 c2 83 b5 c5 34 6d 23 c1 4a 3c 15 49 cc ce 47 e8 58 86 dc c7 8b 8c 81 8d 4e 25 b3 07 24 90 5e f2 2b 21 a5 4d 06 b5 b7 00 f5 e4 16 cf 78 40 07 13 b8 a5 f4 32 35 83 cb b6 b5 a1 41 10 16 40 46 6d 72 ec a5 3b ef 10 10 ce 05 84 63 01 a1 39 91 70 4f a0 b0 ac 89 33 9a 08 e9 03 bc 08 95 61 37 c1 f8 8a a0 b4 ad 06 b8 dc 28 e4 b7 22 3a 0c f7 cd e0 37 07 28 fc 28 fe 91 75 b4 88 d4 85 6f 0e 94 44 37 0b cd a8 44 1f 7f 94 d7 9d 45 88 b8 8a 47 c7 81 90 6c 5a 49 24 f5 5c 1e 9a 42 5a 25 1c bc e6 55 40 28 c0 08 2e 4b de ed 89 f6 c0 da 83 f3 79 bf 19 91 c8 9c 72 3e 07 da 74 56 16 88 4d a7 bf 48 43 a1 8a 18 64 c0 c1 91 b1 81 e6 55 8b c7 38 3b 98 37 42 55 23 71 08 a3 d0 da a0 f4 3c 13 64 23 Data Ascii: hu7kC34m#J<IGXN%$^+!Mx@25A@Fmr;c9pO3a7(":7((uoD7DEGlZI$\BZ%U@(.Kyr>tVMHCdU8;7BU#q<d#
2022-03-25 19:15:14 UTC	955	IN	Data Raw: 96 64 14 25 d4 5c a7 96 41 68 68 99 0d fa bc 76 58 97 34 99 83 53 d2 19 ca c8 53 e2 f6 62 36 14 ab e9 75 90 2b 94 c1 1d 79 16 79 5c e8 6d 2e 58 1b b2 da 44 d4 b1 4e a5 d9 9c e9 1b a9 80 c2 89 fa 64 d4 c7 d2 6e fc 96 87 b7 90 8c 97 74 bc 8c c5 0b 7e b2 fe 8f c8 e0 4e 52 6d 15 ee d6 8f b1 6b ec 83 81 ee 24 e9 2e 35 ea 87 5e 3d ef fe c5 69 a6 3e 77 f4 70 96 ea 7e 89 10 ac bb b8 ee f1 4b ab e7 0f 31 d1 49 ed bc 11 37 a7 f1 f5 46 dc 49 7e 75 21 f9 44 5b 77 da f9 b5 0c fc d6 9f be 97 7e 83 a9 59 ee a0 cb 04 14 02 bd 6d 1d 87 c5 78 91 8f e6 bd 03 79 05 f5 78 ba 70 fd 8d 83 1f 36 a4 b2 9f a7 90 5d e8 07 f0 83 03 a2 1f 3f f2 a6 df 95 99 62 99 9c 97 85 4f 08 26 a7 c8 f7 4f f1 44 e6 9c 65 f8 ea 77 ba fa 01 e8 fb 91 eb 02 00 b4 fc 36 02 10 d8 58 ec 95 09 50 12 04 94 Data Ascii: d%\AhhvX4SSb6u+yy\m.XDNdnt~NRmk$.5^=i>wp~K1I7FI~u!D[w~Ymxyxp6]?bO&ODew6XP
2022-03-25 19:15:14 UTC	971	IN	Data Raw: a0 bc da 24 95 a3 5c f9 b4 3e b2 f1 1d 62 9b 31 e5 ca bb 79 f6 17 e3 16 f2 3f e6 03 f9 27 e8 1c d0 3a 73 81 65 e6 67 f7 e0 07 63 46 e5 bf 0e 5e 30 c5 99 7e 03 be 38 0e b2 23 6d 24 83 47 b3 39 4e 08 9a 16 0d 71 17 dc 76 96 1f 6e 8b 33 a1 c2 06 b7 06 36 88 9e 9e e4 2d d6 8e e8 d4 48 b1 f8 0a 20 51 72 88 5c 77 01 e2 6b 93 bc 96 f8 01 d3 05 3f 00 8f 10 d9 62 4b 77 7c ed f9 5f 6b 33 22 ba 0d 0f e4 3c 72 03 ac 75 44 6e a3 9d 8f 8c 2a c8 5d 3e 23 3c c1 90 86 0f 3f 71 ca d3 bf 11 32 cc 20 e6 21 e4 54 4c 87 d3 bc fa 1e 66 15 f7 e0 e3 c2 a0 06 46 af e4 fd 9a 55 d3 59 07 18 ce c5 70 25 fd 79 17 4d e6 bb 29 97 28 47 b6 99 ee a5 68 5f b8 a9 76 69 a6 75 71 0a 64 9e fd fd 43 45 8c ec d6 97 da 0c 7e af 0a 65 e2 02 56 8b a7 d2 0a 44 82 c3 e5 1d 86 30 37 ec 88 0e 51 2b be Data Ascii: $\>b1y?':segcF^0~8#m$G9Nqvn36-H Qr\wk?bKw\|_k3"<ruDn*]>#<?q2 !TLfFUYp%yM)(Gh_viuqdCE~eVD07Q+
2022-03-25 19:15:14 UTC	987	IN	Data Raw: 6c 94 5a f6 bb 4c 00 15 3a 37 3d 4b 35 da f6 8a e5 f5 44 69 4d 03 e5 50 b5 ac 2d 02 d1 83 05 c9 6c 0d 8e 93 cd 5b 42 b3 b0 5d d6 eb bf 5e 66 a5 6e e1 d4 cd 26 05 b6 48 2b 6a 1e c9 a5 ba 30 af 42 e6 4e 9a 8d 5d b0 a7 60 8c 68 38 62 3f 85 92 8c b2 94 35 b4 bb 43 a7 e0 85 c0 7e 6c c9 40 76 cd b0 c1 ff 0a 23 27 c5 83 e3 65 cf ef a5 70 98 7e 7d d6 c4 f5 84 99 20 54 18 76 b3 58 d1 e7 54 98 58 dd a2 d7 22 05 5c cd 31 89 6a ee 43 71 d4 0a 52 30 9f 91 a8 18 2a c3 55 e3 2a a1 7e b1 d3 90 cc 4f 47 be 97 96 5a 6f 7e 17 b7 e8 05 dc 16 2f 69 b6 e2 03 11 bb 68 c5 5b 0e f1 10 11 ea d0 d1 30 d3 97 5a 46 38 45 d7 d6 24 ba b6 fe 65 2b 2f 04 68 10 31 68 fd 24 7a d5 17 27 0a d9 6e e6 43 f7 ab 95 a8 eb 97 30 98 30 d0 65 76 3f a1 3e 44 67 f2 58 83 08 ce 11 29 d4 f0 c6 0c 35 dc Data Ascii: lZL:7=K5DiMP-l[B]^fn&H+j0BN]`h8b?5C~l@v#'ep~} TvXTX"\1jCqR0U~OGZo~/ih[0ZF8E$e+/h1h$z'nC00ev?>DgX)5
2022-03-25 19:15:14 UTC	1003	IN	Data Raw: 45 8c 23 df 62 bc 32 98 26 9d 03 a1 c6 5c 6d a5 56 5d 74 55 9c 32 90 b5 b9 95 1e b5 a4 61 8c c6 f1 a4 41 13 15 6d e7 a6 85 a2 fe 7e 6d 3b 13 d6 53 d0 82 e4 17 f8 69 5c b6 a2 b8 40 5f 23 62 b3 3a 1c 18 37 05 8d 59 68 34 e6 ea 0e 3b 37 01 8f 9c 46 33 d6 89 31 25 1e ea 52 17 11 e1 91 17 d3 8c 1e 44 8d 03 d4 7c 58 82 80 6c d3 fb 98 38 09 f9 1a 54 57 d6 a2 dc ba 0e f5 0e b4 07 8d 2b 43 e3 f6 5a 31 2b 73 f7 86 4f 92 37 52 ca 90 b6 2d a0 f1 79 ec 52 82 ad 1f 42 c7 b5 81 21 b4 50 46 13 df c7 0a 20 00 1e b6 6b e3 38 35 d1 c7 6c 0a c5 d0 65 2c 67 7d 8a 9b 66 a8 a2 4d 71 2b 31 0b 81 ae 0e 85 15 27 f5 d6 85 bf 47 53 ed f4 50 74 70 b3 0e e2 7f 23 f5 98 a5 b1 16 03 31 14 eb e3 ad 7d 44 fd 79 15 aa c9 4b d8 7a 94 07 80 69 7f ea 81 62 b6 5a fc 3c af ff cf 33 cc 9f 8a 86 Data Ascii: E#b2&\mV]tU2aAm~m;Si\@_#b:7Yh4;7F31%RD\|Xl8TW+CZ1+sO7R-yRB!PF k85le,g}fMq+1'GSPtp#1}DyKzibZ<3
2022-03-25 19:15:14 UTC	1019	IN	Data Raw: b8 10 30 72 89 f8 98 29 46 7c cc cf 32 8c 1c 3b 17 0e de f7 ae c6 16 c9 34 48 e5 55 08 5e 14 b9 84 b7 bf 49 16 ca d5 f7 fd be 3c cb 44 7f cf e1 2f 1d bd 90 2d f7 ff 7e b9 bc ef ef 34 fe de c1 df 53 ff a1 cf 00 79 16 b4 9f 58 08 4f fa 09 a7 f2 1d 75 fb 19 d2 67 7f 6d 0b 6b 0c 81 0d bf 4b b4 b5 bd 6c 09 0d df 79 49 ad 28 7f 3b eb 67 fb db a9 d8 95 4f 0b c1 62 11 70 29 7f 7a 10 3d 4c b0 c2 1c 71 e3 65 65 ea 64 44 a5 f5 46 27 9a 09 02 02 e2 28 2b c1 5c 42 35 ba 5b 59 e1 56 c2 c2 22 00 33 06 34 18 cd 7a 9a d6 e4 f0 51 80 60 c4 26 bc 43 33 24 75 e9 92 f0 1f bb d5 54 d4 dd d3 d4 68 27 d2 63 53 75 cb 8f cd f1 14 48 54 bf 45 b4 b7 1d 9e e5 f0 4e 07 c2 6b 46 98 7e 7b 9a b6 bf cc 81 44 f8 57 30 6b 6b 26 ab 4e 63 5e 29 10 f3 92 78 33 7c a4 17 fc 2a c2 8f e9 e4 48 86 Data Ascii: 0r)F\|2;4HU^I<D/-~4SyXOugmkKlyI(;gObp)z=LqeedDF'(+\B5[YV"34zQ`&C3$uTh'cSuHTENkF~{DW0kk&Nc^)x3\|*H
2022-03-25 19:15:14 UTC	1035	IN	Data Raw: 5f 41 a5 cb 90 43 ca 76 83 00 1a f8 36 af b9 02 b6 72 3d 72 21 75 61 98 1c 97 89 b3 60 1f 6b 32 d9 68 28 b8 e5 8c 56 96 c7 b6 12 82 e8 46 b4 4a 9c ef 30 c7 15 8e 05 f4 e9 1a 92 c6 75 03 d8 da 2c fc 5b de a8 1b 37 7e e7 fb b5 83 bc 07 63 3e b7 45 6e 7c 30 f0 a9 35 76 65 60 87 35 7f 25 29 1b 5f 12 ca 7d a3 86 d5 36 ed 7b 69 c8 83 ea 5a 01 16 ab b4 5b f2 6e 55 9c fb f7 6b 80 01 99 d2 0b d8 10 91 b7 c7 5a b5 18 66 b9 4e 68 73 95 1e be b6 68 82 60 0f 7b 3b 82 60 9a 5d 23 08 5a b4 2d 77 04 f3 b3 9c cf f6 25 1b 4f f1 17 79 bf f6 0f ab 11 3a f8 6f 51 f3 77 c8 53 bb e9 69 ff 81 47 7e db 95 37 78 a0 ff 22 0f 29 d9 29 1f 7d b9 8f 1c c9 d8 40 c2 0d 8e 27 d6 1d 3c 46 31 b6 85 62 6f 94 d4 b1 db 8b db 59 6a 0d 28 c8 eb ab 68 6d e5 b8 43 ce cc 92 90 d3 02 a6 bd 3b d0 98 Data Ascii: _ACv6r=r!ua`k2h(VFJ0u,[7~c>En\|05ve`5%)_}6{iZ[nUkZfNhsh`{;`]#Z-w%Oy:oQwSiG~7x"))}@'<F1boYj(hmC;
2022-03-25 19:15:14 UTC	1051	IN	Data Raw: 92 36 02 e2 24 dd 84 f7 e4 6b cb 94 d2 2a c3 c7 94 b2 a5 76 77 35 4c e3 6d 40 f0 06 d2 65 93 0b 36 2f 3d 00 47 a3 c4 a3 1c 10 b6 1b 24 61 aa 9b 70 ad 4b bb 72 be 80 1e 8e 17 af e5 96 0e d7 5b 0a 55 70 ac 99 03 f2 5d 56 d2 7e bc 97 33 0a 5f b7 f4 3b 2d 67 5c 1f ff 78 82 4e a0 ea 1c 93 2f 17 a5 53 91 e3 ac 7e 5d 8d 72 20 ba 34 2e d9 df 93 6f 99 74 d5 dd b3 09 3f 51 27 d4 3a 8c 77 3e 89 32 86 6a b2 84 51 ff f4 f1 04 7e e4 ba 35 82 1f 31 fa cb 9c 08 62 d3 80 89 13 25 65 ca 38 39 e4 8c 6c 4c cc 31 52 cf 61 78 dc 04 8d 60 c3 03 ca e8 55 bc 69 12 d6 f8 12 10 5f 18 fb 79 a8 00 57 41 9b 0b c6 e0 30 0e 53 f7 ee d4 c5 4f e4 e0 04 5b 94 6f a3 5c 2c 7a b3 d6 de e9 fb 8e ae fa 9f e4 9f 59 06 05 c6 32 c8 25 6c d8 e2 92 09 34 de 7d 13 e0 40 08 92 b6 4d 6d ac 02 b5 8b da Data Ascii: 6$k*vw5Lm@e6/=G$apKr[Up]V~3_;-g\xN/S~]r 4.ot?Q':w>2jQ~51b%e89lL1Rax`Ui_yWA0SO[o\,zY2%l4}@Mm
2022-03-25 19:15:14 UTC	1067	IN	Data Raw: 1f 27 b9 68 35 46 50 71 4e e8 ca 21 29 2a 31 b8 71 de 82 d8 e4 21 ac 34 b1 5b d5 de 93 b5 7d b2 f6 91 12 ad 03 6b c0 c0 25 5f 3f 17 6d 15 1e 98 66 5a e6 00 42 62 61 62 97 49 66 e3 ae 1f 6c 72 61 33 6c 4c 9d 72 9e 3b 7c e5 7b eb cf 86 e4 c7 3d 3a 36 f2 61 ee fb 8e 02 01 af 7f 14 d4 1b 60 d4 a5 ec c3 91 54 df fd 96 49 9d 09 db e3 ed 47 41 55 ad 5f 3f 46 54 35 51 67 54 75 e1 6c a0 aa bb 36 32 ff 2f 05 55 79 8f 2a f7 95 3c 47 41 55 57 a1 46 4b 7f 8d e4 fc 46 eb e8 e8 48 e8 eb 34 63 2d 8a a7 7a a8 c0 14 f6 ba 49 ee 9f c1 24 15 9f 31 68 54 d2 f1 12 04 cd b9 6c 4f 3e d2 12 9f c4 aa 07 61 c4 d9 7f 79 eb 11 43 35 f7 6f ce 03 55 59 56 05 48 27 7f d3 07 f1 75 eb cd cd c2 df c8 36 7f b0 13 45 29 4a f9 db f3 2b fc 41 c7 dd 08 15 34 02 42 28 96 49 53 ee 8d c8 4d 32 6a Data Ascii: 'h5FPqN!)1q!4[}k%_?mfZBbabIflra3lLr;\|{=:6a`TIGAU_?FT5QgTul62/Uy<GAUWFKFH4c-zI$1hTlO>ayC5oUYVH'u6E)J+A4B(ISM2j
2022-03-25 19:15:14 UTC	1083	IN	Data Raw: 65 a8 2f f1 9e 56 77 ea c3 3b 5b e7 ff f8 95 c9 95 10 98 55 11 29 4d e6 fc cd 67 91 3e ec 5a d4 e5 8f fc 8c b5 05 b5 49 4e b0 86 90 e4 bf d8 59 1e c2 ee 82 43 57 19 fa f4 75 9f e8 55 32 96 0f a7 32 6a ff 9f 32 5e c7 d6 c2 fd 7a ef 39 d4 8a 52 69 fd 76 67 03 f8 31 a1 c6 8c 24 1b 8c 2a e1 49 3c 8a 23 d6 87 e1 3d b8 34 ee 88 20 03 8e 08 0c f6 4b c2 f9 85 b2 51 58 6e dc 7d b3 e1 fb e2 3e a4 94 35 47 c9 a8 31 f8 87 1e 07 f6 99 8d f9 88 bd 98 79 81 36 09 96 60 3e a5 f2 c0 a7 e8 7c 90 ad 39 78 2b 79 35 f6 7c 35 ae a8 b8 8c bc bd 17 e3 6d da 26 19 28 76 73 52 b1 41 a2 58 2e c8 11 53 68 50 cf 72 e7 26 95 eb c2 49 76 34 dc c5 cf 69 bf 3b 7c 2e 69 b3 84 ce e0 7e 24 1c 3b 70 8f 7a 21 83 db ff 97 a4 0f 36 e0 83 11 0b d1 c1 47 f8 a4 5f 79 d5 17 b9 04 d8 ec 6c 36 06 73 Data Ascii: e/Vw;[U)Mg>ZINYCWuU22j2^z9Rivg1$*I<#=4 KQXn}>5G1y6`>\|9x+y5\|5m&(vsRAX.ShPr&Iv4i;\|.i~$;pz!6G_yl6s
2022-03-25 19:15:14 UTC	1099	IN	Data Raw: e0 a9 c0 23 63 60 da 7f 29 0c 5b 44 38 b3 ea 7a 35 a6 31 8f 65 92 8b 5d 87 a3 dc de 22 d5 53 a7 cb d5 26 64 75 c0 eb 5a 51 ae 39 90 0e 68 24 49 0d c3 f1 01 5e d1 53 3d 75 d5 d9 06 7f 09 b7 81 62 f7 af 32 1d e6 de 96 67 52 3b af 20 5d 30 ea 71 7b 2d f5 f8 35 54 62 91 9e af 9e 40 0d 44 99 13 20 4d b5 28 af fd 69 1f 1e f0 92 da c6 2d 0d 27 f3 3d 41 1b 79 5f 6b 17 36 37 fd 50 24 bb 92 da 58 e9 b6 5f 0b c7 df f3 60 37 45 93 0c 30 3f 94 c1 e6 22 5a 08 8f 6d c8 a9 94 b7 8a 41 fa 80 3f 61 aa 50 ec 20 19 9c d8 57 dd 50 3b 1d ed 81 4d 7a c4 9e 7a 9c f4 5c 6a fe 03 fe ec fc c5 81 34 32 4a ae b5 3e e0 cf a0 00 e3 1b 2c 4e 7b 6b d5 87 9c 1f 77 52 68 01 97 56 01 79 7c 0a f9 78 f7 8c 82 21 31 0b 96 28 6a a1 03 92 12 3f 64 26 8e c0 8d 4e b9 25 7c 83 0f 66 d0 0c 19 0c ae Data Ascii: #c`)[D8z51e]"S&duZQ9h$I^S=ub2gR; ]0q{-5Tb@D M(i-'=Ay_k67P$X_`7E0?"ZmA?aP WP;Mzz\j42J>,N{kwRhVy\|x!1(j?d&N%\|f
2022-03-25 19:15:14 UTC	1115	IN	Data Raw: 6e a1 c4 87 d4 3e 45 5e 87 d0 4d e2 13 06 d7 c1 1d 70 14 fa e2 f3 2e 4e 07 d5 c9 60 84 8b 33 04 c2 85 65 2c 54 bf ae b1 9e d4 41 91 6c 19 42 7f bd 1e 18 17 6f 31 c6 45 2e b2 22 35 db 95 cc 36 a2 39 72 4b d0 f3 13 9e 18 73 42 f1 3b 33 60 3d 2b fa 6a 3c 0c 0e 9a 56 51 e9 0e 94 fe 52 f8 0c 81 8f f1 d2 67 4b 6f 48 96 9e 4f 39 90 9c e3 32 5f 33 62 33 07 c8 c0 c8 4c 45 49 ad 37 40 26 c7 0a 56 c5 7b a3 8b e9 ec 19 ab c4 80 4d 5b 02 0a 3a 01 c9 e8 49 c1 4b bd 7d 9f 48 19 4d 29 05 48 e1 59 64 32 24 bb 78 5a b5 50 d7 9d fe 32 93 52 16 8c 72 9a 8d 33 33 41 dd d3 57 70 57 6d f0 aa 32 5b 79 05 62 12 7a 97 b8 ab 03 62 7f 1e d5 53 d4 a6 2a 1b 16 27 90 6b 7c 01 bc 30 2d 12 e4 fa 55 73 61 b2 6b 37 7e 4f 2c 4c e9 8a 77 96 33 02 f9 86 e4 5b e2 ae dc c0 ad 99 a4 a6 9e 6f 4c Data Ascii: n>E^Mp.N`3e,TAlBo1E."569rKsB;3`=+j<VQRgKoHO92_3b3LEI7@&V{M[:IK}HM)HYd2$xZP2Rr33AWpWm2[ybzbS*'k\|0-Usak7~O,Lw3[oL
2022-03-25 19:15:14 UTC	1131	IN	Data Raw: ea ee da 6f 95 9e d4 69 6f 72 c7 e7 64 18 61 3d 2f 43 b5 84 1b e1 61 93 11 02 bf f7 a7 43 3a 7d ff 06 4f e8 fb 06 7c a3 9f e7 52 c5 31 98 79 ca 9a a0 ce ad d1 29 e5 d1 29 00 52 80 cf 15 bb b6 26 91 81 97 76 a7 b3 54 c3 66 30 87 7f 9e 3b ac 2f 2d 68 a5 a2 4a d0 39 79 60 73 11 0c c1 c3 43 97 e6 62 22 fc ea 9f fd 9e 5b 8a 23 e7 eb 92 4f f6 dc ee ab 03 a6 5d 35 c3 d0 37 29 a1 e9 be a0 67 dc b6 48 76 5c b2 4a de 96 58 85 af 36 21 45 d7 16 5b 09 f0 4b 69 a6 f3 79 a6 c3 fd 64 cf 4a 5f ed 60 18 0a e4 c9 c5 37 e5 84 af 81 bd 8d 95 29 68 ae 25 32 81 aa 58 60 28 12 22 95 ff 74 18 2c 97 ec b2 44 72 16 6d d0 2b 7c 69 f7 c2 6f 49 04 77 34 48 30 62 8d cd d2 b4 68 87 a4 5f 59 08 5d 8e a9 94 50 1f 1e dc 26 e4 5e 83 69 27 d6 9f 45 da 9d 0b d1 5c 81 ba d5 7b c4 15 6c 51 10 Data Ascii: oiorda=/CaC:}O\|R1y))R&vTf0;/-hJ9y`sCb"[#O]57)gHv\JX6!E[KiydJ_`7)h%2X`("t,Drm+\|ioIw4H0bh_Y]P&^i'E\{lQ
2022-03-25 19:15:14 UTC	1147	IN	Data Raw: 84 d6 55 36 82 fe 13 2d 32 b6 dc 33 28 4f 49 40 e1 87 08 7e 2a d3 c1 44 0d 11 18 86 c8 c2 8c 76 37 42 3b 32 b8 f0 09 43 74 8e c2 8b 7f a2 00 bb 83 46 f0 4a b8 9e 36 35 5f cc bc be 3c 27 05 8a 92 36 18 bd d3 fd e9 2f ad 93 cb 81 04 a1 f2 0f c1 d1 71 25 d9 d2 8a 41 01 7f 26 c9 96 ad a1 84 15 c2 fb cd b0 be bf 80 83 31 6d 34 fa 07 7e c7 0c 8e 08 62 fd 06 dc 17 fc 8e a4 30 d1 0b 17 ee 65 c8 b2 65 6c 1e e7 cd 15 fe b1 eb 85 d2 bd 4c 23 63 c1 a0 62 0a f8 36 ae ba 1c 4f 38 80 86 7a 60 64 5b b3 d0 94 fe 44 8a 92 3b 14 8f fc 73 cf c3 83 42 c2 f2 90 63 cc fe 82 9f 6a 00 32 b5 fe a4 46 44 77 e3 8f ad 59 a9 93 f0 ac e2 17 9c 0a 9f fc bf 3b fd bf e3 07 92 07 20 f7 14 16 74 7a 38 9d ff a8 36 96 1e e7 7a 71 e1 e9 1c da 6a 04 ea b1 b5 cd ef 9e 5f ea ec 56 05 f9 c8 31 59 Data Ascii: U6-23(OI@~*Dv7B;2CtFJ65_<'6/q%A&1m4~b0eelL#cb6O8z`d[D;sBcj2FDwY; tz86zqj_V1Y
2022-03-25 19:15:14 UTC	1163	IN	Data Raw: dc 2b 7d 88 fb 98 0a 97 35 f6 8d f2 8d 52 cb b6 18 7f 1f 8a 2c 9d 68 df b8 9f 0a 2b 7e 0b da 8f 2a 05 a1 57 d0 31 a1 3b dc f0 3d dc 0b 9a 0e 32 5b 7b c6 c1 15 c9 37 1f 61 6f 38 65 2b 66 c0 5b e6 fd 6d ba 33 9c a7 de 6a d6 3a fb c1 a9 b5 c5 99 0c 5f 3c b0 4e 8e 51 b7 ef 14 9b e1 b1 1d e2 1a c4 55 69 6d 77 ec 2a 1c 0c ce fb fc 12 32 f9 7c 92 11 04 09 56 bd 13 16 14 55 cc ec 32 b8 6e b0 f4 86 37 06 f6 6b 8e 3f 18 3f bc 87 cb 1c 11 43 87 22 e5 a8 5f fe 44 c4 84 ff 23 85 2c ab 95 9c 13 1c 81 81 05 70 0c e3 c5 9a f3 86 67 a6 a8 8f 1f 3a af 49 3a 66 a7 84 2f 21 a1 61 2c ca f1 e9 bd e1 79 25 8c af 21 77 76 66 07 6e f3 2a 37 60 8d 7d f5 35 5e 63 32 f9 5a 50 cf d6 46 09 9e 44 e3 28 1f 2e 8e 8b e4 ca 86 51 5b d4 a2 8d 09 9f 39 06 e1 93 30 4d 10 3e aa aa d5 a3 08 3d Data Ascii: +}5R,h+~W1;=2[{7ao8e+f[m3j:_<NQUimw2\|VU2n7k??C"_D#,pg:I:f/!a,y%!wvfn*7`}5^c2ZPFD(.Q[90M>=
2022-03-25 19:15:14 UTC	1179	IN	Data Raw: 70 9a 31 e7 d1 e8 bd 1d 92 df fd a8 48 3e b6 3c 71 6e fe 4a bc 3d 12 9b 45 bb 9b 39 39 e1 39 b9 b1 9b 98 d6 e3 25 ae 36 5c db c8 5d 59 09 45 a9 33 f2 39 9b c5 d1 ea 62 97 d0 17 7a 2b 32 79 37 4b 4f ae 47 63 b1 d5 cc a2 ba 82 37 90 2c c4 5c 62 e3 32 9d 0f 09 f9 14 19 0b d6 83 17 53 a7 35 16 c3 4f 22 2f 57 b8 79 a0 a2 09 37 25 f0 08 e7 ad 7f 27 d5 9b 57 8f 2d f9 78 e9 b9 07 cc 15 4f f4 c1 4a f4 52 11 dc 11 a6 3c f2 8b 3e 84 fb 59 b4 fa 0a fc 1f 58 05 4f 49 75 03 64 b8 59 22 f1 dc a2 5d aa 27 15 2e db c7 b8 d6 66 b8 d6 4e 33 b7 af 79 db fd 23 7b 24 3c 6d e8 09 c8 f3 c1 f8 7b 03 7f 0f 1f e8 69 2a 78 ad a7 a9 e4 4d f1 e7 c4 fd cd f8 5b f9 7a 4f d3 eb 6f f4 34 1d c6 df 19 fc f5 fe 5d 4f 93 1d 7f 37 e1 ef 36 fc 55 e3 af 09 7f bf c3 5f 2b fe ce e2 4f 42 fc 91 f8 Data Ascii: p1H><qnJ=E999%6\]YE39bz+2y7KOGc7,\b2S5O"/Wy7%'W-xOJR<>YXOIudY"]'.fN3y#{$<m{i*xM[zOo4]O76U_+OB
2022-03-25 19:15:14 UTC	1195	IN	Data Raw: fe 01 19 a2 6b 25 c6 16 41 8c 2a b1 52 16 f2 e5 6f 3f 7a d8 28 40 ff 69 4d 4b 52 d1 5b a5 50 23 82 cd cd fb 84 82 5a 99 44 34 69 f4 0f 03 4b a8 e5 89 8e 4d f1 63 1e 7b e0 6a e2 3a 55 d3 b8 2c f2 b3 3d 56 29 f1 ab 7f fb 51 a2 99 98 4a 93 7a 11 4f 50 da 58 46 06 e5 21 54 bf 62 eb a7 ff f0 49 82 1a b9 8c a9 f4 a6 da 6d b8 0b dd cd 3f 73 15 b7 0d 5d e5 1b bc 63 4c 65 9a 9d ae 3a 2b bf 07 f9 ae 20 56 b0 9d 68 0e 99 b9 0d 4b 30 8e a2 09 1c 22 8d e5 5a 0d b5 d4 9a 97 04 63 6c ff 97 f5 86 34 b0 c4 f6 d5 a9 37 6e e3 31 15 a4 39 26 8f b5 59 cb da e9 0f 17 35 60 47 83 c6 b3 33 2f 50 cc fe 09 63 55 e0 b9 88 b1 fd 40 7d bd e1 e5 93 0f 51 58 af 0d 75 7c 01 b6 98 6f de a3 c5 15 29 9a 87 88 f1 c1 94 d5 1a a5 f1 06 a1 b3 a9 3c a6 fa ac f3 41 45 f6 21 b2 d9 90 fa c3 0d e6 Data Ascii: k%A*Ro?z(@iMKR[P#ZD4iKMc{j:U,=V)QJzOPXF!TbIm?s]cLe:+ VhK0"Zcl47n19&Y5`G3/PcU@}QXu\|o)<AE!
2022-03-25 19:15:14 UTC	1211	IN	Data Raw: 23 a1 9b a8 d8 76 e0 21 5a a3 ea 87 67 dc 2c bf c0 83 e2 28 88 f9 5b c3 70 6a b8 97 6e ee a9 56 22 e3 7b b3 74 fb 1a 9d b5 8c 4e 80 8b 59 41 f1 09 79 8f 03 29 a1 dc 82 b6 34 a4 e1 4a 13 b5 aa 53 94 95 fa f0 09 62 5c b1 ce e4 0f 0e fd b4 aa db fc 71 32 d9 2d ff b6 ba c3 4c 79 c0 ca 9d 2f d6 25 72 fa ff 92 9d d8 ff ff 7d 93 7f 64 9f 3e 22 25 47 5f 6f 15 cb 86 e8 36 7e e1 7f 89 f7 fb fd ca 7b 74 6a d6 60 e1 0d 66 44 fb 94 87 87 38 6d 87 68 1c 0c 0f da 08 13 3d 18 f1 ce a2 93 05 36 db 08 7d 42 2e fc 41 bb fe fb 08 31 21 cb eb f2 09 c7 4d 7f e6 09 b9 f7 0f e2 13 f2 2c 00 10 23 95 63 19 e2 d1 85 21 b5 8c 77 0b 0d 09 be 73 c5 7c 33 5d 25 65 bb f3 d2 cb 16 94 7f 76 c9 63 ae 10 c6 c0 f1 13 55 b8 8c 00 e8 a6 0c bd 44 b1 a7 33 d6 8e 90 14 e7 b5 e4 e1 ce 85 b7 c0 9c Data Ascii: #v!Zg,([pjnV"{tNYAy)4JSb\q2-Ly/%r}d>"%G_o6~{tj`fD8mh=6}B.A1!M,#c!ws\|3]%evcUD3
2022-03-25 19:15:14 UTC	1227	IN	Data Raw: d3 d6 ea 68 57 b2 74 6a 33 fe 48 99 38 b3 40 89 d9 91 22 c3 95 ca 2e b4 27 29 d2 72 67 14 79 3c fa 3d 88 19 f5 78 62 ae f6 d2 06 de 1b c7 a9 50 0a 1c 0b 03 c6 02 43 63 17 2c 8a 83 83 67 0d 20 74 e8 b6 13 81 c1 2d ce 29 f8 16 2f 5e 3f 23 a7 58 04 e6 c4 a5 5c 1a c3 10 33 5a 12 6c 3b 1e 38 a5 c5 39 22 46 39 17 94 d1 0f 83 6d c7 02 3d 19 68 a3 c5 d9 d3 08 53 8b 1d d1 95 9d 00 57 a0 50 0c 5d c1 72 d0 cb 05 1a b0 40 d8 70 be bd 4f 8c 16 ee 47 80 43 f6 ea ac 6a db ea 6e 0a 64 d0 9e d0 89 fd 72 24 db 46 bd e7 cc ee c7 1c 16 15 07 ec 28 f0 ba e4 b7 28 c3 c2 02 a9 ee 74 7c c8 f6 8d 5e fb 77 90 21 8c 00 50 e5 dc 48 ad ae 1d 27 b3 03 07 9b 20 44 f8 bb d5 42 fb 10 68 ff 34 15 8b 3d ca 37 f0 a0 c1 c7 da 48 0f 1a 9e cd ec 79 51 3f 82 cc a6 59 45 2b 7d 44 d7 43 f3 1d a1 Data Ascii: hWtj3H8@".')rgy<=xbPCc,g t-)/^?#X\3Zl;89"F9m=hSWP]r@pOGCjndr$F((t\|^w!PH' DBh4=7HyQ?YE+}DC
2022-03-25 19:15:14 UTC	1243	IN	Data Raw: 7a f2 4f d2 72 16 7e 36 49 13 62 85 c7 ac 3b 9c d7 5e 9a c1 3c 03 dd 41 fb 85 73 2d a6 80 ab 28 38 3c d9 40 8e ba c2 27 b3 e6 1f 0a af a0 cf 6c 91 55 b3 f1 27 b2 8a b4 20 54 56 e7 89 69 96 8e 56 18 69 36 46 18 ea 98 c5 43 e9 32 fe db ac 13 8d 81 21 e3 55 92 e0 17 27 ce d9 d3 8d fc d4 17 bb 34 52 3d 2c 9a b1 ec ad a4 15 9f 13 ef e3 72 31 c2 0d 94 d6 c6 b3 92 83 fe 10 13 8d e1 5e 9d 20 ba f3 4e 3a 25 38 14 bc 0c ca af 23 3d 10 8c 73 11 ba 21 11 a7 2c ed 3d 1c bc 62 29 5b cf d2 94 59 ef 57 86 08 d3 b0 ed e2 31 3e d5 8f 0f 09 33 df 50 a5 aa fd 8d 79 67 f5 4d d5 b4 54 df bc 7a ba e7 be 69 ef da 37 83 a9 39 ef b9 36 84 9c 91 e7 89 a2 62 09 fc 27 fc 76 e9 a0 a1 b7 a3 83 36 48 d5 6f 22 57 a8 a4 64 e0 ed 68 57 5b 86 ee 58 b6 df c2 78 cd 8c 77 5d 9d 1d 1f 04 7f 02 Data Ascii: zOr~6Ib;^<As-(8<@'lU' TViVi6FC2!U'4R=,r1^ N:%8#=s!,=b)[YW1>3PygMTzi796b'v6Ho"WdhW[Xxw]
2022-03-25 19:15:14 UTC	1259	IN	Data Raw: b9 35 37 24 35 37 94 aa c6 10 42 b7 ae 56 1d 8e a5 be ca bd b5 3d 4a 21 1d 79 14 a0 7f 7a 5b d1 5a db 33 f9 5a 96 d4 85 aa 2c 81 41 03 7c 6a d2 98 8f 85 bc b7 16 fd 35 30 98 37 6b ab fa 5a 29 3a 46 eb 5c 75 78 a1 95 04 d2 b5 d5 5b ce 13 5a 19 8b 0e 6d 8d 9a fe b9 7e a4 8b 5b a0 67 72 6d 0b 34 bc 6a 55 d7 9e 6a 35 79 36 2b a6 c7 26 3d 9f b6 28 75 e8 78 5d d0 da d4 56 bc ab 82 1a 89 e6 0c 86 43 67 74 89 2a af db 87 4e 00 a1 e5 56 81 a8 7c d0 c1 1a bb 5a 95 57 cf 05 05 3e 77 a5 0b 13 aa a2 d5 d8 52 09 c5 8a 0b 02 a3 a2 76 3a 3c d0 50 34 5d 5d 5d e1 2e b6 4a 10 98 9d 4a 2a 2a 50 ae c2 0a 0c b7 5a 7a 40 89 39 58 01 05 e4 e8 ad 9c 6a 58 48 db 6c 2f 25 ef ca 39 18 ef 7d 7a 44 f7 d6 56 e2 2a 42 d3 63 6c 81 ab c6 53 14 92 3e b8 85 d3 ce 4a 13 6a 6f eb 29 64 3d e8 Data Ascii: 57$57BV=J!yz[Z3Z,A\|j507kZ):F\ux[Zm~[grm4jUj5y6+&=(ux]VCgtNV\|ZW>wRv:<P4]]].JJPZz@9XjXHl/%9}zDVBclS>Jjo)d=
2022-03-25 19:15:14 UTC	1275	IN	Data Raw: 11 cc 54 3c df 95 e5 ca 39 34 2b a9 41 4c 53 5c c5 3c 88 f0 15 10 27 a5 88 26 ca 9d 8e 9a 54 3a 5e 34 05 79 11 9c 91 71 0e 63 47 39 dc 05 86 6a 22 d4 0d 7a fe fc 83 2e 51 d2 8c 34 df 32 3d 53 de 28 c8 88 0c f9 c0 7c 01 69 09 93 7d 3e 87 91 07 ae 76 ef 26 5b 25 0d e0 68 0d cc 8e d2 a6 4b c1 9c 21 c4 77 a9 12 99 c9 89 bc d2 ea 93 28 13 2c a3 32 0e 3e 30 71 7f 29 ae ca 49 93 ea 22 ca 51 f3 ee ce 51 67 1a 52 dd 05 76 85 90 1d eb 9d ac 86 8c e5 20 36 21 3e a1 f7 b0 7a c0 2b 59 54 30 d0 51 a4 ea 57 41 af b1 f9 46 47 8a 57 5a 29 e3 05 3e 89 15 cd d5 91 72 3e a3 1e 94 b9 e4 82 28 dc 8b b2 a7 9b f9 9d 30 ca e5 2f 28 8e 2a a9 fa 16 8d 05 6c a0 fb 9e ef ac 2f f9 f0 14 54 b3 74 3e 23 79 0d 7a 27 36 08 34 ae d3 67 f0 0a d1 b2 a8 04 46 ff 18 cb 12 a4 2d d7 c3 d1 52 5a Data Ascii: T<94+ALS\<'&T:^4yqcG9j"z.Q42=S(\|i}>v&[%hK!w(,2>0q)I"QQgRv 6!>z+YT0QWAFGWZ)>r>(0/(*l/Tt>#yz'64gF-RZ
2022-03-25 19:15:14 UTC	1291	IN	Data Raw: 91 4a 4c 98 55 13 61 7a 31 60 e2 c7 c2 c7 6f 3f fb cf c9 3c 7c 57 5d c5 ba 53 ad cb f3 00 b2 93 8a 09 9c bb 85 e9 0f 80 7b 6c 7e d6 3c 05 2d 2a 68 ec c3 ec c4 fa 15 72 b5 ea 9a 98 7d 7d 98 16 01 36 fc c4 91 a3 2a bd d2 02 85 e3 7b 83 1c b7 07 75 f7 d0 65 cc 23 c9 8f d7 bc 9c ea bf 37 84 29 03 b8 0e 34 7d 8e 49 3c af bf 35 ed 40 53 6f 0c d3 0f 00 0f 0a 7e 02 cf 3a 36 8f 07 3b 8d 7c fa f8 28 bf 19 f6 94 6b 31 cf 7f ea e5 25 f1 3c ff eb 8a 27 55 f1 8d b5 fa 31 8a 7e 54 eb b6 3b 46 de 1a a6 0f 02 6e b5 cb 3b 31 4d 27 22 cf 20 f2 1c 83 3c 2a a6 02 7e 17 15 79 b5 36 9d 3a 9c bb 20 b6 ef d7 f4 db c3 f4 47 c0 92 12 78 05 e3 f9 fb 75 7c b0 af 44 79 5b 98 1a df 01 19 a5 f3 44 1e 3f 9e 54 ba 03 30 59 f2 ec 0f aa e3 05 0f 47 67 29 0a 3f f1 01 f8 85 40 5e 3e 29 1f e3 Data Ascii: JLUaz1`o?<\|W]S{l~<-hr}}6{ue#7)4}I<5@So~:6;\|(k1%<'U1~T;Fn;1M'" <*~y6: Gxu\|Dy[D?T0YGg)?@^>)
2022-03-25 19:15:14 UTC	1307	IN	Data Raw: fb 40 83 1e 7e a2 48 f0 56 3f ad eb c4 5a bf 21 44 67 de 10 82 5e 05 7d 8e 12 12 3c cb 3f f6 61 1c 07 bb 50 22 ac ee af 92 6e 3c a5 f9 54 fa 8a 6a 85 bb 03 fa bd d0 37 85 e8 35 c0 bb 95 c3 3a d8 4b 07 d7 18 e7 1a a2 d2 8e f7 ea 78 ed b9 57 ad 26 0e 99 06 76 5d 91 71 ac 5f 14 63 fd 22 86 f5 8b 28 ca b3 7d fd a2 ff b6 10 4d bd 3d 44 9b b2 71 19 e9 83 ac 18 d6 05 fa b2 ba 57 42 c2 0d 8f e5 9a 78 cc 8c d8 0c ad 17 19 fd ee dd 21 5a 02 04 ef b5 c9 fb 08 9e f3 4a f0 2e 7a a8 c4 5c 5b ce 4f b8 cc de 13 a2 95 40 70 9b 7e 16 a5 20 07 4f ca fc 65 60 d0 8c 23 29 f3 d7 80 17 2d 4e 99 1f 06 ba f5 38 d7 05 72 f3 18 13 cb 30 f8 9e 0d f9 3e be 23 18 69 9e 08 8a f8 09 7d 29 5b 21 0b 71 6f 88 4e d8 66 b5 d9 bc c6 27 ed 58 c6 33 84 b1 a8 3e f6 0c a3 dc 84 50 6e 82 98 b3 0e Data Ascii: @~HV?Z!Dg^}<?aP"n<Tj75:KxW&v]q_c"(}M=DqWBx!ZJ.z\[O@p~ Oe`#)-N8r0>#i})[!qoNf'X3>Pn
2022-03-25 19:15:14 UTC	1323	IN	Data Raw: 6c ff 3e 9f 71 60 5c cc 7a fc 38 a4 d2 e2 ab 8b 19 27 2d 9e 0f 16 5a 9c 03 e1 b4 63 37 c7 83 34 da b4 87 f7 7c f0 d0 e2 98 bd 5c 23 5a dc 0b d2 65 9b 7d bc cf 43 19 2d 5e 00 c5 b4 78 09 6c a4 dd 25 fc 5a 7e 90 f9 43 fb f0 da 43 4a 85 2d 61 fc 87 79 8d 47 38 ff b4 07 af 81 7c 5a bc 1e 96 d3 62 3f 64 d1 e2 2e 47 79 2d b4 b8 37 d8 69 f1 7d 10 4f 8b d3 21 5a 8e 8f eb 7d c4 fb 1e ed c6 3f 41 21 1d f8 98 eb f9 09 f7 02 6d c7 9b a0 4c d6 63 7b 80 f7 19 d9 1e ab 4f 39 87 4b 19 33 1e f9 19 e7 87 f6 e3 0a 48 a3 c5 93 8f 71 3e 69 f1 c3 d0 96 f6 e2 f3 90 49 9b ca 98 c3 50 45 8b fb 43 29 2d 6e 7c 9c d7 4b 8b 3b 81 87 16 c7 43 36 ed f8 9c 73 05 c6 65 1c e7 04 f3 02 22 68 3f ae 84 24 5a 3c ac 9c 7d 68 f1 18 88 a6 dd f8 53 48 a5 2d 5f 30 7e 48 93 fe 92 7b 19 3c b4 d8 78 Data Ascii: l>q`\z8'-Zc74\|\#Ze}C-^xl%Z~CCJ-ayG8\|Zb?d.Gy-7i}O!Z}?A!mLc{O9K3Hq>iIPEC)-n\|K;C6se"h?$Z<}hSH-_0~H{<x
2022-03-25 19:15:14 UTC	1339	IN	Data Raw: c3 af 61 99 ee 7e c8 de c6 60 63 2a fc 0f 8c d3 e1 9e 87 cd 53 87 27 60 a8 2e 71 c7 23 be 57 e7 f9 c7 58 a0 c3 e3 30 47 87 37 98 e7 de e9 f0 e9 e8 d3 e1 4b 30 51 d7 f8 e0 47 ed 87 cb 73 ec 1c 18 a4 c3 6b 90 74 78 dd c7 ac a1 f1 e1 4d b1 54 17 f9 fc 3f d9 3f c6 54 78 bb f9 be 5b 77 f3 02 14 75 9d d7 7f dc f3 a5 7b 78 1e 66 e8 2a b7 3d e1 99 bc 22 d7 f0 36 58 e1 78 f8 2d 54 75 78 15 e6 eb f0 81 15 7b 5e 97 2b fa 49 f3 f4 d9 22 bf 87 71 3a 7c ce 53 d6 4a 87 3f c0 50 dd fd b4 df 41 54 74 78 9d 05 7e 2f 75 78 2b 4c d1 e1 1d 51 d4 45 3e f8 19 73 d0 7d bc dd 5f 5c bb ee e1 f3 30 e2 ca 1c f3 42 73 d0 e1 bd 31 40 57 f8 43 4c d6 e1 73 9e 73 8f 74 78 26 ba 75 8d 8f 7f de 1a e9 f0 5f 5e 70 5d 3a bc 04 d3 75 cf 22 d7 8e 65 ba eb 45 7f 1f 62 95 ee e6 e9 e8 99 9a 6b f8 Data Ascii: a~`cS'`.q#WX0G7K0QGsktxMT??Tx[wu{xf="6Xx-Tux{^+I"q:\|SJ?PATtx~/ux+LQE>s}_\0Bs1@WCLsstx&u_^p]:u"eEbk
2022-03-25 19:15:14 UTC	1355	IN	Data Raw: 6c 72 2d 5e ec 77 73 d9 a6 b0 5a dc 85 06 b4 0e 06 ec b5 78 cd 6a f7 b7 57 ef d6 e0 73 9d c9 9b 8c 73 35 f8 46 c6 c1 d7 c5 a6 1a bc 26 bd 4b 77 d7 e6 1a 1c 1c 64 79 f9 93 a5 35 78 6f ca 12 a9 61 5a 0d ee fc 65 04 ec 35 d8 2f be 5a 11 d4 bb 06 a7 5a 5f db b8 ff 85 1a 7c fa 58 e4 b4 d7 5c d5 b8 c5 47 4d de 9b 94 57 8d ef 9f 67 6c 5d 70 b4 1a 6f ba 9d e0 b5 4f 59 8d 47 ac a9 9a da 6b 6d 35 f6 3f b3 08 f6 6a bc 7a 94 cf a5 2d a2 6a ec 74 9f 64 6c c4 70 9d 1c 10 ba bf 57 35 76 58 33 9a 78 b7 ac c6 6b d7 af 7e f4 76 69 15 2e 6f ba e5 bd 7e b7 aa f0 0a 94 39 bb e6 b3 2a 6c 3f 74 bc 6d 85 a1 0a 77 af 63 f7 eb f2 41 15 5e 3b f8 7a f8 fc 37 ab b0 d7 a3 a3 df 16 cc ae c2 e3 3b 15 7e 9c 31 ae 0a 5f 6c 9a 37 5a 30 b4 0a e7 4b e7 f3 87 70 aa b0 32 20 7f d0 98 66 55 38 Data Ascii: lr-^wsZxjWss5F&Kwdy5xoaZe5/ZZ_\|X\GMWgl]poOYGkm5?jz-jtdlpW5vX3xk~vi.o~9*l?tmwcA^;z7;~1_l7Z0Kp2 fU8

Target ID:	0
Start time:	20:15:12
Start date:	25/03/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip" > cmdline.out 2>&1
Imagebase:	0xf0000
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: conhost.exePID: 4152, Parent PID: 4880

General

Target ID:	1
Start time:	20:15:12
Start date:	25/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7140d0000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: wget.exePID: 3076, Parent PID: 4880

General

Target ID:	2
Start time:	20:15:12
Start date:	25/03/2022
Path:	C:\Windows\SysWOW64\wget.exe
Wow64 process (32bit):	true
Commandline:	wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip"
Imagebase:	0x400000
File size:	3895184 bytes
MD5 hash:	3DADB6E2ECE9C4B3E1E322E617658B60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: 7za.exePID: 2648, Parent PID: 320

General

Target ID:	4
Start time:	20:15:14
Start date:	25/03/2022
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	7za x -y -pinfected -o"C:\Users\user\Desktop\extract" "C:\Users\user\Desktop\download\ComparePlugin_v2.0.2_X64.zip"
Imagebase:	0x770000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: conhost.exePID: 6164, Parent PID: 2648

General

Target ID:	5
Start time:	20:15:14
Start date:	25/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7140d0000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: loaddll64.exePID: 7556, Parent PID: 2084

General

Target ID:	6
Start time:	20:15:16
Start date:	25/03/2022
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll"
Imagebase:	0x7ff727a30000
File size:	140288 bytes
MD5 hash:	4E8A40CAD6CCC047914E3A7830A2D8AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: cmd.exePID: 1604, Parent PID: 7556

General

Target ID:	7
Start time:	20:15:16
Start date:	25/03/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",#1
Imagebase:	0x7ff716eb0000
File size:	289792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: rundll32.exePID: 3196, Parent PID: 7556

General

Target ID:	8
Start time:	20:15:17
Start date:	25/03/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\extract\ComparePlugin.dll,beNotified
Imagebase:	0x7ff61ea80000
File size:	71680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: rundll32.exePID: 1224, Parent PID: 1604

General

Target ID:	9
Start time:	20:15:17
Start date:	25/03/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",#1
Imagebase:	0x7ff711ce0000
File size:	71680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: WerFault.exePID: 4104, Parent PID: 3196

General

Target ID:	14
Start time:	20:15:18
Start date:	25/03/2022
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 3196 -s 436
Imagebase:	0x7ff7694f0000
File size:	568632 bytes
MD5 hash:	5C06542FED8EE68994D43938E7326D75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: WerFault.exePID: 3148, Parent PID: 1224

General

Target ID:	15
Start time:	20:15:18
Start date:	25/03/2022
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1224 -s 432
Imagebase:	0x7ff7694f0000
File size:	568632 bytes
MD5 hash:	5C06542FED8EE68994D43938E7326D75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: rundll32.exePID: 3404, Parent PID: 7556

General

Target ID:	16
Start time:	20:15:20
Start date:	25/03/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\extract\ComparePlugin.dll,getFuncsArray
Imagebase:	0x7ff711ce0000
File size:	71680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: WerFault.exePID: 7720, Parent PID: 3404

General

Target ID:	18
Start time:	20:15:20
Start date:	25/03/2022
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 3404 -s 432
Imagebase:	0x7ff7694f0000
File size:	568632 bytes
MD5 hash:	5C06542FED8EE68994D43938E7326D75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: rundll32.exePID: 4776, Parent PID: 7556

General

Target ID:	20
Start time:	20:15:23
Start date:	25/03/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\extract\ComparePlugin.dll,getName
Imagebase:	0x7ff711ce0000
File size:	71680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: rundll32.exePID: 372, Parent PID: 7556

General

Target ID:	21
Start time:	20:15:26
Start date:	25/03/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",beNotified
Imagebase:	0x7ff711ce0000
File size:	71680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: rundll32.exePID: 428, Parent PID: 7556

General

Target ID:	22
Start time:	20:15:26
Start date:	25/03/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",getFuncsArray
Imagebase:	0x7ff711ce0000
File size:	71680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: rundll32.exePID: 6664, Parent PID: 7556

General

Target ID:	24
Start time:	20:15:26
Start date:	25/03/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",getName
Imagebase:	0x7ff711ce0000
File size:	71680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: rundll32.exePID: 3644, Parent PID: 7556

General

Target ID:	26
Start time:	20:15:26
Start date:	25/03/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",isUnicode
Imagebase:	0x7ff711ce0000
File size:	71680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: rundll32.exePID: 6640, Parent PID: 7556

General

Target ID:	27
Start time:	20:15:26
Start date:	25/03/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\extract\ComparePlugin.dll",messageProc
Imagebase:	0x7ff711ce0000
File size:	71680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: WerFault.exePID: 3148, Parent PID: 372

General

Target ID:	28
Start time:	20:15:27
Start date:	25/03/2022
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 372 -s 428
Imagebase:	0x7ff7694f0000
File size:	568632 bytes
MD5 hash:	5C06542FED8EE68994D43938E7326D75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: WerFault.exePID: 3344, Parent PID: 428

General

Target ID:	29
Start time:	20:15:27
Start date:	25/03/2022
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 428 -s 424
Imagebase:	0x7ff7694f0000
File size:	568632 bytes
MD5 hash:	5C06542FED8EE68994D43938E7326D75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

⊘No disassembly

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Com_a390959f1f8b5ca1582bdff61f9451e7944f2ec_71036408_399256d0-1930-45f7-b8f8-e5db712531dc\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Com_a390959f1f8b5ca1582bdff61f9451e7944f2ec_71036408_7b33abf3-139a-4117-9db1-e0552caf4048\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Com_cf6dae3a8bcb14daf052b4753019709517e7_71036408_8d113b16-a122-48e1-973a-0e9340f5e74b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Com_cf6dae3a8bcb14daf052b4753019709517e7_71036408_9c2fb87e-0516-41f9-ad98-9e013c83d1cb\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_Com_cf6dae3a8bcb14daf052b4753019709517e7_71036408_bc772a15-5856-4b2d-aa65-5a0d4f57349d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER399E.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER39AD.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B06.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B45.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B94.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3BD2.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER445C.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4586.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER45B5.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C97.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CE5.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5DF0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E3E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E8D.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5EAC.tmp.xml

C:\Users\user\Desktop\cmdline.out

C:\Users\user\Desktop\download\ComparePlugin_v2.0.2_X64.zip

Windows Analysis Report
https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip